@junghanacs/entwurf 0.23.1 → 0.24.0

package/pi-extensions/entwurf-control.ts

@@ -81,6 +81,7 @@ import type {
 import { getMarkdownTheme, type Theme } from "@earendil-works/pi-coding-agent";
 import { Box, type Component, Markdown, Spacer, Text } from "@earendil-works/pi-tui";
 import { ENTWURF_SENT_MESSAGE_TYPE } from "../protocol.js";
+import { readCallbackEnv } from "./lib/callback-env.js";
 import {
 	type CompactionGuard,
 	compactionSendReject,
@@ -1118,6 +1119,7 @@ export default function (pi: ExtensionAPI) {
 	if (shouldRegisterControlTools(pi)) {
 		registerListSessionsTool(pi);
 		registerEntwurfV2Tool(pi);
+		registerCallbackTool(pi);
 		registerFreshCallTool(pi);
 		registerResumeCallTool(pi);
 	}
@@ -1740,6 +1742,60 @@ interface VisibleResumeModule {
 	renderVisibleResume(result: { ok: boolean }): { text: string; isError: boolean };
 }
 
+function registerCallbackTool(pi: ExtensionAPI): void {
+	const registerTool = pi.registerTool as (def: any) => void;
+	registerTool({
+		name: "entwurf_callback",
+		label: "Fresh Callback",
+		description: `ZERO-ARGUMENT callback for a fresh sibling this process was launched as. Reads ENTWURF_CALLBACK_TARGET and ENTWURF_CALLBACK_NONCE from this process environment (injected by the launcher next to the identity scrub), validates garden-id and nonce grammar, and dispatches through the existing v2 runner with intent fire-and-forget, message=nonce, wants_reply=false. The target is re-resolved by record/decider. REFUSES BY NAME when the pair is absent, malformed, or this process is a Codex-provenance bridge. No arguments, no fallback to a model-supplied target.`,
+		parameters: Type.Object({}),
+		async execute(
+			_toolCallId: string,
+			_params: Record<string, never>,
+			_signal: AbortSignal | undefined,
+			_onUpdate: unknown,
+			ctx: ExtensionContext,
+		) {
+			const read = readCallbackEnv(process.env);
+			if (!read.ok) {
+				return {
+					content: [{ type: "text", text: `entwurf_callback: ${read.reason}` }],
+					isError: true,
+				};
+			}
+			try {
+				const selfMod = (await import(ENTWURF_SELF_ADDRESS_MODULE)) as unknown as EntwurfSelfAddressModule;
+				const senderProvider = (): SenderEnvelope | undefined => {
+					const s = buildLocalSenderEnvelope(ctx);
+					return s ? decoratePiSenderAddressability(s, selfMod.computeSelfAddressability) : undefined;
+				};
+				const mod = (await import(ENTWURF_V2_SURFACE_MODULE)) as unknown as EntwurfV2SurfaceModule;
+				const rendered = await mod.runAndRenderEntwurfV2FromSurface(
+					{
+						target: read.target,
+						intent: "fire-and-forget",
+						message: read.nonce,
+						wants_reply: false,
+					},
+					{ senderProvider },
+				);
+				return {
+					content: [{ type: "text", text: rendered.text }],
+					isError: rendered.isError,
+					details: { isError: rendered.isError },
+				};
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err);
+				return {
+					content: [{ type: "text", text: `entwurf_callback error: ${msg}` }],
+					isError: true,
+					details: { error: msg },
+				};
+			}
+		},
+	});
+}
+
 /**
  * Unlike `entwurf_fresh_call`, this tool needs NO caller identity: a resume names an existing
  * citizen, so the address is the parameter rather than something the sibling has to report back.

package/pi-extensions/lib/acp/backend.ts

@@ -44,8 +44,8 @@ import { type ChildProcessByStdio, spawn } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { Readable, Writable } from "node:stream";
 import { ndJsonStream, PROTOCOL_VERSION } from "@agentclientprotocol/sdk";
-import type { Api, AssistantMessage, Context, Model, SimpleStreamOptions } from "@earendil-works/pi-ai";
-import { createAssistantMessageEventStream } from "@earendil-works/pi-ai";
+import type { Api, AssistantMessage, Model, SimpleStreamOptions, TranscriptContext } from "@earendil-works/pi-ai";
+import { createAssistantMessageEventStream, getCurrentTools } from "@earendil-works/pi-ai";
 import {
 	type AcpClientHandlers,
 	type AcpConnectionLike,
@@ -81,7 +81,7 @@ import {
 	resolveLifecyclePolicy,
 	writeSessionRecord,
 } from "./session-store.js";
-import { assertExcludeToolsHonored, PI_BUILTIN_BACKED_TOOLS } from "./tool-surface.js";
+import { assertExcludeToolsHonored } from "./tool-surface.js";
 
 // Bootstrap boundaries ONLY. initialize / newSession / set-model are handshake
 // steps that make no model progress, so a stuck one is a dead session and a cold
@@ -1108,7 +1108,7 @@ async function applyProviderPayloadHook<T extends { sessionId: string }>(
  */
 export function streamShellAcp(
 	model: Model<Api>,
-	context: Context,
+	context: TranscriptContext,
 	options?: SimpleStreamOptions,
 ): ReturnType<typeof createAssistantMessageEventStream> {
 	return streamAcpTurn(model, context, options, defaultDeps());
@@ -1117,7 +1117,7 @@ export function streamShellAcp(
 /** The seam-aware turn driver. `streamShellAcp` calls this with the real deps. */
 export function streamAcpTurn(
 	model: Model<Api>,
-	context: Context,
+	context: TranscriptContext,
 	options: SimpleStreamOptions | undefined,
 	deps: AcpTurnDeps,
 ): ReturnType<typeof createAssistantMessageEventStream> {
@@ -1510,7 +1510,17 @@ export function streamAcpTurn(
 		// rather than lie to the model. Uses the RESOLVED tool surface (S2g) so an
 		// operator-narrowed `tools` is what the truthfulness check honors.
 		try {
-			const activeToolNames = context.tools?.map((t) => t.name) ?? [...PI_BUILTIN_BACKED_TOOLS];
+			// pi 0.86 folded `Context.systemPrompt`/`Context.tools` into a leading
+			// `role:"system"` message (`normalizeContext`, pi-ai
+			// `utils/transcript.ts`), so a provider only ever sees a
+			// `TranscriptContext`. The active surface is therefore REPLAYED from the
+			// system messages — `getCurrentTools` applies every toolsAdded/toolsRemoved
+			// delta in order. No `?? [...PI_BUILTIN_BACKED_TOOLS]` fallback: under 0.86
+			// the old `context.tools` read was ALWAYS undefined, so that fallback
+			// silently declared the full builtin set and the truthfulness preflight
+			// could never fire (false green). An empty replayed list means the operator
+			// excluded everything — keep that honest and let the preflight reject.
+			const activeToolNames = getCurrentTools(context.messages).map((t) => t.name);
 			assertExcludeToolsHonored(activeToolNames, { backend: adapter.backend, tools: config.tools });
 		} catch (err) {
 			finishError(err, false);

package/pi-extensions/lib/acp/context.ts

@@ -8,16 +8,26 @@
 //
 // S2c/S2d boundary (GPT S2c Q2): this is CONVERSATION TRANSCRIPT PASSTHROUGH, not
 // rich-carrier identity injection. Deliberately EXCLUDED here (all S2d):
-//   - `context.systemPrompt` — never read into the prompt or `_meta.systemPrompt`
+//   - the system prompt — never read into the prompt or `_meta.systemPrompt`
 //     (the billing carrier stays absent — NEXT §S2-scout 핀1);
 //   - `~/AGENTS.md` / cwd AGENTS / bridge identity narrative;
 //   - first-user-message augment + project-context de-dup;
-//   - `context.tools` — the ACP child tool surface is the S2b
+//   - the declared tool surface — the ACP child tool surface is the S2b
 //     `_meta.claudeCode.options` SSOT, never re-sent here.
+// Since pi 0.86 both of those ride a leading `role:"system"` message inside the
+// `TranscriptContext` (pi-ai `normalizeContext`) rather than their own `Context`
+// fields, so the exclusion is enforced by `renderMessage`'s explicit
+// `case "system"` below, not by simply not reading two fields.
 // Structured tool replay is also excluded: tool calls/results render as plain
 // transcript text, never as ACP tool invocations (the child runs its own tools).
 
-import type { AssistantMessage, Context, Message, ToolResultMessage, UserMessage } from "@earendil-works/pi-ai";
+import type {
+	AssistantMessage,
+	Message,
+	ToolResultMessage,
+	TranscriptContext,
+	UserMessage,
+} from "@earendil-works/pi-ai";
 
 // MUST equal event-mapper.ts `LIFECYCLE_NOTICE_SIGNATURE` (the SSOT/producer).
 // It is mirrored, not imported: the strip-types deterministic gates load these
@@ -80,16 +90,26 @@ function renderMessage(message: Message): string | undefined {
 			const tag = message.isError ? "Tool error" : "Tool result";
 			return text ? `${tag} (${message.toolName}): ${text}` : undefined;
 		}
+		case "system":
+			// The never-forward-systemPrompt invariant, stated rather than inherited.
+			// Since pi 0.86 the system prompt and the declared tool surface arrive AS
+			// transcript messages (`normalizeContext`), so what used to be "we simply
+			// do not read `context.systemPrompt`" is now an active decision on every
+			// turn. `default` would already skip it; the explicit case exists so
+			// deleting it is a visible change and a new pi role cannot quietly start
+			// leaking the prompt into the ACP child's transcript.
+			return undefined;
 		default:
 			return undefined;
 	}
 }
 
 /**
- * Flatten a pi Context into a single transcript string. Excludes
- * `context.systemPrompt` and `context.tools` by construction.
+ * Flatten a pi transcript into a single transcript string. Excludes the system
+ * prompt and the declared tool surface by construction — since 0.86 both ride
+ * the leading `role:"system"` message, which `renderMessage` drops explicitly.
  */
-export function contextTranscript(context: Context): string {
+export function contextTranscript(context: TranscriptContext): string {
 	const lines: string[] = [];
 	for (const message of context.messages) {
 		const line = renderMessage(message);
@@ -99,11 +119,11 @@ export function contextTranscript(context: Context): string {
 }
 
 /**
- * Convert a pi Context into the ACP `prompt` array (a single text block holding
+ * Convert a pi transcript into the ACP `prompt` array (a single text block holding
  * the flattened transcript). Empty history yields an empty array — the caller
  * decides whether that is a hard error.
  */
-export function contextToAcpPrompt(context: Context): AcpTextBlock[] {
+export function contextToAcpPrompt(context: TranscriptContext): AcpTextBlock[] {
 	const transcript = contextTranscript(context);
 	if (!transcript) return [];
 	return [{ type: "text", text: transcript }];
@@ -129,7 +149,7 @@ export type AcpBootstrapPath = "new" | "reuse" | "resume" | "load";
  * (reuse/resume/load): re-sending the whole transcript there would duplicate
  * history the backend already remembers.
  */
-export function latestUserDelta(context: Context): AcpTextBlock[] {
+export function latestUserDelta(context: TranscriptContext): AcpTextBlock[] {
 	let lastAssistantIdx = -1;
 	for (let i = context.messages.length - 1; i >= 0; i--) {
 		if (context.messages[i].role === "assistant") {
@@ -160,7 +180,7 @@ export function latestUserDelta(context: Context): AcpTextBlock[] {
  * `contextMessageSignatures` prefix-compat gate (mismatch → fall back to
  * `"new"` + full transcript); this pure function only splits the scope.
  */
-export function buildAcpPrompt(context: Context, bootstrapPath: AcpBootstrapPath): AcpTextBlock[] {
+export function buildAcpPrompt(context: TranscriptContext, bootstrapPath: AcpBootstrapPath): AcpTextBlock[] {
 	switch (bootstrapPath) {
 		case "new":
 			return contextToAcpPrompt(context);

package/pi-extensions/lib/acp/session-store.ts

@@ -27,7 +27,7 @@ import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import type { Context, Message, ToolResultMessage } from "@earendil-works/pi-ai";
+import type { Message, ToolResultMessage, TranscriptContext } from "@earendil-works/pi-ai";
 import type { AcpBootstrapPath } from "./context.js";
 
 // MUST equal event-mapper.ts `LIFECYCLE_NOTICE_SIGNATURE` (the SSOT/producer).
@@ -236,7 +236,7 @@ function rawMessageSignature(message: Message): string {
  * record never stores raw prompt/tool text — the prefix check works the same on
  * the digest array (GPT `c617cb` hardening).
  */
-export function contextMessageSignatures(context: Context): string[] {
+export function contextMessageSignatures(context: TranscriptContext): string[] {
 	return context.messages.map((m: Message) => sha256(rawMessageSignature(m)));
 }
 

package/pi-extensions/lib/callback-env.ts

@@ -0,0 +1,78 @@
+/**
+ * Callback-env — the launch-computed pair that lets a fresh sibling call home
+ * without copying a garden id or nonce out of prose.
+ *
+ * WHY THIS FILE EXISTS. Until this seam, `composeFreshCallFraming` put
+ * `target=<caller gid>` and `message=<nonce>` into the first-turn prompt, and
+ * the sibling had to retype them into `entwurf_v2`. That is the one place in
+ * the garden Hard Rule 2 (record is the sole address axis) was violated: the
+ * transcript became the address carrier, and a model that dropped a `$` or a
+ * hex nibble produced a refused dispatch that looked like a flaky backend.
+ *
+ * WHAT TRAVELS. Two process-env names, injected by the launcher next to the
+ * identity scrub (`PI_SESSION_ID=` / `PI_AGENT_ID=`), never as a general env
+ * carrier. The no-arg `entwurf_callback` verb reads BOTH from its own process
+ * and refuses by name when they are absent, malformed, or this process is a
+ * Codex-provenance bridge (window env never reaches that MCP child — measured).
+ *
+ * This module does not dispatch. It parses, validates, and formats. Launchers
+ * and the verb share it so a drifted regex cannot inject what the verb rejects.
+ */
+
+import { SESSION_ID_RE } from "./session-id.js";
+
+export const CALLBACK_TARGET_ENV = "ENTWURF_CALLBACK_TARGET";
+export const CALLBACK_NONCE_ENV = "ENTWURF_CALLBACK_NONCE";
+
+/** Exactly what `mintNonce` emits (`fresh-call-composition.ts`): `mux-fresh-call-` + 12 random
+ *  bytes as hex. ONE minter, ONE grammar — both rails call the same `mintNonce`, so a second
+ *  accepted prefix would be a spelling no launcher produces and this leaf exists to refuse
+ *  exactly that. A gate fixture is an oracle and never a reason to widen the subject. */
+export const CALLBACK_NONCE_RE = /^mux-fresh-call-[0-9a-f]{24}$/;
+
+export type CallbackEnvReject = "callback-env-absent" | "callback-env-malformed" | "codex-callback-env-unsupported";
+
+export type CallbackEnvRead = { ok: true; target: string; nonce: string } | { ok: false; reason: CallbackEnvReject };
+
+function parseCallbackPair(target: unknown, nonce: unknown): CallbackEnvRead {
+	if (typeof target !== "string" || typeof nonce !== "string") {
+		return { ok: false, reason: "callback-env-malformed" };
+	}
+	if (!SESSION_ID_RE.test(target) || !CALLBACK_NONCE_RE.test(nonce)) {
+		return { ok: false, reason: "callback-env-malformed" };
+	}
+	return { ok: true, target, nonce };
+}
+
+/**
+ * Format the two `KEY=value` assignments a launcher injects. Throws rather than
+ * emitting a pair the verb would refuse — a launch that cannot name its caller
+ * must not open a window whose first action is a guaranteed reject.
+ */
+export function callbackEnvAssignments(params: { target: string; nonce: string }): readonly [string, string] {
+	const parsed = parseCallbackPair(params.target, params.nonce);
+	if (!parsed.ok) {
+		throw new Error(`callback-env: refusing to inject ${parsed.reason}`);
+	}
+	return [`${CALLBACK_TARGET_ENV}=${parsed.target}`, `${CALLBACK_NONCE_ENV}=${parsed.nonce}`];
+}
+
+/**
+ * Read the pair from a process environment. Codex provenance is a named refuse
+ * even when the pair is well-formed: that bridge is an app-server child, and a
+ * pane-injected value would be the wrong citizen's (or last-launch-wins).
+ *
+ * Both names absent → `callback-env-absent`. One present, or either failing
+ * grammar → `callback-env-malformed`. No fallback to a model-supplied target.
+ */
+export function readCallbackEnv(env: NodeJS.ProcessEnv = process.env): CallbackEnvRead {
+	if (env.ENTWURF_BRIDGE_NATIVE_HOST?.trim() === "codex") {
+		return { ok: false, reason: "codex-callback-env-unsupported" };
+	}
+	const target = env[CALLBACK_TARGET_ENV];
+	const nonce = env[CALLBACK_NONCE_ENV];
+	if (target === undefined && nonce === undefined) {
+		return { ok: false, reason: "callback-env-absent" };
+	}
+	return parseCallbackPair(target, nonce);
+}

package/pi-extensions/lib/compaction-send-guard.ts

@@ -1,7 +1,10 @@
 /**
  * compaction-send-guard — whether a control-socket `send` may call `pi.sendMessage`.
  *
- * Pi 0.85.1 has no public `ExtensionContext.isCompacting()`. Compaction is non-idle
+ * Pi 0.86.0 has no public `ExtensionContext.isCompacting()` (`[측정 2026-09-20]` the
+ * installed `dist/core/extensions/types.d.ts` declares `isIdle(): boolean` at :233 and
+ * `signal` at :237, and carries no `isCompacting` member at all; the identifier exists
+ * only inside the interactive/rpc modes' own bundles). Compaction is non-idle
  * (`AgentSession.isIdle` = no agent run AND not compacting) but `sendCustomMessage`
  * does not refuse it. A non-streaming `triggerTurn:true` send starts `_runAgentPrompt`
  * while `compact()` is rewriting the session tree — the field path that can make

package/pi-extensions/lib/fresh-call-composition.ts

@@ -54,6 +54,17 @@ export type FreshCallBackend = (typeof FRESH_CALL_BACKENDS)[number];
  * permission dialect: omp's approval layer consults the same minted string (`source-audit.md`).
  */
 export const FRESH_CALL_CALLBACK_TOOL: Record<FreshCallBackend, string> = {
+	pi: "entwurf_callback",
+	"claude-code": "mcp__entwurf-bridge__entwurf_callback",
+	copilot: "entwurf-bridge-entwurf_callback",
+	omp: "mcp__entwurf_bridge_entwurf_callback",
+	// Codex's tool process is the operator app-server, not the pane: the no-arg
+	// verb refuses there by name. First action stays the delivery verb with args.
+	codex: "mcp__entwurf_bridge__entwurf_v2",
+};
+
+/** Where a sibling SENDS the task result. Always the delivery verb, never the birth callback. */
+export const FRESH_CALL_DELIVERY_TOOL: Record<FreshCallBackend, string> = {
 	pi: "entwurf_v2",
 	"claude-code": "mcp__entwurf-bridge__entwurf_v2",
 	copilot: "entwurf-bridge-entwurf_v2",
@@ -101,8 +112,11 @@ export const FRESH_CALL_PEERS_TOOL: Record<FreshCallBackend, string> = {
  * `[측정, n=3, same model]` adding the sentence below produced 3/3 callbacks. It is a FACT about the
  * runtime, in the register the rest of this framing uses since the prohibitions came out: it grants
  * nothing, forbids nothing, and names the one call that turns a listed name into a callable tool.
- * Both tools ride ONE `ToolSearch` select, so the corroboration the framing offers stays reachable
- * for a child that takes the offer.
+ * ALL THREE tools ride ONE `ToolSearch` select — the birth callback, the DELIVERY verb the last
+ * line of the framing names, and the peers listing the corroboration sentence offers. The delivery
+ * verb has to be in the same select or the deferral simply moves from the first action to the last:
+ * a sibling that finishes its task and cannot call `entwurf_v2` is the same production silence,
+ * spent instead of saved.
  *
  * Every other backend gets an EMPTY array, deliberately: pi has no deferred-tool surface, and the
  * other three were never measured to need it. A hint invented for a runtime nobody probed would be
@@ -112,7 +126,7 @@ export const FRESH_CALL_TOOL_LOAD_HINT: Record<FreshCallBackend, readonly string
 	pi: [],
 	"claude-code": [
 		"If ${callbackTool} is not callable yet, the entwurf-bridge server is still connecting or its",
-		'tools are deferred: load them first with ToolSearch("select:${callbackTool},${peersTool}") —',
+		'tools are deferred: load them first with ToolSearch("select:${callbackTool},${deliveryTool},${peersTool}") —',
 		"it waits for the server — then call ${callbackTool}.",
 	],
 	copilot: [],
@@ -144,22 +158,22 @@ export const OMP_BOOTSTRAP_FLAG = "entwurf-bootstrap";
 
 /** Payload grammar version, matched exactly by the decoder. A bump means a stale installed
  * unit, which is the one thing `doctor-omp-bridge` exists to say out loud. */
-export const OMP_BOOTSTRAP_VERSION = 1;
+export const OMP_BOOTSTRAP_VERSION = 2;
 
 /**
  * The whole of what a fresh omp sibling is launched with.
  *
- * THREE FIELDS, CLOSED. The decoder refuses an unknown key, so this object is the entire
- * contract: who to call back, the nonce that proves it is this call, and the task that is
- * released only after that callback succeeds. There is no command here, no path, no env name
- * and no model — the model is already an explicit argv token, and a second copy of it inside
- * a payload would be a second place for it to disagree with the launch.
+ * TWO FIELDS, CLOSED. Address (target + nonce) rides process env, not this payload — a second
+ * copy here would be a second address axis. The decoder refuses an unknown key, so this object
+ * is the entire remaining contract: the task released after the no-arg callback succeeds.
+ * `callerGardenId` / `nonce` stay on the function so launcher call sites do not grow a second
+ * shape; they are not serialised.
  */
 export function buildOmpBootstrapPayload(params: { callerGardenId: string; nonce: string; task: string }): string {
+	void params.callerGardenId;
+	void params.nonce;
 	return JSON.stringify({
 		v: OMP_BOOTSTRAP_VERSION,
-		target: params.callerGardenId,
-		nonce: params.nonce,
 		task: params.task,
 	});
 }
@@ -298,7 +312,11 @@ export function composeBackendArgs(
 		case "pi":
 			return [composition.prompt, "--entwurf-control", "--model", model];
 		case "claude-code":
-			return [composition.prompt, `--allowedTools=${FRESH_CALL_CALLBACK_TOOL["claude-code"]}`, `--model=${model}`];
+			return [
+				composition.prompt,
+				`--allowedTools=${FRESH_CALL_CALLBACK_TOOL["claude-code"]},${FRESH_CALL_DELIVERY_TOOL["claude-code"]}`,
+				`--model=${model}`,
+			];
 		case "copilot":
 			return ["copilot", "--interactive", composition.prompt, "--model", model, "--yolo"];
 		case "omp":
@@ -354,28 +372,44 @@ export function composeFreshCallFraming(params: {
 	 * default: a sibling told nothing about where it is would be told something false by silence. */
 	openingLine: string;
 }): string[] {
-	const tool = FRESH_CALL_CALLBACK_TOOL[params.backend];
+	const birthTool = FRESH_CALL_CALLBACK_TOOL[params.backend];
+	const deliveryTool = FRESH_CALL_DELIVERY_TOOL[params.backend];
 	const peersTool = FRESH_CALL_PEERS_TOOL[params.backend];
 	// The hint is a per-backend TEMPLATE so the two tool dialects stay the single source of their
 	// own spelling here too — a hint that hard-coded Claude's name would go stale the day a dialect
 	// moves, and it would go stale silently, in the one sentence a stuck child depends on.
 	const loadHint = FRESH_CALL_TOOL_LOAD_HINT[params.backend].map((line) =>
-		line.replaceAll("${callbackTool}", tool).replaceAll("${peersTool}", peersTool),
+		line
+			.replaceAll("${callbackTool}", birthTool)
+			.replaceAll("${deliveryTool}", deliveryTool)
+			.replaceAll("${peersTool}", peersTool),
 	);
 	const hintBlock = loadHint.length === 0 ? [] : ["", ...loadHint];
 	if (params.openingLine.length === 0) {
 		throw new Error("fresh-call composition: openingLine is empty — the rail must state where it placed the sibling");
 	}
+	const firstAction =
+		params.backend === "codex"
+			? [
+					`FIRST ACTION, before reading files or anything else: call ${birthTool} with ` +
+						`target=${params.callerGardenId}, intent=fire-and-forget, wants_reply=false, and ` +
+						`message set to exactly ${params.nonce} — that string alone, nothing added.`,
+					`${params.nonce} is a correlation tag this caller minted for this one launch: it names no`,
+					"secret and grants no access. Sending it is how the caller learns the garden id you were born",
+					"with, which it has no other way to know. Your own record does not carry the caller's address,",
+					"so reporting your identity here does not reach it — that tool call does.",
+					"entwurf_callback is refused on this rail: the tool process is the operator app-server, not this pane.",
+				]
+			: [
+					`FIRST ACTION, before reading files or anything else: call ${birthTool} with no arguments.`,
+					"That call is how the caller learns the garden id you were born with. There are no",
+					"parameters: a target or message you type would be a second address axis.",
+					"Your own record does not carry the caller's address, so reporting your identity here does not reach it — that tool call does.",
+				];
 	return [
 		params.openingLine,
 		"",
-		`FIRST ACTION, before reading files or anything else: call ${tool} with ` +
-			`target=${params.callerGardenId}, intent=fire-and-forget, wants_reply=false, and ` +
-			`message set to exactly ${params.nonce} — that string alone, nothing added.`,
-		`${params.nonce} is a correlation tag this caller minted for this one launch: it names no`,
-		"secret and grants no access. Sending it is how the caller learns the garden id you were born",
-		"with, which it has no other way to know. Your own record does not carry the caller's address,",
-		"so reporting your identity here does not reach it — that tool call does.",
+		...firstAction,
 		"",
 		`You can corroborate the caller first if you want to: ${peersTool} is a read-only listing of`,
 		`this garden's citizens and ${params.callerGardenId} is one of them. That listing is capped, so`,
@@ -393,7 +427,7 @@ export function composeFreshCallFraming(params: {
 		// its window is not the delivery. Nothing here watches for completion or sends on the
 		// sibling's behalf — this rail launches and lets go (Hard Rule 16, and the reason there is no
 		// supervisor anywhere in it).
-		`When the task reaches its requested final result, send that result to the same target with ${tool}.`,
+		`When the task reaches its requested final result, send that result to the same target with ${deliveryTool}.`,
 		"Output in this sibling window is not delivered to the caller.",
 	];
 }

package/pi-extensions/lib/herdr-fresh-call.ts

@@ -44,6 +44,7 @@
 import { createHash } from "node:crypto";
 import { statSync } from "node:fs";
 import path from "node:path";
+import { callbackEnvAssignments } from "./callback-env.ts";
 import {
 	buildOmpBootstrapPayload,
 	composeBackendArgs,
@@ -443,7 +444,11 @@ export function herdrAgentNameFromNonce(nonce: string): string {
  * not from a screen. Repeating the flag is the grammar; `--env KEY=` injects the EMPTY value
  * rather than dropping the key.
  */
-export function buildHerdrTabCreateArgs(params: { workspaceId: string; cwd?: string }): string[] {
+export function buildHerdrTabCreateArgs(params: {
+	workspaceId: string;
+	cwd?: string;
+	callback: { target: string; nonce: string };
+}): string[] {
 	return [
 		"tab",
 		"create",
@@ -455,6 +460,7 @@ export function buildHerdrTabCreateArgs(params: { workspaceId: string; cwd?: str
 		"PI_SESSION_ID=",
 		"--env",
 		"PI_AGENT_ID=",
+		...callbackEnvAssignments(params.callback).flatMap((assignment) => ["--env", assignment]),
 	];
 }
 
@@ -849,6 +855,7 @@ export async function herdrFreshCall(
 		buildHerdrTabCreateArgs({
 			workspaceId: callerPane.workspaceId,
 			...(cwd === undefined ? {} : { cwd }),
+			callback: { target: callerGardenId, nonce },
 		}),
 	);
 	if (tabRun.status !== 0) {
@@ -1205,9 +1212,10 @@ export function renderHerdrFreshCall(result: HerdrFreshCallResult): { text: stri
 			`mean the sibling is running, that its first turn ran, or that the task was delivered. The tab and pane ` +
 			`coordinates are a view and can change under the sibling — they are not an address and nothing may be ` +
 			`dispatched to them.\n` +
-			`The sibling's garden id arrives separately — it calls entwurf_v2 back with the nonce above as its first ` +
-			`action, and the sender envelope of THAT message is the address. Nothing is polling for it; if it never ` +
-			`comes, the pane is visible and can be read directly.`,
+			`The sibling's garden id arrives separately — its first action is the zero-argument callback verb, and ` +
+			`the sender envelope of THAT message is the address. The nonce above is the correlation tag it carries; ` +
+			`the sibling reads it from its own launch env, never from this receipt. Nothing is polling for it; if it ` +
+			`never comes, the pane is visible and can be read directly.`,
 		isError: false,
 	};
 }

package/pi-extensions/lib/herdr-placement.ts

@@ -21,7 +21,7 @@
  * THE TWO AXES ARE NOT EQUALLY EXACT, AND THE DIFFERENCE IS NAMED. On the claude axis
  * the reported value IS the key, byte for byte. On the pi axis it is a session FILE
  * PATH, and the key is recovered from that filename by a strict conversion measured on
- * pi 0.85.1 — a VENDOR FLOOR, not a key equality. Calling both "a unique-key join"
+ * pi 0.86.0 — a VENDOR FLOOR, not a key equality. Calling both "a unique-key join"
  * would hide which one can drift when a vendor renames a file. The conversion is
  * deliberately strict at both ends so that drift lands as a missed join, never a wrong
  * one, and a listing that declined to read anything says so (see `declinedReports`).
@@ -112,14 +112,23 @@ const OFFICIAL_REPORTS: Readonly<
 };
 
 /**
- * A pi session filename, measured 2026-09-14 on pi 0.85.1:
+ * A pi session filename, measured 2026-09-20 on pi 0.86.0:
  *
- *   2026-09-14T05-17-03-979Z_01a09e58-f06a-70e8-b14a-1f0f0c7f7c7d.jsonl
+ *   2026-09-20T00-35-44-197Z_01a0bc3d-87c4-738e-b391-265c8ba5a1b0.jsonl
  *   └────────── start stamp ─────────┘ └──────── nativeSessionId ────────┘
  *
+ * `[측정 2026-09-20]` that is a REAL file a sandboxed pi 0.86.0 wrote, and its own
+ * `{"type":"session"}` header carries `id: 01a0bc3d-87c4-738e-b391-265c8ba5a1b0` —
+ * the exact string `piNativeSessionIdFromPath` recovers from the name. The layout was
+ * re-measured rather than carried: pi 0.86.0 rewrote session-manager.ts (+269 −141
+ * over v0.85.1), but every line that BUILDS a name is byte-unchanged
+ * (`${fileTimestamp}_${this.sessionId}.jsonl`, session-manager.ts:991/1527/1703); the
+ * only diff in that file's `.jsonl` lines is a lambda parameter rename on the READER
+ * side. A source read alone would not have settled it, so the real file is the receipt.
+ *
  * WHY THIS IS PINNED HERE AND NOT INFERRED. The uuid is the join key and it lives in
  * a VENDOR filename, so this rule depends on pi's naming and would break silently if
- * pi changed it. **Vendor floor: pi 0.85.1, measured 2026-09-14** — whether that layout
+ * pi changed it. **Vendor floor: pi 0.86.0, measured 2026-09-20** — whether that layout
  * is a vendor contract or a convention is NOT measured, so this is the one place in the
  * axis that can drift under us. It is therefore strict on both ends — the name must end
  * in `.jsonl` and the tail after the last `_` must be a well-formed uuid — and a name