@junghanacs/entwurf 0.23.1 → 0.24.0

package/pi-extensions/lib/mux-fresh-call.ts

@@ -86,6 +86,7 @@
  *     there is no "session created" field because nothing here creates one.
  */
 
+import { callbackEnvAssignments } from "./callback-env.ts";
 import { classifyTmuxCwd, type TmuxCwdRejectReason } from "./classify-tmux-cwd.ts";
 import {
 	CODEX_CALLER_SEAT_HINT,
@@ -111,6 +112,7 @@ import {
 	composeFreshCallPrompt,
 	FRESH_CALL_BACKENDS,
 	FRESH_CALL_CALLBACK_TOOL,
+	FRESH_CALL_DELIVERY_TOOL,
 	type FreshCallBackend,
 	type FreshCallComposition,
 	type FreshCallInputRejectReason,
@@ -158,6 +160,7 @@ export {
 	buildOmpBootstrapPayload,
 	FRESH_CALL_BACKENDS,
 	FRESH_CALL_CALLBACK_TOOL,
+	FRESH_CALL_DELIVERY_TOOL,
 	type FreshCallBackend,
 	type FreshCallComposition,
 	isSafeFreshCallModel,
@@ -351,9 +354,11 @@ export type FreshCallResult = { ok: true; receipt: FreshCallReceipt } | { ok: fa
  * scrub only on the backend whose measurement surfaced it would encode the claim that the other
  * four are immune, which is false. It costs the legitimate case nothing: a carrier is only ever
  * authoritative when the process that owns it exported it ITSELF, and a fresh `pi` sibling does
- * exactly that after this argv has run. This is a fixed two-variable seam and deliberately NOT a
- * general env carrier — an arbitrary `-e` passthrough would hand callers the environment-shaping
- * power this rail exists to refuse.
+ * exactly that after this argv has run. This is a fixed seam and deliberately NOT a general env
+ * carrier — an arbitrary `-e` passthrough would hand callers the environment-shaping power this
+ * rail exists to refuse. Two more `-e` assignments ride beside the scrub: the callback pair
+ * (`callback-env.ts`), launcher-computed, so the sibling's first action does not retype an
+ * address out of prose.
  */
 const SCRUBBED_INHERITED_ENV = ["PI_SESSION_ID=", "PI_AGENT_ID="] as const;
 
@@ -371,7 +376,8 @@ export function buildFreshCallArgs(
 	targetSessionId: string,
 	runtimePath: string,
 	backendArgs: readonly string[],
-	cwd?: string,
+	cwd: string | undefined,
+	callback: { target: string; nonce: string },
 ): string[] {
 	assertSelector("session", targetSessionId);
 	assertLaunchTarget(runtimePath);
@@ -384,6 +390,7 @@ export function buildFreshCallArgs(
 		"-d",
 		"-a",
 		...SCRUBBED_INHERITED_ENV.flatMap((assignment) => ["-e", assignment]),
+		...callbackEnvAssignments(callback).flatMap((assignment) => ["-e", assignment]),
 		"-t",
 		`${targetSessionId}:{end}`,
 		...(cwd === undefined ? [] : ["-c", cwd]),
@@ -569,7 +576,13 @@ export function freshCall(
 			);
 		}
 	}
-	const run = runTmux(buildFreshCallArgs(targetSessionId, runtimePath, backendArgs, cwd), env);
+	const run = runTmux(
+		buildFreshCallArgs(targetSessionId, runtimePath, backendArgs, cwd, {
+			target: callerGardenId,
+			nonce,
+		}),
+		env,
+	);
 	assertTmuxOk("new-window", run);
 
 	let fields: ReturnType<typeof parseWindowFields>;
@@ -683,9 +696,11 @@ export function renderFreshCall(result: FreshCallResult): { text: string; isErro
 			`\n` +
 			`This is a LAUNCH receipt: tmux created that window and was asked to start the runtime with the model above. It does ` +
 			`NOT mean the sibling is running, that its first turn ran, or that the task was delivered.\n` +
-			`The sibling's garden id arrives separately — it calls entwurf_v2 back with the nonce above as its ` +
-			`first action, and the sender envelope of THAT message is the address. Nothing is polling for it; ` +
-			`if it never comes, the window is visible and can be read directly.`,
+			`The sibling's garden id arrives separately — its first action is the zero-argument callback verb ` +
+			`(codex is the one arm that still sends the nonce as arguments), and the sender envelope of THAT ` +
+			`message is the address. The nonce above is the correlation tag it carries; the sibling reads it ` +
+			`from its own launch env, never from this receipt. Nothing is polling for it; if it never comes, ` +
+			`the window is visible and can be read directly.`,
 		isError: false,
 	};
 }

package/pi-extensions/meta-bridge-omp.ts

@@ -83,7 +83,6 @@ import {
 	type MetaRootBundle,
 	ompMetaRootBase,
 	ompMetaRoots,
-	requireGardenId,
 	upsertMetaSession,
 	writeMetaSenderMarker,
 } from "./lib/meta-session.ts";
@@ -162,7 +161,7 @@ export const OMP_BOOTSTRAP_FLAG = "entwurf-bootstrap";
 /** Payload grammar version. A payload that does not say exactly this is refused rather than
  * best-guessed: the launcher and this unit ship in the same package, so a mismatch means a
  * STALE installed unit — the one condition `doctor-omp-bridge` exists to name out loud. */
-export const OMP_BOOTSTRAP_VERSION = 1;
+export const OMP_BOOTSTRAP_VERSION = 2;
 
 /**
  * The model-facing callback tool, spelled for omp. `[측정]` the vendor's minter sanitises to
@@ -177,7 +176,7 @@ export const OMP_BOOTSTRAP_VERSION = 1;
  * spellings are held equal by `test/omp-fresh-bootstrap.contract.test.ts`, the same shape
  * `check-omp-fresh-preflight` already uses for the preflight's reproduced oracles.
  */
-export const OMP_BOOTSTRAP_CALLBACK_TOOL = "mcp__entwurf_bridge_entwurf_v";
+export const OMP_BOOTSTRAP_CALLBACK_TOOL = "mcp__entwurf_bridge_entwurf_callback";
 
 /** Task ceiling, held equal to the launcher's `TASK_MAX_CHARS` by the same contract test. */
 export const OMP_BOOTSTRAP_TASK_MAX_CHARS = 16000;
@@ -195,15 +194,9 @@ export const OMP_BOOTSTRAP_READY_TIMEOUT_MS = 60_000;
  * primitive; a FIXED DELAY is forbidden because the gap is a race, not a constant. */
 export const OMP_BOOTSTRAP_POLL_MS = 100;
 
-/** The nonce the launcher mints (`mintNonce`: `mux-fresh-call-` + 12 random bytes as hex). */
-const BOOTSTRAP_NONCE_RE = /^mux-fresh-call-[0-9a-f]{24}$/;
-
-/** What the launcher put on the flag. Exactly three fields — a target to call back to, the
- * correlation nonce, and the operator's task. Nothing here is a command, a path or an env
- * name, and the decoder refuses anything wider. */
+/** What the launcher put on the flag. Address rides process env; this payload is the task
+ * released after the no-arg callback succeeds. The decoder refuses anything wider. */
 export interface OmpBootstrapPayload {
-	target: string;
-	nonce: string;
 	task: string;
 }
 
@@ -216,8 +209,6 @@ export type OmpBootstrapRejectReason =
 	| "payload-not-object"
 	| "version-unsupported"
 	| "payload-unknown-key"
-	| "target-invalid"
-	| "nonce-invalid"
 	| "task-empty"
 	| "task-too-long";
 
@@ -228,7 +219,7 @@ export type OmpBootstrapDecode =
 /** The wire keys, closed. An unknown key is a REFUSAL rather than an ignored extra: this
  * flag is the one thing a caller can put arbitrary bytes into, so the decoder's job is to
  * make "what the launcher meant" and "what this unit will act on" the same set. */
-const BOOTSTRAP_KEYS = new Set(["v", "target", "nonce", "task"]);
+const BOOTSTRAP_KEYS = new Set(["v", "task"]);
 
 /**
  * Read the flag value into a payload, or name why not.
@@ -256,18 +247,10 @@ export function decodeOmpBootstrapPayload(raw: unknown): OmpBootstrapDecode {
 	for (const key of Object.keys(obj)) {
 		if (!BOOTSTRAP_KEYS.has(key)) return { ok: false, reason: "payload-unknown-key" };
 	}
-	let target: string;
-	try {
-		target = requireGardenId(obj.target);
-	} catch {
-		return { ok: false, reason: "target-invalid" };
-	}
-	const nonce = obj.nonce;
-	if (typeof nonce !== "string" || !BOOTSTRAP_NONCE_RE.test(nonce)) return { ok: false, reason: "nonce-invalid" };
 	const task = obj.task;
 	if (typeof task !== "string" || task.trim().length === 0) return { ok: false, reason: "task-empty" };
 	if (task.length > OMP_BOOTSTRAP_TASK_MAX_CHARS) return { ok: false, reason: "task-too-long" };
-	return { ok: true, value: { target, nonce, task } };
+	return { ok: true, value: { task } };
 }
 
 /**
@@ -279,18 +262,13 @@ export function decodeOmpBootstrapPayload(raw: unknown): OmpBootstrapDecode {
  * no competing goal at all. Stage two exists so this message never has to compete with the
  * work; adding "then do X" back into it would rebuild exactly the prompt that failed.
  */
-export function buildOmpCallbackOnlyPrompt(params: { target: string; nonce: string }): string {
+export function buildOmpCallbackOnlyPrompt(): string {
 	return [
 		"You are a fresh visible citizen that entwurf opened in the operator's tmux session.",
 		"",
-		`FIRST AND ONLY ACTION RIGHT NOW: call ${OMP_BOOTSTRAP_CALLBACK_TOOL} with ` +
-			`target=${params.target}, intent=fire-and-forget, wants_reply=false, and ` +
-			`message set to exactly ${params.nonce} — that string alone, nothing added.`,
+		`FIRST AND ONLY ACTION RIGHT NOW: call ${OMP_BOOTSTRAP_CALLBACK_TOOL} with no arguments.`,
 		"That call is how the agent that opened you learns your address. Make the call before",
-		"reading files, before planning, and before answering in prose. Do not reword the message.",
-		"",
-		"Do not inspect environment variables, do not call entwurf_self, and do not start an MCP",
-		"server yourself. Your own report of your identity is not the address anyone needs.",
+		"reading files, before planning, and before answering in prose. There are no parameters.",
 		"",
 		"Your actual task arrives as the NEXT user message, immediately after that call succeeds.",
 		"Do not ask for it and do not guess at it.",
@@ -756,20 +734,29 @@ export function ompCallbackToolReady(pi: OmpExtensionApi): boolean {
 }
 
 /**
- * Does this tool event name OUR callback, with OUR target and OUR nonce?
+ * Does this tool event name OUR callback?
  *
  * The event carries no server name, no session id and no original MCP tool name
- * (`extensions/types.ts:916-1017`), so the match is built from what IS there: the canonical
- * minted tool name plus the two argument values this rail already owns as contract. Exact
- * string equality on both — a prefix or `includes` here would let a sibling's nonce release
- * this session's task.
+ * (`extensions/types.ts:916-1017`), so the match is built from what IS there: exact string
+ * equality on the canonical minted tool name — a prefix or `includes` here would let a
+ * neighbouring tool release this session's task.
+ *
+ * The target/nonce half of this predicate is GONE, and that is the point of the out-of-band
+ * callback: the address rides the sibling's process env, so the verb takes no arguments and
+ * there are no argument values left to compare. What replaces the comparison is the ABSENCE
+ * of arguments — a call carrying a target or a message is a model supplying an address, which
+ * is the second address axis Hard Rule 2 refuses, and it must not release the task. Correlation
+ * to THIS bootstrap is not weakened by the removal: it is carried by the stored `toolCallId`
+ * (one session, one live tool call) plus the fact that only this session's env named the caller.
  */
-function matchesCallback(event: OmpToolCallEvent, payload: OmpBootstrapPayload): boolean {
+function matchesCallback(event: OmpToolCallEvent, _payload: OmpBootstrapPayload): boolean {
 	if (event?.toolName !== OMP_BOOTSTRAP_CALLBACK_TOOL) return false;
 	const input = event?.input;
-	if (typeof input !== "object" || input === null || Array.isArray(input)) return false;
+	if (input === undefined || input === null) return true;
+	if (typeof input !== "object" || Array.isArray(input)) return false;
 	const args = input as Record<string, unknown>;
-	return args.target === payload.target && args.message === payload.nonce;
+	// No-arg verb: a supplied target/message is a second address axis — not our callback.
+	return args.target === undefined && args.message === undefined;
 }
 
 /**
@@ -822,7 +809,7 @@ export function createOmpBootstrap(opts: {
 		stopTimer();
 		if (isFinal()) return;
 		phase = "failed";
-		log("WARN", `bootstrap-failed nonce=${payload.nonce}: ${why}; the task was NOT sent`);
+		log("WARN", `bootstrap-failed: ${why}; the task was NOT sent`);
 	}
 
 	/**
@@ -858,8 +845,8 @@ export function createOmpBootstrap(opts: {
 			// two callback prompts for one bootstrap.
 			phase = "callback-sent";
 			stopTimer();
-			log("INFO", `bootstrap-ready nonce=${payload.nonce}: callback tool live, sending callback-only prompt`);
-			send(buildOmpCallbackOnlyPrompt({ target: payload.target, nonce: payload.nonce }));
+			log("INFO", "bootstrap-ready: callback tool live, sending callback-only prompt");
+			send(buildOmpCallbackOnlyPrompt());
 			return;
 		}
 		if (timers.now() >= deadline) {
@@ -895,14 +882,14 @@ export function createOmpBootstrap(opts: {
 			const id = event?.toolCallId;
 			if (typeof id !== "string" || id.length === 0) return;
 			callId = id;
-			log("INFO", `bootstrap-callback-observed nonce=${payload.nonce} toolCallId=${id}`);
+			log("INFO", `bootstrap-callback-observed toolCallId=${id}`);
 		},
 		onToolResult(event: OmpToolResultEvent): void {
 			if (phase !== "callback-sent" || callId === null) return;
 			if (event?.toolCallId !== callId) return;
 			if (!matchesCallback(event, payload)) return;
 			if (event?.isError !== false) {
-				log("WARN", `bootstrap-callback-errored nonce=${payload.nonce} toolCallId=${callId}; the task was NOT sent`);
+				log("WARN", `bootstrap-callback-errored toolCallId=${callId}; the task was NOT sent`);
 				return;
 			}
 			// RELEASED, AND THE TASK IS NOT SENT HERE. This handler runs inside the callback
@@ -911,7 +898,7 @@ export function createOmpBootstrap(opts: {
 			// record that the callback provably succeeded; `onTurnEnd` owns the send.
 			phase = "released";
 			stopTimer();
-			log("INFO", `bootstrap-released nonce=${payload.nonce} toolCallId=${callId}: task armed for the next turn_end`);
+			log("INFO", `bootstrap-released toolCallId=${callId}: task armed for the next turn_end`);
 		},
 		/**
 		 * The stage-two boundary: the callback turn is over, so the session is at the edge
@@ -932,7 +919,7 @@ export function createOmpBootstrap(opts: {
 		onTurnEnd(): void {
 			if (phase !== "released") return;
 			phase = "task-sent";
-			log("INFO", `bootstrap-task-sent nonce=${payload.nonce}: delivering the task at the turn_end boundary`);
+			log("INFO", "bootstrap-task-sent: delivering the task at the turn_end boundary");
 			send(payload.task);
 		},
 		invalidate(why: string): void {
@@ -942,7 +929,7 @@ export function createOmpBootstrap(opts: {
 			// caller's task must die with the session it was addressed to.
 			if (isFinal()) return;
 			phase = "failed";
-			log("INFO", `bootstrap-invalidated nonce=${payload.nonce}: ${why}; the task was NOT sent`);
+			log("INFO", `bootstrap-invalidated: ${why}; the task was NOT sent`);
 		},
 	};
 }
@@ -1118,7 +1105,7 @@ export function startOmpBootstrap(opts: {
 	const handle = createOmpBootstrap({ payload: decoded.value, pi, timers, log });
 	activeBootstrap = { sessionId: envelope.nativeSessionId, handle };
 	bootstrapConsumed = true;
-	log("INFO", `bootstrap-armed nonce=${decoded.value.nonce} target=${decoded.value.target}`);
+	log("INFO", "bootstrap-armed: payload admitted, waiting for callback tool");
 	handle.start();
 }
 

package/run.sh

@@ -122,7 +122,7 @@ Usage:
   ./run.sh setup [project-dir]        # ONE presence-driven composition (#86): per-component PASS/SKIP/FAIL for pi/claude/agy/copilot/omp/codex + stable dev bins + v2 install smoke. Codex birth/MCP/status-line atoms are composed at user scope; setup stays non-green until the operator trusts the birth declaration once in visible Codex. Absent harness = zero-state SKIP, detected-incomplete = named FAIL + nonzero exit. Never installs a harness, starts a daemon, touches credentials, or writes the vendor trust receipt
   ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, doctor-pi-provider, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live) + the Codex Pi -> visible Codex -> visible Pi receipt chain (smoke-codex-fresh-live; initial Pi and the Codex it opens in one session S, explicit operator-owned app-server PID in a DIFFERENT session — that separation is the lane B claim). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
   ./run.sh check-bridge               # entwurf-bridge direct MCP smoke + protocol/negative-path test.sh (live substrate = v2 live smokes)
-  ./run.sh check-entwurf-bridge-boot # deterministic gate (5d-5-pre, G1a/G1b/G1e/G1f, IN pnpm run check:full): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2 and entwurf_resume_call registered/schema + the tools/list surface is EXACTLY the seven shipped garden verbs; tools/list only, no auth/side-effect
+  ./run.sh check-entwurf-bridge-boot # deterministic gate (5d-5-pre, G1a/G1b/G1e/G1f/G1h, IN pnpm run check:full): boot start.sh under strip-types + assert v2 fence graph loads + entwurf_v2, entwurf_resume_call and entwurf_callback registered/schema + the tools/list surface is EXACTLY the eight shipped garden verbs; tools/list only, no auth/side-effect
   ./run.sh check-entwurf-bridge-pi-free # deterministic gate (0.12.1 A, IN pnpm check): static — bridge index eager value-import closure must carry no @earendil-works/pi-* (type-only + dynamic import excluded); proves the meta-bridge boots pi-free
   ./run.sh check-model-lock           # deterministic unit test for pi-extensions/model-lock.ts (4-quadrant + edge cases, no API)
   ./run.sh check-shell-quote          # POSIX-safety gate for shellQuote (remote SSH arg quoting in entwurf paths) — source parity + behavior matrix, no SSH
@@ -276,7 +276,7 @@ Usage:
   ./run.sh check-dep-versions         # local deterministic check that the pi pin agrees across package.json (devDeps + peer range), run.sh (peer-install pins), and the baseline docs (AGENTS/README/ROADMAP/setup-clean-host/demo)
   ./run.sh check-node-floor-coherence # binds the Node floor (24+, single axis) across engines.node, run.sh setup preflight, meta-bridge install/doctor judgment logic, clean-host docs, the bridge launcher header, and the CI runner node-version — engines.node is the SSOT, everything else is derived; sweeps tracked contract text for an unregistered declaration
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
-  ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes, one cell per property: version boundary (@0.85.10 must leak, @0.85.1 bare or with either measured peer-hash must pass) and closure prefix (an off-pin @earendil-works/chord must leak — it carries no `pi-` prefix); snapshot-safe qualification oracle, also run first inside check-pack-install
+  ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes, one cell per property: version boundary (a prefix-extended @0.86.0-beta.1 and an off-pin @0.85.1 must leak, @0.86.0 bare or with any measured peer-hash must pass) and closure prefix (an off-pin @earendil-works/chord must leak — it carries no `pi-` prefix); snapshot-safe qualification oracle, also run first inside check-pack-install
   ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
   ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke + the #116 M3-b1 herdr-plugin RUNTIME VERIFIER run against that actual installed tarball (the focused check-herdr-runtime-bootstrap drives a fixture; THIS is where the real package is proven) with the pinned pi peers (pins derived from the package.json devDep; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES) + the INSTALLED-PACKAGE branch of the Copilot and OMP birth installers actually RUN (compiled entry selected, no raw .ts, and a real birth edge mints a citizen — the half a required-artifact list can never stand in for)
   ./run.sh check-install-container    # 0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)
@@ -709,6 +709,31 @@ install_user_scope() {
     esac
     shift
   done
+  # pi FLOOR — the same closed range `setup` enforces (#119 door symmetry). setup refuses an
+  # out-of-range pi by name before it writes any Pi wiring; this verb is the OTHER door onto the
+  # same registration (herdr plugin activation reaches it through plugins/herdr/lib/build.mjs →
+  # scripts/herdr-plugin-activate.mjs → `run.sh install-user-scope --plugin-runtime …`) and had no
+  # version check at all, so a host pi setup would name as FAIL got its citizen written here in
+  # silence. Both doors now tell the same truth, off the SAME derived range — `pi_supported_range`
+  # reads the package.json devDep pin, so there is one range in the repo and no second parser.
+  #
+  # ABSENT pi is deliberately NOT changed here. This verb is called by an activation that has
+  # already decided pi is one of its backends; inventing a presence verdict at the writer would put
+  # a second detection authority next to setup's. Out-of-range is the asymmetry that was real, and
+  # it is the only one closed. PI_BIN is the same probe seam setup uses (hermetic gates pin it;
+  # production leaves it unset).
+  local pi_bin="${PI_BIN:-pi}" pi_range pi_ver
+  if command -v "$pi_bin" >/dev/null 2>&1; then
+    pi_range=$(pi_supported_range)
+    # Bounded capture, same reason as setup's: a resolvable pi whose --version crashes or prints
+    # garbage must reach the refusal below, never abort through set -e with nothing said.
+    pi_ver="$("$pi_bin" --version 2>/dev/null | head -n 1 | tr -d '[:space:]')" || pi_ver=""
+    if ! pi_version_in_range "${pi_ver:-0}" "$pi_range"; then
+      echo "[install-user-scope] pi: FAIL — detected pi ${pi_ver:-<unreadable version>} is outside the supported range $pi_range; nothing was written. Align pi, then re-run." >&2
+      exit 1
+    fi
+  fi
+
   preflight_v3_store install-user-scope
   section "install-user-scope: the GLOBAL pi citizen only (no project wiring)"
   register_user_scope_citizen "$plugin_runtime"
@@ -2120,13 +2145,16 @@ assert.equal(peerTui, piAi,
 // floor tracks the devDep pin so a consumer can't install against a pi lacking
 // the public trust exports the bridge imports at the pinned minor, AND an upper
 // bound at the next minor stops a fresh install from silently pulling a future
-// pi (past the declared ceiling — 0.86+ at the current 0.85.1 pin) whose
+// pi (past the declared ceiling — 0.87+ at the current 0.86.0 pin) whose
 // internal export surface has drifted from the one we typecheck against.
 // pi moves its public surface every minor (the 0.79→0.80 getModels→provider-
-// factory churn is exactly this), so an open `>=` floor is exactly how the next
-// installer re-acquires the drift. The floor is also the HARD MINIMUM a consumer
-// install resolves: at `>=0.85.1` an existing 0.85.0 host is upgraded, not kept.
-// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.85.1 <0.86`).
+// factory churn is exactly this, and 0.86 is the same shape again: a custom
+// provider's streamSimple now receives a branded TranscriptContext instead of a
+// raw Context, with systemPrompt/tools folded into a leading system message), so
+// an open `>=` floor is exactly how the next installer re-acquires the drift.
+// The floor is also the HARD MINIMUM a consumer install resolves: at `>=0.86.0`
+// an existing 0.85.1 host is upgraded, not kept.
+// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.86.0 <0.87`).
 const [piMaj, piMin] = piAi.split('.').map(Number);
 assert.equal(piMaj, 0,
   `pi pin major must stay 0 for the next-minor ceiling rule (got ${piAi}); revisit check-dep-versions when pi reaches 1.x`);
@@ -2157,10 +2185,48 @@ assert.equal(peerDepTui, expectedPeer,
 // read, and sat two bumps stale (`>=0.84.3 <0.85` at a 0.85.1 pin) precisely
 // because it was outside this list. Its declaration is a plain range, so the
 // range scan below binds it — no new PROSE_DECL is needed for it.
-const BASELINE_DOCS = ['README.md', 'ROADMAP.md', 'docs/setup-clean-host.md', 'demo/README.md', 'VERIFY.md'];
+// plugins/herdr/README.md joined on 2026-09-20, the same repair one bump later:
+// its step-1 `npm install -g @earendil-works/pi-coding-agent` was UNPINNED, so
+// from the hour 0.86.0 published it installed a pi outside the range the plugin
+// ships against — and nothing read that line. It now carries the range and is
+// scanned here, which is the only reason writing the number down is allowed.
+// docs/acp-backend-rail.md joined on 2026-09-20 for the same reason the two before it did:
+// its support table declared `peer >=0.85.1 <0.86` in prose no gate read, and the 0.86.0 bump
+// would have carried that into a release. Its declaration is a plain closed range and it is the
+// ONLY one in that file (the other rows declare exact versions of non-pi packages, which neither
+// pattern below matches), so the range scan binds it with no new PROSE_DECL. The bare `0.86.0`
+// devDep mentions in the same cell are prose, not an install pin, and stay unscanned — the range
+// half is what holds the row honest.
+const BASELINE_DOCS = ['README.md', 'ROADMAP.md', 'docs/setup-clean-host.md', 'demo/README.md', 'VERIFY.md', 'plugins/herdr/README.md', 'docs/acp-backend-rail.md'];
+
+// ROADMAP.md is a baseline doc AND the home of the dated bump ledger, and those
+// are opposite kinds of sentence. A ledger entry is a RECEIPT: `2026-09-06 bump
+// — pi 0.84.4 → 0.85.1` records the range that landed THAT day, and rewriting it
+// at the next bump would destroy the evidence trail the entry exists to keep.
+// The comment above always said history keeps its old versions; until 0.86.0
+// that was only true because the newest entry happened to name the live pin, so
+// the FIRST bump after an entry was written is what exposed it. A ledger entry
+// opens at its dated bullet and runs until the enclosing list resumes at column
+// 0 (measured: every `  - ` bullet inside the Dep-bump block is a bump entry).
+function stripBumpLedger(file, text) {
+  if (file !== 'ROADMAP.md') return text;
+  let inLedger = false, dropped = 0;
+  const kept = text.split('\n').filter((line) => {
+    if (/^  - \*\*\d{4}-\d{2}-\d{2} bump — /.test(line)) { inLedger = true; }
+    else if (inLedger && /^(- |#|\S)/.test(line)) { inLedger = false; }
+    if (inLedger) dropped++;
+    return !inLedger;
+  });
+  // Guard the exclusion itself: it must find a real ledger and must not eat the
+  // whole file. Either way the range/exact scans below would pass vacuously.
+  assert.ok(dropped > 0, 'ROADMAP.md: no dated bump-ledger entry found — the ledger moved or its bullet shape changed; re-point stripBumpLedger instead of leaving history inside the pin scan');
+  assert.ok(kept.length > 100, `ROADMAP.md: the bump-ledger exclusion swallowed the document (${kept.length} lines left) — the live pin declarations would no longer be scanned`);
+  return kept.join('\n');
+}
+
 let rangeDecls = 0, exactDecls = 0;
 for (const file of BASELINE_DOCS) {
-  const text = readFileSync(file, 'utf8');
+  const text = stripBumpLedger(file, readFileSync(file, 'utf8'));
   // Closed-range declarations: `>=<floor> <0.<ceiling>` (spaces optional).
   for (const [decl, floor, ceilMinor] of text.matchAll(/>=\s?(\d+\.\d+\.\d+)\s?<\s?0\.(\d+)/g)) {
     rangeDecls++;
@@ -3470,8 +3536,10 @@ check_pack() {
 #
 # (1) The version BOUNDARY. A pnpm .pnpm entry is `<name>@<version>` followed by either
 #     `_<peer-hash>` or end-of-name (measured pnpm 11.20.0 on this tree), so an unbounded
-#     substring match would bless a lookalike such as `@0.85.10` while announcing the pinned
-#     floor — a false-green oracle (found by independent review, 2026-08-25).
+#     substring match would bless a lookalike whose version merely STARTS with the pin — a
+#     prerelease such as `@0.86.0-beta.1`, or the `@0.85.10` shape that first exposed this —
+#     while announcing the pinned floor: a false-green oracle (found by independent review,
+#     2026-08-25).
 # (2) The name PREFIX covers the whole @earendil-works closure, not the `pi-` families alone.
 #     0.85.0 added `@earendil-works/chord`, declared as a runtime `dependencies` entry by
 #     pi-coding-agent, pi-agent-core, pi-client and pi-protocol — inside the closure, with a
@@ -3479,15 +3547,17 @@ check_pack() {
 #     `@earendil-works+chord@0.85.1` next to the seven pi entries, and the old
 #     `^@earendil-works+pi-` filter did not see it: chord would have floated silently while
 #     this gate printed a verified pin. The prefix is the closure's org, not one family in it.
-#     (The measured peer-hash suffix moved too — `_ws@8.21.3` at 0.85.1 where 0.84.4 carried
-#     `_@modelcontextprotocol+sdk@…` — which is exactly what property (1)'s `(_|$)` absorbs;
-#     both shapes are fixtures below so a future suffix change cannot pass vacuously.)
+#     (The measured peer-hash suffix keeps moving — `_@modelcontextprotocol+sdk@…` at 0.84.4,
+#     `_ws@8.21.3` at 0.85.1, and `[측정 2026-09-20]` the combined
+#     `_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6__ws@8.21.3_zod@4.3.6` on a 0.86.0 tree —
+#     which is exactly what property (1)'s `(_|$)` absorbs; all three shapes are fixtures
+#     below so a future suffix change cannot pass vacuously.)
 pack_install_leaked_pi() {
-  grep '^@earendil-works+' | grep -Ev '@0\.85\.1(_|$)' || true
+  grep '^@earendil-works+' | grep -Ev '@0\.86\.0(_|$)' || true
 }
 
 # Matcher self-test on SYNTHETIC lookalikes: a healthy install tree cannot exercise either
-# false-green shape (it contains no 0.85.10 and no off-pin chord), so the oracle is proven
+# false-green shape (it contains no prefix-extended version and no off-pin chord), so the oracle is proven
 # against fixture listings. One cell per property of pack_install_leaked_pi, so a regression
 # in either is named by its own signature rather than folded into a single verdict. Exposed
 # as its own snapshot-safe subcommand because the heavy check-pack-install cannot run inside
@@ -3497,30 +3567,33 @@ pack_install_leaked_pi() {
 check_pack_pin_matcher() {
   local matcher_probe
 
-  # Cell 1 — the version boundary. Both measured peer-hash shapes are fixtures: the
-  # 0.84.4-era `_@modelcontextprotocol+sdk@…` and the `_ws@8.21.3` observed on a real
-  # 0.85.1 tree. Neither may leak; the two lookalikes must.
+  # Cell 1 — the version boundary. Every measured peer-hash shape is a fixture: the
+  # 0.84.4-era `_@modelcontextprotocol+sdk@…`, the `_ws@8.21.3` observed on a real
+  # 0.85.1 tree, and `[측정 2026-09-20]` the combined suffix a 0.86.0 install carries.
+  # None may leak; the two lookalikes must — a PREFIX-EXTENDED version (`0.86.0-beta.1`,
+  # the prerelease shape that an unanchored match would bless) and an off-pin version.
   matcher_probe=$(printf '%s\n' \
-    '@earendil-works+pi-ai@0.85.1' \
-    '@earendil-works+pi-ai@0.85.1_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
-    '@earendil-works+pi-ai@0.85.1_ws@8.21.3' \
-    '@earendil-works+pi-ai@0.85.10' \
-    '@earendil-works+pi-agent-core@0.85.0' | pack_install_leaked_pi)
-  if [ "$matcher_probe" != '@earendil-works+pi-ai@0.85.10
-@earendil-works+pi-agent-core@0.85.0' ]; then
-    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the 0.85.10/0.85.0 lookalikes and pass 0.85.1 bare or with either measured peer-hash — got: ${matcher_probe:-<nothing leaked>}"
+    '@earendil-works+pi-ai@0.86.0' \
+    '@earendil-works+pi-ai@0.86.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
+    '@earendil-works+pi-ai@0.86.0_ws@8.21.3' \
+    '@earendil-works+pi-ai@0.86.0_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6__ws@8.21.3_zod@4.3.6' \
+    '@earendil-works+pi-ai@0.86.0-beta.1' \
+    '@earendil-works+pi-agent-core@0.85.1' | pack_install_leaked_pi)
+  if [ "$matcher_probe" != '@earendil-works+pi-ai@0.86.0-beta.1
+@earendil-works+pi-agent-core@0.85.1' ]; then
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the prefix-extended 0.86.0-beta.1 and the off-pin 0.85.1 lookalikes, and pass 0.86.0 bare or with any measured peer-hash — got: ${matcher_probe:-<nothing leaked>}"
     return 1
   fi
 
   # Cell 2 — the closure prefix. chord is a non-`pi-` member of the same runtime closure
-  # (0.85.0 onward). An off-pin chord MUST leak; the pinned one must not. A matcher narrowed
+  # (0.85.0 onward, still true at 0.86.0). An off-pin chord MUST leak; the pinned one must not. A matcher narrowed
   # back to `^@earendil-works+pi-` sees nothing here and dies at this signature.
   matcher_probe=$(printf '%s\n' \
+    '@earendil-works+chord@0.86.0' \
     '@earendil-works+chord@0.85.1' \
-    '@earendil-works+chord@0.85.0' \
-    '@earendil-works+pi-ai@0.85.1' | pack_install_leaked_pi)
-  if [ "$matcher_probe" != '@earendil-works+chord@0.85.0' ]; then
-    fail "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE] the pin-leak matcher must cover every @earendil-works closure member, not just the pi-* families — an off-pin @earendil-works/chord has to leak (it is a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol at 0.85.x) — got: ${matcher_probe:-<nothing leaked>}"
+    '@earendil-works+pi-ai@0.86.0' | pack_install_leaked_pi)
+  if [ "$matcher_probe" != '@earendil-works+chord@0.85.1' ]; then
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE] the pin-leak matcher must cover every @earendil-works closure member, not just the pi-* families — an off-pin @earendil-works/chord has to leak (it is a runtime dependency of pi-coding-agent, pi-agent-core, pi-client and pi-protocol at 0.86.0 — `[측정 2026-09-20]` `npm view <pkg>@0.86.0 dependencies`) — got: ${matcher_probe:-<nothing leaked>}"
     return 1
   fi
 
@@ -3753,7 +3826,7 @@ _check_pack_install_impl() {
   printf '%s\n' '{ "name": "entwurf-install-smoke", "version": "0.0.0", "private": true }' > "$tmp/package.json"
 
   # pi-agent-core is pinned even though we never import it: pi-coding-agent depends
-  # on it by CARET (`^0.85.x`), so with no lockfile in this fresh temp project it
+  # on it by CARET (`^0.86.x`), so with no lockfile in this fresh temp project it
   # floats to whatever pi published last — and that newer core then drags a NESTED
   # pi-ai of its own. Measured 2026-07-21: pinning only the three we import left
   # pi-agent-core@0.80.10 + pi-ai@0.80.10 in the tree while the gate still announced
@@ -3782,19 +3855,31 @@ _check_pack_install_impl() {
   # It is pinned here for the first time. The leak assertion below covers every
   # other @earendil-works package too — but only because the matcher's prefix was
   # widened from `pi-` to the org in the same change; before that it was blind to
-  # precisely this class of new member. The verified floor is 0.85.1 as of 2026-09-06.
-  echo "[check-pack-install] pnpm add into $tmp (with 0.85.x peers + chord + typebox)"
+  # precisely this class of new member.
+  #
+  # `[측정 2026-09-20]` at 0.86.0 the constellation SHRANK for the first time:
+  # `npm view @earendil-works/pi-coding-agent@0.86.0 dependencies` lists only
+  # {chord, pi-ai, pi-tui, pi-agent-core} — pi-client and pi-protocol are no
+  # longer reachable from the three packages we import (pi-client still carries
+  # {chord, pi-protocol}, pi-protocol still carries {chord}, both published at
+  # 0.86.0). Their explicit pins stay: a pin that is momentarily redundant costs
+  # two frozen rows in a temp tree, while retiring one is how a caret re-enters
+  # the closure unwatched on the next minor — the same shape as the 2026-07-21
+  # pi-agent-core incident. The list moves WITH the floor and is re-measured at
+  # each bump, never pruned on a single quiet minor.
+  # The verified floor is 0.86.0 as of 2026-09-20.
+  echo "[check-pack-install] pnpm add into $tmp (with 0.86.x peers + chord + typebox)"
   local install_log
   install_log=$(cd "$tmp" && pnpm add \
     "$tgz_path" \
-    "@earendil-works/pi-ai@0.85.1" \
-    "@earendil-works/pi-coding-agent@0.85.1" \
-    "@earendil-works/pi-tui@0.85.1" \
-    "@earendil-works/pi-agent-core@0.85.1" \
-    "@earendil-works/pi-client@0.85.1" \
-    "@earendil-works/pi-protocol@0.85.1" \
-    "@earendil-works/pi-telemetry@0.85.1" \
-    "@earendil-works/chord@0.85.1" \
+    "@earendil-works/pi-ai@0.86.0" \
+    "@earendil-works/pi-coding-agent@0.86.0" \
+    "@earendil-works/pi-tui@0.86.0" \
+    "@earendil-works/pi-agent-core@0.86.0" \
+    "@earendil-works/pi-client@0.86.0" \
+    "@earendil-works/pi-protocol@0.86.0" \
+    "@earendil-works/pi-telemetry@0.86.0" \
+    "@earendil-works/chord@0.86.0" \
     "typebox@latest" \
     --ignore-workspace --ignore-scripts 2>&1) || {
     fail "[check-pack-install] pnpm add failed:"
@@ -3804,17 +3889,17 @@ _check_pack_install_impl() {
 
   # A pin is a wish until the resolved tree is read back. Assert it: EVERY
   # @earendil-works package present — direct or transitive, top level or nested,
-  # chord included — must be the pinned 0.85.1. Anything else means an unpinned caret
+  # chord included — must be the pinned 0.86.0. Anything else means an unpinned caret
   # floated and the rest of this gate would be exercising a runtime nobody verified,
-  # while still printing "pinned pi 0.85.1". Fail loud instead of proving the wrong floor.
+  # while still printing "pinned pi 0.86.0". Fail loud instead of proving the wrong floor.
   local leaked_pi
   leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | pack_install_leaked_pi)
   if [ -n "$leaked_pi" ]; then
-    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.85.1):"
+    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.86.0):"
     printf '%s\n' "$leaked_pi" | sed 's/^/    /' >&2
     return 1
   fi
-  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 0.85.1 (chord included)"
+  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 0.86.0 (chord included)"
 
   # Resolve the installed package.json and confirm pi.extensions
   # arrived intact. If pi.extensions is empty or missing, the
@@ -4620,7 +4705,7 @@ function finish(trimmed) {
   // gate that exists to catch "green clone, dead consumer". Equality also catches the
   // other direction the narrow-surface rule cares about: an extra or duplicated verb
   // reaching hosts without a decision. Written sorted; `names` is sorted above.
-  const EXPECT_TOOLS = ['entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
+  const EXPECT_TOOLS = ['entwurf_callback', 'entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
   if (names.length !== EXPECT_TOOLS.length || EXPECT_TOOLS.some((n, i) => names[i] !== n)) {
     console.error('installed MCP tool set MISMATCH — want exactly [' + EXPECT_TOOLS.join(',') + '] got [' + names.join(',') + ']');
     process.exit(1);
@@ -5179,12 +5264,12 @@ function finishOk(trimmed) {
   }
   const names = tools.map((t) => t?.name).sort();
   // EXACT set, not a floor. This is the assertion behind the operator-facing claim that
-  // `entwurf check-bridge` proves the installed bytes list the seven garden tools — and
+  // `entwurf check-bridge` proves the installed bytes list the eight garden tools — and
   // under an installed package this launcher IS the dist branch of start.sh, so a subset
   // check here let an artifact missing entwurf_fresh_call / entwurf_resume_call read as a
   // green bridge. Equality also refuses an undecided extra verb. Written sorted; `names`
   // is sorted above.
-  const expected = ['entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
+  const expected = ['entwurf_callback', 'entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
   if (names.length !== expected.length || expected.some((n, i) => names[i] !== n)) {
     console.error(`MCP tool set MISMATCH — want exactly [${expected.join(',')}] got [${names.join(',')}]`);
     process.exit(1);