@junghanacs/entwurf 0.23.1 → 0.24.0

package/scripts/mutants/acp-backend-preflight.json

@@ -0,0 +1,20 @@
+{
+	"schemaVersion": 1,
+	"lane": "acp-backend-preflight",
+	"mutants": [
+		{
+			"claim": "ACP-PREFLIGHT-REPLAYS-TRANSCRIPT-TOOLS",
+			"title": "reading a `context.tools` field instead of replaying the transcript makes the exclude-tools preflight unfireable on every pi 0.86 turn — the operator is told a tool is excluded while the backend still runs it",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\t\tconst activeToolNames = getCurrentTools(context.messages).map((t) => t.name);"],
+			"replace": [
+				"\t\t\tconst activeToolNames =",
+				"\t\t\t\t(context as unknown as { tools?: { name: string }[] }).tools?.map((t) => t.name) ?? [\"read\", \"bash\", \"edit\", \"write\"];"
+			],
+			"gate": ["bash", "run.sh", "check-acp-backend-preflight"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACP-PREFLIGHT-REPLAYS-TRANSCRIPT-TOOLS]",
+			"signatureSource": "scripts/check-acp-backend-preflight.ts"
+		}
+	]
+}

package/scripts/mutants/bridge-boot-resume.json

@@ -40,6 +40,32 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:BRIDGEBOOT-PUBLIC-SURFACE-EXACT-SET]",
 			"signatureSource": "scripts/check-entwurf-bridge-boot.ts"
+		},
+		{
+			"claim": "BRIDGEBOOT-CALLBACK-REGISTERED",
+			"title": "the callback verb is imported but never registered — invisible to every host, while every import-level assertion stays green",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["server.tool(\n\t\"entwurf_callback\","],
+			"replace": [
+				"const _unregisteredCallbackTool = (...a: unknown[]) => void a;\n_unregisteredCallbackTool(\n\t\"entwurf_callback\","
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-bridge-boot"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BRIDGEBOOT-CALLBACK-REGISTERED]",
+			"signatureSource": "scripts/check-entwurf-bridge-boot.ts"
+		},
+		{
+			"claim": "BRIDGEBOOT-CALLBACK-ZERO-ARG",
+			"title": "a target parameter is added to the callback schema, giving the model a way to supply an address the env pair was meant to own",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["\t\"MCP child). No arguments, no fallback to a model-supplied target.\",\n\t{},"],
+			"replace": [
+				"\t\"MCP child). No arguments, no fallback to a model-supplied target.\",\n\t{ target: z.string().optional() },"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-bridge-boot"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BRIDGEBOOT-CALLBACK-ZERO-ARG]",
+			"signatureSource": "scripts/check-entwurf-bridge-boot.ts"
 		}
 	]
 }

package/scripts/mutants/herdr-activation.json

@@ -13,6 +13,22 @@
 			"signature": "[QK:HAC-PI-USER-SCOPE-ONLY]",
 			"signatureSource": "scripts/check-herdr-activation.ts"
 		},
+		{
+			"claim": "HAC-PI-FLOOR-BOTH-DOORS",
+			"title": "dropping the pi range check from install-user-scope re-opens the door asymmetry: setup refuses a below-floor pi by name while the herdr activation door writes the same registration in silence, so one host reports two verdicts for one citizen",
+			"subject": "run.sh",
+			"find": [
+				"    if ! pi_version_in_range \"${pi_ver:-0}\" \"$pi_range\"; then",
+				"      echo \"[install-user-scope] pi: FAIL — detected pi ${pi_ver:-<unreadable version>} is outside the supported range $pi_range; nothing was written. Align pi, then re-run.\" >&2",
+				"      exit 1",
+				"    fi"
+			],
+			"replace": ["    : \"$pi_range\""],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-PI-FLOOR-BOTH-DOORS]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
 		{
 			"claim": "HAC-COMMAND-IS-DERIVED",
 			"title": "accepting any absolute directory as 'the plugin runtime' is a way to point every pi session at an executable of the caller's choosing — 'absolute' was never the contract, 'this host's stable runtime' was",

package/scripts/mutants/herdr-fresh-call.json

@@ -443,6 +443,17 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:HFC-WITNESS-BINDING-COMPLETE]",
 			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-CALLBACK-ENV",
+			"title": "the launcher-computed callback pair is dropped from herdr --env, so a herdr sibling's first action has to retype a garden id out of prose",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\t...callbackEnvAssignments(params.callback).flatMap((assignment) => [\"--env\", assignment]),"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-CALLBACK-ENV]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
 		}
 	]
 }

package/scripts/mutants/mux-fresh-call.json

@@ -18,7 +18,7 @@
 			"title": "claude-code goes back to the variadic space form, which swallows the prompt as an option value",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": [
-				"\t\t\treturn [composition.prompt, `--allowedTools=${FRESH_CALL_CALLBACK_TOOL[\"claude-code\"]}`, `--model=${model}`];"
+				"\t\t\treturn [\n\t\t\t\tcomposition.prompt,\n\t\t\t\t`--allowedTools=${FRESH_CALL_CALLBACK_TOOL[\"claude-code\"]},${FRESH_CALL_DELIVERY_TOOL[\"claude-code\"]}`,\n\t\t\t\t`--model=${model}`,\n\t\t\t];"
 			],
 			"replace": [
 				"\t\t\treturn [composition.prompt, \"--allowedTools\", FRESH_CALL_CALLBACK_TOOL[\"claude-code\"], `--model=${model}`];"
@@ -55,9 +55,11 @@
 			"title": "Claude Code drops the explicit model token and silently resolves its ambient Opus default again",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": [
-				"\t\t\treturn [composition.prompt, `--allowedTools=${FRESH_CALL_CALLBACK_TOOL[\"claude-code\"]}`, `--model=${model}`];"
+				"\t\t\treturn [\n\t\t\t\tcomposition.prompt,\n\t\t\t\t`--allowedTools=${FRESH_CALL_CALLBACK_TOOL[\"claude-code\"]},${FRESH_CALL_DELIVERY_TOOL[\"claude-code\"]}`,\n\t\t\t\t`--model=${model}`,\n\t\t\t];"
+			],
+			"replace": [
+				"\t\t\treturn [\n\t\t\t\tcomposition.prompt,\n\t\t\t\t`--allowedTools=${FRESH_CALL_CALLBACK_TOOL[\"claude-code\"]},${FRESH_CALL_DELIVERY_TOOL[\"claude-code\"]}`,\n\t\t\t];"
 			],
-			"replace": ["\t\t\treturn [composition.prompt, `--allowedTools=${FRESH_CALL_CALLBACK_TOOL[\"claude-code\"]}`];"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:FRESHCALL-CLAUDE-MODEL-ARGV]",
@@ -67,8 +69,8 @@
 			"claim": "FRESHCALL-CALLBACK-PRECEDES-TASK",
 			"title": "the task is framed before the callback instruction, so a sibling that stalls in the task never names itself",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
-			"find": ["\t\t`FIRST ACTION, before reading files or anything else: call ${tool} with ` +"],
-			"replace": ["\t\t`FINAL ACTION, after completing the task: call ${tool} with ` +"],
+			"find": ["\t\t\t\t\t`FIRST ACTION, before reading files or anything else: call ${birthTool} with no arguments.`"],
+			"replace": ["\t\t\t\t\t`FINAL ACTION, after completing the task: call ${birthTool} with no arguments.`"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:FRESHCALL-CALLBACK-PRECEDES-TASK]",
@@ -275,7 +277,7 @@
 			"claim": "FRESHCALL-COPILOT-CALLBACK-TOOL",
 			"title": "the Copilot callback names Claude Code's `mcp__server__tool` spelling — a dialect copied instead of measured, and the whole first turn is spent looking for a tool that is not there",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
-			"find": ["\tcopilot: \"entwurf-bridge-entwurf_v2\","],
+			"find": ["\tcopilot: \"entwurf-bridge-entwurf_callback\","],
 			"replace": ["\tcopilot: \"mcp__entwurf-bridge__entwurf_v2\","],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 180,
@@ -669,7 +671,7 @@
 			"title": "the first turn stops naming where the result goes, so a sibling finishes its task, prints the answer in its own window, and the caller never learns it is done",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": [
-				"\t\t`When the task reaches its requested final result, send that result to the same target with ${tool}.`,"
+				"\t\t`When the task reaches its requested final result, send that result to the same target with ${deliveryTool}.`,"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -682,13 +684,24 @@
 			"title": "the Claude child loses the one sentence that tells it how to load a deferred callback tool — the framing goes back to naming a tool the child cannot call on its first turn, which is the measured silence: 0/5 directly callable, 5 of 14 production launches dead",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": [
-				"\t\"claude-code\": [\n\t\t\"If ${callbackTool} is not callable yet, the entwurf-bridge server is still connecting or its\",\n\t\t'tools are deferred: load them first with ToolSearch(\"select:${callbackTool},${peersTool}\") —',\n\t\t\"it waits for the server — then call ${callbackTool}.\",\n\t],"
+				"\t\"claude-code\": [\n\t\t\"If ${callbackTool} is not callable yet, the entwurf-bridge server is still connecting or its\",\n\t\t'tools are deferred: load them first with ToolSearch(\"select:${callbackTool},${deliveryTool},${peersTool}\") —',\n\t\t\"it waits for the server — then call ${callbackTool}.\",\n\t],"
 			],
 			"replace": ["\t\"claude-code\": [],"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:FRESHCOMP-TOOL-LOAD-HINT-CLAUDE-ONLY]",
 			"signatureSource": "test/fresh-call-composition.contract.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-CALLBACK-ENV",
+			"title": "the launcher-computed callback pair is dropped from tmux -e, so the sibling's first action has to retype a garden id out of prose — Hard Rule 2",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t...callbackEnvAssignments(callback).flatMap((assignment) => [\"-e\", assignment]),"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-CALLBACK-ENV]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
 		}
 	]
 }

package/scripts/mutants/omp-fresh.json

@@ -45,7 +45,7 @@
 			"claim": "FRESHCALL-OMP-CALLBACK-TOOL-DIALECT",
 			"title": "the callback tool name spelled the way a reader expects instead of the way omp mints it — `entwurf_v2` keeps its digit, which omp's sanitizer charset [a-z_] eats. The sibling is told to call a tool that does not exist in its session, so the whole first turn is spent and no address ever comes back. A launch receipt still prints",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
-			"find": ["\tomp: \"mcp__entwurf_bridge_entwurf_v\","],
+			"find": ["\tomp: \"mcp__entwurf_bridge_entwurf_callback\","],
 			"replace": ["\tomp: \"mcp__entwurf_bridge_entwurf_v2\","],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 300,
@@ -167,10 +167,8 @@
 			"claim": "OMP-BOOTSTRAP-CALLBACK-ONLY",
 			"title": "the task folded back into the stage-one prompt, so the sibling is asked to call back AND to work in one message. This is the prompt the failed LIVE actually ran, minus the missing tool: a competing goal beside the callback is what the two-stage split exists to remove, and nothing about argv or readiness would notice it coming back",
 			"subject": "pi-extensions/meta-bridge-omp.ts",
-			"find": ["\t\t\tsend(buildOmpCallbackOnlyPrompt({ target: payload.target, nonce: payload.nonce }));"],
-			"replace": [
-				"\t\t\tsend(`${buildOmpCallbackOnlyPrompt({ target: payload.target, nonce: payload.nonce })}\\n\\n${payload.task}`);"
-			],
+			"find": ["\t\t\tsend(buildOmpCallbackOnlyPrompt());"],
+			"replace": ["\t\t\tsend(`${buildOmpCallbackOnlyPrompt()}\\n\\n${payload.task}`);"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:OMP-BOOTSTRAP-CALLBACK-ONLY]",
@@ -204,11 +202,9 @@
 			"claim": "OMP-BOOTSTRAP-RESULT-ARMS-ONLY",
 			"title": "the task sent from inside the tool_result handler again, instead of at the turn_end boundary. `[LIVE 2026-08-30]` this is the exact shape that failed: the hook log showed armed/ready/callback-observed/released, the release predicate was provably correct, and the task still never appeared in the session — because that handler runs while the callback turn is streaming. Every static contract about correlation and readiness stays green while the product delivers nothing",
 			"subject": "pi-extensions/meta-bridge-omp.ts",
-			"find": [
-				"\t\t\tlog(\"INFO\", `bootstrap-released nonce=${payload.nonce} toolCallId=${callId}: task armed for the next turn_end`);"
-			],
+			"find": ["\t\t\tlog(\"INFO\", `bootstrap-released toolCallId=${callId}: task armed for the next turn_end`);"],
 			"replace": [
-				"\t\t\tlog(\"INFO\", `bootstrap-released nonce=${payload.nonce} toolCallId=${callId}: task armed for the next turn_end`);\n\t\t\tphase = \"task-sent\";\n\t\t\tsend(payload.task);"
+				"\t\t\tlog(\"INFO\", `bootstrap-released toolCallId=${callId}: task armed for the next turn_end`);\n\t\t\tphase = \"task-sent\";\n\t\t\tsend(payload.task);"
 			],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 300,

package/scripts/mutants/pack-install.json

@@ -6,7 +6,7 @@
 			"claim": "PACK-INSTALL-PIN-MATCHER-BOUNDED",
 			"title": "the pin-leak matcher loses its version boundary and blesses substring lookalikes — @0.85.10 reads as the pinned 0.85.1 and the gate announces a verified tree it never verified (independent review, 2026-08-25)",
 			"subject": "run.sh",
-			"find": ["  grep '^@earendil-works+' | grep -Ev '@0\\.85\\.1(_|$)' || true"],
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@0\\.86\\.0(_|$)' || true"],
 			"replace": ["  grep '^@earendil-works+' | grep -v '@0\\.85\\.1' || true"],
 			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
 			"timeoutSeconds": 120,
@@ -17,8 +17,8 @@
 			"claim": "PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE",
 			"title": "the pin-leak matcher narrows back to the pi-* families and goes blind to a non-pi member of the same runtime closure — @earendil-works/chord (new in pi 0.85.0, a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol) floats unpinned while the gate prints a verified pin (measured 2026-09-06 on a real 0.85.1 install tree)",
 			"subject": "run.sh",
-			"find": ["  grep '^@earendil-works+' | grep -Ev '@0\\.85\\.1(_|$)' || true"],
-			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@0\\.85\\.1(_|$)' || true"],
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@0\\.86\\.0(_|$)' || true"],
+			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@0\\.86\\.0(_|$)' || true"],
 			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE]",

package/scripts/probe-bridge-command.ts

@@ -67,6 +67,7 @@ export const EXPECTED_TOOLS = [
 	"entwurf_register_native",
 	"entwurf_fresh_call",
 	"entwurf_resume_call",
+	"entwurf_callback",
 ] as const;
 const DEFAULT_TIMEOUT_MS = 10_000;
 /** How long a probed child gets to die politely before it is killed outright. */

package/scripts/smoke-acp-session-reuse-live.ts

@@ -24,11 +24,26 @@ import { copyFileSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import type { Api, AssistantMessageEvent, Context, Model } from "@earendil-works/pi-ai";
+import type { Api, AssistantMessageEvent, Model, TranscriptContext } from "@earendil-works/pi-ai";
+import { normalizeContext } from "@earendil-works/pi-ai";
 import { skipLive } from "./lib/live-skip.ts";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5";
+// The pi built-ins the Claude child also exposes natively. pi declares its tool surface on
+// every turn, and since 0.86 that declaration reaches a provider as the leading system
+// message's `toolsAdded` (`normalizeContext`), which backend.ts replays for the exclude-tools
+// truthfulness preflight. A fixture that declares NO tools is therefore not "a turn with the
+// defaults" — it is a turn where the operator excluded everything, and the preflight rejects it
+// before the prompt is ever sent. So every provider-path context here is built through
+// `normalizeContext`, never typed as a raw `Context`: that annotation is exactly what hid this
+// shape from typecheck when the 0.86 pin landed.
+const PI_DECLARED_TOOLS = ["read", "bash", "edit", "write"].map((name) => ({
+	name,
+	description: "",
+	parameters: {} as never,
+}));
+
 const TURN_TIMEOUT_MS = Number(process.env.ENTWURF_ACP_PROVIDER_TIMEOUT_MS) || 240_000;
 
 function fail(msg: string): never {
@@ -101,7 +116,8 @@ async function main(): Promise<void> {
 	console.error(`[smoke-acp-session-reuse-live] codeword: ${codeword}`);
 
 	// --- turn 1 (new): introduce the codeword, full transcript ---
-	const turn1: Context = {
+	const turn1: TranscriptContext = normalizeContext({
+		tools: PI_DECLARED_TOOLS,
 		messages: [
 			{
 				role: "user",
@@ -109,7 +125,7 @@ async function main(): Promise<void> {
 				timestamp: 0,
 			},
 		],
-	};
+	});
 	const r1 = await withTimeout(
 		"turn 1",
 		consume(backend.streamShellAcp(model, turn1, options) as Stream),
@@ -121,7 +137,9 @@ async function main(): Promise<void> {
 	console.error("[smoke-acp-session-reuse-live] starting turn 2 reuse prompt");
 
 	// --- turn 2 (reuse): ask for the codeword, DELTA ONLY ---
-	const turn2: Context = {
+	// turn1.messages already carries the folded system message, so spreading it keeps the
+	// declared surface on the reuse turn too; normalizeContext does not double it.
+	const turn2: TranscriptContext = normalizeContext({
 		messages: [
 			...turn1.messages,
 			{
@@ -147,7 +165,7 @@ async function main(): Promise<void> {
 				timestamp: 0,
 			},
 		],
-	};
+	});
 	const r2 = await withTimeout(
 		"turn 2",
 		consume(backend.streamShellAcp(model, turn2, options) as Stream),

package/scripts/smoke-agy-install-state.sh

@@ -67,7 +67,7 @@ write_mcp_fake() {   # $1 = path
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE
@@ -89,7 +89,7 @@ if [ "${REVIEW_ENV:-}" = "fail" ]; then echo configured-env-failure >&2; exit 24
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE

package/scripts/smoke-copilot-mcp-state.sh

@@ -26,7 +26,7 @@ write_mcp_fake() {
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE

package/scripts/smoke-herdr-fresh-call-live.ts

@@ -186,17 +186,38 @@ function transcriptRecords(file: string): string[] {
 }
 
 /**
- * The id of the `entwurf_v2` toolCall in this record that IS the callback, or null. Pi writes a call
- * and its result as two records; this is one half of the join that replaces a same-record read.
+ * The BARE verb names, as the two surfaces this smoke reads actually spell them — NOT the
+ * model-facing dialect. `[측정 2026-09-20, this smoke's own red fixture]` the claude MCP activity
+ * log carries `Calling MCP tool: entwurf_callback` / `Tool 'entwurf_callback' completed`, and pi
+ * writes `"type":"toolCall","name":"entwurf_callback"`; neither records
+ * `mcp__entwurf-bridge__entwurf_callback`. The per-host dialect is owned by
+ * `FRESH_CALL_CALLBACK_TOOL` / `FRESH_CALL_DELIVERY_TOOL` in `fresh-call-composition.ts` and is
+ * what the FRAMING says; these two are what an OBSERVER sees, and conflating them is what this
+ * pair of constants exists to stop.
+ */
+const CALLBACK_VERB = "entwurf_callback";
+const DELIVERY_VERB = "entwurf_v2";
+
+/**
+ * The id of the CALLBACK toolCall in this record, or null. Pi writes a call and its result as two
+ * records; this is one half of the join that replaces a same-record read.
  *
- * WHAT MAKES IT THE CALLBACK, READ STRUCTURALLY `[sol 재검 2026-09-18]`. An earlier version only
- * asked whether the serialised arguments CONTAINED the nonce, which a call carrying `prefix+nonce`,
- * or the right nonce to the wrong target, satisfies just as well — and then the later, correct call
- * is the one that produces the artifact, so the predicate could join a wrong call to a right
- * delivery. The arguments are an object, so they are read as one: the message must BE the nonce,
- * the target must be the caller that minted it, and the intent must be the one the framing names.
+ * WHAT MAKES IT THE CALLBACK `[ff09522]`. It used to be the ARGUMENTS: message === nonce, target
+ * === the caller, intent === fire-and-forget. That predicate is gone because the thing it read is
+ * gone — the birth verb takes ZERO arguments and reads the caller and the nonce out of its own
+ * process env, so there is nothing in the call for a model to get wrong and nothing here to
+ * compare. What identifies the callback now is the verb plus the ABSENCE of an address: a call
+ * carrying a target or a message is a model supplying an address, which is the second address axis
+ * Hard Rule 2 refuses, and it is not this act.
+ *
+ * The nonce↔sender correlation the old predicate carried did not disappear with it — it moved to
+ * the DELIVERED ARTIFACT, which this smoke checks independently and earlier ("the child's callback
+ * ARRIVED … its body is a production nonce and its sender is the child the direct witness resolved
+ * to"). Two records, one event, same as before; only the half that names the call has changed.
  */
 function entwurfCallIdFor(record: string, nonce: string, callerGid: string): string | null {
+	void nonce;
+	void callerGid;
 	let parsed: unknown;
 	try {
 		parsed = JSON.parse(record);
@@ -207,16 +228,14 @@ function entwurfCallIdFor(record: string, nonce: string, callerGid: string): str
 	if (!Array.isArray(content)) return null;
 	for (const part of content) {
 		const call = part as { type?: unknown; name?: unknown; id?: unknown; arguments?: unknown };
-		if (call.type !== "toolCall" || call.name !== "entwurf_v2") continue;
-		const args = call.arguments as
-			| { message?: unknown; target?: unknown; intent?: unknown; wants_reply?: unknown }
-			| undefined;
-		if (typeof args !== "object" || args === null) continue;
-		if (args.message !== nonce) continue;
-		if (args.target !== callerGid) continue;
-		if (args.intent !== "fire-and-forget") continue;
-		// The framing asks for no reply; a call that asked for one is a different act.
-		if (args.wants_reply === true) continue;
+		if (call.type !== "toolCall" || call.name !== CALLBACK_VERB) continue;
+		// Zero-argument verb: absent, null and `{}` are all the shape it is called with. A supplied
+		// target or message is a model naming an address the env already owns — not this act.
+		const args = call.arguments as { message?: unknown; target?: unknown } | undefined | null;
+		if (args !== undefined && args !== null) {
+			if (typeof args !== "object" || Array.isArray(args)) continue;
+			if (args.target !== undefined || args.message !== undefined) continue;
+		}
 		return typeof call.id === "string" ? call.id : null;
 	}
 	return null;
@@ -864,23 +883,27 @@ async function main(): Promise<void> {
 				// OFFERS exactly that corroboration ("you can corroborate the caller first if you
 				// want to"), so the old oracle contradicted our own prompt and would have forbidden
 				// the behaviour we asked for. What still must hold is everything the claim was
-				// actually about — the callback lands before any work, it completes, and no
-				// entwurf_v2 in the log failed or timed out.
+				// actually about — the callback lands before any work, it completes, and neither the
+				// callback verb nor the delivery verb failed or timed out anywhere in the log.
+				// `[ff09522]` the verb this joins on MOVED: the birth callback is `entwurf_callback`
+				// and `entwurf_v2` is now only the DELIVERY the closing line asks for. Joining on the
+				// old name does not merely miss — it mis-attributes, finding the result-delivery call
+				// and then reporting the real callback as forbidden work before it.
 				// ONLY what the framing actually offers. `entwurf_self` used to sit in this set and
 				// nothing ever proposed it to the child — an allowance for a tool we do not mention
 				// widens the oracle without widening the contract (sol D1, 2026-09-18).
 				const READ_ONLY_FIRST = new Set(["entwurf_peers"]);
-				const beforeCallback = order.slice(0, Math.max(order.indexOf("entwurf_v2"), 0));
+				const beforeCallback = order.slice(0, Math.max(order.indexOf(CALLBACK_VERB), 0));
 				// THE JOIN THIS AXIS CAN ACTUALLY MAKE. The claude MCP log records WHICH tool was
 				// called and whether it completed — never its arguments or its result body — so
-				// "the first entwurf_v2 completed" alone would also be true of a call that delivered
+				// "the first callback completed" alone would also be true of a call that delivered
 				// somebody else's nonce or came back as a semantic reject over a successful
 				// transport. The second artifact closes it: the caller's own delivered message
 				// carries the EXACT nonce and the child as its sender, and its enqueue timestamp has
 				// to fall inside the window of that first call. Two independent records, one event.
-				const callAt = indexOfEntry(childActivity, (e) => (e.debug ?? "") === "Calling MCP tool: entwurf_v2");
+				const callAt = indexOfEntry(childActivity, (e) => (e.debug ?? "") === `Calling MCP tool: ${CALLBACK_VERB}`);
 				const doneAt = indexOfEntry(childActivity, (e) =>
-					(e.debug ?? "").startsWith("Tool 'entwurf_v2' completed successfully"),
+					(e.debug ?? "").startsWith(`Tool '${CALLBACK_VERB}' completed successfully`),
 				);
 				const callbackStamp = deliveredMessages(String(fenced.ENTWURF_META_MAILBOX_DIR), callerGid)[0]?.file ?? "";
 				const stampedAt = Date.parse(
@@ -902,14 +925,19 @@ async function main(): Promise<void> {
 					// here, and a claim about "any work" is wider than the oracle. What IS observed, and
 					// is the thing the framing actually asks for, is the ORDER OF TOOLS: the first
 					// non-read-only tool this child called was the callback.
-					`${cell.label}: the child's FIRST non-read-only tool call was the callback — the FIRST entwurf_v2 completed successfully and the delivered callback carrying this exact nonce was enqueued inside that call's own window, preceded only by the read-only corroboration the framing offers, with no failed or timed-out entwurf_v2 anywhere in its log (this cell reads tool activity only; assistant text is not observable on this rail)`,
+					`${cell.label}: the child's FIRST non-read-only tool call was the zero-argument ${CALLBACK_VERB} — it completed successfully and the delivered callback carrying this exact nonce was enqueued inside that call's own window, preceded only by the read-only corroboration the framing offers, with neither ${CALLBACK_VERB} nor ${DELIVERY_VERB} failing or timing out anywhere in its log (this cell reads tool activity only; assistant text is not observable on this rail)`,
 					childActivity.length > 0 &&
-						order.includes("entwurf_v2") &&
+						order.includes(CALLBACK_VERB) &&
 						beforeCallback.every((name) => READ_ONLY_FIRST.has(name)) &&
 						within &&
 						callbackArrived &&
-						!childActivity.some(
-							(e) => (e.debug ?? "").startsWith("Tool 'entwurf_v2' failed") || (e.error ?? "").includes("entwurf_v2"),
+						// BOTH verbs, because the child uses both: the birth callback and, after the
+						// work, the delivery verb the framing's closing line names. A failed delivery
+						// is as fatal to this rail as a failed callback.
+						![CALLBACK_VERB, DELIVERY_VERB].some((verb) =>
+							childActivity.some(
+								(e) => (e.debug ?? "").startsWith(`Tool '${verb}' failed`) || (e.error ?? "").includes(verb),
+							),
 						),
 				);
 			}

package/scripts/smoke-herdr-raw-install-live.sh

@@ -553,13 +553,19 @@ const HOME = process.env.HOME;
 const SOCKET_DIR = path.join(HOME, ".pi", "entwurf-control");
 const META_DIR = path.join(HOME, ".pi", "agent", "meta-sessions");
 const ENTWURF_BIN = process.argv[2];
+// The ENTRY POINT is an argument, because there are two of them and they are different
+// claims. `pi --entwurf-control` proves the WIRING; `entwurf pi` proves the LAUNCHER a user
+// received from npm. One program, so neither claim drifts away from the other.
+const LABEL = process.argv[3];
+const [COMMAND, ...COMMAND_ARGS] = process.argv.slice(4);
 
 let bad = 0;
 const ok = (m) => console.log("  ok    " + m);
 const no = (m) => { console.log("  FAIL  " + m); bad = 1; };
 const ls = (dir) => { try { return fs.readdirSync(dir); } catch { return []; } };
 
-const child = spawn("pi", ["--entwurf-control", "--mode", "rpc"], { stdio: ["pipe", "pipe", "pipe"] });
+console.log(`  ENTRY  ${LABEL}: ${COMMAND} ${COMMAND_ARGS.join(" ")}`);
+const child = spawn(COMMAND, COMMAND_ARGS, { stdio: ["pipe", "pipe", "pipe"] });
 let stderr = "";
 child.stderr.on("data", (d) => { stderr += d.toString(); });
 
@@ -655,14 +661,14 @@ child.stdout.on("data", (d) => {
 child.on("error", (err) => { no(`pi failed to spawn: ${err.message}`); done(1); });
 child.on("exit", (code) => {
 	if (settled) return;
-	no(`pi exited ${code} before answering get_state — stderr: ${stderr.trim().slice(0, 600)}`);
+	no(`${LABEL}: the session exited ${code} before answering get_state — stderr: ${stderr.trim().slice(0, 600)}`);
 	done(1);
 });
 
 setTimeout(() => { child.stdin.write(`${JSON.stringify({ type: "get_state", id: "g1" })}\n`); }, 500);
 setTimeout(() => { if (!settled) { no("pi did not answer get_state within 60s"); done(1); } }, 60_000);
 DRIVER_EOF
-node /tmp/use-path-drive.mjs "$ACTIVE/node_modules/.bin/entwurf" || fail=1
+node /tmp/use-path-drive.mjs "$ACTIVE/node_modules/.bin/entwurf" "the plugin wiring" pi --entwurf-control --mode rpc || fail=1
 
 # ── 8. the status fan, driven by the REAL binaries this install produced ─────
 # `check-herdr-plugin` already drives `lib/status.mjs` against stub `entwurf` and `herdr`
@@ -736,6 +742,28 @@ else
 fi
 herdr server stop >/dev/null 2>&1 || true
 
+# ── 8a. the SHIPPED LAUNCHER, from the bin the user actually received ───────
+# [7] proves the wiring by running `pi` off PATH. That is not the same claim as the one #118
+# hop 2 makes, and astra named the gap: a user who installed this plugin does not have this
+# checkout, so the only launcher that means anything to them is the one inside the npm
+# artifact the lock names. Measured on the published tarball before this cell existed, the
+# `pi)` case IS in `run.sh` at 0.23.1 — so the claim is now testable, and this cell is what
+# tests it: the same 0-token birth, driven through `<active>/node_modules/.bin/entwurf pi`.
+#
+# The proof that it EXEC'd pi is the birth itself. A launcher that silently did nothing, or
+# resolved to something else, cannot produce a V3 record and a gardenId-keyed socket.
+#
+# IT SITS AFTER [8] ON PURPOSE: the fan cell asserts the unobserved count as an exact
+# literal, and a second citizen born before it would change that number. Order here is the
+# cheaper of the two ways to keep that oracle exact.
+echo; echo "[8a] entwurf pi — the launcher inside the npm artifact, same 0-token birth"
+ENTWURF_INSTALLED_BIN="$ACTIVE/node_modules/.bin/entwurf"
+if [ -x "$ENTWURF_INSTALLED_BIN" ]; then
+  node /tmp/use-path-drive.mjs "$ENTWURF_INSTALLED_BIN" "the shipped launcher" "$ENTWURF_INSTALLED_BIN" pi --mode rpc || fail=1
+else
+  bad "no installed entwurf bin at $ENTWURF_INSTALLED_BIN — the launcher claim cannot be measured"
+fi
+
 # ── 9. deactivate: the roundtrip, on the npm source (#118 H1-5) ──────────────
 # `check-herdr-activation` cell 16 proves this against fixtures: [QK:HAC-DEACTIVATE-ROUNDTRIP]
 # asserts the pi settings return to their ORIGINAL MEANING (JSON equality, not bytes — the

package/scripts/smoke-omp-fresh-live.ts

@@ -434,7 +434,9 @@ ok(
 // callback-only prompt is delivered first, and the task is released only by the exact
 // successful callback result. The transcript is where both are visible, in order, in one
 // native session.
-const bootstrapLine = buildOmpCallbackOnlyPrompt({ target: callerGid, nonce: nonce as string })
+// Since the callback moved out of band (ENTWURF_CALLBACK_TARGET/NONCE in the sibling env), the
+// callback-only prompt carries no address; the receipt is the no-arg first action itself.
+const bootstrapLine = buildOmpCallbackOnlyPrompt()
 	.split("\n")
 	.find((l) => l.includes("FIRST AND ONLY ACTION")) as string;
 const transcript = fs.readFileSync(transcriptPath as string, "utf8");
@@ -442,7 +444,7 @@ const callbackAt = transcript.indexOf(bootstrapLine);
 const taskAt = transcript.indexOf(sceneFact);
 receipts["5-two-stage-order"] = `callback-only prompt @${callbackAt}, task scene fact @${taskAt}`;
 ok(
-	"stage one is in the sibling's own transcript: the extension delivered the callback-ONLY prompt, carrying this call's target and nonce",
+	"stage one is in the sibling's own transcript: the extension delivered the callback-ONLY prompt (no-arg first action; the address rides the sibling env, never this prompt)",
 	callbackAt >= 0,
 	`        expected line: ${bootstrapLine}`,
 );

package/scripts/smoke-omp-mcp-state.sh

@@ -53,7 +53,7 @@ cat > "$SB/bin/entwurf-bridge" <<'FAKE'
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE

package/scripts/smoke-pi-provider-state.sh

@@ -67,7 +67,7 @@ write_mcp_fake() {   # $1 = path
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE
@@ -93,7 +93,7 @@ write_stale_fake() {  # $1 = path
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"stale-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE