@junghanacs/entwurf 0.23.1 → 0.25.0

package/DELIVERY.md

@@ -27,7 +27,7 @@ API. The levels compare capabilities, not implementation shapes.
 
 | State | Meaning |
 |---|---|
-| `queued` | A message is durable; the backend may not have seen it. |
+| `queued` | A receiver queue accepted the message; the backend may not have seen it. Durability is a property of the RAIL, not of this word — see the acceptance table below. |
 | `triggered` | A supported event/API accepted the signal. |
 | `woke` | An idle interactive session began a turn without user typing. |
 | `injected` | The message reached model-visible context. |
@@ -36,6 +36,29 @@ API. The levels compare capabilities, not implementation shapes.
 
 Avoid bare `delivered`; name the observed boundary.
 
+### Control-socket acceptance boundaries (#120)
+
+A control-socket send answers with ONE of these, and the sender renders that word rather than the
+internal route it took. They are not four spellings of success: they differ on every axis an
+operator has to reason about.
+
+| Boundary | Order | Durability | Visibility | Rejection |
+|---|---|---|---|---|
+| `sent` | n/a — the receiver was idle and the turn was TRIGGERED directly | none needed; the turn started | the turn is running, but the model has NOT necessarily read the text yet, and nothing here says the turn completed | an in-band refusal is `rejected`, never this |
+| `queued-steer` | drained after each turn; overtakes every `queued-follow-up` already waiting | **none** — volatile receiver process memory | nothing shows it: it is not in the TUI's pending-message count | an abort clears the queue and the message is gone, silently |
+| `queued-follow-up` | drained only when the receiver's inner loop ends; a steer arriving later still goes first | **none** — volatile receiver process memory | same: invisible in the receiver's own queue display | same: an abort drops it |
+| `accepted-unknown-boundary` | unknown | unknown | unknown | the receiver ACCEPTED; this names our inability to classify its answer (version skew), and it must never be retried or rendered as `sent` |
+
+`[측정 2026-09-22, pi-agent-core 0.87.0; 재측정 2026-09-23, 0.87.1 — 좌표 동일]` `dist/agent.js:60-71,96-97,137-138`
+(two independent `one-at-a-time` queues, no FIFO between them)
+and `dist/agent-loop.js:85,186,191-197`
+(steering drained every turn, follow-ups only once the inner loop ends).
+
+The **meta-mailbox** rail is the contrast, not a fifth boundary: it writes a durable `*.msg` before
+ringing any doorbell, its filenames are ISO stamps so a drain is a global FIFO, an undrained inbox
+is an honest `mailbox-undeliverable` refusal, and its receipt is that FILE. A mailbox enqueue is a
+durable file receipt; a control-socket queue is process memory.
+
 ## Levels (D0–D8)
 
 These are independent of VERIFY's `L0–L5` evidence levels and BASELINE's question

package/FAQ.md

@@ -0,0 +1,47 @@
+# Entwurf FAQ
+
+Short answers for people meeting Entwurf from a different agent-harness tradition.
+
+## Is Entwurf an agent factory or a subagent framework?
+
+No. Entwurf is closer to a workshop than a factory: it connects independently owned, visible sibling sessions without turning them into workers of a new central runtime. A harness may run its own subagents or teams, but that remains the harness's responsibility.
+
+## What does Entwurf do?
+
+It gives an existing session a stable **garden id** and routes a message, reply, or visible sibling launch through the rail that session actually supports. It does not reconstruct prompts, hydrate transcripts, manage credentials, or emulate another harness.
+
+## What is a garden id?
+
+A garden id is the stable address of one visible, record-backed session. Think of it as an invitation to a shared workshop table, not a worker name, a pane id, a transcript id, or a worktree lease.
+
+## How are session state and project state separated?
+
+Entwurf does not merge or isolate either one. Each harness keeps its own authentication, tools, transcript, and workspace policy. Git branches, worktrees, file locks, task allocation, and any coordination around a shared checkout belong to the operator and the harnesses involved; a garden id is never a file-isolation claim.
+
+## What happens to a harness's internal subagents?
+
+The visible top-level session is the garden principal. Internal children remain inside that harness and do not receive a second garden id, separate delivery authority, or an Entwurf-managed access-control layer.
+
+## Does sending a message start a process?
+
+No. [`entwurf_v2`](./README.md#entwurf_v2--canonical-dispatch-verb) only addresses an existing garden citizen and selects its supported delivery rail. `entwurf_fresh_call` opens a new visible sibling; `entwurf_resume_call` reopens a dormant pi citizen under the same id.
+
+## Where do visible siblings open?
+
+Inside Herdr, Entwurf opens a new unfocused tab in the caller's workspace and currently admits pi and Claude Code. Outside Herdr, it opens one of the fixed pi, Claude Code, Copilot, OMP, or Codex runtimes in a visible tmux window. The runtime keeps its own model, tools, authentication, and transcript.
+
+## Does Entwurf replace Herdr or tmux?
+
+No. Herdr and tmux provide visible seats. Entwurf provides identity, delivery, and receipts across independent harness sessions. A pane or tmux session is a location for a sibling, never its address or liveness proof.
+
+## How do I install it?
+
+Use the [direct installation route](./README.md#install) for the broader harness surface. In an existing Herdr workbench, use the [Herdr integration guide](./plugins/herdr/README.md); it activates only Herdr-integrated pi and Claude Code and leaves the rest to the direct route.
+
+## How do I start pi as a citizen?
+
+After the direct install, run `entwurf pi`; it starts pi with Entwurf's control surface. The Herdr integration does not put `entwurf` on `PATH`, so its documented command remains `pi --entwurf-control`.
+
+## Where is the precise contract?
+
+[AGENTS.md](./AGENTS.md) owns the project invariants. [DELIVERY.md](./DELIVERY.md), [VERIFY.md](./VERIFY.md), and [docs/adding-a-harness.md](./docs/adding-a-harness.md) own capability, evidence, and admission details.

package/README.md

@@ -8,6 +8,8 @@
 
 npm package: <https://www.npmjs.com/package/@junghanacs/entwurf>
 
+**Short answers for common questions:** [FAQ.md](./FAQ.md).
+
 Legacy package: [`@junghanacs/pi-shell-acp`](https://www.npmjs.com/package/@junghanacs/pi-shell-acp). `entwurf` is its 0.12+ successor line: the same work renamed around the garden-citizen dispatch substrate rather than the pi adapter.
 
 > **Repository shape.** This repo is **entwurf-core (v2 dispatch) + native-harness bridges + a pi adapter + an ACP plugin**. Pi is one adapter, not the project subject. Claude Code, GitHub Copilot CLI, and OMP (`omp`) are shipped self-fetch citizens; Antigravity (`agy`) is shipped native-push. Codex CLI is a **native-push citizen, supported in 0.21.0 on Linux** over the operator-owned app-server: vendor-trusted user-scope birth, strict request-scoped identity, loaded-thread probe, one-shot queue delivery, and visible fresh beside the CALLER's own pane. Unrestricted attached-TUI seat inference is not supported or claimed; #95 D1 retired the fixed `codex` tmux home on 2026-09-16, so the operator seats the app-server wherever they like and a Codex caller opens its sibling beside its own TUI pane. Codex remains native so it keeps its vendor tools, delegation, and work context; this is not another way to buy or expose GPT through ACP.
@@ -252,7 +254,7 @@ cd ~/repos/gh/entwurf
 
 The full source setup requires Node 24, pnpm, and Python 3 on PATH. Harnesses are
 optional-by-presence: `setup` runs the frozen dependency install, then composes what the operator
-already installed — a compatible `pi` (`>=0.85.1 <0.86`), Claude Code, agy, and the Copilot CLI
+already installed — a compatible `pi` (`>=0.87.1 <0.88`), Claude Code, agy, and the Copilot CLI
 each get their wiring completed when detected, an absent harness is an explicit zero-state SKIP,
 and a detected harness that cannot be completed (including a below-floor `pi`) is a named FAIL
 that makes setup exit nonzero. `setup` never installs a harness binary or touches a credential
@@ -286,7 +288,7 @@ This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending
 physical host (control sockets, mux, ACP plugin hosting).
 
 To use the `entwurf` provider inside pi, install a compatible pi binary
-separately (`@earendil-works/pi-coding-agent >=0.85.1 <0.86`). Then point pi at
+separately (`@earendil-works/pi-coding-agent >=0.87.1 <0.88`). Then point pi at
 the npm-installed package or development clone:
 
 ```bash
@@ -636,7 +638,7 @@ A two-pane recording covers the pre-0.12 v1 surface end-to-end — sibling resum
 
 Live peer messaging carries a sender envelope `{ sessionId, agentId, cwd, timestamp, origin?, replyable? }`; `entwurf_self` returns that authoritative envelope for the current pi session or trusted meta-session. Plain external MCP hosts are non-replyable. A garden-native meta-session carries a trusted `meta-session` envelope, but **`replyable` is a fact its own rail decides, not a consequence of being trusted** — a self-fetch citizen needs a live armed receiver, a native-push citizen needs an alive adapter probe, and a pi session needs its control socket. `entwurf_self` also reports which rail a meta-session reply would ride, because a native-push citizen has no mailbox to name. `wants_reply` is an etiquette marker rendered as a `(wants reply)` badge — not a transport contract, no wait, no polling. **v2 never gates on it:** a `wants_reply` from an external/non-replyable caller is passed through and surfaced honestly beside that sender's `replyable: false`, not rejected — the decider routes on target + intent, never on sender replyability. (The retired v1 `entwurf_send` did reject it; that behaviour went with the verb.)
 
-In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes seven tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / self-fetch meta-mailbox (Claude Code, Copilot, OMP) / native-push (Antigravity, Codex), and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — WHERE it opens is a fact about the calling process, not a parameter: inside herdr (`HERDR_ENV=1`) it opens a NEW TAB in the caller's own workspace, without taking focus, and admits only `pi` and `claude-code`, refusing `placement` by name; everywhere else it launches one of five fixed backends (`pi`, `claude-code`, `copilot`, `omp`, `codex`) as a visible window on the operator's own tmux server. There is no fallback between the two — an incomplete herdr context is refused by its herdr reason rather than quietly opening a tmux window nobody inside herdr can see. Everything that follows in this paragraph describes the tmux rail; the herdr rail's coordinates, refusals and reclaim are owned by [docs/herdr-launch-rail.md](./docs/herdr-launch-rail.md). On tmux it requires an explicit model, accepts one optional literal absolute `cwd` (omit it or pass `""` to use the caller's cwd) and one optional `placement.tmuxSession` naming an EXISTING session on that server to open the sibling in instead of the caller's own (the operator's project seat — nothing is ever created: an absent session is `tmux-session-missing` and a name outside the addressed grammar `[A-Za-z0-9][A-Za-z0-9_-]*` is `tmux-session-name-invalid`, with no window and no session left behind. The two inputs never infer each other, and the positive form of that matters more than the prohibition: **with `cwd` omitted, a seated sibling starts in THIS agent's own working directory**, measured — it does not inherit the target session's path or its active pane, so naming the `org` seat does not put the sibling in the `org` project. Pass `cwd` when you want a different directory. entwurf never resolves that path: it hands the literal string to tmux, so with a SYMLINKED directory the receipt echoes what you asked for while the record, the transcript path, the callback envelope and `pane_current_path` all show the path the OS resolved it to — two spellings of one place, and the resolved one is what `entwurf_resume_call` later reopens), passes the model and selected directory through the runtime's visible launch path, and hands it a first task; a `copilot` launch goes through entwurf's own managed invocation and is refused before any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units, and an `omp` launch carries its task in the `--entwurf-bootstrap` payload instead of an argv prompt because that vendor connects its MCP tools after the session has already started. Omitted placement follows the CALLER rather than the backend being opened: a Codex CALLER opens its sibling beside its own TUI pane, located by the `thread-id` that pane's terminal title carries (0 or 2+ matching panes reject with no fallback); every other caller opens in its own seat. (0.21.0 shipped a backend-selected default instead — an omitted-placement `codex` TARGET resolved a fixed operator-owned session named `codex` — and #95 D1 retired it on 2026-09-16.) Any of the five can still be sent to an operator-owned existing seat with an explicit `placement.tmuxSession`, and named `claude`/`pi` seats remain available that way, but they are not omitted-placement defaults. Read tmux here as the VISIBLE LAUNCH SEAT, never as an address: the garden id is the address, and it arrives in the callback envelope. Sibling symmetry means each backend keeps its own transcript, auth, native tools and visibility — not that the transports are made identical. The sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model/cwd/seat plus tmux coordinates — including the RESOLVED target session id, which is where the window actually is — and never claims that the runtime accepted them or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task and optional cwd directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
+In ACP-backed and external native-harness sessions, `entwurf-bridge` exposes eight tools: `entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_callback`, `entwurf_self`, `entwurf_inbox_read`, and the explicit/manual `entwurf_register_native` fallback. Native pi exposes the shared capability directly through the extension surface (`entwurf_v2`, `entwurf_peers`, `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_callback` tools; the socket-scan `/entwurf-sessions` command is gone — #50 C4). **For garden-id delivery/reply use `entwurf_v2`** — the canonical surface that classifies the target and routes to live-pi / self-fetch meta-mailbox (Claude Code, Copilot, OMP) / native-push (Antigravity, Codex), and refuses a dormant target instead of waking it. **To open a sibling that does not exist yet use `entwurf_fresh_call`** — WHERE it opens is a fact about the calling process, not a parameter: inside herdr (`HERDR_ENV=1`) it opens a NEW TAB in the caller's own workspace, without taking focus, and admits only `pi` and `claude-code`, refusing `placement` by name; everywhere else it launches one of five fixed backends (`pi`, `claude-code`, `copilot`, `omp`, `codex`) as a visible window on the operator's own tmux server. There is no fallback between the two — an incomplete herdr context is refused by its herdr reason rather than quietly opening a tmux window nobody inside herdr can see. Everything that follows in this paragraph describes the tmux rail; the herdr rail's coordinates, refusals and reclaim are owned by [docs/herdr-launch-rail.md](./docs/herdr-launch-rail.md). On tmux it requires an explicit model, accepts one optional literal absolute `cwd` (omit it or pass `""` to use the caller's cwd) and one optional `placement.tmuxSession` naming an EXISTING session on that server to open the sibling in instead of the caller's own (the operator's project seat — nothing is ever created: an absent session is `tmux-session-missing` and a name outside the addressed grammar `[A-Za-z0-9][A-Za-z0-9_-]*` is `tmux-session-name-invalid`, with no window and no session left behind. The two inputs never infer each other, and the positive form of that matters more than the prohibition: **with `cwd` omitted, a seated sibling starts in THIS agent's own working directory**, measured — it does not inherit the target session's path or its active pane, so naming the `org` seat does not put the sibling in the `org` project. Pass `cwd` when you want a different directory. entwurf never resolves that path: it hands the literal string to tmux, so with a SYMLINKED directory the receipt echoes what you asked for while the record, the transcript path, the callback envelope and `pane_current_path` all show the path the OS resolved it to — two spellings of one place, and the resolved one is what `entwurf_resume_call` later reopens), passes the model and selected directory through the runtime's visible launch path, and hands it a first task; a `copilot` launch goes through entwurf's own managed invocation and is refused before any window opens if this host lacks the Copilot birth, MCP, receiver or visible-footer units, and an `omp` launch carries its task in the `--entwurf-bootstrap` payload instead of an argv prompt because that vendor connects its MCP tools after the session has already started. Omitted placement follows the CALLER rather than the backend being opened: a Codex CALLER opens its sibling beside its own TUI pane, located by the `thread-id` that pane's terminal title carries (0 or 2+ matching panes reject with no fallback); every other caller opens in its own seat. (0.21.0 shipped a backend-selected default instead — an omitted-placement `codex` TARGET resolved a fixed operator-owned session named `codex` — and #95 D1 retired it on 2026-09-16.) Any of the five can still be sent to an operator-owned existing seat with an explicit `placement.tmuxSession`, and named `claude`/`pi` seats remain available that way, but they are not omitted-placement defaults. Read tmux here as the VISIBLE LAUNCH SEAT, never as an address: the garden id is the address, and it arrives in the callback envelope. Sibling symmetry means each backend keeps its own transcript, auth, native tools and visibility — not that the transports are made identical. The sibling's first action is a nonce callback whose sender envelope carries its garden id. The launch receipt records the requested model/cwd/seat plus tmux coordinates — including the RESOLVED target session id, which is where the window actually is — and never claims that the runtime accepted them or completed delivery. (The v1 verbs `entwurf` / `entwurf_resume` / `entwurf_send` are gone.) Garden-native operator commands require `--entwurf-control`. There is no spawn target allowlist — the target registry is gone (#50 C3): `entwurf_v2` and `entwurf_resume_call` address an existing record-backed citizen, while `entwurf_fresh_call` takes its explicit backend/model/task and optional cwd directly rather than resolving a model tuple from a registry file. **To reopen a DORMANT pi citizen use `entwurf_resume_call {target}`** — the record supplies transcript, model, provider and cwd, so it takes no prompt, no task and no model override; it runs no turn, returns a LAUNCH receipt and a separate OBSERVATION receipt (only the second says the citizen is back), refuses a non-pi target as `target-not-pi`, and on an unobserved socket leaves the visible window open and releases its lock rather than retrying.
 
 ### `entwurf_v2` — canonical dispatch verb
 

package/VERIFY.md

@@ -5,7 +5,7 @@ invariants live in gates; this file defines evidence strength, release acceptanc
 and the manual judgements a gate cannot make.
 
 > **Current surface.** `entwurf-bridge` exposes `entwurf_v2`, `entwurf_peers`,
-> `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_self`, `entwurf_inbox_read`, and `entwurf_register_native`. The ACP
+> `entwurf_fresh_call`, `entwurf_resume_call`, `entwurf_callback`, `entwurf_self`, `entwurf_inbox_read`, and `entwurf_register_native`. The ACP
 > backends are Claude and Snowflake Cortex Code. Antigravity is a separate shipped
 > native-push citizen lane. Codex is a native-push citizen supported in 0.21.0, whose birth hook is
 > operator-owned and gated on one vendor trust receipt, with strict request-scoped identity and
@@ -132,6 +132,24 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 > `LIVE=1 ENTWURF_CODEX_APP_SERVER_PID=<existing-app-server-pid>
 > ENTWURF_CODEX_FRESH_MODEL=<codex-model>
 > ENTWURF_CODEX_FRESH_PI_MODEL=<pi-model> ./run.sh smoke-codex-fresh-live`.
+>
+> Those three values are the step's operator-supplied prerequisite, and
+> **`release-gate --cut` inherits that triple** — it is exported onto the aggregate invocation (the
+> release skill's P5 carries it), never inferred by the gate, so the no-inference rule above holds
+> unchanged inside the aggregate. **An ABSENT value is a protocol SKIP naming what was missing; a PRESENT but wrong one
+> stays a FAIL.** That split is the honest reading of the step-outcome protocol — a step that never
+> ran and a step that ran and broke are different facts — and it is what makes this MUST reproducible
+> at every cut instead of inviting a standing exception: before 2026-09-23 all three were assertions, so their
+> absence threw, and because the aggregate supplied none of them this step went red inside every
+> cut on every host (0.25.0's candidate receipt, `MUST PASS=23 FAIL=1`, is that shape). A SKIP is
+> **not** a softening: `--cut` refuses it as `cut: BLOCKED (MUST SKIP)`, so a cut without this
+> receipt is still impossible — the operator supplies the triple and re-runs. A host with no Codex
+> app-server therefore cannot take a cut, which is the intended cost of #87's release stop
+> (「A visible-fresh receipt outside the MUST tier is no longer the general rule」above) rather than
+> an accident. The installed-config preflights are deliberately NOT in that split and remain FAIL
+> on absence — a missing Codex birth, user MCP/status/terminal-title config, runtime, bridge, tmux
+> seat, or an unanswered launch directory is host state `setup` and the Codex doctors own, not a
+> per-invocation input.
 > **Both of THIS cell's live-spend defaults are `gpt-5.6-luna` from 2026-09-17**
 > (`openai-codex/gpt-5.6-luna` on the pi side) — the Codex leg came down off `sol`. It is a tier
 > choice and not a gate change; the receipt this cell is accepted on must be the one that actually
@@ -269,7 +287,7 @@ The goal is not merely "invoke Claude Code." We want:
 **One install command to remember: `./run.sh setup <project>`.** It is idempotent — re-run the exact same command whenever anything looks wrong. There is no second install surface to juggle: from a clone `setup` runs the whole floor in order.
 
 1. `pnpm install` — installs the pinned development dependencies and builds the bridge (source-checkout bootstrap only; an installed package never runs npm/pnpm inside `node_modules`)
-2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=0.85.1 <0.86`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
+2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=0.87.1 <0.88`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
 3. Claude meta-bridge global plugin — only when `claude` is on PATH; otherwise skipped cleanly
 4. source stable-bin exposure — including certified `entwurf` → this checkout's `run.sh`, the managed runtime Copilot fresh resolves; helper units are attempted independently and a foreign helper is a named FAIL
 5. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable

package/demo/README.md

@@ -46,7 +46,10 @@ a background driver types the scene prompts into the sender pane.
 1. **Spawn** a sonnet sibling (memory write — "tempered indigo").
 2. **Resume** that same sibling (memory recall — identity preservation,
    the #9 regression guard).
-3. **Cross-session greeting** via `entwurf_send` (sent box ↔ received box).
+3. **Cross-session greeting** via `entwurf_send`. *(Historical: `entwurf_send` was retired in the
+   0.12 cutover, and the "sent box" half of that pairing was never actually reachable — the
+   sender-side renderer had zero producers and was removed in #120 P3. What the recording shows on
+   the receive side is real; the send side is a box the operator could not have seen.)*
 
 Run:
 
@@ -139,7 +142,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 0.85.1)
+- `pi` on PATH (current floor 0.87.1)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)

package/docs/acp-backend-rail.md

@@ -92,8 +92,8 @@ undifferentiated "supported" column is what let a Claude PASS read as if it also
 
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
-| Entwurf package | `0.23.0` | shipped baseline | the package contract these rows belong to |
-| pi runtime | devDep exact `0.85.1`, peer `>=0.85.1 <0.86` | **exact** oracle + **closed range** | built and certified against 0.85.1; hosts inside the range are accepted, and the ceiling moves only on measurement |
+| Entwurf package | `0.25.0` | shipped baseline | the package contract these rows belong to |
+| pi runtime | devDep exact `0.87.1`, peer `>=0.87.1 <0.88` | **exact** oracle + **closed range** | built and certified against 0.87.1; hosts inside the range are accepted, and the ceiling moves only on measurement |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.4.0` | **exact** | the shared wire oracle both adapters speak |
 | Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.79.0` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
 | Claude Agent SDK | `0.3.274` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
@@ -476,6 +476,53 @@ already emitted a `usage_update` at `compact_boundary` and 0.75.1 still does
 
 Receipt, limits and the `completed`-branch gap: `scripts/raw-acp-compaction-measure/README.md`.
 
+## 11-9. A steer reaches an ACP receiver one child turn late (#120 P5, measurement only)
+
+`entwurf_v2 mode:"steer"` injects into the receiver's pi steering queue; it is not an ACP concept.
+On a NATIVE pi receiver that queue is drained seconds later, and on an ACP receiver it is drained
+one whole child turn later. The difference is not a different drain point — it is the same one.
+
+`[측정 2026-09-22, pi-agent-core 0.87.0; 재측정 2026-09-23, 0.87.1 — 좌표 동일]` `dist/agent-loop.js:141` awaits `streamAssistantResponse`
+once per turn, and the steering drain is `:186`, after the `turn_end` emit at `:185`. For this rail
+that one await is `pi-extensions/lib/acp/backend.ts:815` —
+`await Promise.race([session.connection.prompt(promptArgs), lifecycle])` — so it spans the entire
+`session/prompt` round trip. The child's own tool calls and subagent turns are invisible to pi, so
+pi cannot reach `:186` until the child turn ends. Same code path as native, one long await.
+
+That is a property, not a silent failure: the sender's receipt already says `queued-steer` and
+`DELIVERY.md` already states that both queues are volatile and unordered against each other, so
+nothing here is promised and then quietly not delivered. `[QK:PI-QUEUE-NO-MIDFLIGHT-MERGE]`
+(`test/pi-queue.oracle.test.ts`) proves the mechanism on the installed vendor: a message queued
+while a turn is in flight never joins that turn and arrives as a later one. The delay's SIZE is
+that turn's duration, which the same cell fixes by construction.
+
+**Forwarding is not adopted here.** `[측정 2026-09-22]` standard ACP has no steer method at all —
+enumerating the installed `@agentclientprotocol/sdk`'s `AGENT_METHODS` and `CLIENT_METHODS` yields
+zero entries containing `steer`. What exists is a PRIVATE vendor extension,
+`_session/steering` in `@agentclientprotocol/claude-agent-acp@0.79.0`
+(`dist/acp-agent.js:163`, handler at `:7792`), client→agent, advertised through
+`InitializeResponse._meta.steering.supported`. Our client sends `initialize`, `session/new`,
+`session/prompt`, `session/set_config_option` and `session/cancel` (`acp-client.ts:138-149`) and
+has no steering path at all.
+
+Adopting it would mean owning five things this driver does not own today, each a new contract
+rather than a wiring change:
+
+1. reading the `_meta.steering.supported` capability, and deciding what a backend without it is;
+2. a typed schema and version fence for a request that is outside the SDK's method set, so a
+   private extension changing shape is a named refusal rather than a silent no-op;
+3. a backend-specific concurrent-request seam from the control extension to a live ACP connection —
+   today a turn is one in-flight `prompt`, and this adds a second request during it;
+4. an exactly-once / ordering policy that picks the outer pi queue or the vendor injection but never
+   both, since those are two independent orderings that currently do not meet;
+5. a receipt mapping for the extension's outcomes — `injected`, `promptRequired`, `startedNewTurn` —
+   plus the idle race, cancel and release meanings behind them. (`idleBehavior:"promptRequired"`
+   lets a host refuse the detached `startedNewTurn` path, but that opt-in is itself a new contract.)
+
+The adapter keeps its own turn-settlement bookkeeping internally, and our event mapper ignores
+update kinds it does not handle (`event-mapper.ts:377-378`), so nothing above is a claim that
+Entwurf must replicate vendor internals. The reason to stay put is the five contracts, not a ledger.
+
 ## Open work
 
 - causal MCP-readiness diagnosis and, only with proof, a backend-invariant fence;

package/docs/setup-clean-host.md

@@ -22,7 +22,7 @@ evidence split, and its three states must not collapse into "macOS is supported"
 | npm/pnpm | npm is bundled with Node; pnpm is required for source setup | package or source installation |
 | Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot/Codex wiring writers |
 | entwurf | global/project-local `@junghanacs/entwurf`, or a source checkout | operator command and garden capability |
-| pi | optional-by-presence, `>=0.85.1 <0.86` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| pi | optional-by-presence, `>=0.87.1 <0.88` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
 | Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
 | OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
@@ -156,7 +156,7 @@ on Darwin; that is wiring, not a rail receipt. If `pi` is on PATH,
 Install the exact release floor, then wire the project:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@0.85.1
+npm install -g @earendil-works/pi-coding-agent@0.87.1
 pi --version
 
 cd ~/entwurf-smoke
@@ -164,7 +164,7 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported range is `>=0.85.1 <0.86`. It is a hard minimum: installing this
+The supported range is `>=0.87.1 <0.88`. It is a hard minimum: installing this
 release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
 minor. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.
@@ -264,9 +264,10 @@ process. Open omp yourself and it is a two-way citizen either way — it sends u
 garden id and a reply lands on it.
 
 The first turn of a fresh omp sibling is a TWO-STAGE BOOTSTRAP, not a positional prompt: the
-launcher carries `{v,target,nonce,task}` on the fixed registered flag `--entwurf-bootstrap`,
-and the installed birth extension waits until the callback tool is actually callable, sends a
-callback-only prompt, and delivers the operator's task only after that exact call succeeds.
+launcher carries `{v,task}` on the fixed registered flag `--entwurf-bootstrap` while the
+caller's address rides the sibling's own process env, and the installed birth extension waits
+until the zero-argument callback tool is actually callable, sends a callback-only prompt, and
+delivers the operator's task only after that exact call succeeds.
 That is a measured correction — the interactive host defers MCP discovery, so a positional
 first turn began before the tool it named existed.
 
@@ -306,7 +307,7 @@ as a note rather than a fault.
 
 **entwurf sets no OMP version floor in code, and will not grow one on schedule.** Detection is
 presence-only (`command -v "${OMP_BIN:-omp}"`); there is no `entwurf.ompFloor`, no coherence
-gate, and no exact pin — unlike Node (`engines.node`), pi (`>=0.85.1 <0.86`) and Claude Code
+gate, and no exact pin — unlike Node (`engines.node`), pi (`>=0.87.1 <0.88`) and Claude Code
 (`entwurf.claudeCodeFloor`), each of which has an enforcement point. That asymmetry is a
 decision, not an omission. A floor is the answer to a vendor that fails SILENTLY — Claude Code
 earned one because an older binary validates the exec manifest, drops `args` at runtime, and

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -34,8 +34,13 @@
  *   - entwurf_resume_call — reopen ONE DORMANT pi citizen under its OWN garden id in a visible
  *                       window; target-only, runs no turn, LAUNCH and OBSERVATION receipts stay
  *                       apart.
+ *   - entwurf_callback — ZERO-ARGUMENT fresh-sibling callback. Reads ENTWURF_CALLBACK_TARGET +
+ *                       ENTWURF_CALLBACK_NONCE from this process env (launcher-injected), validates
+ *                       grammar, and dispatches through the existing v2 runner. Refuses by name
+ *                       when env is absent/malformed or this process is a Codex-provenance bridge.
+ *                       No model-supplied target fallback.
  *
- * That list is the WHOLE public surface — seven verbs — and `check-entwurf-bridge-boot`
+ * That list is the WHOLE public surface — eight verbs — and `check-entwurf-bridge-boot`
  * (G1f) holds it as an exact set on the runtime tools/list, so a verb added or dropped
  * here without a decision is red rather than merely undocumented.
  *
@@ -64,6 +69,7 @@ import * as process from "node:process";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
+import { readCallbackEnv } from "../../../pi-extensions/lib/callback-env.js";
 import { controlSocketPathIn, defaultControlSocketDir } from "../../../pi-extensions/lib/control-socket-path.js";
 import { resolveMailboxReceiverFacts } from "../../../pi-extensions/lib/entwurf-deliverability.js";
 import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provider.js";
@@ -348,7 +354,9 @@ server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids: message, r
     "alone does not say which rail that citizen answers on. Give target + intent; the decider picks transport " +
     "from liveness (live socket citizen → control-socket send; deliverable self-fetch citizen → meta-bridge " +
     "mailbox; probe-alive native-push citizen → direct injection into its conversation) and reports ONE " +
-    "outcome (delivered / rejected / delivered-but-lock-dirty). EXISTING targets only; discover with " +
+    "outcome, named per rail: a control receiver's acceptance boundary (`sent` / `queued-steer` / " +
+    "`queued-follow-up` / `accepted-unknown-boundary` — those four only), a mailbox ENQUEUE receipt, a " +
+    "native-push INJECTION, a rejection, or lock-dirty. EXISTING targets only; discover with " +
     "entwurf_peers. A peer entwurf_peers shows as liveness=alive → fire-and-forget. A " +
     "citizen with NO socket liveness (liveness=unsupported) is ALSO fire-and-forget — unsupported means only " +
     '"no control-socket probe." The decider resolves the actual rail at dispatch time: a self-fetch ' +
@@ -383,9 +391,8 @@ server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids: message, r
     mode: z
         .enum(["steer", "follow_up"])
         .optional()
-        .describe("Injection style for a CONTROL-SOCKET send only: steer (interrupt the current turn) or " +
-        "follow_up (queue after it). The mailbox and native-push plans carry no mode, so it has no " +
-        "effect on those rails."),
+        .describe("Injection style for a CONTROL-SOCKET send only: steer (ask the receiver's steering queue) or follow_up (ask its follow-up queue). NEITHER is an interrupt: a busy receiver drains steering after each turn and follow-ups only when its inner loop ends, so a later steer overtakes every earlier follow_up and there is no order between the two. Both queues are volatile process memory — an abort drops what is in them. The receipt names which queue accepted the message (`queued-steer` / `queued-follow-up`); an idle receiver answers `sent`, meaning the turn was TRIGGERED, not that the model has seen the text. " +
+        "The mailbox and native-push plans carry no mode, so it has no effect on those rails."),
     wants_reply: z.boolean().optional().describe("Human-conversation reply hint (default false)"),
 }, async ({ target, intent, message, mode, wants_reply }, extra) => {
     try {
@@ -740,6 +747,32 @@ server.tool("entwurf_resume_call", "Reopen ONE DORMANT pi citizen under its OWN
         return textErr(`entwurf_resume_call error: ${err instanceof Error ? err.message : String(err)}`);
     }
 });
+server.tool("entwurf_callback", "ZERO-ARGUMENT callback for a fresh sibling this process was launched as. Reads " +
+    "ENTWURF_CALLBACK_TARGET and ENTWURF_CALLBACK_NONCE from this process environment " +
+    "(injected by the launcher next to the identity scrub), validates garden-id and nonce " +
+    "grammar, and dispatches through the existing v2 runner with intent fire-and-forget, " +
+    "message=nonce, wants_reply=false. The target is re-resolved by record/decider — env " +
+    "names the id, it does not skip dispatch. REFUSES BY NAME when the pair is absent, " +
+    "malformed, or this process is a Codex-provenance bridge (window env never reaches that " +
+    "MCP child). No arguments, no fallback to a model-supplied target.", {}, async (_args, extra) => {
+    const read = readCallbackEnv(process.env);
+    if (!read.ok) {
+        return textErr(`entwurf_callback: ${read.reason}`);
+    }
+    try {
+        const sender = await buildSendSenderEnvelope({ requestMeta: extra._meta });
+        const rendered = await runAndRenderEntwurfV2FromSurface({
+            target: read.target,
+            intent: "fire-and-forget",
+            message: read.nonce,
+            wants_reply: false,
+        }, { senderProvider: () => sender });
+        return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
+    }
+    catch (err) {
+        return textErr(`entwurf_callback error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+});
 // ============================================================================
 // Main
 // ============================================================================

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/context.js

@@ -8,12 +8,16 @@
 //
 // S2c/S2d boundary (GPT S2c Q2): this is CONVERSATION TRANSCRIPT PASSTHROUGH, not
 // rich-carrier identity injection. Deliberately EXCLUDED here (all S2d):
-//   - `context.systemPrompt` — never read into the prompt or `_meta.systemPrompt`
+//   - the system prompt — never read into the prompt or `_meta.systemPrompt`
 //     (the billing carrier stays absent — NEXT §S2-scout 핀1);
 //   - `~/AGENTS.md` / cwd AGENTS / bridge identity narrative;
 //   - first-user-message augment + project-context de-dup;
-//   - `context.tools` — the ACP child tool surface is the S2b
+//   - the declared tool surface — the ACP child tool surface is the S2b
 //     `_meta.claudeCode.options` SSOT, never re-sent here.
+// Since pi 0.86 both of those ride a leading `role:"system"` message inside the
+// `TranscriptContext` (pi-ai `normalizeContext`) rather than their own `Context`
+// fields, so the exclusion is enforced by `renderMessage`'s explicit
+// `case "system"` below, not by simply not reading two fields.
 // Structured tool replay is also excluded: tool calls/results render as plain
 // transcript text, never as ACP tool invocations (the child runs its own tools).
 // MUST equal event-mapper.ts `LIFECYCLE_NOTICE_SIGNATURE` (the SSOT/producer).
@@ -69,13 +73,23 @@ function renderMessage(message) {
             const tag = message.isError ? "Tool error" : "Tool result";
             return text ? `${tag} (${message.toolName}): ${text}` : undefined;
         }
+        case "system":
+            // The never-forward-systemPrompt invariant, stated rather than inherited.
+            // Since pi 0.86 the system prompt and the declared tool surface arrive AS
+            // transcript messages (`normalizeContext`), so what used to be "we simply
+            // do not read `context.systemPrompt`" is now an active decision on every
+            // turn. `default` would already skip it; the explicit case exists so
+            // deleting it is a visible change and a new pi role cannot quietly start
+            // leaking the prompt into the ACP child's transcript.
+            return undefined;
         default:
             return undefined;
     }
 }
 /**
- * Flatten a pi Context into a single transcript string. Excludes
- * `context.systemPrompt` and `context.tools` by construction.
+ * Flatten a pi transcript into a single transcript string. Excludes the system
+ * prompt and the declared tool surface by construction — since 0.86 both ride
+ * the leading `role:"system"` message, which `renderMessage` drops explicitly.
  */
 export function contextTranscript(context) {
     const lines = [];
@@ -87,7 +101,7 @@ export function contextTranscript(context) {
     return lines.join("\n\n");
 }
 /**
- * Convert a pi Context into the ACP `prompt` array (a single text block holding
+ * Convert a pi transcript into the ACP `prompt` array (a single text block holding
  * the flattened transcript). Empty history yields an empty array — the caller
  * decides whether that is a hard error.
  */

package/mcp/entwurf-bridge/dist/pi-extensions/lib/callback-env.js

@@ -0,0 +1,68 @@
+/**
+ * Callback-env — the launch-computed pair that lets a fresh sibling call home
+ * without copying a garden id or nonce out of prose.
+ *
+ * WHY THIS FILE EXISTS. Until this seam, `composeFreshCallFraming` put
+ * `target=<caller gid>` and `message=<nonce>` into the first-turn prompt, and
+ * the sibling had to retype them into `entwurf_v2`. That is the one place in
+ * the garden Hard Rule 2 (record is the sole address axis) was violated: the
+ * transcript became the address carrier, and a model that dropped a `$` or a
+ * hex nibble produced a refused dispatch that looked like a flaky backend.
+ *
+ * WHAT TRAVELS. Two process-env names, injected by the launcher next to the
+ * identity scrub (`PI_SESSION_ID=` / `PI_AGENT_ID=`), never as a general env
+ * carrier. The no-arg `entwurf_callback` verb reads BOTH from its own process
+ * and refuses by name when they are absent, malformed, or this process is a
+ * Codex-provenance bridge (window env never reaches that MCP child — measured).
+ *
+ * This module does not dispatch. It parses, validates, and formats. Launchers
+ * and the verb share it so a drifted regex cannot inject what the verb rejects.
+ */
+import { SESSION_ID_RE } from "./session-id.js";
+export const CALLBACK_TARGET_ENV = "ENTWURF_CALLBACK_TARGET";
+export const CALLBACK_NONCE_ENV = "ENTWURF_CALLBACK_NONCE";
+/** Exactly what `mintNonce` emits (`fresh-call-composition.ts`): `mux-fresh-call-` + 12 random
+ *  bytes as hex. ONE minter, ONE grammar — both rails call the same `mintNonce`, so a second
+ *  accepted prefix would be a spelling no launcher produces and this leaf exists to refuse
+ *  exactly that. A gate fixture is an oracle and never a reason to widen the subject. */
+export const CALLBACK_NONCE_RE = /^mux-fresh-call-[0-9a-f]{24}$/;
+function parseCallbackPair(target, nonce) {
+    if (typeof target !== "string" || typeof nonce !== "string") {
+        return { ok: false, reason: "callback-env-malformed" };
+    }
+    if (!SESSION_ID_RE.test(target) || !CALLBACK_NONCE_RE.test(nonce)) {
+        return { ok: false, reason: "callback-env-malformed" };
+    }
+    return { ok: true, target, nonce };
+}
+/**
+ * Format the two `KEY=value` assignments a launcher injects. Throws rather than
+ * emitting a pair the verb would refuse — a launch that cannot name its caller
+ * must not open a window whose first action is a guaranteed reject.
+ */
+export function callbackEnvAssignments(params) {
+    const parsed = parseCallbackPair(params.target, params.nonce);
+    if (!parsed.ok) {
+        throw new Error(`callback-env: refusing to inject ${parsed.reason}`);
+    }
+    return [`${CALLBACK_TARGET_ENV}=${parsed.target}`, `${CALLBACK_NONCE_ENV}=${parsed.nonce}`];
+}
+/**
+ * Read the pair from a process environment. Codex provenance is a named refuse
+ * even when the pair is well-formed: that bridge is an app-server child, and a
+ * pane-injected value would be the wrong citizen's (or last-launch-wins).
+ *
+ * Both names absent → `callback-env-absent`. One present, or either failing
+ * grammar → `callback-env-malformed`. No fallback to a model-supplied target.
+ */
+export function readCallbackEnv(env = process.env) {
+    if (env.ENTWURF_BRIDGE_NATIVE_HOST?.trim() === "codex") {
+        return { ok: false, reason: "codex-callback-env-unsupported" };
+    }
+    const target = env[CALLBACK_TARGET_ENV];
+    const nonce = env[CALLBACK_NONCE_ENV];
+    if (target === undefined && nonce === undefined) {
+        return { ok: false, reason: "callback-env-absent" };
+    }
+    return parseCallbackPair(target, nonce);
+}