@junghanacs/entwurf 0.23.1 → 0.25.0

package/pi-extensions/entwurf-control.ts

@@ -78,9 +78,9 @@ import type {
 	ExtensionContext,
 	MessageRenderer,
 } from "@earendil-works/pi-coding-agent";
-import { getMarkdownTheme, type Theme } from "@earendil-works/pi-coding-agent";
-import { Box, type Component, Markdown, Spacer, Text } from "@earendil-works/pi-tui";
-import { ENTWURF_SENT_MESSAGE_TYPE } from "../protocol.js";
+import { getMarkdownTheme } from "@earendil-works/pi-coding-agent";
+import { Box, Markdown, Spacer, Text } from "@earendil-works/pi-tui";
+import { readCallbackEnv } from "./lib/callback-env.js";
 import {
 	type CompactionGuard,
 	compactionSendReject,
@@ -88,6 +88,7 @@ import {
 	noteCompactionBefore,
 	noteCompactionTerminal,
 } from "./lib/compaction-send-guard.js";
+import { sendReceiptBoundary } from "./lib/control-send-receipt.js";
 import { CONTROL_SOCKET_SUFFIX, controlSocketPathIn, defaultControlSocketDir } from "./lib/control-socket-path.js";
 import {
 	attachAcceptedSocketDisconnectPolicy,
@@ -111,15 +112,6 @@ const EMACS_AGENT_SOCKET_FLAG = "emacs-agent-socket";
 // comes from the `.js` leaf both runtime lanes can import.
 const ENTWURF_DIR = defaultControlSocketDir(os.homedir());
 const SESSION_MESSAGE_TYPE = "entwurf-message";
-// Sender-side UI marker. Layer B (ACP path) emits a CustomMessage with this
-// customType so the operator sees a first-class [entwurf sent →] box paired
-// with the receive-side [entwurf received ⟵] box. The provider-level context
-// filter in index.ts drops this customType before the LLM sees it — colocated
-// with the emitter so sessions without --entwurf-control are still protected.
-// There is no second emitter: the v1 native send path ("Layer A") that also drew
-// this box through renderSentMessage() was removed in the 0.12 cutover, and
-// renderSentMessage is now registered for exactly one customType (see
-// registerMessageRenderer below). Do not describe a native sender-side box.
 const SENDER_INFO_PATTERN = /<sender_info>[\s\S]*?<\/sender_info>/g;
 
 // ============================================================================
@@ -477,10 +469,12 @@ const renderSessionMessage: MessageRenderer = (message, { expanded }, theme) =>
 	//
 	// The label is "[entwurf received ⟵]" with a left-pointing arrow so the
 	// receiving operator immediately sees the directionality (this is an
-	// incoming message). The corresponding sender-side surface in
-	// mcp/entwurf-bridge/entwurf_v2 renders "[entwurf sent →]" — same
-	// transport, opposite arrows, no confusion about who-said-what when the
-	// transcript is read end-to-end.
+	// incoming message). There is no matching box on the sending side: the one
+	// that used to be described here had zero producers and was removed (#120 P3).
+	// A sender sees a TEXT receipt naming the acceptance boundary
+	// (`entwurf-v2-surface.ts`), which is the honest thing to show — a box would
+	// claim the message was rendered into someone's transcript, and only the
+	// receiver can say that.
 	//
 	// wants_reply defaults to false (etiquette marker, not protocol contract).
 	// We show the badge only when the sender explicitly set it true; an
@@ -522,124 +516,6 @@ const renderSessionMessage: MessageRenderer = (message, { expanded }, theme) =>
 	return box;
 };
 
-// Sender-side payload — what renderSentMessage needs to draw the [entwurf sent →]
-// box. Carried by the ACP path's CustomMessage `details` — the ONLY carrier since
-// the v1 native renderResult path was removed (0.12 cutover). All four envelope fields are intentionally
-// echoed in the box even though the sender is "this same session" — operators
-// reading a busy multi-session transcript should be able to verify at a glance
-// which 담당자 is on the wire (cwd) and which model identity (agentId) actually
-// signed the message, without scrolling up to find the session header.
-//
-// timestamp is captured at execute() / send-emit time, not at render time, so
-// re-renders (resize, expand toggle) keep showing the moment the message was
-// actually delivered rather than drifting forward to "now".
-//
-// wants_reply mirrors the receive-side etiquette badge. It stays optional because
-// the box is drawn from a CustomMessage whose `details` may predate the field; the
-// v1 `registerSessionTool` / `entwurfSendParameters` schema this note used to point
-// at is gone (0.12 cutover), so there is no native call site left to grow.
-interface SentBoxData {
-	to: string; // target sessionId
-	from?: string; // sender agentId, e.g. "entwurf/claude-opus-5"
-	cwd?: string; // sender cwd (raw, abbreviateHome applied at render)
-	timestamp?: string; // ISO 8601 UTC; rendered in KST
-	mode?: string; // "steer" | "follow_up" | string passed through
-	wants_reply?: boolean;
-	deliveredAs?: string; // RPC echo — surfaces when receiver remapped (e.g. queued as followUp)
-	body: string; // message text the operator sent
-}
-
-// Visual mirror of renderSessionMessage. Same Box / Markdown / theme tokens —
-// the two boxes must share the customMessageBg / customMessageLabel /
-// customMessageText surface so they are pixel-equivalent in any theme. The
-// only deliberate visual differences are:
-//   - label: [entwurf sent →]   vs  [entwurf received ⟵]
-//   - "to:" leads, "from:" follows  vs  "from:" only
-//   - mode: line                  (no equivalent on receive side — receiver
-//                                   doesn't see how the sender queued it)
-//
-// `expanded` truncates the body the same way as renderSessionMessage so a
-// large send shows the same preview shape as a large receive. operators
-// reading the transcript should not need different mental models.
-// Return type is `Component`, the interface `MessageRenderer` actually asks for
-// (`Component | undefined`, read at pi-coding-agent
-// `dist/core/extensions/types.d.ts:889`) — NOT the concrete `Container`.
-// `[측정 2026-09-06]` pi 0.85.0's mouse work gave `Container` a `private mouseLayout?`
-// (`pi-tui dist/tui.d.ts:198`; 0.84.4's `Container` had no private member at all), and
-// `Box` declares a SEPARATE private `mouseLayout` of its own. TypeScript only accepts a
-// private member from the same declaration, so the structural assignment `Box -> Container`
-// that held through 0.84.4 became TS2322 at 0.85.x. This was an UNDECLARED break — the
-// upstream Breaking section names only `createGatewayBindingFetch`. Annotating the shared
-// interface is the honest fix: nothing here ever needed Container's own surface.
-const buildSentMessageBox = (data: SentBoxData, expanded: boolean, theme: Theme): Component => {
-	let body = data.body || "(no content)";
-	if (!expanded) {
-		const lines = body.split("\n");
-		if (lines.length > 5) {
-			body = `${lines.slice(0, 5).join("\n")}\n...`;
-		}
-	}
-
-	const box = new Box(1, 1, (t) => theme.bg("customMessageBg", t));
-	const labelBase = theme.fg("customMessageLabel", `\x1b[1m[entwurf sent →]\x1b[22m`);
-
-	// Header line: label + KST + optional (wants reply) badge — matches the
-	// receive-side header layout 1:1.
-	const kst = formatTimestampKst(data.timestamp) ?? "(unknown time)";
-	const replyBadge = data.wants_reply === true ? "  (wants reply)" : "";
-	const headerLine = `${labelBase} ${theme.fg("dim", `${kst}${replyBadge}`)}`;
-	box.addChild(new Text(headerLine, 0, 0));
-
-	// to: <sessionId>  — target peer
-	box.addChild(new Text(theme.fg("dim", `to:   ${data.to || "(unknown sessionId)"}`), 0, 0));
-
-	// from: <agentId> @ <cwd>  — self identity. Shown even though it's "us"
-	// because in a multi-session human-greeted topology the operator is
-	// switching between several pi sessions and needs to confirm which one
-	// signed this send.
-	const fromAgent = data.from ?? "(unknown agent)";
-	const fromCwd = data.cwd ? abbreviateHome(data.cwd) : "(unknown cwd)";
-	box.addChild(new Text(theme.fg("dim", `from: ${fromAgent} @ ${fromCwd}`), 0, 0));
-
-	// mode: <mode>[ → deliveredAs]  — show RPC remap when it differs from
-	// what the caller asked for (e.g. caller said "steer" but receiver was
-	// idle so it became a direct prompt). Silent when they agree.
-	if (data.mode) {
-		const remap = data.deliveredAs && data.deliveredAs !== data.mode ? theme.fg("muted", ` → ${data.deliveredAs}`) : "";
-		box.addChild(new Text(theme.fg("dim", `mode: ${data.mode}${remap}`), 0, 0));
-	}
-
-	box.addChild(new Spacer(1));
-	box.addChild(
-		new Markdown(body, 0, 0, getMarkdownTheme(), {
-			color: (value: string) => theme.fg("customMessageText", value),
-		}),
-	);
-	return box;
-};
-
-// CustomMessageRenderer adapter for Layer B (ACP path). The CustomMessage
-// carries the SentBoxData under `details` (set by index.ts streamShellAcp
-// when a completed mcp__entwurf-bridge__entwurf_v2 is observed). `content`
-// holds the raw message body too, but we prefer details.body because the
-// content channel may have been routed through string-only persistence and
-// trimmed.
-const renderSentMessage: MessageRenderer = (message, { expanded }, theme) => {
-	const details = (message.details ?? {}) as Partial<SentBoxData>;
-	const fallbackBody = extractTextContent(message.content);
-	const data: SentBoxData = {
-		to: details.to ?? "(unknown sessionId)",
-		from: details.from,
-		cwd: details.cwd,
-		timestamp: details.timestamp,
-		mode: details.mode,
-		wants_reply: details.wants_reply,
-		deliveredAs: details.deliveredAs,
-		body: details.body ?? fallbackBody,
-	};
-	return buildSentMessageBox(data, expanded, theme);
-};
-
 // ============================================================================
 // Command Handlers
 // ============================================================================
@@ -823,9 +699,17 @@ async function handleCommand(
 			return;
 		}
 
+		// #120 P2: the receiver reports the BOUNDARY it actually observed — `sent` for an idle
+		// direct trigger, `queued-steer` / `queued-follow-up` for the two in-process queues — and
+		// nothing else. The bare `delivered:true` that used to lead this payload is GONE rather
+		// than kept for compatibility: it was equally true of all three states and therefore said
+		// nothing, which is the bare `delivered` DELIVERY.md refuses by name. The `deliveredAs`
+		// beside it had no consumer at all. Skew is safe in both directions without a translator —
+		// an old sender keys on `response.success` and never reads `data`, and a new sender reads
+		// an old receiver's payload as `accepted-unknown-boundary`, the honest name for an
+		// acceptance it cannot classify.
 		respond(true, "send", {
-			delivered: true,
-			deliveredAs: isIdle ? "direct" : mode === "follow_up" ? "followUp" : "steer",
+			boundary: sendReceiptBoundary({ idle: isIdle, mode }),
 			wants_reply: wantsReply,
 		});
 		return;
@@ -1103,21 +987,11 @@ export default function (pi: ExtensionAPI) {
 	};
 
 	pi.registerMessageRenderer(SESSION_MESSAGE_TYPE, renderSessionMessage);
-	// Layer B (ACP path) sender-side UI box. Registered unconditionally because
-	// renderer registration happens at extension load, BEFORE we know whether
-	// this session ends up with a routable identity: `updateSessionEnv` only
-	// publishes PI_SESSION_ID once a garden id exists, and clears it otherwise.
-	// A session without `--entwurf-control` therefore does NOT send — a bundled
-	// `entwurf_v2` sender call there fails loud on the missing envelope (the
-	// documented provider-vs-citizen boundary), and this renderer simply never
-	// fires. Registering it up front keeps one registration path instead of a
-	// conditional seam, and guarantees the [entwurf sent →] box exists for every
-	// session that DOES send.
-	pi.registerMessageRenderer(ENTWURF_SENT_MESSAGE_TYPE, renderSentMessage);
 
 	if (shouldRegisterControlTools(pi)) {
 		registerListSessionsTool(pi);
 		registerEntwurfV2Tool(pi);
+		registerCallbackTool(pi);
 		registerFreshCallTool(pi);
 		registerResumeCallTool(pi);
 	}
@@ -1385,7 +1259,7 @@ function registerEntwurfV2Tool(pi: ExtensionAPI): void {
 		mode: Type.Optional(
 			StringEnum(["steer", "follow_up"] as const, {
 				description:
-					"Injection style for a CONTROL-SOCKET send only: steer (immediate) or follow_up (after task). " +
+					"Injection style for a CONTROL-SOCKET send only: steer (ask the receiver's steering queue) or follow_up (ask its follow-up queue). NEITHER is an interrupt: a busy receiver drains steering after each turn and follow-ups only when its inner loop ends, so a later steer overtakes every earlier follow_up and there is no order between the two. Both queues are volatile process memory — an abort drops what is in them. The receipt names which queue accepted the message (`queued-steer` / `queued-follow-up`); an idle receiver answers `sent`, meaning the turn was TRIGGERED, not that the model has seen the text. " +
 					"The mailbox and native-push plans carry no mode, so it has no effect on those rails.",
 			}),
 		),
@@ -1413,9 +1287,11 @@ function registerEntwurfV2Tool(pi: ExtensionAPI): void {
 		description: `CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id alone
 does not say which rail that citizen answers on. Give target + intent; the decider picks transport from
 liveness (live socket citizen → control-socket send; deliverable self-fetch citizen → meta-bridge mailbox;
-probe-alive native-push citizen → direct injection into its conversation) and reports ONE outcome
-(delivered / rejected / delivered-but-lock-dirty). EXISTING targets only; discover with entwurf_peers.
-A peer entwurf_peers shows as liveness=alive → fire-and-forget. A citizen with NO socket liveness
+probe-alive native-push citizen → direct injection into its conversation) and reports ONE outcome, per rail: a control
+receiver's acceptance boundary ("sent" / "queued-steer" / "queued-follow-up" /
+"accepted-unknown-boundary" — those four only), a mailbox ENQUEUE receipt, a native-push INJECTION,
+a rejection, or lock-dirty. EXISTING targets only (see entwurf_peers).
+A peer shown as liveness=alive → fire-and-forget. A citizen with NO socket liveness
 (liveness=unsupported) is ALSO fire-and-forget — unsupported means only "no control-socket probe" — and the
 decider picks its own rail: a self-fetch backend (e.g. Claude Code) gets the mailbox, a native-push backend
 (e.g. Antigravity) gets direct injection and has NO mailbox at all. THERE IS A THIRD RESULT: the mailbox
@@ -1424,9 +1300,8 @@ rather than queued for an inbox nobody drains. The native-push probe is 3-valued
 alive → injected; dead → native-push-target-dead; indeterminate → native-push-probe-indeterminate
 (unestablished ≠ gone). DORMANT IS UNREACHABLE: a socket-domain citizen that is not running gets
 dormant-fire-forget-unsupported — same receiver rule as the mailbox, no active drainer means no
-delivery. The intent that used to answer there, owned-outcome, resumed it by
-launching a hidden background child; it was withdrawn under the visible-first rule, so re-open the session
-yourself and dispatch again. LOCK: taken for a control-socket-DOMAIN dispatch. The mailbox and native-push
+delivery. The intent that used to answer there, owned-outcome, was withdrawn
+under the visible-first rule — re-open the session yourself and dispatch again. LOCK: taken for a control-socket-DOMAIN dispatch. The mailbox and native-push
 rails are lock-free — deliverability and the adapter probe guard them. mode applies to a CONTROL-SOCKET
 send only; other plans carry no mode. wants_reply rides every rail. message caps at 16000 chars; send an
 artifact path + digest for more.`,
@@ -1740,6 +1615,60 @@ interface VisibleResumeModule {
 	renderVisibleResume(result: { ok: boolean }): { text: string; isError: boolean };
 }
 
+function registerCallbackTool(pi: ExtensionAPI): void {
+	const registerTool = pi.registerTool as (def: any) => void;
+	registerTool({
+		name: "entwurf_callback",
+		label: "Fresh Callback",
+		description: `ZERO-ARGUMENT callback for a fresh sibling this process was launched as. Reads ENTWURF_CALLBACK_TARGET and ENTWURF_CALLBACK_NONCE from this process environment (injected by the launcher next to the identity scrub), validates garden-id and nonce grammar, and dispatches through the existing v2 runner with intent fire-and-forget, message=nonce, wants_reply=false. The target is re-resolved by record/decider. REFUSES BY NAME when the pair is absent, malformed, or this process is a Codex-provenance bridge. No arguments, no fallback to a model-supplied target.`,
+		parameters: Type.Object({}),
+		async execute(
+			_toolCallId: string,
+			_params: Record<string, never>,
+			_signal: AbortSignal | undefined,
+			_onUpdate: unknown,
+			ctx: ExtensionContext,
+		) {
+			const read = readCallbackEnv(process.env);
+			if (!read.ok) {
+				return {
+					content: [{ type: "text", text: `entwurf_callback: ${read.reason}` }],
+					isError: true,
+				};
+			}
+			try {
+				const selfMod = (await import(ENTWURF_SELF_ADDRESS_MODULE)) as unknown as EntwurfSelfAddressModule;
+				const senderProvider = (): SenderEnvelope | undefined => {
+					const s = buildLocalSenderEnvelope(ctx);
+					return s ? decoratePiSenderAddressability(s, selfMod.computeSelfAddressability) : undefined;
+				};
+				const mod = (await import(ENTWURF_V2_SURFACE_MODULE)) as unknown as EntwurfV2SurfaceModule;
+				const rendered = await mod.runAndRenderEntwurfV2FromSurface(
+					{
+						target: read.target,
+						intent: "fire-and-forget",
+						message: read.nonce,
+						wants_reply: false,
+					},
+					{ senderProvider },
+				);
+				return {
+					content: [{ type: "text", text: rendered.text }],
+					isError: rendered.isError,
+					details: { isError: rendered.isError },
+				};
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err);
+				return {
+					content: [{ type: "text", text: `entwurf_callback error: ${msg}` }],
+					isError: true,
+					details: { error: msg },
+				};
+			}
+		},
+	});
+}
+
 /**
  * Unlike `entwurf_fresh_call`, this tool needs NO caller identity: a resume names an existing
  * citizen, so the address is the parameter rather than something the sibling has to report back.

package/pi-extensions/lib/acp/backend.ts

@@ -44,8 +44,8 @@ import { type ChildProcessByStdio, spawn } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { Readable, Writable } from "node:stream";
 import { ndJsonStream, PROTOCOL_VERSION } from "@agentclientprotocol/sdk";
-import type { Api, AssistantMessage, Context, Model, SimpleStreamOptions } from "@earendil-works/pi-ai";
-import { createAssistantMessageEventStream } from "@earendil-works/pi-ai";
+import type { Api, AssistantMessage, Model, SimpleStreamOptions, TranscriptContext } from "@earendil-works/pi-ai";
+import { createAssistantMessageEventStream, getCurrentTools } from "@earendil-works/pi-ai";
 import {
 	type AcpClientHandlers,
 	type AcpConnectionLike,
@@ -81,7 +81,7 @@ import {
 	resolveLifecyclePolicy,
 	writeSessionRecord,
 } from "./session-store.js";
-import { assertExcludeToolsHonored, PI_BUILTIN_BACKED_TOOLS } from "./tool-surface.js";
+import { assertExcludeToolsHonored } from "./tool-surface.js";
 
 // Bootstrap boundaries ONLY. initialize / newSession / set-model are handshake
 // steps that make no model progress, so a stuck one is a dead session and a cold
@@ -1108,7 +1108,7 @@ async function applyProviderPayloadHook<T extends { sessionId: string }>(
  */
 export function streamShellAcp(
 	model: Model<Api>,
-	context: Context,
+	context: TranscriptContext,
 	options?: SimpleStreamOptions,
 ): ReturnType<typeof createAssistantMessageEventStream> {
 	return streamAcpTurn(model, context, options, defaultDeps());
@@ -1117,7 +1117,7 @@ export function streamShellAcp(
 /** The seam-aware turn driver. `streamShellAcp` calls this with the real deps. */
 export function streamAcpTurn(
 	model: Model<Api>,
-	context: Context,
+	context: TranscriptContext,
 	options: SimpleStreamOptions | undefined,
 	deps: AcpTurnDeps,
 ): ReturnType<typeof createAssistantMessageEventStream> {
@@ -1510,7 +1510,17 @@ export function streamAcpTurn(
 		// rather than lie to the model. Uses the RESOLVED tool surface (S2g) so an
 		// operator-narrowed `tools` is what the truthfulness check honors.
 		try {
-			const activeToolNames = context.tools?.map((t) => t.name) ?? [...PI_BUILTIN_BACKED_TOOLS];
+			// pi 0.86 folded `Context.systemPrompt`/`Context.tools` into a leading
+			// `role:"system"` message (`normalizeContext`, pi-ai
+			// `utils/transcript.ts`), so a provider only ever sees a
+			// `TranscriptContext`. The active surface is therefore REPLAYED from the
+			// system messages — `getCurrentTools` applies every toolsAdded/toolsRemoved
+			// delta in order. No `?? [...PI_BUILTIN_BACKED_TOOLS]` fallback: under 0.86
+			// the old `context.tools` read was ALWAYS undefined, so that fallback
+			// silently declared the full builtin set and the truthfulness preflight
+			// could never fire (false green). An empty replayed list means the operator
+			// excluded everything — keep that honest and let the preflight reject.
+			const activeToolNames = getCurrentTools(context.messages).map((t) => t.name);
 			assertExcludeToolsHonored(activeToolNames, { backend: adapter.backend, tools: config.tools });
 		} catch (err) {
 			finishError(err, false);

package/pi-extensions/lib/acp/context.ts

@@ -8,16 +8,26 @@
 //
 // S2c/S2d boundary (GPT S2c Q2): this is CONVERSATION TRANSCRIPT PASSTHROUGH, not
 // rich-carrier identity injection. Deliberately EXCLUDED here (all S2d):
-//   - `context.systemPrompt` — never read into the prompt or `_meta.systemPrompt`
+//   - the system prompt — never read into the prompt or `_meta.systemPrompt`
 //     (the billing carrier stays absent — NEXT §S2-scout 핀1);
 //   - `~/AGENTS.md` / cwd AGENTS / bridge identity narrative;
 //   - first-user-message augment + project-context de-dup;
-//   - `context.tools` — the ACP child tool surface is the S2b
+//   - the declared tool surface — the ACP child tool surface is the S2b
 //     `_meta.claudeCode.options` SSOT, never re-sent here.
+// Since pi 0.86 both of those ride a leading `role:"system"` message inside the
+// `TranscriptContext` (pi-ai `normalizeContext`) rather than their own `Context`
+// fields, so the exclusion is enforced by `renderMessage`'s explicit
+// `case "system"` below, not by simply not reading two fields.
 // Structured tool replay is also excluded: tool calls/results render as plain
 // transcript text, never as ACP tool invocations (the child runs its own tools).
 
-import type { AssistantMessage, Context, Message, ToolResultMessage, UserMessage } from "@earendil-works/pi-ai";
+import type {
+	AssistantMessage,
+	Message,
+	ToolResultMessage,
+	TranscriptContext,
+	UserMessage,
+} from "@earendil-works/pi-ai";
 
 // MUST equal event-mapper.ts `LIFECYCLE_NOTICE_SIGNATURE` (the SSOT/producer).
 // It is mirrored, not imported: the strip-types deterministic gates load these
@@ -80,16 +90,26 @@ function renderMessage(message: Message): string | undefined {
 			const tag = message.isError ? "Tool error" : "Tool result";
 			return text ? `${tag} (${message.toolName}): ${text}` : undefined;
 		}
+		case "system":
+			// The never-forward-systemPrompt invariant, stated rather than inherited.
+			// Since pi 0.86 the system prompt and the declared tool surface arrive AS
+			// transcript messages (`normalizeContext`), so what used to be "we simply
+			// do not read `context.systemPrompt`" is now an active decision on every
+			// turn. `default` would already skip it; the explicit case exists so
+			// deleting it is a visible change and a new pi role cannot quietly start
+			// leaking the prompt into the ACP child's transcript.
+			return undefined;
 		default:
 			return undefined;
 	}
 }
 
 /**
- * Flatten a pi Context into a single transcript string. Excludes
- * `context.systemPrompt` and `context.tools` by construction.
+ * Flatten a pi transcript into a single transcript string. Excludes the system
+ * prompt and the declared tool surface by construction — since 0.86 both ride
+ * the leading `role:"system"` message, which `renderMessage` drops explicitly.
  */
-export function contextTranscript(context: Context): string {
+export function contextTranscript(context: TranscriptContext): string {
 	const lines: string[] = [];
 	for (const message of context.messages) {
 		const line = renderMessage(message);
@@ -99,11 +119,11 @@ export function contextTranscript(context: Context): string {
 }
 
 /**
- * Convert a pi Context into the ACP `prompt` array (a single text block holding
+ * Convert a pi transcript into the ACP `prompt` array (a single text block holding
  * the flattened transcript). Empty history yields an empty array — the caller
  * decides whether that is a hard error.
  */
-export function contextToAcpPrompt(context: Context): AcpTextBlock[] {
+export function contextToAcpPrompt(context: TranscriptContext): AcpTextBlock[] {
 	const transcript = contextTranscript(context);
 	if (!transcript) return [];
 	return [{ type: "text", text: transcript }];
@@ -129,7 +149,7 @@ export type AcpBootstrapPath = "new" | "reuse" | "resume" | "load";
  * (reuse/resume/load): re-sending the whole transcript there would duplicate
  * history the backend already remembers.
  */
-export function latestUserDelta(context: Context): AcpTextBlock[] {
+export function latestUserDelta(context: TranscriptContext): AcpTextBlock[] {
 	let lastAssistantIdx = -1;
 	for (let i = context.messages.length - 1; i >= 0; i--) {
 		if (context.messages[i].role === "assistant") {
@@ -160,7 +180,7 @@ export function latestUserDelta(context: Context): AcpTextBlock[] {
  * `contextMessageSignatures` prefix-compat gate (mismatch → fall back to
  * `"new"` + full transcript); this pure function only splits the scope.
  */
-export function buildAcpPrompt(context: Context, bootstrapPath: AcpBootstrapPath): AcpTextBlock[] {
+export function buildAcpPrompt(context: TranscriptContext, bootstrapPath: AcpBootstrapPath): AcpTextBlock[] {
 	switch (bootstrapPath) {
 		case "new":
 			return contextToAcpPrompt(context);

package/pi-extensions/lib/acp/session-store.ts

@@ -27,7 +27,7 @@ import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-import type { Context, Message, ToolResultMessage } from "@earendil-works/pi-ai";
+import type { Message, ToolResultMessage, TranscriptContext } from "@earendil-works/pi-ai";
 import type { AcpBootstrapPath } from "./context.js";
 
 // MUST equal event-mapper.ts `LIFECYCLE_NOTICE_SIGNATURE` (the SSOT/producer).
@@ -236,7 +236,7 @@ function rawMessageSignature(message: Message): string {
  * record never stores raw prompt/tool text — the prefix check works the same on
  * the digest array (GPT `c617cb` hardening).
  */
-export function contextMessageSignatures(context: Context): string[] {
+export function contextMessageSignatures(context: TranscriptContext): string[] {
 	return context.messages.map((m: Message) => sha256(rawMessageSignature(m)));
 }
 

package/pi-extensions/lib/callback-env.ts

@@ -0,0 +1,78 @@
+/**
+ * Callback-env — the launch-computed pair that lets a fresh sibling call home
+ * without copying a garden id or nonce out of prose.
+ *
+ * WHY THIS FILE EXISTS. Until this seam, `composeFreshCallFraming` put
+ * `target=<caller gid>` and `message=<nonce>` into the first-turn prompt, and
+ * the sibling had to retype them into `entwurf_v2`. That is the one place in
+ * the garden Hard Rule 2 (record is the sole address axis) was violated: the
+ * transcript became the address carrier, and a model that dropped a `$` or a
+ * hex nibble produced a refused dispatch that looked like a flaky backend.
+ *
+ * WHAT TRAVELS. Two process-env names, injected by the launcher next to the
+ * identity scrub (`PI_SESSION_ID=` / `PI_AGENT_ID=`), never as a general env
+ * carrier. The no-arg `entwurf_callback` verb reads BOTH from its own process
+ * and refuses by name when they are absent, malformed, or this process is a
+ * Codex-provenance bridge (window env never reaches that MCP child — measured).
+ *
+ * This module does not dispatch. It parses, validates, and formats. Launchers
+ * and the verb share it so a drifted regex cannot inject what the verb rejects.
+ */
+
+import { SESSION_ID_RE } from "./session-id.js";
+
+export const CALLBACK_TARGET_ENV = "ENTWURF_CALLBACK_TARGET";
+export const CALLBACK_NONCE_ENV = "ENTWURF_CALLBACK_NONCE";
+
+/** Exactly what `mintNonce` emits (`fresh-call-composition.ts`): `mux-fresh-call-` + 12 random
+ *  bytes as hex. ONE minter, ONE grammar — both rails call the same `mintNonce`, so a second
+ *  accepted prefix would be a spelling no launcher produces and this leaf exists to refuse
+ *  exactly that. A gate fixture is an oracle and never a reason to widen the subject. */
+export const CALLBACK_NONCE_RE = /^mux-fresh-call-[0-9a-f]{24}$/;
+
+export type CallbackEnvReject = "callback-env-absent" | "callback-env-malformed" | "codex-callback-env-unsupported";
+
+export type CallbackEnvRead = { ok: true; target: string; nonce: string } | { ok: false; reason: CallbackEnvReject };
+
+function parseCallbackPair(target: unknown, nonce: unknown): CallbackEnvRead {
+	if (typeof target !== "string" || typeof nonce !== "string") {
+		return { ok: false, reason: "callback-env-malformed" };
+	}
+	if (!SESSION_ID_RE.test(target) || !CALLBACK_NONCE_RE.test(nonce)) {
+		return { ok: false, reason: "callback-env-malformed" };
+	}
+	return { ok: true, target, nonce };
+}
+
+/**
+ * Format the two `KEY=value` assignments a launcher injects. Throws rather than
+ * emitting a pair the verb would refuse — a launch that cannot name its caller
+ * must not open a window whose first action is a guaranteed reject.
+ */
+export function callbackEnvAssignments(params: { target: string; nonce: string }): readonly [string, string] {
+	const parsed = parseCallbackPair(params.target, params.nonce);
+	if (!parsed.ok) {
+		throw new Error(`callback-env: refusing to inject ${parsed.reason}`);
+	}
+	return [`${CALLBACK_TARGET_ENV}=${parsed.target}`, `${CALLBACK_NONCE_ENV}=${parsed.nonce}`];
+}
+
+/**
+ * Read the pair from a process environment. Codex provenance is a named refuse
+ * even when the pair is well-formed: that bridge is an app-server child, and a
+ * pane-injected value would be the wrong citizen's (or last-launch-wins).
+ *
+ * Both names absent → `callback-env-absent`. One present, or either failing
+ * grammar → `callback-env-malformed`. No fallback to a model-supplied target.
+ */
+export function readCallbackEnv(env: NodeJS.ProcessEnv = process.env): CallbackEnvRead {
+	if (env.ENTWURF_BRIDGE_NATIVE_HOST?.trim() === "codex") {
+		return { ok: false, reason: "codex-callback-env-unsupported" };
+	}
+	const target = env[CALLBACK_TARGET_ENV];
+	const nonce = env[CALLBACK_NONCE_ENV];
+	if (target === undefined && nonce === undefined) {
+		return { ok: false, reason: "callback-env-absent" };
+	}
+	return parseCallbackPair(target, nonce);
+}

package/pi-extensions/lib/compaction-send-guard.ts

@@ -1,7 +1,12 @@
 /**
  * compaction-send-guard — whether a control-socket `send` may call `pi.sendMessage`.
  *
- * Pi 0.85.1 has no public `ExtensionContext.isCompacting()`. Compaction is non-idle
+ * Pi has no public `ExtensionContext.isCompacting()`. `[측정 2026-09-20, pi 0.86.0]` and
+ * re-measured `[측정 2026-09-22, pi 0.87.0]` and `[측정 2026-09-23, pi 0.87.1]`: the installed
+ * `dist/core/extensions/types.d.ts` declares `isIdle(): boolean` at :233 and `signal` at :237 —
+ * the SAME coordinates at all three floors — and carries no `isCompacting` member at all (grep
+ * count 0, re-counted on 0.87.1); the identifier exists
+ * only inside the interactive/rpc modes' own bundles). Compaction is non-idle
  * (`AgentSession.isIdle` = no agent run AND not compacting) but `sendCustomMessage`
  * does not refuse it. A non-streaming `triggerTurn:true` send starts `_runAgentPrompt`
  * while `compact()` is rewriting the session tree — the field path that can make