@junghanacs/entwurf 0.30.0 → 0.31.0

package/docs/acp-backend-rail.md

@@ -48,6 +48,7 @@ Source of truth: `pi-extensions/lib/acp/backend-adapter.ts`.
 | `buildSessionMeta` | Build optional `newSession._meta` from the already-loaded carrier. |
 | `enforceModel` | Make the requested native model authoritative before the prompt. |
 | `configSignatureFields` | Return a stable primitive map whose changes invalidate reuse. |
+| `readPromptRejection?` | Name a backend-owned typed prompt rejection and its fixed app-policy verdict; absent means the existing verbatim-first failure path. |
 
 `backend.ts` resolves the adapter once at turn entry. Common config never branches on
 backend-specific keys; `adapterSettings` remains opaque until handed back to its owner.
@@ -85,21 +86,58 @@ turned one long turn into four in 0.13.0. Gates: `check-acp-prompt-lifecycle` (b
 with pi's own classifier as the oracle), `check-probe-ordering` (no production prompt
 cutoff in source).
 
+### Typed Claude prompt rejection — no automatic whole-prompt replay (#127)
+
+Claude ACP 0.85.1 can reject a prompt with the wire SDK's `RequestError`, code `-32603`,
+`data.errorKind === "incomplete_tool_call"`, after marking unfinished foreground tools
+failed. Some tools may already have run. This is an RPC failure, not a successful
+`stopReason`, and a failed tool notification alone is not a turn settlement. The code
+is JSON-RPC's internal error; the kind is Claude's extension vocabulary, not a standard
+retry permission. AIR session-failure metadata remains capability-gated off by
+`clientCapabilities: {}`.
+
+Only the Claude adapter declares `readPromptRejection`. The common loop passes the
+once-resolved adapter at the two prompt catches, not at bootstrap failures, and skips
+this reader when the operator's abort wins. A recognized rejection seals once as
+`error/error`, drops the new or reused session under the existing policy, and sets a
+fixed semantic `errorMessage` which pi's real retry **and** overflow classifiers must
+reject. No global retry disable, substring sanitizer, or new failure ledger is added.
+
+The first raw failure remains in pi's existing `AssistantMessage.diagnostics`: original
+name/message/stack/code, serialized data, and applicable stderr tail, lifecycle, launch
+signal and overflow hint. None is remixed into the semantic verdict. Actual wire data
+is parsed JSON; a hand-built non-wire value that cannot serialize gets an explicit
+unserializable marker rather than escaping before the stream seal. Assistant content,
+context replay and reuse signatures remain unchanged; persisted message JSON gains
+these diagnostics. Cortex, other error kinds/codes, preprompt failures and aborts keep
+the existing path. No warm reuse after this failure is newly claimed.
+
+`check-acp-vendor-rejection` owns the source-adjacent adapter/pipeline assertions and
+four defect mutants. Its real classifier oracles, raw positive controls, failed-tool
+ordering, exact-once seal/drop, raw evidence and separate cooperative-cancel cells do
+not certify a real vendor runtime. Target closure installation, focused receipts,
+qualification, full floor and LIVE compatibility remain separate in the
+[#127 thread](https://github.com/junghan0611/entwurf/issues/127).
+
 ## Support contract (#81)
 
 What "supported" means here, per declaration class. The classes are kept apart on purpose: one
 undifferentiated "supported" column is what let a Claude PASS read as if it also certified Cortex.
 The rows are THIS checkout's declarations, not a shipped release: what a published version carried
 is that version's CHANGELOG entry, and a candidate's own evidence is its issue thread, LIVE receipts
-and exact-SHA CI (#125 for the Pi 1.0 candidate).
+and exact-SHA CI. The pi row shipped in 0.30.0 (#125). The ACP wire SDK, Claude adapter and Claude
+Agent SDK rows are the unpublished #127 candidate: published 0.30.0 still declares
+`claude-agent-acp 0.79.0` and `@agentclientprotocol/sdk 1.4.0`
+(`[측정 2026-10-04]` `npm view @junghanacs/entwurf@0.30.0`; per-bump record in the ROADMAP Dep bump
+ledger, 2026-10-03).
 
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
 | Entwurf package | `package.json` `version` | checkout declaration, not a release receipt | names the package label these rows sit beside; whether that label shipped, and with which rows, is CHANGELOG's record |
-| pi runtime | devDep exact `1.0.0`, peer `>=1.0.0 <1.1` | **exact** oracle + **closed range** | the source pin this checkout builds and gates against; hosts inside the range are accepted, and the ceiling moves only on measurement. Its 1.0.0 evidence is #125's branch receipts, not a shipped release |
-| ACP wire SDK | `@agentclientprotocol/sdk 1.4.0` | **exact** | the shared wire oracle both adapters speak |
-| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.79.0` | **exact**, bundled | the adapter we ship and certify; resolved before any PATH fallback |
-| Claude Agent SDK | `0.3.274` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
+| pi runtime | devDep exact `1.0.2`, peer `>=1.0.2 <1.1` | **exact** oracle + **closed range** | the source pin this checkout builds and gates against; hosts inside the range are accepted, and the ceiling moves only on measurement. Unshipped candidate floor: the published 0.30.0 and 0.30.1 declare floor 1.0.0 with the same next-minor ceiling (`[측정 2026-10-05]` `npm view @junghanacs/entwurf@0.30.1 peerDependencies`; acceptance record CHANGELOG 0.30.0, #125 branch evidence). The 1.0.2 move and its receipts are ROADMAP's 2026-10-05 bump entry |
+| ACP wire SDK | `@agentclientprotocol/sdk 1.6.0` | **exact** | the shared wire oracle both adapters speak |
+| Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.85.1` | **exact**, bundled | checkout candidate; resolved before any PATH fallback; declaration is not compatibility evidence |
+| Claude Agent SDK | `0.3.286` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |
 | Anthropic SDK | `0.100.1` | **exact**, peer-resolution only | satisfies the Agent SDK peer floor (0.93.0+); never an API client here (gate L4) |
 | Claude Code runtime | `>=2.1.217` (`entwurf.claudeCodeFloor`) | **floor** | below it, hook args are silently dropped; entwurf enforces this itself |
 | Node | `>=24` (`engines.node`) | **floor** | single axis, derived everywhere else |
@@ -181,7 +219,7 @@ different reasons, and collapsing them would hide a real risk**:
   imported nowhere: `[측정 2026-09-18]` `git grep -c` over `pi-extensions/`, `test/`, `scripts/`,
   `mcp/` is **0**. We never imported the adapter as a library at all — we spawn its binary.
 - **0.77.0's `allowDangerouslySkipPermissions` opt-out is a new lever we deliberately do not
-  pull, and our effective permission mode is unchanged.** 0.76.0 sent
+  pull, and at 0.79.0 our effective permission mode was unchanged.** 0.76.0 sent
   `allowDangerouslySkipPermissions: ALLOW_BYPASS` unconditionally and computed
   `initialPermissionMode = creationOpts.permissionMode ?? resolvePermissionMode(settings…)`.
   0.79.0 computes `allowBypass = ALLOW_BYPASS && sessionMeta?.claudeCode?.options?.allowDangerouslySkipPermissions !== false`
@@ -192,7 +230,9 @@ different reasons, and collapsing them would hide a real risk**:
   versions (`dist/permissions/modes.js` 직독). Our overlay pins
   `permissions.defaultMode: "bypassPermissions"` (`overlay.ts:122`), which resolves the same
   under both. The lever now EXISTS for a host that wants a non-bypass sibling; declaring it is a
-  separate axis, not a one-line flip, and nothing in this bump takes it.
+  separate axis, not a one-line flip, and nothing in this bump takes it. That is the 0.79.0
+  measurement; at 0.85.1 project or managed settings can drop bypass (the 0.79.0 → 0.85.1 entry
+  below).
 - **0.77.0's system-reminder strip never touches our first-user-message augment.**
   `INJECTED_CONTEXT_MARKERS = ["system-reminder"]` joins the local-command markers in
   `stripMarkerTags`, and `stripLocalCommandMetadata` has exactly two call sites
@@ -247,6 +287,51 @@ different reasons, and collapsing them would hide a real risk**:
   is byte-identical (`md5 cfd031d0…` both versions). The `settings`-as-STRING-PATH branch our
   call-site contract names is still on the unconditional `session/new` path
   (`dist/acp-agent.js:6010-6012`).
+- **0.79.0 → 0.85.1 (#127) is a source classification, not a runtime certification.**
+  `[측정 2026-10-03, tag v0.85.1 = 686c0c99, src and dist read directly; nothing executed]`.
+  Coordinates and evidence classes are in the ROADMAP Dep bump entry for 2026-10-03. The typed
+  rejection above is the only failure-policy change Entwurf wrote for this bump. The reachable
+  upstream changes below are classified, not new Entwurf contracts:
+  - **Permission mode is conditional (#1165, reachable on a host/project basis).** The adapter
+    builds its own `SettingsManager(params.cwd, …)` over `claudeConfigDir/settings.json`, the
+    cwd's `.claude/settings.json` and `settings.local.json`, and the managed path, then calls
+    `resolveSettings({ cwd })` without a `settingSources` argument. That call flow is separate
+    from our SDK query's `settingSources: []` (`tool-surface.ts:152`). When those settings carry
+    `disableBypassPermissionsMode: "disable"`, `allowBypass` drops, more permission requests reach
+    our approve-all-by-kind handler, and `[permission:approved]` notices appear. The SDK's
+    default `resolveSettings` source set is UNREAD, and no gate covers this case.
+  - **Reachable, classified from source only.**
+    - `createSession` starts a background `getContextUsage()` refresh (call at tag `85:8317`), and
+      does so again after a model change. Upstream comments (`85:8301`, `85:8350-8352`) describe
+      SDK control requests as serialized. The SDK internals are UNREAD, so whether our bounded
+      set-model and early-abort grace queue behind it is a lead, and its timing is UNRUN.
+    - A turn made only of `<synthetic>` frames emits no `usage_update` (#1132), and our
+      keep-prior occupancy seals the prior value.
+    - `tool_call_update` omits unchanged fields for every client (#1153). No producer was found
+      that sends a pre-terminal `rawOutput.isError`, so a tool failure still arrives as
+      `status: "failed"`.
+    - #1216's `teardownSession` stops awaiting the interrupt reply. It is reached only
+      indirectly, through dispose on stdin EOF or a signal: we never send `session/close`, and
+      our `session/cancel` still awaits.
+    - A sign-out during an unsettled turn fails it with `RequestError.authRequired()` and no
+      extra message (#1179, tag `85:4420`). The stock text is the SDK default
+      `Authentication required` (sdk 1.6.0 `jsonrpc.js:1032-1033`), and that message ALONE is not
+      transient to pi's real classifier. The sealed legacy `errorMessage` also carries the
+      stderr tail, lifecycle and hint (`backend.ts:1463-1490`), and a tail can still match the
+      retry pattern. `[측정 2026-10-04, coordinator classifier probe]`: `"Authentication required"`
+      → `retryable: false`; the same text plus `\n--- backend stderr (tail) ---\n500` →
+      `retryable: true`. #127 does not sanitize this path and certifies no auth runtime.
+    - The nine other vendor `internalError` sites keep the same legacy path. Their
+      `Internal error:` prefix can match the classifier, and that pre-existing policy is
+      unchanged here. This is a source and classifier reading, not a frequency claim and not a
+      complete-callee identity claim.
+  - **Capability-gated:** `notice`, the one new `sessionUpdate` literal (17 → 18 kinds).
+  - **Ambient only:** `CLAUDE_AGENT_ACP_EXPERIMENTAL_V2=1` selects a v1/v2 router. Entwurf
+    neither sets nor scrubs it, and the router's v1 path for a v1 client is UNRUN.
+  - **Entry identity is not settlement identity.** `newSession`, `prompt`,
+    `setSessionConfigOption`, `requestPermission`, `closeSession`, `sessionUsage`,
+    `turnQuotaMeta` and `quotaTokenCount` are byte-identical as extracted entry bodies. Turn
+    settlement moved inside the changed `runConsumer`.
 
 - **The one 0.73.0 → 0.75.1 change that DOES reach us:** context compaction is now surfaced as a
   synthetic ACP tool lifecycle (0.75.0, #991) — a `tool_call` with `kind: "think"`, title
@@ -373,10 +458,15 @@ caller-session `_meta`, and cross-machine certification.
 
 A backend can return `newSession` before its declared MCP server is callable. This was
 observed intermittently on the Claude rail and directly on Cortex's private `mcp.json`
-path. Neither `claude-agent-acp` 0.79.0 nor the Cortex landing adds a client-side
-readiness fence over a session's declared MCP servers, and entwurf's common loop
-calls `mcpServerStatus()` nowhere.
-(Re-measured at the 0.76.0 → 0.79.0 bump, not inherited — the previous bump's argument is
+path. Entwurf's common loop calls `mcpServerStatus()` nowhere; it does not add a
+client-side readiness fence over a session's declared MCP servers. The historical
+0.76.0 → 0.79.0 source measurement below is dated evidence, not a current-version
+runtime claim. For the 0.85.1 candidate, #127 re-measured the MCP-authentication
+window as byte-identical and ran the MCP/self/send LIVE samples; neither source
+identity nor green samples establish the cause of the intermittent readiness gap
+or close #72. Changed SDK internals and session initialization remain separate
+risk surfaces.
+(Historical measurement at the 0.76.0 → 0.79.0 bump, not inherited — the previous bump's argument is
 not reused, the way the 0.75.1 → 0.76.0 entry did not reuse 0.73.0 → 0.75.1's.
 `mcpServerStatus` call sites in `src/acp-agent.ts` are **2 at v0.76.0 and 2 at v0.79.0**
 `[측정 2026-09-18, upstream v0.79.0/src/acp-agent.ts read directly, grep -n]`; they first
@@ -392,7 +482,8 @@ empty) and the region moved +11 while the file shrank 10,405 → 10,329 lines. T
 agent-picker removal, the 0.78.0 compaction/checkpoint/AIR work and the 0.79.0 permission
 presentation touch no part of this path, so the other reachable-surface findings stand as
 re-measured in the capability-posture section above.
-This bump changes no readiness behavior and closes no part of #72.)
+That historical source measurement closes no part of #72; it is not a claim that
+all effective readiness behavior stayed unchanged in the 0.85.1 runtime.)
 
 ### 11-7-a/b. Instrument and first measurement
 
@@ -500,12 +591,14 @@ nothing here is promised and then quietly not delivered. `[QK:PI-QUEUE-NO-MIDFLI
 while a turn is in flight never joins that turn and arrives as a later one. The delay's SIZE is
 that turn's duration, which the same cell fixes by construction.
 
-**Forwarding is not adopted here.** `[측정 2026-09-22]` standard ACP has no steer method at all —
-enumerating the installed `@agentclientprotocol/sdk`'s `AGENT_METHODS` and `CLIENT_METHODS` yields
-zero entries containing `steer`. What exists is a PRIVATE vendor extension,
-`_session/steering` in `@agentclientprotocol/claude-agent-acp@0.79.0`
-(`dist/acp-agent.js:163`, handler at `:7792`), client→agent, advertised through
-`InitializeResponse._meta.steering.supported`. Our client sends `initialize`, `session/new`,
+**Forwarding is not adopted here.** The dated `[측정 2026-09-22]` SDK-method enumeration
+and private-extension observation below belong to the then-installed oracle, not a
+0.85.1 runtime measurement: `AGENT_METHODS` and `CLIENT_METHODS` contained zero entries
+matching `steer`; `_session/steering` was a PRIVATE vendor extension in
+`@agentclientprotocol/claude-agent-acp@0.79.0` (`dist/acp-agent.js:163`, handler at `:7792`),
+client→agent, advertised through `InitializeResponse._meta.steering.supported`.
+The current boundary is our client's lack of a steering path, not a claim that the
+old vendor coordinates describe the current pin. Our client sends `initialize`, `session/new`,
 `session/prompt`, `session/set_config_option` and `session/cancel` (`acp-client.ts:138-149`) and
 has no steering path at all.
 

package/docs/setup-clean-host.md

@@ -28,7 +28,8 @@ evidence split, and its three states must not collapse into "macOS is supported"
 | npm/pnpm | npm is bundled with Node; pnpm is required for source setup | package or source installation |
 | Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot/Codex wiring writers |
 | entwurf | global/project-local `@junghanacs/entwurf`, or a source checkout | operator command and garden capability |
-| pi | optional-by-presence, `>=1.0.0 <1.1` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| pi | optional-by-presence, `>=1.0.2 <1.1` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| Native durable (`pi-durable`) | optional-by-presence, operator-provided experimental source runtime at the fixed `…/entwurf/pi-durable/runtime`, pinned to `cd32f77` plus the narrow runtime-contact overlay; not supplied by ordinary Pi npm installation — absent is an explicit setup SKIP, present-but-not-the-pin a named FAIL | optional 0.31.0 candidate contact via `entwurf pi-durable`; first native Pi ↔ pi-durable admission/LIVE accepted on one Linux host, runtime provision and release acceptance separate (§2b) |
 | Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
 | OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
@@ -190,7 +191,7 @@ on Darwin; that is wiring, not a rail receipt. If `pi` is on PATH,
 Install the exact release floor, then wire the project:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@1.0.0
+npm install -g @earendil-works/pi-coding-agent@1.0.2
 pi --version
 
 cd ~/entwurf-smoke
@@ -198,7 +199,7 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported range is `>=1.0.0 <1.1`. It is a hard minimum: installing this
+The supported range is `>=1.0.2 <1.1`. It is a hard minimum: installing this
 release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
 minor. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.
@@ -282,6 +283,105 @@ emacsclient -s "${PI_EMACS_AGENT_SOCKET:-server}" --eval '(...)'
 
 </details>
 
+## 2b. Optional native durable (`pi-durable`)
+
+**0.31.0 installation contract; first native admission/LIVE accepted on one Linux host.**
+The [DELIVERY matrix](../DELIVERY.md) records the 2026-10-06 LIVE36 candidate
+acceptance; release/artifact and runtime-supply evidence remain separate.
+Durable is a separate native harness contact, not an option automatically enabled
+by `entwurf pi` or by registering ordinary Pi's adapter.
+
+There are three different things to install or supply:
+
+1. **Entwurf:** the existing global/project-local npm or source-checkout route in
+   §1 stays unchanged. It supplies Entwurf bytes, not the native harness.
+2. **Durable library:** `@earendil-works/pi-durable` is npm-installable. A library
+   dependency does not install the experimental coding app/TUI or birth a citizen.
+3. **Native app/runtime:** upstream's experimental durable app runs from a Pi
+   source checkout through its source resolver. The pinned 1.0.2 ordinary
+   `pi-coding-agent` package excludes experimental app output; upgrading the global
+   `pi` CLI does not supply it. Entwurf's maintained contact requires the exact
+   upstream commit `cd32f7725fdbddbaecdff5b1e68491563394e0ca` plus its narrow
+   runtime-contact overlay, operator-provided dependencies and pinned runtime data.
+
+The upstream [library installation guide](https://github.com/earendil-works/pi/blob/cd32f7725fdbddbaecdff5b1e68491563394e0ca/packages/durable/README.md#installation)
+and [experimental app guide](https://github.com/earendil-works/pi/blob/cd32f7725fdbddbaecdff5b1e68491563394e0ca/packages/coding-agent/src/experimental/durable/README.md)
+describe different consumers. Running the bare upstream app does not attach
+Entwurf's garden contact. Entwurf does not install a second harness distribution,
+rebuild its controller/model/auth/storage system or proxy a subscription.
+
+### What the operator supplies
+
+The runtime lives at ONE fixed place, with no path override:
+`$XDG_DATA_HOME/entwurf/pi-durable/runtime` (an absolute `XDG_DATA_HOME`; otherwise
+`~/.local/share/entwurf/pi-durable/runtime`). It counts as the pin only when:
+
+- HEAD is `cd32f7725fdbddbaecdff5b1e68491563394e0ca`, nothing is staged, `git diff`
+  equals the packaged overlay `pi/pi-durable/overlay/runtime-contacts.patch` byte for
+  byte, and no non-ignored file is untracked;
+- the upstream source resolver
+  `packages/coding-agent/src/experimental/source-resolver.ts` is present;
+- the git-ignored model data in `packages/ai/src/providers/data` matches the pinned
+  digest: the bytes `@earendil-works/pi-ai@1.0.2` ships in `dist/providers/data`,
+  **including its `.manifest.json` dotfile** (recorded in
+  `pi/pi-durable/overlay/upstream-pin.json`).
+
+The operator supplies it by hand; Entwurf never downloads, installs, repairs,
+moves or deletes the runtime. The sequence below was run on a Linux host
+(2026-10-06); afterwards the runtime verifier `entwurf setup` consults returned
+the pin (exit 0) and the checkout's native contact cells passed against it.
+`ENTWURF_ROOT` is your Entwurf package root or checkout, which ships the patch:
+
+```bash
+case "${XDG_DATA_HOME:-}" in
+  /*) R="$XDG_DATA_HOME/entwurf/pi-durable/runtime" ;;
+  *)  R="$HOME/.local/share/entwurf/pi-durable/runtime" ;;
+esac
+git clone --no-checkout https://github.com/earendil-works/pi.git "$R"
+git -C "$R" checkout --detach cd32f7725fdbddbaecdff5b1e68491563394e0ca
+git -C "$R" apply "$ENTWURF_ROOT/pi/pi-durable/overlay/runtime-contacts.patch"  # worktree only; do not stage
+(cd "$R" && npm ci --ignore-scripts)    # upstream lockfile; dependency install scripts skipped
+T=$(mktemp -d)
+(cd "$T" && npm pack @earendil-works/pi-ai@1.0.2)
+tar -xzf "$T/earendil-works-pi-ai-1.0.2.tgz" -C "$T" package/dist/providers/data
+cp -a "$T/package/dist/providers/data/." "$R/packages/ai/src/providers/data/"   # dotfiles too
+entwurf setup                           # expect: pi-durable PASS
+```
+
+Why it is a source checkout and not `npm install`: `@earendil-works/pi-coding-agent`
+(1.0.2 and 1.0.4 alike) excludes `dist/experimental` from its `files`, and its only
+experimental export resolves to `src/`, which the tarball does not ship, so the
+durable app's `experimental/durable/runtime.ts` and `tui.ts` exist only in a source
+checkout. `@earendil-works/pi-durable` on npm is the library (no app, TUI or bin).
+
+### What Entwurf does with it
+
+- `entwurf setup` reports a `pi-durable` row from that check and writes no durable
+  wiring in any case: **PASS** when the runtime is the pin, **SKIP** when nothing is
+  at the fixed place, **FAIL** with the named refusal when something is there but is
+  not the pin.
+- `entwurf pi-durable [args…]` is the managed launch. It verifies the same runtime
+  first (refusal exit 4 when absent, 3 otherwise), then runs the packaged bootstrap
+  `pi/pi-durable/bootstrap.mjs` under the runtime's source resolver, owning this
+  terminal. The bootstrap imports only the compiled closure shipped beside it
+  (`mcp/entwurf-bridge/dist/…`), so an installed package never imports checkout
+  TypeScript; a source checkout needs a built bridge (`pnpm run build-bridge`) first.
+  `plugins/pi-durable/bootstrap.mjs` is only the checkout path that re-exports it.
+
+Existing users who do not enable durable keep the same installation steps. For
+durable, native Pi owns credentials, model settings, SQLite sessions and recovery;
+keep them in place rather than copying credentials or migrating ordinary Pi
+transcripts. Native recovery does not prove exactly-once Entwurf dispatch or inbox
+read recovery. The contact provides garden attachment, visible identity and
+announce-only root-directed self-fetch. First native admission closed
+[#129](https://github.com/junghan0611/entwurf/issues/129) at reviewed main:
+visible fresh/callback, addressed receive and both real Pi ↔ pi-durable LIVE legs
+passed on one Linux host. Installed-bootstrap import-only proof is not a native
+runtime/TUI launch or a live Claude ↔ pi-durable receipt. This section states the
+installation contract; exact release/artifact acceptance is a separate floor.
+[#130](https://github.com/junghan0611/entwurf/issues/130) owns npm-only runtime
+supply, later Pi versions, ACP and UI follow-ups.
+
 ## 3. Optional Claude Code native citizen
 
 This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending physical
@@ -445,7 +545,7 @@ as a note rather than a fault.
 
 **entwurf sets no OMP version floor in code, and will not grow one on schedule.** Detection is
 presence-only (`command -v "${OMP_BIN:-omp}"`); there is no `entwurf.ompFloor`, no coherence
-gate, and no exact pin — unlike Node (`engines.node`), pi (`>=1.0.0 <1.1`) and Claude Code
+gate, and no exact pin — unlike Node (`engines.node`), pi (`>=1.0.2 <1.1`) and Claude Code
 (`entwurf.claudeCodeFloor`), each of which has an enforcement point. That asymmetry is a
 decision, not an omission. A floor is the answer to a vendor that fails SILENTLY — Claude Code
 earned one because an older binary validates the exec manifest, drops `args` at runtime, and

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -630,8 +630,8 @@ server.tool("entwurf_register_native", "Register an ALREADY-RUNNING native conve
 server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling beside you and hand it a first task. WHERE it opens is decided by where THIS " +
     "agent runs, never by a parameter: inside herdr (HERDR_ENV=1) it opens a NEW UNFOCUSED TAB in your own " +
     "herdr workspace, pi and claude-code " +
-    "only; everywhere else it opens in the operator's tmux with all five backends (pi, " +
-    "claude-code, copilot, omp, codex). No fallback: an incomplete herdr context is refused by name, " +
+    "only; everywhere else it opens in the operator's tmux with all six backends (pi, " +
+    "claude-code, copilot, omp, codex, pi-durable). No fallback: an incomplete herdr context is refused by name, " +
     "never by a tmux window you cannot see from herdr. The sibling's FIRST action " +
     "is a callback to you carrying a nonce, whose sender envelope is its garden id — that is how you learn the " +
     "address of a thing that did not exist a moment ago. This returns a LAUNCH receipt (the owner's " +
@@ -639,8 +639,8 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling beside you and
     "the task was delivered. Those coordinates are a VIEW, never an address — a herdr tab/pane id can change under " +
     "a running sibling. Nothing polls. " +
     "For EXISTING citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and passed to the chosen " +
-    "runtime CLI (`provider/model` for pi, an id/alias for Claude Code, a pattern for the rest). On tmux, copilot/omp/codex are refused BEFORE any window " +
-    "opens when their birth, MCP, receive or visible-identity units are absent, and codex also needs the " +
+    "runtime CLI (`provider/model` for pi, an id/alias for Claude Code, `provider/model id` exactly as the catalog names it for pi-durable, a pattern for the rest). On tmux, copilot/omp/codex/pi-durable are refused BEFORE any window " +
+    "opens when their birth, MCP, receive or visible-identity units are absent, pi-durable also when its operator-provided pinned runtime is absent or drifted, and codex also needs the " +
     "operator-owned app-server socket entwurf never starts; in herdr they are refused by name first. " +
     "Optional placement.tmuxSession is a TMUX-ONLY seat naming ONE EXISTING session and " +
     "ALWAYS wins; omitted, the seat follows the CALLER, never the backend opened: a CODEX CALLER opens beside " +
@@ -648,8 +648,8 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling beside you and
     "NOTHING is created. In herdr the field is refused by name. Do not put secrets in the task — model and task argv are visible to same-user " +
     "processes.", {
     backend: z
-        .enum(["pi", "claude-code", "copilot", "omp", "codex"])
-        .describe("Which fixed runtime to open. Only these five, and only pi/claude-code when this agent runs inside herdr; there is no arbitrary command."),
+        .enum(["pi", "claude-code", "copilot", "omp", "codex", "pi-durable"])
+        .describe("Which fixed runtime to open. Only these six, and only pi/claude-code when this agent runs inside herdr; there is no arbitrary command."),
     model: z
         .string()
         .min(1)
@@ -663,7 +663,7 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling beside you and
         // as an unused suppression while the escape goes back to being fixable.
         // biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above
         .regex(/^[A-Za-z0-9][A-Za-z0-9._/:\[\]-]*$/)
-        .describe("Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot/OMP/Codex model name."),
+        .describe("Required runtime model: canonical provider/model for pi, provider/<exact catalog model id> for pi-durable, a Claude Code model id/alias, or a Copilot/OMP/Codex model name."),
     task: z
         .string()
         .min(1)

package/mcp/entwurf-bridge/dist/pi-extensions/entwurf-capabilities.json

@@ -6,6 +6,7 @@
 		"codex": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "threadId" },
 		"copilot": { "wakeMode": "self-fetch", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" },
 		"omp": { "wakeMode": "self-fetch", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" },
+		"pi-durable": { "wakeMode": "self-fetch", "deliveryLevel": "D2", "nativeIdLabel": "sessionId" },
 		"pi": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" }
 	}
 }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/backend-adapter.js

@@ -20,6 +20,7 @@
 import { createRequire } from "node:module";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
+import { RequestError } from "@agentclientprotocol/sdk";
 import { enrichMcpServersWithEnvelope } from "./config.js";
 import { loadEngraving } from "./engraving.js";
 import { CORTEX_MODEL_PREFIX, curatedClaudeModels, curatedCortexModels, SUPPORTED_ANTHROPIC_MODEL_IDS, SUPPORTED_CORTEX_MODEL_IDS, } from "./models.js";
@@ -34,10 +35,46 @@ import { buildClaudeSessionMeta } from "./tool-surface.js";
 function shellQuote(value) {
     return `'${value.replace(/'/g, `'\\''`)}'`;
 }
+/** The pi diagnostic type under which backend.ts preserves a recognised rejection verbatim. */
+export const ACP_PROMPT_REJECTION_DIAGNOSTIC = "entwurf_acp_prompt_rejection";
+/** The verdict for claude-agent-acp's `incomplete_tool_call` (#127; upstream #1212, 0.85.0+). */
+export const INCOMPLETE_TOOL_CALL_VERDICT = "ACP turn failed because foreground tool results are incomplete. Some tools may already have run; automatic replay is unsafe. Inspect the preserved vendor rejection before continuing.";
 // ---------------------------------------------------------------------------
 // claude adapter — the first implementation (the rail's reference backend)
 // ---------------------------------------------------------------------------
 const SUPPORTED_CLAUDE_IDS = new Set(SUPPORTED_ANTHROPIC_MODEL_IDS);
+/** JSON-RPC internal error — the code claude-agent-acp rejects an unfinished-tool turn with. */
+const JSONRPC_INTERNAL_ERROR = -32603;
+/** claude-agent-acp's own kind for a turn that hit `end_turn` with foreground tools unanswered
+ *  (read at v0.85.1 `src/acp-agent.ts:4286-4340`, `errorKindData("incomplete_tool_call")`). */
+const CLAUDE_INCOMPLETE_TOOL_CALL = "incomplete_tool_call";
+/**
+ * The claude reader for `readPromptRejection` (#127). Only the root wire SDK's own decode
+ * counts: its client rejects a JSON-RPC error response with `new RequestError(code, message,
+ * data)`, `data` being the parsed `error.data` (sdk 1.4.0 `dist/jsonrpc.js:842-844`). A
+ * look-alike object, another code, or another `errorKind` is not this failure and keeps the
+ * verbatim-first path.
+ */
+function readClaudePromptRejection(err) {
+    if (!(err instanceof RequestError) || err.code !== JSONRPC_INTERNAL_ERROR)
+        return undefined;
+    const data = err.data;
+    if (typeof data !== "object" || data === null || !("errorKind" in data))
+        return undefined;
+    if (data.errorKind !== CLAUDE_INCOMPLETE_TOOL_CALL)
+        return undefined;
+    return { errorKind: CLAUDE_INCOMPLETE_TOOL_CALL, verdict: INCOMPLETE_TOOL_CALL_VERDICT, dataJson: jsonText(data) };
+}
+/** Evidence text for a wire value. A value that came off the wire serializes; one that cannot
+ *  (a hand-built fake) is named as such, so recording evidence never breaks the turn's seal. */
+function jsonText(value) {
+    try {
+        return JSON.stringify(value) ?? String(value);
+    }
+    catch (err) {
+        return `[unserializable: ${err instanceof Error ? err.name : typeof err}]`;
+    }
+}
 /**
  * Resolve the claude launch — an ENTWURF-OWNED launcher, or the env override for debug.
  * This is the single source for the claude launch spec; backend.ts holds no private copy.
@@ -139,6 +176,9 @@ export const claudeAdapter = {
     // The token partition is NOT declared here: ACP's only token carrier is a
     // per-turn round-trip aggregate, which is not what pi's four fields mean.
     sealsTurnAccounting: true,
+    // #127: claude-agent-acp 0.85.0+ rejects an `end_turn` with unanswered foreground tools as
+    // -32603 `incomplete_tool_call` (upstream #1212). Its raw text reads as transient to pi.
+    readPromptRejection: readClaudePromptRejection,
 };
 // ---------------------------------------------------------------------------
 // Registry — modelId → adapter
@@ -285,6 +325,9 @@ export const cortexAdapter = {
     // backend.ts seals nothing for a backend without this flag, so cortex's
     // emitted usage is byte-identical to what it was before #93. Declaring this
     // with a guess would mint exactly the silent misaccounting #93 exists to end.
+    // NO readPromptRejection — also deliberate. Nobody has read which failures cortex's ACP
+    // server rejects a prompt with, so every cortex failure keeps the verbatim-first
+    // errorMessage. Borrowing claude's `incomplete_tool_call` reader would be a guess.
 };
 const ADAPTERS = [claudeAdapter, cortexAdapter];
 /**

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-deliverability.js

@@ -105,7 +105,13 @@ export function receiverMarkerMatchesIdentity(marker, identity) {
 // previous garden in-process on its `/new` edge (the unarm the claude hook lacked),
 // so the cell this join closes has a different owner there. Admitting it needs its
 // own measurement, not this file's optimism.
-export const SENDER_JOINED_RECEIVER_OWNER_KINDS = ["claude-code-cli"];
+//
+// `pi-durable-host` is admitted because the join holds by construction: the durable contact
+// writes its sender marker under the host's own pid and arms its watch in that same process
+// (`meta-bridge-pi-durable.ts`), so the receiver marker's `ownerPid` IS the sender-marker key.
+// Inside the scope a host whose sender marker is gone or names another garden is a retired
+// watch, which is the refusal this admission exists to make reachable.
+export const SENDER_JOINED_RECEIVER_OWNER_KINDS = ["claude-code-cli", "pi-durable-host"];
 /** Does this watch owner share its pid with the backend's sender marker? */
 export function receiverOwnerKindJoinsSender(ownerKind) {
     return SENDER_JOINED_RECEIVER_OWNER_KINDS.includes(ownerKind);

package/mcp/entwurf-bridge/dist/pi-extensions/lib/fresh-call-composition.js

@@ -23,11 +23,12 @@
  */
 import { randomBytes } from "node:crypto";
 /** The backends this rail can open. Fixed set, not a profile — a further one is a decision,
- * not a config entry. `copilot` was added by #82 RAIL 9, `omp` by #87 Bundle C, and `codex`
- * by #95 after its system birth and app-server rails were measured. The set is joined to the
+ * not a config entry. `copilot` was added by #82 RAIL 9, `omp` by #87 Bundle C, `codex`
+ * by #95 after its system birth and app-server rails were measured, and `pi-durable` by #129
+ * (the operator-provided durable app through the managed `entwurf pi-durable`). The set is joined to the
  * citizen backends by `check-harness-admission-parity`: a harness that mints records but is
  * missing HERE is not an unwired convenience, it is a release blocker. */
-export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp", "codex"];
+export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp", "codex", "pi-durable"];
 /**
  * The callback tool NAME differs per backend and that is not cosmetic: every session reaches the
  * capability under whatever name its harness composes for the `entwurf-bridge` MCP server, and
@@ -64,6 +65,11 @@ export const FRESH_CALL_CALLBACK_TOOL = {
     // Codex's tool process is the operator app-server, not the pane: the no-arg
     // verb refuses there by name. First action stays the delivery verb with args.
     codex: "mcp__entwurf_bridge__entwurf_v2",
+    // The durable contact registers the bridge verbs as its OWN tools under their bare names, and the
+    // app offers a tool to the model by its registered name (`durable/harness/registry.ts:99`
+    // @cd32f77). Measured for `entwurf_v2` on the S+native-H wire (receipt 4012c066); the callback
+    // spelling follows the same rule and is owed its first LIVE observation.
+    "pi-durable": "entwurf_callback",
 };
 /** Where a sibling SENDS the task result. Always the delivery verb, never the birth callback. */
 export const FRESH_CALL_DELIVERY_TOOL = {
@@ -72,6 +78,7 @@ export const FRESH_CALL_DELIVERY_TOOL = {
     copilot: "entwurf-bridge-entwurf_v2",
     omp: "mcp__entwurf_bridge_entwurf_v",
     codex: "mcp__entwurf_bridge__entwurf_v2",
+    "pi-durable": "entwurf_v2",
 };
 /**
  * The same dialects, for the tool the framing OFFERS rather than requires.
@@ -93,6 +100,7 @@ export const FRESH_CALL_PEERS_TOOL = {
     copilot: "entwurf-bridge-entwurf_peers",
     omp: "mcp__entwurf_bridge_entwurf_peers",
     codex: "mcp__entwurf_bridge__entwurf_peers",
+    "pi-durable": "entwurf_peers",
 };
 /**
  * ONE BACKEND NEEDS TO BE TOLD HOW TO REACH ITS OWN CALLBACK TOOL `[측정 2026-09-18, n=5 + n=3]`.
@@ -132,6 +140,7 @@ export const FRESH_CALL_TOOL_LOAD_HINT = {
     copilot: [],
     omp: [],
     codex: [],
+    "pi-durable": [],
 };
 /**
  * The omp bootstrap flag, spelled WITHOUT dashes — the vendor's flag map is keyed by bare
@@ -311,6 +320,28 @@ export function composeBackendArgs(backend, composition, model, resolveCodexSock
                 "--dangerously-bypass-approvals-and-sandbox",
                 composition.prompt,
             ];
+        case "pi-durable": {
+            // The managed verb (`entwurf pi-durable`) carries the explicit model as pi's own
+            // `--provider`/`--model` pair, split at the FIRST `/` (the preflight already refused a model
+            // with no provider), the explicit width, and the WHOLE framing as the closed `{v,task}`
+            // payload — the durable bootstrap submits it to the root once, after the birth. The
+            // caller's address rides the env pair, never this payload.
+            const at = model.indexOf("/");
+            if (at <= 0 || at === model.length - 1) {
+                throw new Error(`fresh-call composition: pi-durable model ${JSON.stringify(model)} is not <provider>/<model id>`);
+            }
+            return [
+                "pi-durable",
+                "--provider",
+                model.slice(0, at),
+                "--model",
+                model.slice(at + 1),
+                "--width",
+                "task-wide",
+                `--${OMP_BOOTSTRAP_FLAG}`,
+                JSON.stringify({ v: OMP_BOOTSTRAP_VERSION, task: composition.prompt }),
+            ];
+        }
     }
 }
 /**

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-sender-identity.js

@@ -57,7 +57,13 @@ import { resolveNativePushAdapter } from "./native-push/adapter.js";
  * exactly the #46 defect on agy, and copilot joined the list only once its own hook wrote one
  * (#82 RAIL 5b). Membership says a marker may EXIST, never that a reply can land: the reply
  * rail is chosen from `nativePushSupported` at the bridge, not from this list. */
-export const META_SENDER_BACKENDS = ["claude-code", "antigravity", "copilot", "omp"];
+export const META_SENDER_BACKENDS = [
+    "claude-code",
+    "antigravity",
+    "copilot",
+    "omp",
+    "pi-durable",
+];
 /**
  * Two live native sessions claim this MCP process as their own. We can SEE both identities but
  * cannot say which one is calling, so we send under neither. Choosing by lookup order, backend

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js

@@ -76,7 +76,7 @@ export class MetaRecordError extends Error {
  * every write, including its own. `./run.sh doctor-meta-bridge` already flags a
  * stale deployed writer — run it after the change.
  */
-export const META_BACKENDS = ["claude-code", "antigravity", "codex", "copilot", "omp"];
+export const META_BACKENDS = ["claude-code", "antigravity", "codex", "copilot", "omp", "pi-durable"];
 export const META_BACKEND_DESCRIPTORS = {
     "claude-code": {
         backend: "claude-code",
@@ -189,6 +189,24 @@ export const META_BACKEND_DESCRIPTORS = {
         deliveryLevel: "D6",
         nativeIdLabel: "sessionId",
     },
+    // The long-running durable app (#129). Graded only as far as its RECORDED receipts reach.
+    //   sessionId the durable session directory name `<13-digit ms>-<uuid>` that
+    //             `selectSession` creates and `--continue` reopens
+    //             (`experimental/durable/sessions.ts:18-55` @cd32f77), surfaced as
+    //             `view.current().session.id`. Not `pi.provider.sessionId`, which a
+    //             fork changes.
+    //   D2        receiver armed: the contact mints the record, names the host as sender, and arms
+    //             a root doorbell (the receiver marker is owned by the host pid as `pi-durable-host`,
+    //             which the owner join admits). The addressed-enqueue → idle-wake → root-notice → drain
+    //             chain has ONE recorded receipt, on the scripted-model + native-harness lab cell
+    //             (`check-pi-durable-receive`, S+H, V not run) — lab evidence, not a vendor-turn D4–D6
+    //             acceptance, and no sibling-isolation (D3) or LIVE fresh receipt exists yet.
+    "pi-durable": {
+        backend: "pi-durable",
+        wakeMode: "self-fetch",
+        deliveryLevel: "D2",
+        nativeIdLabel: "sessionId",
+    },
 };
 // ---------------------------------------------------------------------------
 // Validation helpers (crash, don't warn)
@@ -261,7 +279,15 @@ function isoNow(now) {
 /** The one live identity schema number. */
 export const META_SCHEMA_VERSION_V3 = 3;
 /** Every backend admitted by the one V3 record-citizen schema. */
-export const META_CITIZEN_BACKENDS = ["claude-code", "antigravity", "codex", "copilot", "omp", "pi"];
+export const META_CITIZEN_BACKENDS = [
+    "claude-code",
+    "antigravity",
+    "codex",
+    "copilot",
+    "omp",
+    "pi-durable",
+    "pi",
+];
 export function requireCitizenBackend(value) {
     if (typeof value !== "string" || !META_CITIZEN_BACKENDS.includes(value)) {
         throw new MetaRecordError(`meta-record "backend" must be one of ${META_CITIZEN_BACKENDS.join(" | ")} (got ${describe(value)}).`);