@junghanacs/entwurf 0.30.1 → 0.31.0

package/AGENTS.md

@@ -100,6 +100,7 @@ implement → affected focused gates → independent review → one amendment bu
 ## Type and Working Boundaries
 
 - Each `.ts` file belongs to one declared typecheck fence; `exclude` may move a file between fences but never out of all of them, so an exclude states the receiving `include` in the same change. Root pi extensions use TypeBox through `@earendil-works/pi-ai`; MCP/scripts use explicit `.ts` imports required by Node strip-types. Installed surfaces route to compiled JS. Behavior-adjacent `.test.ts` takes the fence `test/` takes — `scripts/tsconfig.json`, never the emit-capable root program — and is kept out of the tarball by a files-array negation whose tripwire is `check-pack`.
+- Develop only on branches in this repository checkout; never use worktrees or tmp development clones. Isolated test fixtures and temporary evidence are not development checkouts.
 - Make surgical, one-contract changes. Removal repairs source and its proof together; a green gate never proves retired behavior.
 - Before commit, sweep repository-wide for retired authority vocabulary and landed-plan future tense. Historical tombstones may remain; live docs, source, gates, and usage must agree.
 - Prefer capability-domain language over identity rank. Use tabs unless the project formatter requires otherwise. GLG decides commit, push, and release gates.

package/CHANGELOG.md

@@ -4,6 +4,118 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.31.0 - 2026-10-07
+
+### Added
+
+- **Native durable contact (`pi-durable`, #129).**
+  Treat the experimental durable coding app as a separate native harness. One
+  native host attaches to one V3 garden id; the contact adds visible garden
+  identity, self/peers, canonical outbound dispatch and announce-only root-directed
+  mailbox receive with explicit inbox read. Runtime, TUI, model/auth, SQLite
+  storage, transcript and recovery remain upstream-owned. Internal subagents do
+  not mint another citizen. Native recovery is not exactly-once Entwurf delivery.
+
+### Installation
+
+- **Entwurf's npm/source installation route stays unchanged.** Optional native
+  durable use additionally requires an operator-provided pinned upstream source
+  runtime and the narrow runtime-contact overlay (Pi 1.0.2/source `cd32f77` in this
+  lane). The `@earendil-works/pi-durable` **library** is npm-installable; the
+  experimental coding app/TUI is not supplied by the ordinary Pi npm package.
+  Entwurf does not install a harness or copy credentials. Existing non-durable
+  users do not need a source checkout. [Native durable setup boundary](docs/setup-clean-host.md#2b-optional-native-durable-pi-durable).
+
+### Changed
+
+- **Pi dependency/runtime floor is 1.0.2**, with pi peer range `>=1.0.2 <1.1`.
+  Native durable pins upstream source `cd32f77` and its narrow contact overlay;
+  no upgrade to a newer experimental app or replacement runtime is included.
+- **Source workspace discovery is root-only.** Explicit `packages: ['.']` keeps
+  pnpm's workspace scan coherent with the root install, without disabling its
+  dependency verification. Prepack still runs the foreground build lifecycle,
+  with build output on stderr so pack JSON stays readable and failures propagate.
+
+### Verification
+
+- **Reviewed pre-version main:** product `165338e` and native-admission `535c2e1`
+  landed separately with normal hooks/shared safety scans. The final landing's
+  [exact-SHA CI](https://github.com/junghan0611/entwurf/actions/runs/37478003145)
+  at `535c2e1b63e6a66c45227e197de80bf261202aec` passed all four required jobs
+  and the qualification BODY **872/872 KILLED**, including the new foreign-sender
+  guard4.5s KILLED against subject `7bdea2c4c664…`. Implementation issue #129 is closed; #130 owns
+  npm-only runtime supply, Pi upgrades, ACP and UI follow-ups. This main receipt
+  is not the later prepared-commit or preserved-artifact acceptance.
+- **Native first admission:** corrected real Pi → pi-durable → Pi LIVE36
+  passed in41s on `openai-codex/gpt-6.1-sol`, task-wide native5 + contact6 offering.
+  A consistent official SQLite backup establishes first callback, own-id inbox
+  read, joined successful native dispatch and the exact root doorbell reaching done.
+  Pi transcript row19 carries the exact expected payload and authoritative durable
+  sender. Native V evidence is distinct from checkout contact95/send19/receive21
+  scripted S + native H and installed-bootstrap import-only proof.
+- **Receipt-oracle repair is portable and independently reviewed.** Exact payload,
+  terminal sender envelope, root scope, effective offering, call/result and doorbell
+  joins replace substring/union predicates. Eight inline tests and the existing mux
+  coordinate carry a foreign-sender guard mutant. The original35-GREEN predicate
+  selected fixture row15; real old-row19 delivery was independently present. Old raw,
+  wrong receipt and RED857/870 remain preserved, never relabelled new acceptance.
+  Native admission raw: `.tmp-verify/b9ffcb-pack-cause/live-pd-20261006T223708/`.
+- **Versioned working-candidate P4:** FULL666s/exit0, HEAD/index/tracked work-surface
+  and binary diff frozen MATCH; pack dry-run580files. The pre-verdict release-metadata
+  patch/bytes are preserved in `.tmp-verify/031-release/prepare/p4/`, snapshot SHA
+  `2529949384af40c6ca15f65575638b97980817cb85d7a68bb81e9ff1b34c8fa7`, full-log SHA
+  `57da80e9e32159f8bc966381a2756d6a34cca647dd5ee5791ee681ed3509b0df`.
+  This floor used the exact private Herdr0.9.3 aarch64 supply pin; operator0.9.1 stayed
+  unchanged. No qualification BODY or native LIVE was executed in this P4 run.
+- **Explicit agy criterion7 exception for this0.31.0 cut, confirmed by GLG
+  (2026-10-07):** “agy 예외. 0.30.1부터 그렇게 헀어 더 진행가자” permits continuing
+  prepare/make while agy1.2 remains **NOT CERTIFIED**. The historical1.1 pin and
+  DELIVERY certification row stay unchanged; #128 remains first-party own-context
+  prerequisite research. No nonce/credential extraction, old-CID replay, transport
+  implementation, permanent floor change or npm publication is authorized by this
+  exception. Other release axes remain mandatory.
+- **Fresh native Claude host:** owned writer/registry refresh corrected the stale
+  deployed v3 bytes before P5. Source=assembled=installed writer `c8f05d394d0e`,
+  capability registry `2f95e94f1eb9`; strict doctor exits0 with four live owner joins.
+  A new Claude2.1.291 session after install, garden `20261007T024544-c71062`,
+  ownerPID2784041/startKey `linux:304383485`, bridge child2784080, joins sender,
+  receiver and V3 record with no model turn. `prepare/claude-native-cert/accepted.json`
+  retains the exact metadata. This is checkout-provenance certification, not an
+  installed emitted-JS/bin-shim, registry, model-turn or fresh delivery/reply receipt.
+- **First P5 and scoped repair remain distinct.** The frozen candidate's first
+  `--cut` run ended RED: MUST23/2/0, BEHAVIOR1/0/0, qualification872/872 KILLED,
+  HEAD/index/tracked bytes MATCH. Log `/tmp/entwurf-release-gate-0.31.0.JdQ4q6/release-gate.log`.
+  The owned OMP receiver's stale writer was refreshed through its installer; strict
+  runtime/ownership doctor and fresh receive LIVE11 passed. Initial Pi's Codex relay
+  added one trailing newline; the exact source oracle rejected it. A fresh chain on
+  the unchanged candidate passed65 assertions, source audits Pi3/3 + Codex3/3, with
+  no oracle relaxation or old-CID replay. The owed on-demand seat×cwd fresh-call
+  matrix passed39. `prepare/p5-focused-1/accepted.json` retains those focused receipts;
+  they do not turn the original aggregate RED into GREEN. Immediate P9 was report-only,
+  five eligible roots312K after P5 and six328K after the focused bundle; protected
+  Emacs was the only reparented `/tmp` process, with no deletion or signal.
+- **Final fresh P5 cut verdict:** `LIVE=1 ./run.sh release-gate
+  /tmp/entwurf-release-gate-0.31.0.Xzbk2b --cut` exited0 after110m15s:
+  **MUST PASS=25 FAIL=0 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0 SKIP=0**, its own
+  FULL and qualification **872/872 KILLED**, frozen HEAD/index/tracked bytes MATCH.
+  Log SHA256 `609612baff850ec06fc74321002b33a6b71d3dabc76874dc1546b8722c317bf2`;
+  snapshot SHA256 `38c49ca5123ffc9883762d637084dba9ed77adbdd5f3e86287a1ace565f763de`.
+  `prepare/p5-final/accepted.json` retains the boundary; native durable raw is
+  `/tmp/smoke-pi-durable-fresh-live-2026-10-06T23-27-34-983Z`. Immediate P9 reported
+  unused198/eligible6/328K, protected Emacs only; no deletion/signal.
+- **Fresh-eyes documentation alignment:** independent Grok review found one
+  underclaim bundle, not a false green: operator docs still called accepted native
+  admission pending and a direction note pointed to a retired branch handoff.
+  After the final P5 verdict, documentation-only commit `87de9f7` aligns those states
+  with DELIVERY/#129 and distinguishes seven citizen backends from six fresh-openable
+  ones. Bounded independent re-review closed the Defect (Blocker0/Defect0); normal
+  hooks/shared scanner passed, and main fast-forwarded locally before release-prep. Executable/gate/model/pin/manifest bytes are unchanged; no LIVE Claude ↔
+  durable or registry/runtime provision is inferred. Review artifacts live in
+  `.tmp-verify/031-release/grok-fresh-review/` and `docs-amendment/`.
+- **Release acceptance is pending:** prep commit/prepared-SHA CI and preserved
+  artifact remain outstanding. No final candidate, tag, GitHub release or npm
+  publication is asserted here.
+
 ## 0.30.1 - 2026-10-04
 
 ### Fixed

package/DELIVERY.md

@@ -116,6 +116,7 @@ physical host. Do not read a D-level cell as a Darwin receipt.
 | **Copilot CLI first-party extension** | raw transport probe; superseded by the owned product unit | D7 path observed; D3 control receipt incomplete; D8 unproven | CLI-spawned extension over stdio JSON-RPC; `joinSession()` + documented `fs.watch` → `session.send({mode:"enqueue"})`. Idle wake, exact-marker reply, and completion passed on 2026-08-23 (CLI 1.0.80, L4, one Linux host). Two-process isolation was observed but its decisive B log was not preserved. Kept as the transport receipt the owned receive unit was built on; the shipped unit differs deliberately — it announces the inbox instead of injecting the body. |
 | **Copilot CLI garden citizen** | shipped in 0.15.0; send + receive + visible fresh accepted on one host | D6; D7 partial; D3 pending; D8 unproven | Birth, garden id, MCP hand and record-backed sender identity are accepted; the RECEIVER is an installed first-party extension that binds to the V3 record, writes a receiver marker owned by the WATCHER pid, and rings a doorbell the model drains with `entwurf_inbox_read`. `wakeMode` is `self-fetch`, so dispatch reaches the mailbox rail: armed → delivered, unarmed/stale → the honest `mailbox-undeliverable` refusal. **D6 is the owned-invocation LIVE acceptance of 2026-08-23** — garden `20260823T181316-d9f6ba`, native `20fe30c8-b2bc-4600-91a0-8a409131be51`, CLI 1.0.80: receive log `joined`→`armed`→`doorbell fresh=1`→`rang`, mailbox `lastEnqueuedAt 09:23:41.235Z` / `lastReadAt 09:23:56.480Z`, and a model reply on the same record/native/gid chain. **Visible fresh (step 9 clause 7) is a separate LIVE, 2026-08-25** — launch window `@89`/`%89` nonce `mux-fresh-call-690529ae99f99faa2252aefb`; exact-callback garden `20260825T085721-f68be0`; one `entwurf_v2` → `meta-mailbox → enqueued`; same garden `lastReadAt 2026-08-24T23:57:47.784Z` plus same-gid reply; GLG saw footer garden id and a healthy multi-turn window. Those rows stay unmerged. D7 is PARTIAL: reply and read receipt were observed, the completion taxonomy and long-haul operation were not. D3 (second-session isolation of an owned invocation) is PENDING — observed once, decisive log lost to scratch cleanup. Evidence level L4: one host. Launch through the owned invocation `entwurf copilot`, which sets `COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS` for that one process; `doctor-copilot-receive` reads live CLI environments because a session launched without it is silently inert. Visible fresh is operator-metered and is not a release-gate MUST. |
 | **OMP (`omp`) garden citizen** | shipped in 0.16.0; send + receive + visible fresh accepted on one host | D6; D3 proven; D7 partial; D8 partial | Two in-process extensions in the operator's own TUI: birth mints the `mode === "tui"` host (subagents mint nothing) and names it as sender; the RECEIVER unit joins that citizen in the SAME process, holds an `fs.watch` on its mailbox signal, and rings an announce-only doorbell through the vendor's `pi.sendUserMessage` — measured to be on the FACTORY object, not the event ctx, and measured to start a turn on an idle host with zero typing (`agent_start` +31ms). `wakeMode` is `self-fetch`: the model drains with `entwurf_inbox_read` and THAT read is the receipt. **D6 is the LIVE acceptance of 2026-08-30** (oracle, omp 18.0.0) — garden `20260830T140819-116f6a`, `lastEnqueuedAt 05:08:20.555Z` / `lastReadAt 05:08:23.958Z`, and the citizen's own transcript carrying `mcp__entwurf_bridge_entwurf_inbox_read` for its own garden id. **D3 is PROVEN, not pending**: with two live omp citizens armed, one addressed enqueue rang exactly one doorbell and the sibling persisted no transcript and kept an empty mailbox. D7 is PARTIAL (`lastReadAt` needs no scraping; the reply does). D8 is PARTIAL — dedupe and every stale-handling path are implemented and hermetically pinned, ordering/loop-guard/crash-recovery are not. The `/new` unarm is the rail-specific one: the watch lives in the operator's TUI, so pid + start-key cannot see a citizen change underneath a living process, and without an explicit unarm the previous garden id would keep reading deliverable. Requires `tools: xdev: false` in `~/.omp/agent/config.yml` — the vendor default hides MCP tool schemas from the prompt, so the doorbell would name a tool the model cannot call. The decisive receipt lines — the ordering probe, the D6 chain, the D3 isolation and the `/new` unarm — are pasted into `scripts/raw-omp-measure/README.md` §M7 rather than left in a host-local `/tmp` path. Evidence level L4: one Linux host, ARM. **Visible fresh (step 9) is ACCEPTED — the clause 7 LIVE went green on 2026-08-30:** `entwurf_fresh_call` opens omp on all three public surfaces through the bare `omp` runtime with an explicit `--approval-mode yolo` width and the `mcp__entwurf_bridge_entwurf_v` callback name, behind a five-axis pre-mutation preflight whose fifth axis is omp-specific (`tools.xdev !== true`, without which the model cannot call the callback tool at all). **The first turn is a TWO-STAGE BOOTSTRAP rather than a positional prompt, and that is a measured correction, not a preference.** `[LIVE 2026-08-30]` the positional-prompt candidate opened its window and minted its citizen (garden `20260830T181342-452167`, native `01a051f2-3107-7147-8806-fa2a6f527610`), delivered the byte-identical framing as a user message at `09:13:42.413Z`, and the model answered the literal text `ACK` at `09:13:47.105Z` with ZERO tool calls; the caller timed out at 240s. `[source]` the interactive UI defers MCP discovery (`sdk.ts:1847-1855`, `:1881-1905`) while the positional `initialMessage` prompts straight after `mode.init()` (`main.ts:540-565`), and `[측정]` an observer on the same runtime saw `turn_start` at +654ms with the entwurf tools absent and the callback tool present only at +1484ms. So the launcher now carries `{v,target,nonce,task}` on the fixed registered flag `--entwurf-bootstrap`, and the in-process birth extension polls `getAllTools`(`source:"mcp"`) AND `getActiveTools` for the exact callback name, sends a callback-ONLY prompt, arms the task only on a `tool_result` whose stored `toolCallId`, tool name, target, nonce and `isError === false` all match, and DELIVERS it at the next `turn_end` of that same session. `[LIVE 2026-08-30]` that last boundary is itself a measured correction: a first attempt sent the task from inside the `tool_result` handler with an explicit `deliverAs: "followUp"`, the hook log showed the full chain (`bootstrap-armed` → `bootstrap-ready` +440ms → `bootstrap-callback-observed` → `bootstrap-released`), and the task still never appeared in the session — `[source]` an explicit `deliverAs` queues without starting a turn in either state, while the omitted form starts one when idle (`agent-session.ts:6511-6513`), which the same transcript confirmed three seconds later when the Bundle B doorbell's omitted-option send landed and started a turn. `[측정 2026-08-30]` the callback-only half is what was proven to work: model `openai-codex/gpt-5.6-sol`, tool live at +1105ms, prompt injected at +1107ms, and the sibling calling `mcp__entwurf_bridge_entwurf_v` with the exact nonce (`omp-cb-btkvva4r87` → `20260830T184054-1aa1f2`, `meta-mailbox → enqueued`). **The clause 7 acceptance, `smoke-omp-fresh-live` (release-gate MUST), 2026-08-30, 21 assertions, omp 18.0.0 / `openai-codex/gpt-5.6-sol`:** launch through `tools/call entwurf_fresh_call` with nonce `mux-fresh-call-34faea228f3c3638684b40ff`; sibling garden `20260830T192913-df52b9` taken from the CALLBACK's sender envelope and never from the launch receipt; exactly one new citizen (§3.5); addressed `entwurf_v2` → `meta-mailbox → enqueued`; `lastEnqueuedAt 10:29:19.179Z` / `lastReadAt 10:29:24.673Z`; the drain visible in that session's own transcript for its own garden id. **Both bootstrap stages are in that transcript in order** — the callback-only prompt at offset 970, the caller's task at 4732, no four-backend positional framing anywhere, and an assistant message after the task proving it started a turn rather than sitting in a queue. The unit's own log carries the state machine: `bootstrap-armed 10:29:13.399Z` → `bootstrap-ready 10:29:13.819Z` (+420ms) → `bootstrap-callback-observed 10:29:18.663Z` (`toolCallId=call_KZJtkxfzy1IEE4ejKutCPWcm|fc_0858…`) → `bootstrap-released 10:29:18.731Z` → `bootstrap-task-sent 10:29:18.759Z`. Evidence level L4: one Linux host, ARM, one run. `check-harness-admission-parity` keeps the deterministic half of the admission from being a matter of memory. What this does NOT establish: multi-host, multi-model, or repeated fresh calls in one process. **Cross-harness leg, 2026-08-31 (first bidirectional live-turn roundtrip on the committed bytes + operator redeploy):** a claude-code citizen (`20260831T090152-f998ac`) opened a fresh omp sibling through the public surface (nonce `mux-fresh-call-807cb693b1913ce98ffdbfd1`, callback sender garden `20260831T124226-eac41a`), dispatched an addressed `entwurf_v2` → `meta-mailbox → enqueued`, and the omp citizen's own live turn drained and replied into the claude mailbox — its self-report (doorbell → `entwurf_inbox_read`; callback-only first user message, task second) agrees with every receipt on the chain. |
+| **pi-durable native host** | 0.31.0 candidate; visible fresh + addressed receive + both cross-harness legs accepted on one Linux host (2026-10-06, `smoke-pi-durable-fresh-live`, 36 assertions, exit 0) | D6 (D3/D4 shown); D7 partial; D8 unproven | The operator-provided pinned source runtime (`cd32f77` + overlay) launched by the managed `entwurf pi-durable --provider … --model … --width task-wide`; the contact registers six tools and spawns the compiled bridge as a direct child; receive is announce-only self-fetch (doorbell → root submission → `entwurf_inbox_read`). Receipt (V on both sides, `openai-codex/gpt-6.1-sol`): real Pi `20261006T223710-e51e21` opened pd `20261006T223720-ba0c08` through `entwurf_fresh_call`; pd's first action called back into Pi with the exact nonce; Pi's live turn → pd mailbox ENQUEUE `2026-10-06T13-37-35-446Z-b57c69.msg`, that message's doorbell submission `done` on pd's root conversation, drained by pd's live turn (`entwurf_inbox_read` of its own id, settled); pd's live turn → Pi `entwurf_v2` settled `control-socket → sent` (native tool-result, joined by call id) and landed as exactly one Pi row with the expected payload and pd as the anchored sender. Native offering (root `pi.system`, toolsAdded/toolsRemoved applied): the six contact tools + bash/read/edit/write/subagent; pd's first root tool call is the callback. Actual model from root `pi.assistant` rows; the generation checkpoint does not retain `request.model` after completion. |
 | **Copilot CLI TUI+server** — *withdrawn lane, kept as evidence* | rejected | D7; D8 unproven | Older official-SDK probe over hidden `--ui-server`; idle enqueue worked, but loopback RPC authentication was not established. The bundled extension supersedes this candidate without reviving it. |
 | **ACP Claude / Cortex** | shipped runtime, outside this matrix | — | ACP sessions are children launched by entwurf's pi adapter, not already-running native sessions to wake. |
 

package/README.md

@@ -27,6 +27,15 @@ Claude and Cortex Code are ACP backends. Codex and Antigravity stay native so th
 retain their own tools and work context. Capabilities differ by rail: a shipped
 citizen is not a promise of every lifecycle operation.
 
+**Native durable contact (`pi-durable`) is accepted in the 0.31.0 candidate (#129).**
+It is a separate native harness contact, not ordinary Pi's control-socket adapter.
+The contact attaches one durable host to a garden id, adds visible identity and
+two-way mailbox contact, while the upstream harness keeps its TUI, models/auth,
+SQLite storage and recovery. First native admission passed on one Linux host;
+release/artifact acceptance is separate. The
+[installation requirements](#optional-native-durable--0310) differ from installing
+the ordinary Pi CLI.
+
 ## Install
 
 **Choose by where you work. Neither route installs a harness, subscription or login.**
@@ -35,7 +44,7 @@ citizen is not a promise of every lifecycle operation.
 
 Prerequisites: **Node >=24.0.0**, Python 3 for `setup`, and any harnesses you choose
 to use, already installed and authenticated. Pi is optional-by-presence, supported
-range `>=1.0.0 <1.1`; Claude Code supported floor `>=2.1.217` is required for its
+range `>=1.0.2 <1.1`; Claude Code supported floor `>=2.1.217` is required for its
 managed exec-hook lifecycle. pnpm is needed only for source-checkout setup.
 
 ```bash
@@ -63,6 +72,34 @@ Detected harness wiring on Darwin can therefore be written while setup stays
 non-green. Native Windows is **UNSUPPORTED**. The package has no npm `os`
 restriction; that is not certification of every platform's harness rails.
 
+### Optional native durable — 0.31.0
+
+**Entwurf's npm installation does not change. Enabling durable additionally needs
+an operator-provided native runtime; installing ordinary Pi from npm is not enough.**
+
+| Component | How it is supplied | What it does not supply |
+|---|---|---|
+| Entwurf | Existing npm or source-checkout route above | A harness binary, source runtime, subscription or login |
+| `@earendil-works/pi-durable` | npm **library** | The experimental app/TUI or Entwurf citizen attachment |
+| Native experimental durable app | Pinned upstream **source checkout**, with Entwurf's narrow runtime-contact overlay | A replacement ordinary Pi CLI or an Entwurf-owned harness |
+
+This lane retains Pi 1.0.2/source `cd32f77`; a newer global Pi installation does
+not provision that experimental runtime. Existing non-durable users do not need
+a Pi source checkout. Native auth and sessions stay upstream-owned: Entwurf does
+not copy credentials or convert ordinary Pi sessions into durable SQLite sessions.
+
+The package ships the compiled adapter and bootstrap: `entwurf setup` reports the
+operator runtime as PASS/SKIP/FAIL without writing durable wiring, and
+`entwurf pi-durable` is the managed launch. First native admission passed on
+2026-10-06: visible fresh/callback, addressed receive and real Pi ↔ pi-durable
+LIVE36 on one Linux host ([receipts](./DELIVERY.md)). Installed-bootstrap import
+proof does not supply or certify the native runtime; npm installation alone is
+not a durable readiness verdict. #129 closed at reviewed main; release acceptance
+remains its own floor.
+See [setup: native durable](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable)
+and [#130](https://github.com/junghan0611/entwurf/issues/130) for runtime-supply,
+Pi-upgrade, ACP and UI follow-ups.
+
 ### Herdr workbench
 
 ```bash
@@ -182,14 +219,17 @@ and [Herdr launch](https://github.com/junghan0611/entwurf/blob/main/docs/herdr-l
 Instead of keeping native pi copies of the verbs, the adapter registers the same
 compiled bridge after record birth, under the citizen's identity, and Pi supervises
 that MCP child. **MCP is ingress; pi receive remains the record-addressed Unix
-control socket.** Garden identity and dispatch stay Entwurf's. What `pi-durable`
-or Pi codemode should mean here remains undecided: this cut neither adopts nor
-certifies them. The 0.30.0 follow-up separately measured Herdr supply 0.9.3 and
+control socket.** Garden identity and dispatch stay Entwurf's. That 0.30.0 cut
+did not adopt or certify `pi-durable` or codemode. Native durable support is now
+accepted as a separate 0.31.0 candidate contact, as described above; codemode remains a
+harness-internal capability, not another garden citizen. The 0.30.0 follow-up
+separately measured Herdr supply 0.9.3 and
 re-pinned the plugin runtime to published npm 0.30.0 with manifest 0.30.0; its
 public consumer and CI receipts live in the #126 thread. That dated alignment is
-not a permanent version-equality rule. Unpublished 0.30.1 uses the closed
-`herdr-checkout` verification carrier; the [plugin source contract](./plugins/herdr/README.md)
-owns the measured npm re-pin and source-specific proof owed after publication.
+not a permanent version-equality rule. 0.30.1 is published (npm, 2026-10-04); at its tag the
+plugin's runtime lock is still the closed `herdr-checkout` verification carrier. Publication did
+not re-pin it: the measured npm re-pin and its source-specific proof are separate, still-open
+work that the [plugin source contract](./plugins/herdr/README.md) owns.
 
 Entwurf is the 0.12+ successor to
 [`@junghanacs/pi-shell-acp`](https://www.npmjs.com/package/@junghanacs/pi-shell-acp):

package/VERIFY.md

@@ -200,6 +200,22 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 
 Do not collapse source, package, fixture, and native-host evidence into one “green.”
 
+**Native durable contact (#129).** `check-pi-durable-beside` is the deterministic
+beside-test/mutant coordinate in `check:contracts`. The separate
+`check-pi-durable-contact`, `check-pi-durable-send` and `check-pi-durable-receive`
+are CHECKOUT-ONLY SDK/contact gates: they require the provisioned pinned overlay
+runtime (`ENTWURF_PI_DURABLE_RUNTIME`) and a private compiled bridge emitted from
+this candidate (`ENTWURF_PI_DURABLE_BRIDGE_ENTRY`). Missing inputs report SKIP 97,
+never PASS; present invalid inputs fail. Installed packages refuse these developer
+gates. Contact is adapter-direct/harness-bypassed; send/receive exercise scripted
+loopback S plus actual native harness H, not vendor V. Their scoped raw records,
+wire, native view and SQLite oracles do not certify every queue/crash window.
+The installed-bootstrap import in `check-pack-install` proves package closure,
+not runtime supply or native admission. First-release visible fresh/callback and
+native caller/target/cross-harness LIVE are owed by `smoke-pi-durable-fresh-live`, a
+release-gate MUST (LIVE=1; vendor V on a real Pi and a real pi-durable host, operator
+runtime required); SDK or package green does not waive it.
+
 | Axis | Required proof | Limit |
 |---|---|---|
 | Source | `pnpm run check:full` + `./run.sh check-gate-qualification` | Does not prove an installed consumer. |
@@ -290,7 +306,7 @@ The goal is not merely "invoke Claude Code." We want:
 **One install command to remember: `./run.sh setup <project>`.** It is idempotent — re-run the exact same command whenever anything looks wrong. There is no second install surface to juggle: from a clone `setup` runs the whole floor in order.
 
 1. `pnpm install` — installs the pinned development dependencies and builds the bridge (source-checkout bootstrap only; an installed package never runs npm/pnpm inside `node_modules`)
-2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.0.0 <1.1`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
+2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.0.2 <1.1`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
 3. Claude meta-bridge global plugin — only when `claude` is on PATH; otherwise skipped cleanly
 4. source stable-bin exposure — including certified `entwurf` → this checkout's `run.sh`, the managed runtime Copilot fresh resolves; helper units are attempted independently and a foreign helper is a named FAIL
 5. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable

package/demo/README.md

@@ -142,7 +142,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 1.0.0)
+- `pi` on PATH (current floor 1.0.2)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)

package/docs/acp-backend-rail.md

@@ -134,7 +134,7 @@ ledger, 2026-10-03).
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
 | Entwurf package | `package.json` `version` | checkout declaration, not a release receipt | names the package label these rows sit beside; whether that label shipped, and with which rows, is CHANGELOG's record |
-| pi runtime | devDep exact `1.0.0`, peer `>=1.0.0 <1.1` | **exact** oracle + **closed range** | the source pin this checkout builds and gates against; hosts inside the range are accepted, and the ceiling moves only on measurement. Shipped in 0.30.0 (`[측정 2026-10-04]` npm `latest` `0.30.0` declares this same peer range); its acceptance record is CHANGELOG 0.30.0, with #125 as the branch evidence |
+| pi runtime | devDep exact `1.0.2`, peer `>=1.0.2 <1.1` | **exact** oracle + **closed range** | the source pin this checkout builds and gates against; hosts inside the range are accepted, and the ceiling moves only on measurement. Unshipped candidate floor: the published 0.30.0 and 0.30.1 declare floor 1.0.0 with the same next-minor ceiling (`[측정 2026-10-05]` `npm view @junghanacs/entwurf@0.30.1 peerDependencies`; acceptance record CHANGELOG 0.30.0, #125 branch evidence). The 1.0.2 move and its receipts are ROADMAP's 2026-10-05 bump entry |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.6.0` | **exact** | the shared wire oracle both adapters speak |
 | Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.85.1` | **exact**, bundled | checkout candidate; resolved before any PATH fallback; declaration is not compatibility evidence |
 | Claude Agent SDK | `0.3.286` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |

package/docs/setup-clean-host.md

@@ -28,7 +28,8 @@ evidence split, and its three states must not collapse into "macOS is supported"
 | npm/pnpm | npm is bundled with Node; pnpm is required for source setup | package or source installation |
 | Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot/Codex wiring writers |
 | entwurf | global/project-local `@junghanacs/entwurf`, or a source checkout | operator command and garden capability |
-| pi | optional-by-presence, `>=1.0.0 <1.1` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| pi | optional-by-presence, `>=1.0.2 <1.1` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| Native durable (`pi-durable`) | optional-by-presence, operator-provided experimental source runtime at the fixed `…/entwurf/pi-durable/runtime`, pinned to `cd32f77` plus the narrow runtime-contact overlay; not supplied by ordinary Pi npm installation — absent is an explicit setup SKIP, present-but-not-the-pin a named FAIL | optional 0.31.0 candidate contact via `entwurf pi-durable`; first native Pi ↔ pi-durable admission/LIVE accepted on one Linux host, runtime provision and release acceptance separate (§2b) |
 | Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
 | OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
@@ -190,7 +191,7 @@ on Darwin; that is wiring, not a rail receipt. If `pi` is on PATH,
 Install the exact release floor, then wire the project:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@1.0.0
+npm install -g @earendil-works/pi-coding-agent@1.0.2
 pi --version
 
 cd ~/entwurf-smoke
@@ -198,7 +199,7 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported range is `>=1.0.0 <1.1`. It is a hard minimum: installing this
+The supported range is `>=1.0.2 <1.1`. It is a hard minimum: installing this
 release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
 minor. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.
@@ -282,6 +283,105 @@ emacsclient -s "${PI_EMACS_AGENT_SOCKET:-server}" --eval '(...)'
 
 </details>
 
+## 2b. Optional native durable (`pi-durable`)
+
+**0.31.0 installation contract; first native admission/LIVE accepted on one Linux host.**
+The [DELIVERY matrix](../DELIVERY.md) records the 2026-10-06 LIVE36 candidate
+acceptance; release/artifact and runtime-supply evidence remain separate.
+Durable is a separate native harness contact, not an option automatically enabled
+by `entwurf pi` or by registering ordinary Pi's adapter.
+
+There are three different things to install or supply:
+
+1. **Entwurf:** the existing global/project-local npm or source-checkout route in
+   §1 stays unchanged. It supplies Entwurf bytes, not the native harness.
+2. **Durable library:** `@earendil-works/pi-durable` is npm-installable. A library
+   dependency does not install the experimental coding app/TUI or birth a citizen.
+3. **Native app/runtime:** upstream's experimental durable app runs from a Pi
+   source checkout through its source resolver. The pinned 1.0.2 ordinary
+   `pi-coding-agent` package excludes experimental app output; upgrading the global
+   `pi` CLI does not supply it. Entwurf's maintained contact requires the exact
+   upstream commit `cd32f7725fdbddbaecdff5b1e68491563394e0ca` plus its narrow
+   runtime-contact overlay, operator-provided dependencies and pinned runtime data.
+
+The upstream [library installation guide](https://github.com/earendil-works/pi/blob/cd32f7725fdbddbaecdff5b1e68491563394e0ca/packages/durable/README.md#installation)
+and [experimental app guide](https://github.com/earendil-works/pi/blob/cd32f7725fdbddbaecdff5b1e68491563394e0ca/packages/coding-agent/src/experimental/durable/README.md)
+describe different consumers. Running the bare upstream app does not attach
+Entwurf's garden contact. Entwurf does not install a second harness distribution,
+rebuild its controller/model/auth/storage system or proxy a subscription.
+
+### What the operator supplies
+
+The runtime lives at ONE fixed place, with no path override:
+`$XDG_DATA_HOME/entwurf/pi-durable/runtime` (an absolute `XDG_DATA_HOME`; otherwise
+`~/.local/share/entwurf/pi-durable/runtime`). It counts as the pin only when:
+
+- HEAD is `cd32f7725fdbddbaecdff5b1e68491563394e0ca`, nothing is staged, `git diff`
+  equals the packaged overlay `pi/pi-durable/overlay/runtime-contacts.patch` byte for
+  byte, and no non-ignored file is untracked;
+- the upstream source resolver
+  `packages/coding-agent/src/experimental/source-resolver.ts` is present;
+- the git-ignored model data in `packages/ai/src/providers/data` matches the pinned
+  digest: the bytes `@earendil-works/pi-ai@1.0.2` ships in `dist/providers/data`,
+  **including its `.manifest.json` dotfile** (recorded in
+  `pi/pi-durable/overlay/upstream-pin.json`).
+
+The operator supplies it by hand; Entwurf never downloads, installs, repairs,
+moves or deletes the runtime. The sequence below was run on a Linux host
+(2026-10-06); afterwards the runtime verifier `entwurf setup` consults returned
+the pin (exit 0) and the checkout's native contact cells passed against it.
+`ENTWURF_ROOT` is your Entwurf package root or checkout, which ships the patch:
+
+```bash
+case "${XDG_DATA_HOME:-}" in
+  /*) R="$XDG_DATA_HOME/entwurf/pi-durable/runtime" ;;
+  *)  R="$HOME/.local/share/entwurf/pi-durable/runtime" ;;
+esac
+git clone --no-checkout https://github.com/earendil-works/pi.git "$R"
+git -C "$R" checkout --detach cd32f7725fdbddbaecdff5b1e68491563394e0ca
+git -C "$R" apply "$ENTWURF_ROOT/pi/pi-durable/overlay/runtime-contacts.patch"  # worktree only; do not stage
+(cd "$R" && npm ci --ignore-scripts)    # upstream lockfile; dependency install scripts skipped
+T=$(mktemp -d)
+(cd "$T" && npm pack @earendil-works/pi-ai@1.0.2)
+tar -xzf "$T/earendil-works-pi-ai-1.0.2.tgz" -C "$T" package/dist/providers/data
+cp -a "$T/package/dist/providers/data/." "$R/packages/ai/src/providers/data/"   # dotfiles too
+entwurf setup                           # expect: pi-durable PASS
+```
+
+Why it is a source checkout and not `npm install`: `@earendil-works/pi-coding-agent`
+(1.0.2 and 1.0.4 alike) excludes `dist/experimental` from its `files`, and its only
+experimental export resolves to `src/`, which the tarball does not ship, so the
+durable app's `experimental/durable/runtime.ts` and `tui.ts` exist only in a source
+checkout. `@earendil-works/pi-durable` on npm is the library (no app, TUI or bin).
+
+### What Entwurf does with it
+
+- `entwurf setup` reports a `pi-durable` row from that check and writes no durable
+  wiring in any case: **PASS** when the runtime is the pin, **SKIP** when nothing is
+  at the fixed place, **FAIL** with the named refusal when something is there but is
+  not the pin.
+- `entwurf pi-durable [args…]` is the managed launch. It verifies the same runtime
+  first (refusal exit 4 when absent, 3 otherwise), then runs the packaged bootstrap
+  `pi/pi-durable/bootstrap.mjs` under the runtime's source resolver, owning this
+  terminal. The bootstrap imports only the compiled closure shipped beside it
+  (`mcp/entwurf-bridge/dist/…`), so an installed package never imports checkout
+  TypeScript; a source checkout needs a built bridge (`pnpm run build-bridge`) first.
+  `plugins/pi-durable/bootstrap.mjs` is only the checkout path that re-exports it.
+
+Existing users who do not enable durable keep the same installation steps. For
+durable, native Pi owns credentials, model settings, SQLite sessions and recovery;
+keep them in place rather than copying credentials or migrating ordinary Pi
+transcripts. Native recovery does not prove exactly-once Entwurf dispatch or inbox
+read recovery. The contact provides garden attachment, visible identity and
+announce-only root-directed self-fetch. First native admission closed
+[#129](https://github.com/junghan0611/entwurf/issues/129) at reviewed main:
+visible fresh/callback, addressed receive and both real Pi ↔ pi-durable LIVE legs
+passed on one Linux host. Installed-bootstrap import-only proof is not a native
+runtime/TUI launch or a live Claude ↔ pi-durable receipt. This section states the
+installation contract; exact release/artifact acceptance is a separate floor.
+[#130](https://github.com/junghan0611/entwurf/issues/130) owns npm-only runtime
+supply, later Pi versions, ACP and UI follow-ups.
+
 ## 3. Optional Claude Code native citizen
 
 This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending physical
@@ -445,7 +545,7 @@ as a note rather than a fault.
 
 **entwurf sets no OMP version floor in code, and will not grow one on schedule.** Detection is
 presence-only (`command -v "${OMP_BIN:-omp}"`); there is no `entwurf.ompFloor`, no coherence
-gate, and no exact pin — unlike Node (`engines.node`), pi (`>=1.0.0 <1.1`) and Claude Code
+gate, and no exact pin — unlike Node (`engines.node`), pi (`>=1.0.2 <1.1`) and Claude Code
 (`entwurf.claudeCodeFloor`), each of which has an enforcement point. That asymmetry is a
 decision, not an omission. A floor is the answer to a vendor that fails SILENTLY — Claude Code
 earned one because an older binary validates the exec manifest, drops `args` at runtime, and

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -630,8 +630,8 @@ server.tool("entwurf_register_native", "Register an ALREADY-RUNNING native conve
 server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling beside you and hand it a first task. WHERE it opens is decided by where THIS " +
     "agent runs, never by a parameter: inside herdr (HERDR_ENV=1) it opens a NEW UNFOCUSED TAB in your own " +
     "herdr workspace, pi and claude-code " +
-    "only; everywhere else it opens in the operator's tmux with all five backends (pi, " +
-    "claude-code, copilot, omp, codex). No fallback: an incomplete herdr context is refused by name, " +
+    "only; everywhere else it opens in the operator's tmux with all six backends (pi, " +
+    "claude-code, copilot, omp, codex, pi-durable). No fallback: an incomplete herdr context is refused by name, " +
     "never by a tmux window you cannot see from herdr. The sibling's FIRST action " +
     "is a callback to you carrying a nonce, whose sender envelope is its garden id — that is how you learn the " +
     "address of a thing that did not exist a moment ago. This returns a LAUNCH receipt (the owner's " +
@@ -639,8 +639,8 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling beside you and
     "the task was delivered. Those coordinates are a VIEW, never an address — a herdr tab/pane id can change under " +
     "a running sibling. Nothing polls. " +
     "For EXISTING citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and passed to the chosen " +
-    "runtime CLI (`provider/model` for pi, an id/alias for Claude Code, a pattern for the rest). On tmux, copilot/omp/codex are refused BEFORE any window " +
-    "opens when their birth, MCP, receive or visible-identity units are absent, and codex also needs the " +
+    "runtime CLI (`provider/model` for pi, an id/alias for Claude Code, `provider/model id` exactly as the catalog names it for pi-durable, a pattern for the rest). On tmux, copilot/omp/codex/pi-durable are refused BEFORE any window " +
+    "opens when their birth, MCP, receive or visible-identity units are absent, pi-durable also when its operator-provided pinned runtime is absent or drifted, and codex also needs the " +
     "operator-owned app-server socket entwurf never starts; in herdr they are refused by name first. " +
     "Optional placement.tmuxSession is a TMUX-ONLY seat naming ONE EXISTING session and " +
     "ALWAYS wins; omitted, the seat follows the CALLER, never the backend opened: a CODEX CALLER opens beside " +
@@ -648,8 +648,8 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling beside you and
     "NOTHING is created. In herdr the field is refused by name. Do not put secrets in the task — model and task argv are visible to same-user " +
     "processes.", {
     backend: z
-        .enum(["pi", "claude-code", "copilot", "omp", "codex"])
-        .describe("Which fixed runtime to open. Only these five, and only pi/claude-code when this agent runs inside herdr; there is no arbitrary command."),
+        .enum(["pi", "claude-code", "copilot", "omp", "codex", "pi-durable"])
+        .describe("Which fixed runtime to open. Only these six, and only pi/claude-code when this agent runs inside herdr; there is no arbitrary command."),
     model: z
         .string()
         .min(1)
@@ -663,7 +663,7 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling beside you and
         // as an unused suppression while the escape goes back to being fixable.
         // biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above
         .regex(/^[A-Za-z0-9][A-Za-z0-9._/:\[\]-]*$/)
-        .describe("Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot/OMP/Codex model name."),
+        .describe("Required runtime model: canonical provider/model for pi, provider/<exact catalog model id> for pi-durable, a Claude Code model id/alias, or a Copilot/OMP/Codex model name."),
     task: z
         .string()
         .min(1)

package/mcp/entwurf-bridge/dist/pi-extensions/entwurf-capabilities.json

@@ -6,6 +6,7 @@
 		"codex": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "threadId" },
 		"copilot": { "wakeMode": "self-fetch", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" },
 		"omp": { "wakeMode": "self-fetch", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" },
+		"pi-durable": { "wakeMode": "self-fetch", "deliveryLevel": "D2", "nativeIdLabel": "sessionId" },
 		"pi": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" }
 	}
 }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-deliverability.js

@@ -105,7 +105,13 @@ export function receiverMarkerMatchesIdentity(marker, identity) {
 // previous garden in-process on its `/new` edge (the unarm the claude hook lacked),
 // so the cell this join closes has a different owner there. Admitting it needs its
 // own measurement, not this file's optimism.
-export const SENDER_JOINED_RECEIVER_OWNER_KINDS = ["claude-code-cli"];
+//
+// `pi-durable-host` is admitted because the join holds by construction: the durable contact
+// writes its sender marker under the host's own pid and arms its watch in that same process
+// (`meta-bridge-pi-durable.ts`), so the receiver marker's `ownerPid` IS the sender-marker key.
+// Inside the scope a host whose sender marker is gone or names another garden is a retired
+// watch, which is the refusal this admission exists to make reachable.
+export const SENDER_JOINED_RECEIVER_OWNER_KINDS = ["claude-code-cli", "pi-durable-host"];
 /** Does this watch owner share its pid with the backend's sender marker? */
 export function receiverOwnerKindJoinsSender(ownerKind) {
     return SENDER_JOINED_RECEIVER_OWNER_KINDS.includes(ownerKind);

package/mcp/entwurf-bridge/dist/pi-extensions/lib/fresh-call-composition.js

@@ -23,11 +23,12 @@
  */
 import { randomBytes } from "node:crypto";
 /** The backends this rail can open. Fixed set, not a profile — a further one is a decision,
- * not a config entry. `copilot` was added by #82 RAIL 9, `omp` by #87 Bundle C, and `codex`
- * by #95 after its system birth and app-server rails were measured. The set is joined to the
+ * not a config entry. `copilot` was added by #82 RAIL 9, `omp` by #87 Bundle C, `codex`
+ * by #95 after its system birth and app-server rails were measured, and `pi-durable` by #129
+ * (the operator-provided durable app through the managed `entwurf pi-durable`). The set is joined to the
  * citizen backends by `check-harness-admission-parity`: a harness that mints records but is
  * missing HERE is not an unwired convenience, it is a release blocker. */
-export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp", "codex"];
+export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp", "codex", "pi-durable"];
 /**
  * The callback tool NAME differs per backend and that is not cosmetic: every session reaches the
  * capability under whatever name its harness composes for the `entwurf-bridge` MCP server, and
@@ -64,6 +65,11 @@ export const FRESH_CALL_CALLBACK_TOOL = {
     // Codex's tool process is the operator app-server, not the pane: the no-arg
     // verb refuses there by name. First action stays the delivery verb with args.
     codex: "mcp__entwurf_bridge__entwurf_v2",
+    // The durable contact registers the bridge verbs as its OWN tools under their bare names, and the
+    // app offers a tool to the model by its registered name (`durable/harness/registry.ts:99`
+    // @cd32f77). Measured for `entwurf_v2` on the S+native-H wire (receipt 4012c066); the callback
+    // spelling follows the same rule and is owed its first LIVE observation.
+    "pi-durable": "entwurf_callback",
 };
 /** Where a sibling SENDS the task result. Always the delivery verb, never the birth callback. */
 export const FRESH_CALL_DELIVERY_TOOL = {
@@ -72,6 +78,7 @@ export const FRESH_CALL_DELIVERY_TOOL = {
     copilot: "entwurf-bridge-entwurf_v2",
     omp: "mcp__entwurf_bridge_entwurf_v",
     codex: "mcp__entwurf_bridge__entwurf_v2",
+    "pi-durable": "entwurf_v2",
 };
 /**
  * The same dialects, for the tool the framing OFFERS rather than requires.
@@ -93,6 +100,7 @@ export const FRESH_CALL_PEERS_TOOL = {
     copilot: "entwurf-bridge-entwurf_peers",
     omp: "mcp__entwurf_bridge_entwurf_peers",
     codex: "mcp__entwurf_bridge__entwurf_peers",
+    "pi-durable": "entwurf_peers",
 };
 /**
  * ONE BACKEND NEEDS TO BE TOLD HOW TO REACH ITS OWN CALLBACK TOOL `[측정 2026-09-18, n=5 + n=3]`.
@@ -132,6 +140,7 @@ export const FRESH_CALL_TOOL_LOAD_HINT = {
     copilot: [],
     omp: [],
     codex: [],
+    "pi-durable": [],
 };
 /**
  * The omp bootstrap flag, spelled WITHOUT dashes — the vendor's flag map is keyed by bare
@@ -311,6 +320,28 @@ export function composeBackendArgs(backend, composition, model, resolveCodexSock
                 "--dangerously-bypass-approvals-and-sandbox",
                 composition.prompt,
             ];
+        case "pi-durable": {
+            // The managed verb (`entwurf pi-durable`) carries the explicit model as pi's own
+            // `--provider`/`--model` pair, split at the FIRST `/` (the preflight already refused a model
+            // with no provider), the explicit width, and the WHOLE framing as the closed `{v,task}`
+            // payload — the durable bootstrap submits it to the root once, after the birth. The
+            // caller's address rides the env pair, never this payload.
+            const at = model.indexOf("/");
+            if (at <= 0 || at === model.length - 1) {
+                throw new Error(`fresh-call composition: pi-durable model ${JSON.stringify(model)} is not <provider>/<model id>`);
+            }
+            return [
+                "pi-durable",
+                "--provider",
+                model.slice(0, at),
+                "--model",
+                model.slice(at + 1),
+                "--width",
+                "task-wide",
+                `--${OMP_BOOTSTRAP_FLAG}`,
+                JSON.stringify({ v: OMP_BOOTSTRAP_VERSION, task: composition.prompt }),
+            ];
+        }
     }
 }
 /**

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-sender-identity.js

@@ -57,7 +57,13 @@ import { resolveNativePushAdapter } from "./native-push/adapter.js";
  * exactly the #46 defect on agy, and copilot joined the list only once its own hook wrote one
  * (#82 RAIL 5b). Membership says a marker may EXIST, never that a reply can land: the reply
  * rail is chosen from `nativePushSupported` at the bridge, not from this list. */
-export const META_SENDER_BACKENDS = ["claude-code", "antigravity", "copilot", "omp"];
+export const META_SENDER_BACKENDS = [
+    "claude-code",
+    "antigravity",
+    "copilot",
+    "omp",
+    "pi-durable",
+];
 /**
  * Two live native sessions claim this MCP process as their own. We can SEE both identities but
  * cannot say which one is calling, so we send under neither. Choosing by lookup order, backend