@junghanacs/entwurf 0.30.1 → 0.32.0

package/docs/setup-clean-host.md

@@ -28,7 +28,8 @@ evidence split, and its three states must not collapse into "macOS is supported"
 | npm/pnpm | npm is bundled with Node; pnpm is required for source setup | package or source installation |
 | Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot/Codex wiring writers |
 | entwurf | global/project-local `@junghanacs/entwurf`, or a source checkout | operator command and garden capability |
-| pi | optional-by-presence, `>=1.0.0 <1.1` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| pi | optional-by-presence, `>=1.0.4 <1.1` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| Native durable (`pi-durable`) | supplied by the Entwurf package (#130): a pinned upstream v1.0.4 app carrier plus the exact 1.0.4 pi SDK set as production dependencies — setup PASS when they verify, a named FAIL otherwise (never SKIP) | the `entwurf pi-durable` contact; native birth/LIVE on this supply surface is a separate release proof (§2b) |
 | Claude Code | optional, **`>=2.1.217`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
 | OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
@@ -190,7 +191,7 @@ on Darwin; that is wiring, not a rail receipt. If `pi` is on PATH,
 Install the exact release floor, then wire the project:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@1.0.0
+npm install -g @earendil-works/pi-coding-agent@1.0.4
 pi --version
 
 cd ~/entwurf-smoke
@@ -198,7 +199,7 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported range is `>=1.0.0 <1.1`. It is a hard minimum: installing this
+The supported range is `>=1.0.4 <1.1`. It is a hard minimum: installing this
 release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
 minor. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.
@@ -282,6 +283,122 @@ emacsclient -s "${PI_EMACS_AGENT_SOCKET:-server}" --eval '(...)'
 
 </details>
 
+## 2b. Optional native durable (`pi-durable`)
+
+**#130 / 0.32 installation contract: installing Entwurf supplies pi-durable.** The
+operator clones, patches, builds and copies nothing. 0.31.0 shipped the earlier
+source-runtime route (an operator checkout of Pi 1.0.2/source `cd32f77` at a fixed XDG
+place); that route is retired, not kept as a fallback, and its runtime directory is never
+read. Durable is a separate native harness contact, not an option automatically enabled
+by `entwurf pi` or by registering ordinary Pi's adapter.
+
+What the Entwurf package supplies:
+
+1. **The pi SDK set** — `@earendil-works/{pi-coding-agent, pi-ai, pi-tui, pi-agent-core,
+   pi-durable, chord, pi-mcp, pi-codemode, pi-telemetry}` at exactly `1.0.4`, plus
+   `proper-lockfile`, as Entwurf's own production dependencies (declared once in
+   `pi/pi-durable/overlay/upstream-pin.json` `sdk`). Model data rides the published
+   `pi-ai`; there is no catalog copy.
+2. **The native app/TUI carrier** — upstream does not publish the experimental durable
+   app (`pi-coding-agent` excludes `dist/experimental`; `pi-durable` on npm is the
+   library). Entwurf ships the six pinned app files from upstream tag `v1.0.4`
+   (`7c10bd4337495ee613f2224843ecdf349b80d1df`), its narrow runtime-contact overlay
+   applied to `runtime.ts`, type-stripped and relocated, in `pi/pi-durable/carrier/`
+   with upstream's MIT license. Each file's source blob and emitted digest are in the pin.
+   The carrier reaches pi-coding-agent's internals only through its resolver
+   (`pi/pi-durable/carrier-resolver.mjs`), which maps them to the published package's
+   own `dist/` as installed — never through a source checkout.
+
+The upstream [library guide](https://github.com/earendil-works/pi/blob/v1.0.4/packages/durable/README.md)
+and [experimental app guide](https://github.com/earendil-works/pi/blob/v1.0.4/packages/coding-agent/src/experimental/durable/README.md)
+describe what the carrier is. Running the bare upstream app does not attach Entwurf's
+garden contact. Entwurf does not rebuild the controller/model/auth/storage system or
+proxy a subscription; native execution, models, auth, queues, SQLite and recovery stay
+upstream-owned.
+
+### What Entwurf checks
+
+The carrier is runnable only when, read from where Entwurf is installed: every pinned
+carrier file, the license, the resolver and its relocation grammar are present
+(`pi-durable-package-incomplete`); each carrier file carries its pinned digest
+(`pi-durable-carrier-drift`); every declared SDK package resolves from the carrier
+(`pi-durable-sdk-absent`); and every reachable physical edge — from the carrier to each package,
+and from every package copy it reaches, at any depth, to its own `@earendil-works` dependencies —
+lands on a package of the declared name at exactly the pinned version (`pi-durable-sdk-mismatch`). The members declare one another with caret
+ranges, so semver satisfaction is not the contract; the bytes an import binds are. Sharing
+one copy with an aligned host install of the same version is an ordinary layout. A mixed
+tree (for example an override that binds pi-durable's `pi-ai` one patch behind) still
+*imports* — which is why the edge check exists — and is refused by name.
+
+- `entwurf setup` reports a `pi-durable` row from that check and writes no durable wiring:
+  **PASS** when it verifies, **FAIL** with the named refusal otherwise — never SKIP, because
+  nothing is optional to detect: a missing piece is an incomplete installation, repaired by
+  reinstalling Entwurf.
+- `entwurf pi-durable [args…]` is the managed launch. It verifies first (exit 3 on any
+  refusal), then runs the packaged bootstrap `pi/pi-durable/bootstrap.mjs` under the carrier
+  resolver, owning this terminal:
+
+  ```bash
+  entwurf pi-durable --provider <provider> --model <exact catalog id> --width task-wide
+  entwurf pi-durable --continue    # this directory's newest durable session
+  ```
+
+  The bootstrap imports only the compiled closure shipped beside it
+  (`mcp/entwurf-bridge/dist/…`); a source checkout needs a built bridge
+  (`pnpm run build-bridge`) and its development dependencies installed first.
+  `plugins/pi-durable/bootstrap.mjs` is only the checkout path that re-exports it.
+
+- **One explicit native module (optional).** Add `--native-module <absolute file>` to either
+  launch to load ONE module of your own. It is an ordinary ES module: its top-level code (top-level
+  await included) runs first, before the TUI and the durable runtime load, so it can prepare the
+  environment the provider runtime and tool children will read; its default export is a native
+  durable `Extension` (`{ name, tools?, sections?, hooks?, … }`, the upstream durable API, not
+  ordinary Pi's `ExtensionAPI`), installed after Entwurf's contact. An env-only module exports
+  just `{ name }`. Refused by name before anything opens: a relative or non-file path
+  (`native-module-path-*`), a module that throws (`native-module-import-failed`), a function or
+  nameless default (`native-module-export-invalid`), an extension named like one the app installs
+  itself (`entwurf`, `coding-tools`, `pi-prompt`, `subagent`) or a tool named like one of Entwurf's
+  contact tools (`native-module-name-reserved`; any other duplicate is the native registry's to
+  judge), and a module whose initialization changes
+  `PI_SESSION_ID`, `PI_CODING_AGENT_DIR`, `HOME` or any `ENTWURF_*` (`native-module-env-identity-changed`)
+  or the process directory (`native-module-cwd-changed`). Your module is trusted code; those
+  checks catch mistakes, they do not sandbox it. Nothing else names a module — no directory,
+  setting or profile — and a sibling opened by `entwurf_fresh_call` starts without one.
+
+- **Known warning.** Ordinary Pi may print `Host-provided extension packages must be declared in
+  peerDependencies with a "*" range, not dependencies: @earendil-works/…` for Entwurf's
+  `package.json`. Entwurf declares the exact pi SDK set as production dependencies on purpose:
+  the installed copies serve the separate pi-durable native process. Pi's check reads that
+  manifest field; it is a known constraint of supplying both from one package, accepted for 0.32,
+  not a claim that every load path is harmless.
+
+The ordinary Pi CLI on PATH is a separate subject (§2, range `>=1.0.4 <1.1`): a host Pi is
+not needed to run pi-durable, and a host inside the range need not be the same copy as the
+carrier's. Native Pi owns credentials, model settings and durable SQLite sessions; keep them
+in place rather than copying credentials or migrating ordinary Pi transcripts. Native
+recovery does not prove exactly-once Entwurf dispatch or inbox read recovery. The contact
+provides garden attachment, visible identity and announce-only root-directed self-fetch.
+Package gates prove the installed carrier's load, its physical edges and the public launch up
+to the app's own model resolution; the checkout contact/send/receive gates run the same carrier
+with scripted S plus native H; Pi ↔ pi-durable LIVE on this supply surface is a separate release
+proof ([#130](https://github.com/junghan0611/entwurf/issues/130)).
+
+### Maintainer: re-emitting the carrier
+
+Only a maintainer moving the pin runs `scripts/emit-pi-durable-carrier.ts`. It reads the
+pinned commit's objects (`<commit>:<path>`, `--no-replace-objects`) from a repository the
+maintainer names, applies the overlay patch with `git apply` in a private scratch tree,
+type-strips with Node's own strip-only TypeScript, relocates, and checks that the six files
+import exactly the pin's declared `distTargets`:
+
+```bash
+node scripts/emit-pi-durable-carrier.ts --source <clone holding the pinned commit> --write
+node scripts/emit-pi-durable-carrier.ts --source <clone holding the pinned commit> --check  # rebuild equality
+```
+
+`--check` without such a repository is a named SKIP, never rebuild acceptance; the emitter
+version (Node) is part of the pin.
+
 ## 3. Optional Claude Code native citizen
 
 This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending physical
@@ -445,7 +562,7 @@ as a note rather than a fault.
 
 **entwurf sets no OMP version floor in code, and will not grow one on schedule.** Detection is
 presence-only (`command -v "${OMP_BIN:-omp}"`); there is no `entwurf.ompFloor`, no coherence
-gate, and no exact pin — unlike Node (`engines.node`), pi (`>=1.0.0 <1.1`) and Claude Code
+gate, and no exact pin — unlike Node (`engines.node`), pi (`>=1.0.4 <1.1`) and Claude Code
 (`entwurf.claudeCodeFloor`), each of which has an enforcement point. That asymmetry is a
 decision, not an omission. A floor is the answer to a vendor that fails SILENTLY — Claude Code
 earned one because an older binary validates the exec manifest, drops `args` at runtime, and

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -630,8 +630,8 @@ server.tool("entwurf_register_native", "Register an ALREADY-RUNNING native conve
 server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling beside you and hand it a first task. WHERE it opens is decided by where THIS " +
     "agent runs, never by a parameter: inside herdr (HERDR_ENV=1) it opens a NEW UNFOCUSED TAB in your own " +
     "herdr workspace, pi and claude-code " +
-    "only; everywhere else it opens in the operator's tmux with all five backends (pi, " +
-    "claude-code, copilot, omp, codex). No fallback: an incomplete herdr context is refused by name, " +
+    "only; everywhere else it opens in the operator's tmux with all six backends (pi, " +
+    "claude-code, copilot, omp, codex, pi-durable). No fallback: an incomplete herdr context is refused by name, " +
     "never by a tmux window you cannot see from herdr. The sibling's FIRST action " +
     "is a callback to you carrying a nonce, whose sender envelope is its garden id — that is how you learn the " +
     "address of a thing that did not exist a moment ago. This returns a LAUNCH receipt (the owner's " +
@@ -639,8 +639,8 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling beside you and
     "the task was delivered. Those coordinates are a VIEW, never an address — a herdr tab/pane id can change under " +
     "a running sibling. Nothing polls. " +
     "For EXISTING citizens use entwurf_v2 — this tool only creates, and entwurf_peers only reports. Model is REQUIRED and passed to the chosen " +
-    "runtime CLI (`provider/model` for pi, an id/alias for Claude Code, a pattern for the rest). On tmux, copilot/omp/codex are refused BEFORE any window " +
-    "opens when their birth, MCP, receive or visible-identity units are absent, and codex also needs the " +
+    "runtime CLI (`provider/model` for pi, an id/alias for Claude Code, `provider/model id` exactly as the catalog names it for pi-durable, a pattern for the rest). On tmux, copilot/omp/codex/pi-durable are refused BEFORE any window " +
+    "opens when their birth, MCP, receive or visible-identity units are absent, pi-durable also on named refusals of its installed carrier or exact SDK set, and codex also needs the " +
     "operator-owned app-server socket entwurf never starts; in herdr they are refused by name first. " +
     "Optional placement.tmuxSession is a TMUX-ONLY seat naming ONE EXISTING session and " +
     "ALWAYS wins; omitted, the seat follows the CALLER, never the backend opened: a CODEX CALLER opens beside " +
@@ -648,8 +648,8 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling beside you and
     "NOTHING is created. In herdr the field is refused by name. Do not put secrets in the task — model and task argv are visible to same-user " +
     "processes.", {
     backend: z
-        .enum(["pi", "claude-code", "copilot", "omp", "codex"])
-        .describe("Which fixed runtime to open. Only these five, and only pi/claude-code when this agent runs inside herdr; there is no arbitrary command."),
+        .enum(["pi", "claude-code", "copilot", "omp", "codex", "pi-durable"])
+        .describe("Which fixed runtime to open. Only these six, and only pi/claude-code when this agent runs inside herdr; there is no arbitrary command."),
     model: z
         .string()
         .min(1)
@@ -663,7 +663,7 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling beside you and
         // as an unused suppression while the escape goes back to being fixable.
         // biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above
         .regex(/^[A-Za-z0-9][A-Za-z0-9._/:\[\]-]*$/)
-        .describe("Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot/OMP/Codex model name."),
+        .describe("Required runtime model: canonical provider/model for pi, provider/<exact catalog model id> for pi-durable, a Claude Code model id/alias, or a Copilot/OMP/Codex model name."),
     task: z
         .string()
         .min(1)

package/mcp/entwurf-bridge/dist/pi-extensions/entwurf-capabilities.json

@@ -6,6 +6,7 @@
 		"codex": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "threadId" },
 		"copilot": { "wakeMode": "self-fetch", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" },
 		"omp": { "wakeMode": "self-fetch", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" },
+		"pi-durable": { "wakeMode": "self-fetch", "deliveryLevel": "D2", "nativeIdLabel": "sessionId" },
 		"pi": { "wakeMode": "direct-inject", "deliveryLevel": "D6", "nativeIdLabel": "sessionId" }
 	}
 }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-deliverability.js

@@ -105,7 +105,13 @@ export function receiverMarkerMatchesIdentity(marker, identity) {
 // previous garden in-process on its `/new` edge (the unarm the claude hook lacked),
 // so the cell this join closes has a different owner there. Admitting it needs its
 // own measurement, not this file's optimism.
-export const SENDER_JOINED_RECEIVER_OWNER_KINDS = ["claude-code-cli"];
+//
+// `pi-durable-host` is admitted because the join holds by construction: the durable contact
+// writes its sender marker under the host's own pid and arms its watch in that same process
+// (`meta-bridge-pi-durable.ts`), so the receiver marker's `ownerPid` IS the sender-marker key.
+// Inside the scope a host whose sender marker is gone or names another garden is a retired
+// watch, which is the refusal this admission exists to make reachable.
+export const SENDER_JOINED_RECEIVER_OWNER_KINDS = ["claude-code-cli", "pi-durable-host"];
 /** Does this watch owner share its pid with the backend's sender marker? */
 export function receiverOwnerKindJoinsSender(ownerKind) {
     return SENDER_JOINED_RECEIVER_OWNER_KINDS.includes(ownerKind);

package/mcp/entwurf-bridge/dist/pi-extensions/lib/fresh-call-composition.js

@@ -23,11 +23,12 @@
  */
 import { randomBytes } from "node:crypto";
 /** The backends this rail can open. Fixed set, not a profile — a further one is a decision,
- * not a config entry. `copilot` was added by #82 RAIL 9, `omp` by #87 Bundle C, and `codex`
- * by #95 after its system birth and app-server rails were measured. The set is joined to the
+ * not a config entry. `copilot` was added by #82 RAIL 9, `omp` by #87 Bundle C, `codex`
+ * by #95 after its system birth and app-server rails were measured, and `pi-durable` by #129
+ * (the durable app this package carries, through the managed `entwurf pi-durable`). The set is joined to the
  * citizen backends by `check-harness-admission-parity`: a harness that mints records but is
  * missing HERE is not an unwired convenience, it is a release blocker. */
-export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp", "codex"];
+export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp", "codex", "pi-durable"];
 /**
  * The callback tool NAME differs per backend and that is not cosmetic: every session reaches the
  * capability under whatever name its harness composes for the `entwurf-bridge` MCP server, and
@@ -64,6 +65,11 @@ export const FRESH_CALL_CALLBACK_TOOL = {
     // Codex's tool process is the operator app-server, not the pane: the no-arg
     // verb refuses there by name. First action stays the delivery verb with args.
     codex: "mcp__entwurf_bridge__entwurf_v2",
+    // The durable contact registers the bridge verbs as its OWN tools under their bare names, and the
+    // app offers a tool to the model by its registered name (`durable/harness/registry.ts:99`
+    // @cd32f77). Measured for `entwurf_v2` on the S+native-H wire (receipt 4012c066); the callback
+    // spelling follows the same rule and is owed its first LIVE observation.
+    "pi-durable": "entwurf_callback",
 };
 /** Where a sibling SENDS the task result. Always the delivery verb, never the birth callback. */
 export const FRESH_CALL_DELIVERY_TOOL = {
@@ -72,6 +78,7 @@ export const FRESH_CALL_DELIVERY_TOOL = {
     copilot: "entwurf-bridge-entwurf_v2",
     omp: "mcp__entwurf_bridge_entwurf_v",
     codex: "mcp__entwurf_bridge__entwurf_v2",
+    "pi-durable": "entwurf_v2",
 };
 /**
  * The same dialects, for the tool the framing OFFERS rather than requires.
@@ -93,6 +100,7 @@ export const FRESH_CALL_PEERS_TOOL = {
     copilot: "entwurf-bridge-entwurf_peers",
     omp: "mcp__entwurf_bridge_entwurf_peers",
     codex: "mcp__entwurf_bridge__entwurf_peers",
+    "pi-durable": "entwurf_peers",
 };
 /**
  * ONE BACKEND NEEDS TO BE TOLD HOW TO REACH ITS OWN CALLBACK TOOL `[측정 2026-09-18, n=5 + n=3]`.
@@ -132,6 +140,7 @@ export const FRESH_CALL_TOOL_LOAD_HINT = {
     copilot: [],
     omp: [],
     codex: [],
+    "pi-durable": [],
 };
 /**
  * The omp bootstrap flag, spelled WITHOUT dashes — the vendor's flag map is keyed by bare
@@ -311,6 +320,28 @@ export function composeBackendArgs(backend, composition, model, resolveCodexSock
                 "--dangerously-bypass-approvals-and-sandbox",
                 composition.prompt,
             ];
+        case "pi-durable": {
+            // The managed verb (`entwurf pi-durable`) carries the explicit model as pi's own
+            // `--provider`/`--model` pair, split at the FIRST `/` (the preflight already refused a model
+            // with no provider), the explicit width, and the WHOLE framing as the closed `{v,task}`
+            // payload — the durable bootstrap submits it to the root once, after the birth. The
+            // caller's address rides the env pair, never this payload.
+            const at = model.indexOf("/");
+            if (at <= 0 || at === model.length - 1) {
+                throw new Error(`fresh-call composition: pi-durable model ${JSON.stringify(model)} is not <provider>/<model id>`);
+            }
+            return [
+                "pi-durable",
+                "--provider",
+                model.slice(0, at),
+                "--model",
+                model.slice(at + 1),
+                "--width",
+                "task-wide",
+                `--${OMP_BOOTSTRAP_FLAG}`,
+                JSON.stringify({ v: OMP_BOOTSTRAP_VERSION, task: composition.prompt }),
+            ];
+        }
     }
 }
 /**

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-sender-identity.js

@@ -57,7 +57,13 @@ import { resolveNativePushAdapter } from "./native-push/adapter.js";
  * exactly the #46 defect on agy, and copilot joined the list only once its own hook wrote one
  * (#82 RAIL 5b). Membership says a marker may EXIST, never that a reply can land: the reply
  * rail is chosen from `nativePushSupported` at the bridge, not from this list. */
-export const META_SENDER_BACKENDS = ["claude-code", "antigravity", "copilot", "omp"];
+export const META_SENDER_BACKENDS = [
+    "claude-code",
+    "antigravity",
+    "copilot",
+    "omp",
+    "pi-durable",
+];
 /**
  * Two live native sessions claim this MCP process as their own. We can SEE both identities but
  * cannot say which one is calling, so we send under neither. Choosing by lookup order, backend

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js

@@ -76,7 +76,7 @@ export class MetaRecordError extends Error {
  * every write, including its own. `./run.sh doctor-meta-bridge` already flags a
  * stale deployed writer — run it after the change.
  */
-export const META_BACKENDS = ["claude-code", "antigravity", "codex", "copilot", "omp"];
+export const META_BACKENDS = ["claude-code", "antigravity", "codex", "copilot", "omp", "pi-durable"];
 export const META_BACKEND_DESCRIPTORS = {
     "claude-code": {
         backend: "claude-code",
@@ -189,6 +189,24 @@ export const META_BACKEND_DESCRIPTORS = {
         deliveryLevel: "D6",
         nativeIdLabel: "sessionId",
     },
+    // The long-running durable app (#129). Graded only as far as its RECORDED receipts reach.
+    //   sessionId the durable session directory name `<13-digit ms>-<uuid>` that
+    //             `selectSession` creates and `--continue` reopens
+    //             (`experimental/durable/sessions.ts:18-55` @cd32f77), surfaced as
+    //             `view.current().session.id`. Not `pi.provider.sessionId`, which a
+    //             fork changes.
+    //   D2        receiver armed: the contact mints the record, names the host as sender, and arms
+    //             a root doorbell (the receiver marker is owned by the host pid as `pi-durable-host`,
+    //             which the owner join admits). The addressed-enqueue → idle-wake → root-notice → drain
+    //             chain has ONE recorded receipt, on the scripted-model + native-harness lab cell
+    //             (`check-pi-durable-receive`, S+H, V not run) — lab evidence, not a vendor-turn D4–D6
+    //             acceptance, and no sibling-isolation (D3) or LIVE fresh receipt exists yet.
+    "pi-durable": {
+        backend: "pi-durable",
+        wakeMode: "self-fetch",
+        deliveryLevel: "D2",
+        nativeIdLabel: "sessionId",
+    },
 };
 // ---------------------------------------------------------------------------
 // Validation helpers (crash, don't warn)
@@ -261,7 +279,15 @@ function isoNow(now) {
 /** The one live identity schema number. */
 export const META_SCHEMA_VERSION_V3 = 3;
 /** Every backend admitted by the one V3 record-citizen schema. */
-export const META_CITIZEN_BACKENDS = ["claude-code", "antigravity", "codex", "copilot", "omp", "pi"];
+export const META_CITIZEN_BACKENDS = [
+    "claude-code",
+    "antigravity",
+    "codex",
+    "copilot",
+    "omp",
+    "pi-durable",
+    "pi",
+];
 export function requireCitizenBackend(value) {
     if (typeof value !== "string" || !META_CITIZEN_BACKENDS.includes(value)) {
         throw new MetaRecordError(`meta-record "backend" must be one of ${META_CITIZEN_BACKENDS.join(" | ")} (got ${describe(value)}).`);

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-fresh-call.js

@@ -95,6 +95,8 @@ import { assertLaunchTarget, LaunchPreconditionError, resolveRuntimeOnPath, } fr
 import { APPEND_FORMAT, assertSelector, assertTmuxOk, inspectPlacement, parseWindowFields, requireSameContext, runTmux, } from "./mux-placement.js";
 import { resolveCodexDefaultSocketPath } from "./native-push/codex-ws-client.js";
 import { OMP_PREFLIGHT_HINT, ompFreshPreflight } from "./omp-fresh-preflight.js";
+import { PI_DURABLE_PREFLIGHT_HINT, piDurableFreshPreflight, } from "./pi-durable-fresh-preflight.js";
+import { checkPiDurableRuntime, PI_DURABLE_RUNTIME_HINT, piDurablePackageLayout } from "./pi-durable-runtime.js";
 import { classifyTmuxSessionName, resolveTmuxSessionId } from "./resolve-tmux-session.js";
 /**
  * THE COMPOSITION MOVED, THE RAIL DID NOT (#116 S2-a). Backend argv, the first-turn framing and
@@ -154,6 +156,10 @@ export const FRESH_CALL_RUNTIME = {
     copilot: "entwurf",
     omp: "omp",
     codex: "codex",
+    // #129/#130: like copilot, a MANAGED verb and never the bare app. The durable app is this
+    // package's carrier and runs under the carrier's resolver; `entwurf pi-durable` is the one fixed
+    // invocation that verifies the carrier and its SDK set and execs the packaged bootstrap.
+    "pi-durable": "entwurf",
 };
 /**
  * WHICH RULE PICKS THE TARGET SESSION. Three in strict order, and the order is the contract:
@@ -197,9 +203,9 @@ export function selectFreshCallSeat(placement) {
  * for. That is sufficient and not a compromise: every reader of the carrier trims and tests
  * truthiness (`index.ts:212-217`), so empty and absent are the same answer by construction.
  *
- * It is applied to all five backends because the leak is a property of tmux, not of a vendor. A
+ * It is applied to all six backends because the leak is a property of tmux, not of a vendor. A
  * scrub only on the backend whose measurement surfaced it would encode the claim that the other
- * four are immune, which is false. It costs the legitimate case nothing: a carrier is only ever
+ * five are immune, which is false. It costs the legitimate case nothing: a carrier is only ever
  * authoritative when the process that owns it exported it ITSELF, and a fresh `pi` sibling does
  * exactly that after this argv has run. This is a fixed seam and deliberately NOT a general env
  * carrier — an arbitrary `-e` passthrough would hand callers the environment-shaping power this
@@ -337,6 +343,24 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
         if (missing)
             return { ok: false, reason: missing };
     }
+    if (params.backend === "pi-durable") {
+        // The framed first input is computed here only to MEASURE it against the bootstrap payload
+        // cap; the same pure function composes it again below. The carrier is verified from THIS
+        // process's package closure, before anything is placed. The window runs whatever `entwurf`
+        // PATH names, and the managed verb re-verifies its own package before it execs anything, so
+        // the window never runs an unverified carrier — but when the two package closures differ, this
+        // verdict and the window's can disagree, and the window is left showing its own refusal.
+        const layout = piDurablePackageLayout();
+        const runtime = layout === null ? null : checkPiDurableRuntime(layout);
+        const missing = piDurableFreshPreflight({
+            model,
+            firstInput: buildFreshCallPrompt({ backend: params.backend, task, callerGardenId, nonce }),
+            layout,
+            runtime: runtime === null || runtime.ok ? null : runtime.reason,
+        });
+        if (missing)
+            return { ok: false, reason: missing };
+    }
     const inspected = inspectPlacement(env);
     if (!inspected.ok)
         return { ok: false, reason: inspected.reason };
@@ -448,6 +472,8 @@ const REJECT_HINT = {
     // the sentence an operator reads cannot drift away from the predicate that produced it.
     ...COPILOT_PREFLIGHT_HINT,
     ...OMP_PREFLIGHT_HINT,
+    ...PI_DURABLE_RUNTIME_HINT,
+    ...PI_DURABLE_PREFLIGHT_HINT,
     ...CODEX_PREFLIGHT_HINT,
     ...CODEX_CALLER_PREFLIGHT_HINT,
     ...CODEX_CALLER_SEAT_HINT,

package/mcp/entwurf-bridge/dist/pi-extensions/lib/pi-durable-fresh-preflight.js

@@ -0,0 +1,92 @@
+/**
+ * pi-durable-fresh-preflight — the pre-mutation check a pi-durable fresh call needs (#129 W, L6;
+ * `docs/adding-a-harness.md` step 9 clauses 2, 3 and 5).
+ *
+ * Same question as `omp-fresh-preflight.ts`, at the same moment: before `mux-fresh-call` mutates the
+ * operator's tmux session, is everything the fresh contract needs actually in place? A refusal HERE,
+ * before placement, leaves no window behind. A pass here does not promise the window's own pass: the
+ * managed verb re-verifies inside the window, whose env is the tmux SERVER's and whose `entwurf` is
+ * whatever PATH names, so under env or package-closure skew it can still refuse after the window
+ * exists — and that refusal is left showing in it.
+ *
+ * ── The inputs, first ──
+ *
+ *   model         the fresh-call model grammar already admits `/`, and a durable launch needs the
+ *                 provider spelled out (the bootstrap refuses a model resolved by inference), so
+ *                 the model here is `<provider>/<model id>` split at the FIRST `/` — a catalog id
+ *                 that itself contains `/` keeps it. A model with no provider part is refused.
+ *   first input   the whole framing (callback first, then the task) rides the bootstrap's closed
+ *                 `{v:2,task}` payload, whose decoder caps `task` at 16000 characters. A framed
+ *                 task over that cap would open a window whose bootstrap refuses its own argv.
+ *
+ * ── Then the carrier, then the four units ──
+ *
+ *   carrier          the package's own pi-durable carrier and its declared SDK set, verified
+ *                    (`pi-durable-runtime.ts`); passed in as that check's verdict.
+ *   birth            the compiled contact in this package's closure — it mints the record.
+ *   MCP hand         the compiled entwurf-bridge entry in the same closure — the contact spawns it.
+ *   receive          the compiled owner join in the same closure admits `pi-durable-host`; without
+ *                    it every dispatch to the citizen is the honest `mailbox-undeliverable`.
+ *   visible identity the packaged bootstrap — the one that hands the TUI the view whose conversation
+ *                    labels carry the garden id.
+ *
+ * ── What this deliberately does NOT claim ──
+ *
+ * Filesystem truth about ONE package closure and the SDK it resolves. It does not prove the durable
+ * app opens, the bridge connects, the doorbell arms or a garden id renders — that is runtime truth for
+ * the clause 7 LIVE receipt. No spawn, no network, no mutation; every path arrives as an argument, so
+ * this leaf imports nothing but types.
+ */
+import { existsSync, readFileSync } from "node:fs";
+/** The bootstrap decoder's task cap (`meta-bridge-omp.ts` OMP_BOOTSTRAP_TASK_MAX_CHARS); the beside
+ * test holds the two equal. */
+export const PI_DURABLE_FIRST_INPUT_MAX_CHARS = 16000;
+/** `<provider>/<model id>` at the FIRST `/`, or `null` when either side is empty. */
+export function splitPiDurableModel(model) {
+    const at = model.indexOf("/");
+    if (at <= 0 || at === model.length - 1)
+        return null;
+    return { provider: model.slice(0, at), model: model.slice(at + 1) };
+}
+/** The compiled owner join, read from the emitted bytes the bridge actually loads. */
+function ownerJoinAdmitsDurableHost(file) {
+    try {
+        const join = /SENDER_JOINED_RECEIVER_OWNER_KINDS\s*=\s*(\[[^\]]*\])/.exec(readFileSync(file, "utf8"))?.[1];
+        return join?.includes('"pi-durable-host"') ?? false;
+    }
+    catch {
+        // Bounded environment probe: an unreadable file is a missing unit.
+        return false;
+    }
+}
+/** The FIRST missing thing, in repair order, or `null` when a fresh launch may proceed. */
+export function piDurableFreshPreflight(params) {
+    if (splitPiDurableModel(params.model) === null)
+        return "pi-durable-model-not-provider-qualified";
+    if (params.firstInput.length > PI_DURABLE_FIRST_INPUT_MAX_CHARS)
+        return "pi-durable-first-input-too-long";
+    if (params.layout === null)
+        return "pi-durable-package-incomplete";
+    if (params.runtime !== null)
+        return params.runtime;
+    const layout = params.layout;
+    if (!existsSync(layout.adapter))
+        return "pi-durable-birth-unit-missing";
+    if (!existsSync(layout.bridgeEntry))
+        return "pi-durable-mcp-hand-missing";
+    if (!ownerJoinAdmitsDurableHost(layout.deliverability))
+        return "pi-durable-receive-unit-missing";
+    if (!existsSync(layout.bootstrap))
+        return "pi-durable-visible-identity-missing";
+    return null;
+}
+/** Repair text beside the predicate that decides it. The runtime reasons keep theirs on the runtime
+ * leaf; `mux-fresh-call` spreads both tables. */
+export const PI_DURABLE_PREFLIGHT_HINT = {
+    "pi-durable-model-not-provider-qualified": "a pi-durable model is `<provider>/<model id>` — the durable bootstrap resolves no provider by inference",
+    "pi-durable-first-input-too-long": "the framed first input exceeds the 16000-character bootstrap payload cap — shorten the task",
+    "pi-durable-birth-unit-missing": "this Entwurf package has no compiled pi-durable contact (mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-pi-durable.js), so the sibling would mint no record — reinstall or rebuild Entwurf",
+    "pi-durable-mcp-hand-missing": "this Entwurf package has no compiled entwurf-bridge entry, so the sibling's callback tool would not exist — reinstall or rebuild Entwurf",
+    "pi-durable-receive-unit-missing": "this Entwurf package's compiled owner join does not admit pi-durable-host, so nothing could ever be delivered to the sibling — reinstall or rebuild Entwurf",
+    "pi-durable-visible-identity-missing": "this Entwurf package has no packaged pi-durable bootstrap (pi/pi-durable/bootstrap.mjs), so no TUI would carry the garden id — reinstall Entwurf",
+};