@junghanacs/entwurf 0.30.1 → 0.32.0

package/pi/pi-durable/carrier-relocation.mjs

@@ -0,0 +1,160 @@
+// The pi-durable carrier's ONE relocation grammar (#130), shared by the maintainer emitter
+// (scripts/emit-pi-durable-carrier.ts) and the runtime resolver (./carrier-resolver.mjs), so the
+// rewrite the emitter performs and the resolution the runtime accepts cannot drift apart.
+//
+// The durable app is source-only upstream: published `@earendil-works/pi-coding-agent` ships no
+// `dist/experimental`, and its exports map exposes no deep `dist/` path. The carrier is the pinned
+// upstream app files, type-stripped, with exactly two rewrites:
+//
+//   "./<sibling>.ts"   → "./<sibling>.js"                 a carrier file importing another carrier file
+//   "../../<path>.ts"  → entwurf-pi-dist:<path>.js        the app importing a pi-coding-agent internal
+//
+// Every other specifier — `@earendil-works/*`, `proper-lockfile`, `node:*` — is left untouched and
+// resolves by Node's own rules from where the carrier is installed. The reserved scheme is chosen so
+// that a carrier loaded WITHOUT the resolver fails by name (Node refuses an unknown URL scheme) rather
+// than quietly resolving `../../` inside this package. The resolver accepts the scheme only from a
+// declared carrier file and only for a declared target, and maps it to that file under the PHYSICAL
+// root of the pi-coding-agent the carrier itself resolves — never through the exports map.
+//
+// Plain JS on purpose: the resolver is preloaded with `node --import` from an installed package,
+// where Node does not strip types, and it must not depend on the compiled bridge closure.
+
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+export const CARRIER_SCHEME = "entwurf-pi-dist:";
+export const CODING_AGENT = "@earendil-works/pi-coding-agent";
+
+/** A refusal with a stable name first, as the bootstrap's. */
+function refuse(reason, detail) {
+	return Object.assign(new Error(`${reason}: ${detail}`), { reason });
+}
+
+/** A static import, export-from or side-effect import statement as upstream writes them: double quotes,
+ * the statement ending its line. A multi-line `import {` … `} from "x";` matches from its `import`. */
+const STATEMENT = /^(\s*(?:import|export|\})[^;]*?\bfrom\s*")([^"]+)(";[ \t]*)$|^(\s*import\s*")([^"]+)(";[ \t]*)$/gm;
+/** Every place a module specifier can begin — the statements above, and anything they would miss. */
+const ANY_SPECIFIER = /\b(?:from|import)\s*["'(]/g;
+
+/**
+ * Rewrite one type-stripped carrier source. `siblings` are the carrier file names (`runtime.js` …),
+ * `targets` the declared pi-coding-agent dist paths (`core/model-runtime.js` …). Throws by name on a
+ * relative specifier outside those two rules, a dynamic import, or a specifier the statement grammar
+ * did not recognize. Returns the rewritten code and the targets it used.
+ *
+ * @param {string} file
+ * @param {string} code
+ * @param {{ siblings: readonly string[], targets: readonly string[] }} declared
+ * @returns {{ code: string, used: string[] }}
+ */
+export function relocateCarrierSource(file, code, { siblings, targets }) {
+	const used = new Set();
+	let statements = 0;
+	const rewrite = (spec) => {
+		if (spec.startsWith("./")) {
+			const name = `${spec.slice(2, -3)}.js`;
+			if (!spec.endsWith(".ts") || !siblings.includes(name)) {
+				throw refuse("carrier-relocation-unknown-sibling", `${file} imports ${spec}`);
+			}
+			return `./${name}`;
+		}
+		if (spec.startsWith("../../")) {
+			const target = `${spec.slice(6, -3)}.js`;
+			if (!spec.endsWith(".ts") || !targets.includes(target)) {
+				throw refuse("carrier-relocation-unknown-target", `${file} imports ${spec}`);
+			}
+			used.add(target);
+			return `${CARRIER_SCHEME}${target}`;
+		}
+		if (spec.startsWith(".") || spec.startsWith("/") || spec.startsWith(CARRIER_SCHEME)) {
+			throw refuse("carrier-relocation-unknown-relative", `${file} imports ${spec}`);
+		}
+		return spec;
+	};
+	const out = code.replace(STATEMENT, (_all, headA, specA, tailA, headB, specB, tailB) => {
+		statements++;
+		return headA !== undefined ? `${headA}${rewrite(specA)}${tailA}` : `${headB}${rewrite(specB)}${tailB}`;
+	});
+	const begun = (code.match(ANY_SPECIFIER) ?? []).length;
+	if (begun !== statements) {
+		throw refuse(
+			"carrier-relocation-unrecognized-import",
+			`${file}: ${begun} specifier openings, ${statements} recognized statements (a dynamic import, a single-quoted or mid-line import)`,
+		);
+	}
+	return { code: out, used: [...used].sort() };
+}
+
+/**
+ * The carrier section of the packaged pin, validated. A malformed pin throws (crash, don't warn).
+ *
+ * @param {URL | string} pinPath
+ * @returns {{ files: string[], targets: string[] }}
+ */
+export function readCarrierDeclaration(pinPath) {
+	const pin = JSON.parse(readFileSync(pinPath, "utf8"));
+	const carrier = pin?.carrier;
+	const names = Array.isArray(carrier?.files) ? carrier.files.map((f) => f?.name) : undefined;
+	const targets = carrier?.distTargets;
+	const plain = (s) => typeof s === "string" && /^[a-z0-9-]+(?:\/[a-z0-9-]+)*\.js$/.test(s);
+	if (!names?.every(plain) || names.length === 0 || names.some((n) => n.includes("/"))) {
+		throw refuse("pi-durable-carrier-pin-malformed", "carrier.files must name plain carrier .js files");
+	}
+	if (!Array.isArray(targets) || targets.length === 0 || !targets.every(plain)) {
+		throw refuse("pi-durable-carrier-pin-malformed", "carrier.distTargets must list relative dist .js paths");
+	}
+	return { files: names, targets };
+}
+
+/**
+ * The PHYSICAL `dist/` directory of the pi-coding-agent the carrier resolves, from the URL its root
+ * export resolved to (`<root>/dist/index.js`). Refuses by name when that is not the package root.
+ *
+ * @param {string} rootExportUrl
+ */
+export function codingAgentDistFrom(rootExportUrl) {
+	const entry = rootExportUrl.startsWith("file:") ? fileURLToPath(rootExportUrl) : "";
+	const dist = path.dirname(entry);
+	const root = path.dirname(dist);
+	const manifest = path.join(root, "package.json");
+	if (path.basename(entry) !== "index.js" || path.basename(dist) !== "dist" || !existsSync(manifest)) {
+		throw refuse(
+			"pi-durable-carrier-host-root",
+			`${CODING_AGENT} resolved to ${rootExportUrl}, not <root>/dist/index.js`,
+		);
+	}
+	const name = JSON.parse(readFileSync(manifest, "utf8")).name;
+	if (name !== CODING_AGENT) {
+		throw refuse("pi-durable-carrier-host-root", `${manifest} names ${JSON.stringify(name)}, not ${CODING_AGENT}`);
+	}
+	return dist;
+}
+
+/**
+ * Resolve one reserved specifier. Only a declared carrier file may ask, only for a declared target,
+ * and the target file must exist. Returns the file URL; everything else throws by name.
+ *
+ * @param {string} specifier  begins with CARRIER_SCHEME
+ * @param {string | undefined} parentURL
+ * @param {{ carrierDirUrl: string, files: readonly string[], targets: readonly string[], dist: () => string }} declared
+ */
+export function resolveCarrierSpecifier(specifier, parentURL, { carrierDirUrl, files, targets, dist }) {
+	const parent =
+		typeof parentURL === "string" && parentURL.startsWith(carrierDirUrl) ? parentURL.slice(carrierDirUrl.length) : "";
+	if (!files.includes(parent)) {
+		throw refuse(
+			"pi-durable-carrier-specifier-origin",
+			`${specifier} asked from ${parentURL ?? "no parent"}, not a carrier file`,
+		);
+	}
+	const target = specifier.slice(CARRIER_SCHEME.length);
+	if (!targets.includes(target)) {
+		throw refuse("pi-durable-carrier-specifier-unknown", `${specifier} (from ${parent}) is not a declared target`);
+	}
+	const file = path.join(dist(), target);
+	if (!existsSync(file)) {
+		throw refuse("pi-durable-carrier-target-missing", `${specifier} → ${file} does not exist`);
+	}
+	return pathToFileURL(file).href;
+}

package/pi/pi-durable/carrier-resolver.mjs

@@ -0,0 +1,38 @@
+// The pi-durable carrier's resolver (#130): preloaded as `node --import <this file>` before the
+// packaged bootstrap. It registers ONE synchronous resolve hook that answers only the carrier's
+// reserved entwurf-pi-dist: specifiers (grammar and refusals: ./carrier-relocation.mjs) and hands
+// every other specifier to Node unchanged. It is not a source/TypeScript resolver and it never reads
+// a checkout, a runtime directory or an environment variable: the pi-coding-agent it maps into is the
+// one the carrier itself resolves from where this package is installed.
+
+import { registerHooks } from "node:module";
+import {
+	CARRIER_SCHEME,
+	CODING_AGENT,
+	codingAgentDistFrom,
+	readCarrierDeclaration,
+	resolveCarrierSpecifier,
+} from "./carrier-relocation.mjs";
+
+const { files, targets } = readCarrierDeclaration(new URL("./overlay/upstream-pin.json", import.meta.url));
+const carrierDirUrl = new URL("./carrier/", import.meta.url).href;
+let dist;
+
+registerHooks({
+	resolve(specifier, context, nextResolve) {
+		if (!specifier.startsWith(CARRIER_SCHEME)) return nextResolve(specifier, context);
+		const url = resolveCarrierSpecifier(specifier, context.parentURL, {
+			carrierDirUrl,
+			files,
+			targets,
+			// From a carrier file, as the carrier's own bare imports resolve — never the exports map.
+			dist: () => {
+				dist ??= codingAgentDistFrom(
+					nextResolve(CODING_AGENT, { ...context, parentURL: `${carrierDirUrl}${files[0]}` }).url,
+				);
+				return dist;
+			},
+		});
+		return { url, shortCircuit: true };
+	},
+});

package/pi/pi-durable/overlay/runtime-contacts.patch

@@ -0,0 +1,91 @@
+diff --git a/packages/coding-agent/src/experimental/durable/runtime.ts b/packages/coding-agent/src/experimental/durable/runtime.ts
+index fcd6e523..929dbc79 100644
+--- a/packages/coding-agent/src/experimental/durable/runtime.ts
++++ b/packages/coding-agent/src/experimental/durable/runtime.ts
+@@ -8,7 +8,9 @@ import {
+ 	type ConversationView,
+ 	type Cursor,
+ 	type EntryRecord,
++	type Extension,
+ 	Harness,
++	type InputSubmissionDraft,
+ 	type ModelRef,
+ 	ROOT_CONVERSATION_ID,
+ 	type Submission,
+@@ -81,6 +83,10 @@ export interface DurableController {
+ export interface OpenDurableOptions {
+ 	readonly cwd?: string;
+ 	readonly continueSession?: boolean;
++	/** Installed after the built-in extensions and before the Harness opens, so recovered work finds their tools. */
++	readonly extensions?: readonly Extension[];
++	/** A new session's explicit model, resolved as pi's `--provider`/`--model`; unresolved, the open fails. */
++	readonly model?: { readonly provider: string; readonly model: string };
+ }
+ 
+ export interface OpenDurableResult {
+@@ -88,6 +94,8 @@ export interface OpenDurableResult {
+ 	readonly controller: DurableController;
+ 	/** pi's settings, for the TUI's theme and terminal capabilities. */
+ 	readonly settings: SettingsManager;
++	/** Admits input to the root conversation, whichever one is on screen; resolves at admission, not at the answer. */
++	submitToRoot(draft: InputSubmissionDraft): Promise<Submission>;
+ 	close(): Promise<void>;
+ }
+ 
+@@ -122,6 +130,9 @@ function titleOf(entry: EntryRecord | undefined): { title?: string } {
+ }
+ 
+ export async function openDurable(options: OpenDurableOptions = {}): Promise<OpenDurableResult> {
++	if (options.model !== undefined && options.continueSession) {
++		throw new Error("An explicit model applies only to a new session, not to a continued one");
++	}
+ 	const location = await selectSession(options.cwd ?? process.cwd(), options.continueSession ?? false);
+ 	const envs = new ExecutionEnvs(location.cwd);
+ 	let harness: Harness | undefined;
+@@ -132,6 +143,7 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
+ 		const settings = createHarnessSettings(settingsManager);
+ 		const registry = createCodingRegistry(settingsManager, location.cwd);
+ 		registry.install(Subagent);
++		for (const extension of options.extensions ?? []) registry.install(extension);
+ 
+ 		const pendingReports: unknown[] = [];
+ 		let report: (error: unknown) => void = (error) => pendingReports.push(error);
+@@ -146,7 +158,29 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
+ 			},
+ 			context,
+ 		);
+-		const initial = location.created ? await findInitialAgentModel(settingsManager, modelRuntime) : undefined;
++		const initial = location.created
++			? await findInitialAgentModel(settingsManager, modelRuntime, options.model)
++			: undefined;
++		if (options.model !== undefined) {
++			// pi resolves case-insensitive, partial and unknown ids too (a custom-id fallback with only a warning);
++			// an explicit model must be exactly one registered catalog model, named by its canonical id.
++			const asked = options.model;
++			const ref = initial?.model;
++			const thinking = initial?.thinkingLevel;
++			const registered = ref !== undefined && modelRuntime.getModel(ref.provider, ref.modelId) !== undefined;
++			const named =
++				ref !== undefined &&
++				(asked.model === ref.modelId || (thinking !== undefined && asked.model === `${ref.modelId}:${thinking}`));
++			if (ref === undefined || ref.provider !== asked.provider || !registered || !named) {
++				const resolved =
++					ref === undefined
++						? "none"
++						: `${ref.provider}/${ref.modelId}${thinking === undefined ? "" : `:${thinking}`}`;
++				throw new Error(
++					`explicit-model-not-exact: asked ${asked.provider}/${asked.model}, resolved ${resolved} (registered=${registered})`,
++				);
++			}
++		}
+ 		const root = await harness.root(context, {
+ 			agent: {
+ 				cwd: location.cwd,
+@@ -342,6 +376,7 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
+ 			},
+ 			controller,
+ 			settings: settingsManager,
++			submitToRoot: (draft) => root.submit(draft, context),
+ 			close() {
+ 				closing ??= (async () => {
+ 					unsubscribe();

package/pi/pi-durable/overlay/upstream-pin.json

@@ -0,0 +1,108 @@
+{
+	"schemaVersion": 2,
+	"comment": "The one upstream commit the pi-durable carrier is emitted from, the patch it applies, the emitted files and the published SDK set they run against. The experimental durable app is source-only upstream (published pi-coding-agent ships no dist/experimental), so Entwurf ships it as a CARRIER: the pinned app files, type-stripped, with the relocation in pi/pi-durable/carrier-relocation.mjs. scripts/emit-pi-durable-carrier.ts is the only writer of the generated fields (blob, sha256, emitter.node) and the only reader of upstream source; an installed package never reads source. Model data rides the published @earendil-works/pi-ai.",
+	"repository": "https://github.com/earendil-works/pi",
+	"tag": "v1.0.4",
+	"commit": "7c10bd4337495ee613f2224843ecdf349b80d1df",
+	"patches": ["runtime-contacts.patch"],
+	"carrier": {
+		"comment": "files: the six app files bootstrap.mjs needs (main.ts is replaced by the bootstrap). distTargets: every pi-coding-agent internal the stripped files import, as paths under the published dist/; the emitter refuses a set that differs and the resolver answers no other.",
+		"emitter": {
+			"tool": "node:module.stripTypeScriptTypes",
+			"mode": "strip",
+			"node": "v24.18.1"
+		},
+		"license": {
+			"source": "LICENSE",
+			"blob": "b0a8e9b81083294360c69b4ec45d3d39a2b28197",
+			"sha256": "0457f5bcec3b3b211605dfb5d1a49042fd638f3686a410fe099c24a25af13c48"
+		},
+		"files": [
+			{
+				"name": "runtime.js",
+				"source": "packages/coding-agent/src/experimental/durable/runtime.ts",
+				"patched": true,
+				"blob": "fcd6e5239e999ebf17dea0335fb3dc9cd7f7ce45",
+				"sha256": "ca0ee10dc904a57d46bb33b37fcc4efe48dfa08b2f0d10e79e7bc22136871f0a"
+			},
+			{
+				"name": "tui.js",
+				"source": "packages/coding-agent/src/experimental/durable/tui.ts",
+				"patched": false,
+				"blob": "397b276cbeb1c90e1fbc96c3cc59e6a25f92dad7",
+				"sha256": "bef1ea4bd6e8ab150273752a9b94552d8ce672b518ba3d1ed1a209b8405be1b3"
+			},
+			{
+				"name": "harness-setup.js",
+				"source": "packages/coding-agent/src/experimental/durable/harness-setup.ts",
+				"patched": false,
+				"blob": "4d6a4be5333ebb8e0f17eac1987f18ea35a91fc7",
+				"sha256": "712b630145dc6f5c655a85b01b1e20299c962542e63c5494d2202bb7bf414a15"
+			},
+			{
+				"name": "prompt.js",
+				"source": "packages/coding-agent/src/experimental/durable/prompt.ts",
+				"patched": false,
+				"blob": "8e2f5d5273fba58da8b314766956ed62951c3814",
+				"sha256": "ff1ff765fa313e5cb1c3d7537c901c23adb0562ee433bd050fd35eb3d892134c"
+			},
+			{
+				"name": "sessions.js",
+				"source": "packages/coding-agent/src/experimental/durable/sessions.ts",
+				"patched": false,
+				"blob": "34f9ceeeaeaf874f7478d56115da2e4f726c6a85",
+				"sha256": "1bd1a04ece66f5ab3ca22860c64dba9abc848334d11a27a9afe543f1365c7254"
+			},
+			{
+				"name": "subagent.js",
+				"source": "packages/coding-agent/src/experimental/durable/subagent.ts",
+				"patched": false,
+				"blob": "e767d54e0bf2908e0f4f41c6933b55c00562eb25",
+				"sha256": "8a75d934ef87efbb0bb2006a2141f1ea932560851f1718b991ed947d6efdb54c"
+			}
+		],
+		"distTargets": [
+			"config.js",
+			"core/http-dispatcher.js",
+			"core/keybindings.js",
+			"core/model-resolver.js",
+			"core/model-runtime.js",
+			"core/resource-loader.js",
+			"core/settings-manager.js",
+			"core/skills.js",
+			"core/system-prompt.js",
+			"core/tools/bash.js",
+			"core/tools/edit.js",
+			"core/tools/read.js",
+			"core/tools/renderers/index.js",
+			"core/tools/write.js",
+			"modes/interactive/components/assistant-message.js",
+			"modes/interactive/components/custom-editor.js",
+			"modes/interactive/components/dynamic-border.js",
+			"modes/interactive/components/footer.js",
+			"modes/interactive/components/keybinding-hints.js",
+			"modes/interactive/components/status-indicator.js",
+			"modes/interactive/components/tool-execution.js",
+			"modes/interactive/components/user-message.js",
+			"modes/interactive/theme/theme-controller.js",
+			"modes/interactive/theme/theme.js"
+		]
+	},
+	"sdk": {
+		"comment": "The published library set the carrier runs against, derived from the 1.0.4 declarations. members: the @earendil-works packages the carrier imports and every @earendil-works package those declare. direct: a third-party package a carrier file imports itself (sessions.ts: proper-lockfile, at the version pi-coding-agent 1.0.4 pins). Each is an exact production dependency in package.json; the members' own edges are caret ranges, so the installed physical edges, not semver, are what must equal these versions.",
+		"members": {
+			"@earendil-works/chord": "1.0.4",
+			"@earendil-works/pi-agent-core": "1.0.4",
+			"@earendil-works/pi-ai": "1.0.4",
+			"@earendil-works/pi-codemode": "1.0.4",
+			"@earendil-works/pi-coding-agent": "1.0.4",
+			"@earendil-works/pi-durable": "1.0.4",
+			"@earendil-works/pi-mcp": "1.0.4",
+			"@earendil-works/pi-telemetry": "1.0.4",
+			"@earendil-works/pi-tui": "1.0.4"
+		},
+		"direct": {
+			"proper-lockfile": "4.1.2"
+		}
+	}
+}

package/pi-extensions/lib/entwurf-deliverability.ts

@@ -142,7 +142,13 @@ export function receiverMarkerMatchesIdentity(
 // previous garden in-process on its `/new` edge (the unarm the claude hook lacked),
 // so the cell this join closes has a different owner there. Admitting it needs its
 // own measurement, not this file's optimism.
-export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = ["claude-code-cli"];
+//
+// `pi-durable-host` is admitted because the join holds by construction: the durable contact
+// writes its sender marker under the host's own pid and arms its watch in that same process
+// (`meta-bridge-pi-durable.ts`), so the receiver marker's `ownerPid` IS the sender-marker key.
+// Inside the scope a host whose sender marker is gone or names another garden is a retired
+// watch, which is the refusal this admission exists to make reachable.
+export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = ["claude-code-cli", "pi-durable-host"];
 
 /** Does this watch owner share its pid with the backend's sender marker? */
 export function receiverOwnerKindJoinsSender(ownerKind: string): boolean {

package/pi-extensions/lib/fresh-call-composition.ts

@@ -25,11 +25,12 @@
 import { randomBytes } from "node:crypto";
 
 /** The backends this rail can open. Fixed set, not a profile — a further one is a decision,
- * not a config entry. `copilot` was added by #82 RAIL 9, `omp` by #87 Bundle C, and `codex`
- * by #95 after its system birth and app-server rails were measured. The set is joined to the
+ * not a config entry. `copilot` was added by #82 RAIL 9, `omp` by #87 Bundle C, `codex`
+ * by #95 after its system birth and app-server rails were measured, and `pi-durable` by #129
+ * (the durable app this package carries, through the managed `entwurf pi-durable`). The set is joined to the
  * citizen backends by `check-harness-admission-parity`: a harness that mints records but is
  * missing HERE is not an unwired convenience, it is a release blocker. */
-export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp", "codex"] as const;
+export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp", "codex", "pi-durable"] as const;
 export type FreshCallBackend = (typeof FRESH_CALL_BACKENDS)[number];
 
 /**
@@ -68,6 +69,11 @@ export const FRESH_CALL_CALLBACK_TOOL: Record<FreshCallBackend, string> = {
 	// Codex's tool process is the operator app-server, not the pane: the no-arg
 	// verb refuses there by name. First action stays the delivery verb with args.
 	codex: "mcp__entwurf_bridge__entwurf_v2",
+	// The durable contact registers the bridge verbs as its OWN tools under their bare names, and the
+	// app offers a tool to the model by its registered name (`durable/harness/registry.ts:99`
+	// @cd32f77). Measured for `entwurf_v2` on the S+native-H wire (receipt 4012c066); the callback
+	// spelling follows the same rule and is owed its first LIVE observation.
+	"pi-durable": "entwurf_callback",
 };
 
 /** Where a sibling SENDS the task result. Always the delivery verb, never the birth callback. */
@@ -77,6 +83,7 @@ export const FRESH_CALL_DELIVERY_TOOL: Record<FreshCallBackend, string> = {
 	copilot: "entwurf-bridge-entwurf_v2",
 	omp: "mcp__entwurf_bridge_entwurf_v",
 	codex: "mcp__entwurf_bridge__entwurf_v2",
+	"pi-durable": "entwurf_v2",
 };
 
 /**
@@ -99,6 +106,7 @@ export const FRESH_CALL_PEERS_TOOL: Record<FreshCallBackend, string> = {
 	copilot: "entwurf-bridge-entwurf_peers",
 	omp: "mcp__entwurf_bridge_entwurf_peers",
 	codex: "mcp__entwurf_bridge__entwurf_peers",
+	"pi-durable": "entwurf_peers",
 };
 
 /**
@@ -139,13 +147,16 @@ export const FRESH_CALL_TOOL_LOAD_HINT: Record<FreshCallBackend, readonly string
 	copilot: [],
 	omp: [],
 	codex: [],
+	"pi-durable": [],
 };
 
 /**
- * What a launch has to say, in the two shapes the five backends need. Four of them are
- * handed a first-turn PROMPT; omp is handed a bootstrap PAYLOAD its own installed extension
- * unpacks. Both are always built, because building one is cheap and a backend switch must
- * never be able to reach a field that was not composed.
+ * What a launch has to say, in the two shapes the six backends need. pi, claude-code, copilot
+ * and codex are handed the first-turn PROMPT as an argument; pi-durable is handed that same
+ * PROMPT inside the closed `{v,task}` payload on the bootstrap flag, which its packaged bootstrap
+ * decodes; omp is handed its own bootstrap PAYLOAD, which its installed extension unpacks. Both
+ * are always built, because building one is cheap and a backend switch must never be able to
+ * reach a field that was not composed.
  */
 export interface FreshCallComposition {
 	prompt: string;
@@ -339,6 +350,30 @@ export function composeBackendArgs(
 				"--dangerously-bypass-approvals-and-sandbox",
 				composition.prompt,
 			];
+		case "pi-durable": {
+			// The managed verb (`entwurf pi-durable`) carries the explicit model as pi's own
+			// `--provider`/`--model` pair, split at the FIRST `/` (the preflight already refused a model
+			// with no provider), the explicit width, and the WHOLE framing as the closed `{v,task}`
+			// payload — the durable bootstrap submits it to the root once, after the birth. The
+			// caller's address rides the env pair, never this payload.
+			const at = model.indexOf("/");
+			if (at <= 0 || at === model.length - 1) {
+				throw new Error(
+					`fresh-call composition: pi-durable model ${JSON.stringify(model)} is not <provider>/<model id>`,
+				);
+			}
+			return [
+				"pi-durable",
+				"--provider",
+				model.slice(0, at),
+				"--model",
+				model.slice(at + 1),
+				"--width",
+				"task-wide",
+				`--${OMP_BOOTSTRAP_FLAG}`,
+				JSON.stringify({ v: OMP_BOOTSTRAP_VERSION, task: composition.prompt }),
+			];
+		}
 	}
 }
 

package/pi-extensions/lib/meta-sender-identity.ts

@@ -73,7 +73,13 @@ import { type NativePushAdapter, resolveNativePushAdapter } from "./native-push/
  * exactly the #46 defect on agy, and copilot joined the list only once its own hook wrote one
  * (#82 RAIL 5b). Membership says a marker may EXIST, never that a reply can land: the reply
  * rail is chosen from `nativePushSupported` at the bridge, not from this list. */
-export const META_SENDER_BACKENDS: readonly MetaBackend[] = ["claude-code", "antigravity", "copilot", "omp"];
+export const META_SENDER_BACKENDS: readonly MetaBackend[] = [
+	"claude-code",
+	"antigravity",
+	"copilot",
+	"omp",
+	"pi-durable",
+];
 
 /** A marker that passed BOTH guards, together with the record that vouches for it. */
 export interface TrustedMetaSender {

package/pi-extensions/lib/meta-session.ts

@@ -81,7 +81,7 @@ export class MetaRecordError extends Error {
  * every write, including its own. `./run.sh doctor-meta-bridge` already flags a
  * stale deployed writer — run it after the change.
  */
-export const META_BACKENDS = ["claude-code", "antigravity", "codex", "copilot", "omp"] as const;
+export const META_BACKENDS = ["claude-code", "antigravity", "codex", "copilot", "omp", "pi-durable"] as const;
 export type MetaBackend = (typeof META_BACKENDS)[number];
 
 /**
@@ -222,6 +222,24 @@ export const META_BACKEND_DESCRIPTORS: Record<MetaBackend, MetaBackendDescriptor
 		deliveryLevel: "D6",
 		nativeIdLabel: "sessionId",
 	},
+	// The long-running durable app (#129). Graded only as far as its RECORDED receipts reach.
+	//   sessionId the durable session directory name `<13-digit ms>-<uuid>` that
+	//             `selectSession` creates and `--continue` reopens
+	//             (`experimental/durable/sessions.ts:18-55` @cd32f77), surfaced as
+	//             `view.current().session.id`. Not `pi.provider.sessionId`, which a
+	//             fork changes.
+	//   D2        receiver armed: the contact mints the record, names the host as sender, and arms
+	//             a root doorbell (the receiver marker is owned by the host pid as `pi-durable-host`,
+	//             which the owner join admits). The addressed-enqueue → idle-wake → root-notice → drain
+	//             chain has ONE recorded receipt, on the scripted-model + native-harness lab cell
+	//             (`check-pi-durable-receive`, S+H, V not run) — lab evidence, not a vendor-turn D4–D6
+	//             acceptance, and no sibling-isolation (D3) or LIVE fresh receipt exists yet.
+	"pi-durable": {
+		backend: "pi-durable",
+		wakeMode: "self-fetch",
+		deliveryLevel: "D2",
+		nativeIdLabel: "sessionId",
+	},
 };
 
 // ---------------------------------------------------------------------------
@@ -305,7 +323,15 @@ function isoNow(now: Date): string {
 export const META_SCHEMA_VERSION_V3 = 3 as const;
 
 /** Every backend admitted by the one V3 record-citizen schema. */
-export const META_CITIZEN_BACKENDS = ["claude-code", "antigravity", "codex", "copilot", "omp", "pi"] as const;
+export const META_CITIZEN_BACKENDS = [
+	"claude-code",
+	"antigravity",
+	"codex",
+	"copilot",
+	"omp",
+	"pi-durable",
+	"pi",
+] as const;
 export type MetaCitizenBackend = (typeof META_CITIZEN_BACKENDS)[number];
 
 /**

package/pi-extensions/lib/mux-fresh-call.ts

@@ -143,6 +143,12 @@ import {
 } from "./mux-placement.ts";
 import { resolveCodexDefaultSocketPath } from "./native-push/codex-ws-client.ts";
 import { OMP_PREFLIGHT_HINT, type OmpPreflightRejectReason, ompFreshPreflight } from "./omp-fresh-preflight.ts";
+import {
+	PI_DURABLE_PREFLIGHT_HINT,
+	type PiDurablePreflightRejectReason,
+	piDurableFreshPreflight,
+} from "./pi-durable-fresh-preflight.ts";
+import { checkPiDurableRuntime, PI_DURABLE_RUNTIME_HINT, piDurablePackageLayout } from "./pi-durable-runtime.ts";
 import { classifyTmuxSessionName, resolveTmuxSessionId, type TmuxSessionRejectReason } from "./resolve-tmux-session.ts";
 
 /**
@@ -238,6 +244,10 @@ export const FRESH_CALL_RUNTIME: Record<FreshCallBackend, string> = {
 	copilot: "entwurf",
 	omp: "omp",
 	codex: "codex",
+	// #129/#130: like copilot, a MANAGED verb and never the bare app. The durable app is this
+	// package's carrier and runs under the carrier's resolver; `entwurf pi-durable` is the one fixed
+	// invocation that verifies the carrier and its SDK set and execs the packaged bootstrap.
+	"pi-durable": "entwurf",
 };
 
 /** A launch that was refused, or a placement that could not be established. Every value is a
@@ -251,6 +261,7 @@ export type FreshCallRejectReason =
 	| TmuxSessionRejectReason
 	| CopilotPreflightRejectReason
 	| OmpPreflightRejectReason
+	| PiDurablePreflightRejectReason
 	| CodexPreflightRejectReason
 	| CodexCallerPreflightRejectReason
 	| CodexCallerSeatRejectReason
@@ -350,9 +361,9 @@ export type FreshCallResult = { ok: true; receipt: FreshCallReceipt } | { ok: fa
  * for. That is sufficient and not a compromise: every reader of the carrier trims and tests
  * truthiness (`index.ts:212-217`), so empty and absent are the same answer by construction.
  *
- * It is applied to all five backends because the leak is a property of tmux, not of a vendor. A
+ * It is applied to all six backends because the leak is a property of tmux, not of a vendor. A
  * scrub only on the backend whose measurement surfaced it would encode the claim that the other
- * four are immune, which is false. It costs the legitimate case nothing: a carrier is only ever
+ * five are immune, which is false. It costs the legitimate case nothing: a carrier is only ever
  * authoritative when the process that owns it exported it ITSELF, and a fresh `pi` sibling does
  * exactly that after this argv has run. This is a fixed seam and deliberately NOT a general env
  * carrier — an arbitrary `-e` passthrough would hand callers the environment-shaping power this
@@ -506,6 +517,23 @@ export function freshCall(
 		const missing = ompFreshPreflight(env);
 		if (missing) return { ok: false, reason: missing };
 	}
+	if (params.backend === "pi-durable") {
+		// The framed first input is computed here only to MEASURE it against the bootstrap payload
+		// cap; the same pure function composes it again below. The carrier is verified from THIS
+		// process's package closure, before anything is placed. The window runs whatever `entwurf`
+		// PATH names, and the managed verb re-verifies its own package before it execs anything, so
+		// the window never runs an unverified carrier — but when the two package closures differ, this
+		// verdict and the window's can disagree, and the window is left showing its own refusal.
+		const layout = piDurablePackageLayout();
+		const runtime = layout === null ? null : checkPiDurableRuntime(layout);
+		const missing = piDurableFreshPreflight({
+			model,
+			firstInput: buildFreshCallPrompt({ backend: params.backend, task, callerGardenId, nonce }),
+			layout,
+			runtime: runtime === null || runtime.ok ? null : runtime.reason,
+		});
+		if (missing) return { ok: false, reason: missing };
+	}
 	const inspected = inspectPlacement(env);
 	if (!inspected.ok) return { ok: false, reason: inspected.reason };
 	const placement = inspected.placement;
@@ -626,6 +654,8 @@ const REJECT_HINT: Record<FreshCallRejectReason, string> = {
 	// the sentence an operator reads cannot drift away from the predicate that produced it.
 	...COPILOT_PREFLIGHT_HINT,
 	...OMP_PREFLIGHT_HINT,
+	...PI_DURABLE_RUNTIME_HINT,
+	...PI_DURABLE_PREFLIGHT_HINT,
 	...CODEX_PREFLIGHT_HINT,
 	...CODEX_CALLER_PREFLIGHT_HINT,
 	...CODEX_CALLER_SEAT_HINT,