@junghanacs/entwurf 0.31.0 → 0.32.0

package/AGENTS.md

@@ -31,7 +31,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 3. **One identity contract, capability domains.** Branch on rail/liveness capability, not a privileged citizen class.
 4. **Live-fact dispatch.** Never store liveness or infer send/resume before resolving the record and probing its rail.
 5. **Rejects are real.** Wrong intent, dead/drifted identity, undeliverable mailbox, ambiguity, and indeterminate probe reject without mutation or fallback.
-6. **MCP is explicit.** Only explicit `mcpServers`; no ambient configuration scan or automatic retrieval.
+6. **MCP and native modules are explicit.** MCP uses only explicit `mcpServers`; native extension modules use operator-declared paths through the owning bootstrap. Neither discovers ambient configuration, scans extension directories, or retrieves modules automatically. Native modules do not emulate a foreign extension API.
 7. **One meta-store contract.** Record body and filename agree; active records are readable regular non-symlink V3 files; `nativeSessionId` is unique. Writers and doctor certify the active store before writing. Address-bearing reads use the addressable reader; `readStoreRecordFile`/`O_NOFOLLOW` and lstat policy both remain load-bearing. Quiesce and fresh-cut an unreadable generation; redeploy a stale unknown-backend reader. Store protocol and gates: `meta-session.ts`, `check-meta-*`, `check-fresh-cut-gate`.
 8. **GC reclaims processes, not memory.** Preserve or archive records and transcripts; do not casually delete them.
 9. **Not a second harness.** No prompt reconstruction, transcript hydration, tool-result ledger, credential mediation, or harness emulation. Backends own auth and transcript.
@@ -42,7 +42,7 @@ Ask: does this follow capability rather than a surface name; record backend asym
 14. **Native-hook ownership is structural.** Use shipped exec launchers and provenance, shared plausible-owner-pid policy, no shell fallback or ancestry guess. Version floors belong to their package source and are enforced there; hook contract/docs own the changing detail.
 15. **Crash, don’t warn.** Invalid config/path/model/store state throws. Empty catches are only bounded environment probes; diagnostics go to stderr.
 16. **mux launches, never delivers.** A tmux handle is an ephemeral view, not an address or liveness receipt; screen text/keystrokes are not delivery evidence. A Codex caller's seat is the pane whose title carries its own thread-id, a placement input only; it is never an address, and never a pane nobody named. Cross-window adjacency requires the documented observed-coordinate proof, never pane guessing.
-17. **Entwurf installs itself; setup composes.** Installation supplies Entwurf bytes and development fixtures, never a harness binary, subscription, credential, or login. Setup detects existing harness capability; absence is explicit skip and detected incompleteness is non-green. Portability evidence and rail/runtime support remain separate.
+17. **Supply the missing surface; do not become the harness.** Installation supplies Entwurf bytes, development fixtures, and declared upstream SDK dependencies. Where upstream omits a native execution surface from its distribution, Entwurf may carry that pinned, removable app/TUI with its declared overlay and deterministic emit/import relocation, against one coherent published-library version set. Native execution, auth, queues, storage, transcript and recovery remain upstream-owned (Rule 9). Provenance, license, rebuild and installed-consumer proof belong to the supply contract. No Entwurf-owned copying/inlining of provider model catalogs, subscription, credential or login; no launch-time download, repair, update or fallback. Setup checks capability, version-set coherence and carrier integrity: absent optional capability is explicit skip; incomplete installation, mismatch and drift are named non-green refusals. Portability and runtime evidence remain separate.
 
 History and incident detail belong in [CHANGELOG.md](./CHANGELOG.md), issue threads, [BASELINE.md](./BASELINE.md), or source-adjacent comments. When prose and behavior disagree, repair the owning source or document.
 
@@ -91,6 +91,7 @@ implement → affected focused gates → independent review → one amendment bu
           → qualification once if gate/mutant/matrix changed → full floor once on frozen candidate → commit
 ```
 
+- GLG-requested branch checkpoint commits keep completed subject/proof bundles small: scoped review, affected focused checks and normal hooks/shared scanner before each checkpoint, with known RED/unmeasured boundaries recorded. A checkpoint is not frozen-candidate acceptance. The sequence above owns final candidate acceptance: required changed qualification, frozen FULL and native/LIVE/release floors remain mandatory before landing/shipment, never inherited from an interim commit.
 - Inner loop runs only affected gates; review and its corrections finish before the full floor.
 - A changed contract names a production subject and independent oracle; its focused assertion has a stable QK and exact-once mutant. Matrices change by their declared axes/cells, not appended anecdotes.
 - Qualification body is scheduled once when its surface changes; its manifest/head checks remain in the deterministic floor. A release requires the exact-SHA qualification evidence required by VERIFY, never a nearby green run.

package/CHANGELOG.md

@@ -4,6 +4,88 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.32.0 - 2026-10-08
+
+### Added
+
+- **One npm installation unit for native `pi-durable` (#130).** The package
+  supplies the omitted experimental app/TUI as a pinned Pi1.0.4 carrier, with the
+  declared contact overlay, deterministic emit/import relocation, MIT license
+  and rebuild contract. Nine exact published SDK dependencies supply the native
+  library set. The operator no longer clones, patches or builds a separate
+  fixed-XDG source runtime; there is no old-route fallback, downloader or repair.
+  Native runtime/TUI/models/auth/queues/SQLite/transcripts/recovery remain upstream-owned.
+- **One explicit native extension ingress.** `--native-module <absolute file>`
+  loads ordinary ESM, including top-level await, before TUI/runtime imports;
+  its default native durable Extension is installed by reference after the
+  contact. Reserved extension/contact names and identity/cwd changes refuse by
+  name. These are trusted-code mistake guards, not a sandbox or rollback. No
+  ambient discovery, classic ExtensionAPI shim, persistent module profile or
+  fresh-call propagation. Synthetic node:* development fixtures prove the
+  contact, module tool and native bash child; real dotenv policy stays downstream
+  in agent-config after release.
+
+### Changed
+
+- **Pi host floor and native SDK set are separate subjects.** Host CLI range is
+  `>=1.0.4 <1.1`; native SDK members are exact1.0.4 production dependencies,
+  with `proper-lockfile`4.1.2. The installed verifier walks reachable physical
+  member edges by name/version, allows coherent sharing and cycles, and refuses
+  incomplete, drifted or mixed-version supply even when imports work.
+- **Known ordinary-Pi manifest warning retained.** The host warns that its
+  extension packages belong in peer dependencies; the exact installed SDK copies
+  intentionally serve the separate native process. GLG accepted this manifest
+  constraint for0.32, not a universal harmlessness or peer-contract certification.
+
+### Fixed
+
+- **Qualification preserves prior-run evidence.** Retire the ambient dead-pid /
+  prefix sweep and its marker-based authority. Full/group execution share only
+  invocation-owned snapshot creation/teardown; prior names and bytes survive
+  green, red and collection fixture cases. No replacement GC or cleanup manager.
+  Repair the malformed-carrier oracle's discriminator and run the actual rebuilt
+  verifier inside its own copied package so the READ-ONLY mutant cannot contaminate
+  the checkout. The production refusal and read-only contracts remain unchanged.
+- **Installed-gate host fixtures keep their SDK generation closed.** Derive the
+  aligned host's complete exact SDK roots from the owning pin, and the same
+  member names at1.0.2 for the previous-host control. The first prepared CI's
+  coinstalled host tried pi-ai1.1.0 and received npm404 through its caret edges;
+  its RED is preserved. Product pins/overrides and native assertions are unchanged.
+- **Fresh-call tool description fits the existing host cap.** One clause was
+  shortened from2068 to2021 characters; callable schema, cap2048, named refusals
+  and the installed-carrier contract are unchanged.
+
+### Verification and evidence boundaries
+
+- **Frozen source/native candidate:** `b220b20c1b95f0ecafe8e679668bda3c5678be81`
+  accepted FULL716s/exit0, all898 committed mutant IDs exactly once KILLED,
+  178 green controls, unchanged origin, MUST25/0/0 and BEHAVIOR1/0/0/cutOK.
+  Explicit installed `check-pack-install` passed separately; FULL/aggregate do
+  not contain that gate or the container gate. Saved official Codex65/Pi-durable36
+  snapshots were independently rejudged through their shipped receipt oracles.
+  [Owning #130 receipt](https://github.com/junghan0611/entwurf/issues/130#issuecomment-6043744944).
+- **Pre-version landing:** main `78c917ae2dbec01281c41287db14ed8d008a3c82`,
+  [push CI37679372365](https://github.com/junghan0611/entwurf/actions/runs/37679372365),
+  all four required jobs plus qualification BODY success, exact898/898 KILLED,
+  controls178green/origin unchanged and Linux artifact-consumer exit0. Its
+  temporary tarball retained package version0.31.0; it is neither the published
+  0.31.0 artifact nor a preserved accepted0.32 candidate.
+- **Independent pre-prepare consistency review:** Grok Blocker0/Defect2; the
+  two stale pending underclaims were corrected as prose, not a gate restart.
+  GLG explicitly approved version metadata preparation, new prepared-SHA CI and
+  one preserved exact artifact without repeating local FULL/LIVE for documentation
+  changes. Source/native receipts retain their original fingerprints; prepared-SHA
+  qualification, versioned artifact and registry equality remain independent
+  evidence. This preparation text does not assert a tag, GitHub release or npm publish.
+- **Historical RED retained.** R3 aggregate remains RED despite FULL714s/exit0.
+  Its protected36MB snapshot was irreversibly deleted by the retired sweep;
+  wider deletion extent and the vendor `-32603` cause remain unknown. Original
+  raw/confirmation/review erratum are preserved. Prior-run preservation is a
+  private-fixture proof: r4 had no prior root in actual tmp, so no in-situ claim.
+  Original0.31 release/tag/artifact/archive are immutable. Native agy1.2 remains
+  NOT CERTIFIED and its historical1.1 pin is unchanged; no new native agy acceptance
+  or permanent exception is inferred.
+
 ## 0.31.0 - 2026-10-07
 
 ### Added

package/README.md

@@ -15,7 +15,7 @@ Git branches, worktrees, file isolation and internal delegation remain their con
 [Short answers: FAQ](./FAQ.md).
 
 ```text
-pi / Claude Code / Copilot / OMP / Antigravity / Codex
+pi / pi-durable / Claude Code / Copilot / OMP / Antigravity / Codex
   → record-backed garden id
     → entwurf_v2
       → control-socket | self-fetch mailbox | native-push
@@ -27,14 +27,19 @@ Claude and Cortex Code are ACP backends. Codex and Antigravity stay native so th
 retain their own tools and work context. Capabilities differ by rail: a shipped
 citizen is not a promise of every lifecycle operation.
 
-**Native durable contact (`pi-durable`) is accepted in the 0.31.0 candidate (#129).**
+**Native durable contact (`pi-durable`) ships in the [0.31.0 release](https://github.com/junghan0611/entwurf/releases/tag/v0.31.0) (#129).**
 It is a separate native harness contact, not ordinary Pi's control-socket adapter.
 The contact attaches one durable host to a garden id, adds visible identity and
 two-way mailbox contact, while the upstream harness keeps its TUI, models/auth,
-SQLite storage and recovery. First native admission passed on one Linux host;
-release/artifact acceptance is separate. The
-[installation requirements](#optional-native-durable--0310) differ from installing
-the ordinary Pi CLI.
+SQLite storage and recovery. Native admission passed on one Linux host on the
+0.31.0 source-runtime route. Under the #130/0.32 contract the app ships inside the
+Entwurf package as a pinned [carrier](#native-durable-pi-durable--130--032-contract), so
+it no longer depends on installing the ordinary Pi CLI or provisioning a runtime.
+
+> **Prepared 0.32.0 candidate, not a published release.** The current source contains #130's
+> carrier and explicit native-module contract. Prepared-SHA CI and one preserved versioned
+> artifact have their own acceptance receipts; preparation alone does not assert npm publication.
+> The published 0.31.0 follows its source-runtime docs — it does not supply this carrier.
 
 ## Install
 
@@ -44,7 +49,7 @@ the ordinary Pi CLI.
 
 Prerequisites: **Node >=24.0.0**, Python 3 for `setup`, and any harnesses you choose
 to use, already installed and authenticated. Pi is optional-by-presence, supported
-range `>=1.0.2 <1.1`; Claude Code supported floor `>=2.1.217` is required for its
+range `>=1.0.4 <1.1`; Claude Code supported floor `>=2.1.217` is required for its
 managed exec-hook lifecycle. pnpm is needed only for source-checkout setup.
 
 ```bash
@@ -72,33 +77,37 @@ Detected harness wiring on Darwin can therefore be written while setup stays
 non-green. Native Windows is **UNSUPPORTED**. The package has no npm `os`
 restriction; that is not certification of every platform's harness rails.
 
-### Optional native durable — 0.31.0
+### Native durable (pi-durable) — #130 / 0.32 contract
 
-**Entwurf's npm installation does not change. Enabling durable additionally needs
-an operator-provided native runtime; installing ordinary Pi from npm is not enough.**
+**Installing Entwurf from npm supplies pi-durable. There is no runtime checkout, patch,
+build or model-data copy for the operator.**
 
 | Component | How it is supplied | What it does not supply |
 |---|---|---|
-| Entwurf | Existing npm or source-checkout route above | A harness binary, source runtime, subscription or login |
-| `@earendil-works/pi-durable` | npm **library** | The experimental app/TUI or Entwurf citizen attachment |
-| Native experimental durable app | Pinned upstream **source checkout**, with Entwurf's narrow runtime-contact overlay | A replacement ordinary Pi CLI or an Entwurf-owned harness |
-
-This lane retains Pi 1.0.2/source `cd32f77`; a newer global Pi installation does
-not provision that experimental runtime. Existing non-durable users do not need
-a Pi source checkout. Native auth and sessions stay upstream-owned: Entwurf does
-not copy credentials or convert ordinary Pi sessions into durable SQLite sessions.
-
-The package ships the compiled adapter and bootstrap: `entwurf setup` reports the
-operator runtime as PASS/SKIP/FAIL without writing durable wiring, and
-`entwurf pi-durable` is the managed launch. First native admission passed on
-2026-10-06: visible fresh/callback, addressed receive and real Pi ↔ pi-durable
-LIVE36 on one Linux host ([receipts](./DELIVERY.md)). Installed-bootstrap import
-proof does not supply or certify the native runtime; npm installation alone is
-not a durable readiness verdict. #129 closed at reviewed main; release acceptance
-remains its own floor.
+| Entwurf | Existing npm or source-checkout route above | A harness binary, subscription or login |
+| pi SDK set (`@earendil-works/*` 1.0.4, incl. the `pi-durable` library) | Exact production dependencies of Entwurf | The experimental app, which upstream does not publish |
+| Native experimental durable app/TUI | Entwurf's **carrier**: the pinned upstream v1.0.4 app files, type-stripped, with the narrow runtime-contact overlay (`pi/pi-durable/carrier/`, MIT) | A replacement ordinary Pi CLI or an Entwurf-owned harness |
+
+`entwurf pi-durable` verifies the carrier and the pi SDK set it resolves — every reachable
+package edge binds the declared name at exactly the pinned version — and refuses by name otherwise
+(`pi-durable-package-incomplete`, `-carrier-drift`, `-sdk-absent`, `-sdk-mismatch`);
+`entwurf setup` reports the same verdict as PASS or FAIL (never SKIP) without writing durable
+wiring. The ordinary Pi on PATH is a separate subject with its own range above. Native auth,
+models, sessions and recovery stay upstream-owned: Entwurf does not copy credentials or convert
+ordinary Pi sessions into durable SQLite sessions. One operator module of your own can ride the
+launch with `--native-module <absolute file>`: it initializes before the durable runtime and its
+default export, a native durable `Extension`, is installed after Entwurf's contact ([setup
+§2b](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable)). Ordinary Pi may warn
+that Entwurf's `@earendil-works/*` belong in `peerDependencies`; the exact set is a production
+dependency on purpose, for the native process — a known manifest constraint accepted for 0.32.
+
+The installed carrier's runtime/TUI load, its physical SDK edges and the public launch up to the
+app's own model resolution are package-gate evidence; the checkout contact/send/receive gates run the
+same carrier with scripted S plus native H; Pi ↔ pi-durable LIVE on this supply surface is a separate
+release proof. 0.31.0 shipped the earlier source-runtime
+route (Pi 1.0.2/source `cd32f77`), which this contract replaces.
 See [setup: native durable](./docs/setup-clean-host.md#2b-optional-native-durable-pi-durable)
-and [#130](https://github.com/junghan0611/entwurf/issues/130) for runtime-supply,
-Pi-upgrade, ACP and UI follow-ups.
+and [#130](https://github.com/junghan0611/entwurf/issues/130).
 
 ### Herdr workbench
 
@@ -169,9 +178,9 @@ Liveness is read at dispatch time; an id's shape does not tell you its transport
 | Reopen a dormant pi citizen under its own id | `entwurf_resume_call {target}` | Separate LAUNCH and socket OBSERVATION receipts; no turn is run |
 
 **Delivery starts no process.** A live pi receives over its record-addressed Unix
-control socket; an armed self-fetch citizen (Claude Code, Copilot, OMP) through its
-mailbox; a probe-alive native-push citizen (Antigravity, Codex) through its native
-conversation/thread. Dormant pi, undeliverable mailboxes, dead/indeterminate native
+control socket; an armed self-fetch citizen (Claude Code, Copilot, OMP, pi-durable)
+through its mailbox; a probe-alive native-push citizen (Antigravity, Codex) through
+its native conversation/thread. Dormant pi, undeliverable mailboxes, dead/indeterminate native
 push and record-less sockets reject honestly. Only control-socket dispatch takes
 the per-target lock; the other rails use their own deliverability/probe evidence.
 
@@ -185,9 +194,10 @@ is a live rail fact, not merely a consequence of trusted identity.
 
 **Mux launches; it never delivers.** Inside Herdr, fresh opens a new unfocused tab
 in the caller's workspace, pi/Claude Code only, with no tmux fallback. Outside,
-it opens pi/Claude Code/Copilot/OMP/Codex visibly on the caller's own tmux server.
-The model is required; optional `cwd` is a literal absolute directory, omitted or
-empty means the caller's cwd. Optional `placement.tmuxSession` names an existing
+it opens pi/pi-durable/Claude Code/Copilot/OMP/Codex visibly on the caller's own tmux
+server. pi-durable runs the installed carrier on its exact SDK set described above and
+refuses by name before any window when that verdict is not green; Herdr does not fresh-open it. The model is required; optional `cwd` is a literal
+absolute directory, omitted or empty means the caller's cwd. Optional `placement.tmuxSession` names an existing
 tmux session (not permitted inside Herdr), never a new session or a cwd lookup.
 Omitted tmux placement follows the caller: Codex beside its own TUI pane matched
 by thread-id, everyone else in their own session. Missing/ambiguous context refuses.
@@ -221,7 +231,7 @@ compiled bridge after record birth, under the citizen's identity, and Pi supervi
 that MCP child. **MCP is ingress; pi receive remains the record-addressed Unix
 control socket.** Garden identity and dispatch stay Entwurf's. That 0.30.0 cut
 did not adopt or certify `pi-durable` or codemode. Native durable support is now
-accepted as a separate 0.31.0 candidate contact, as described above; codemode remains a
+released as a separate 0.31.0 native contact, as described above; codemode remains a
 harness-internal capability, not another garden citizen. The 0.30.0 follow-up
 separately measured Herdr supply 0.9.3 and
 re-pinned the plugin runtime to published npm 0.30.0 with manifest 0.30.0; its

package/VERIFY.md

@@ -200,21 +200,40 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 
 Do not collapse source, package, fixture, and native-host evidence into one “green.”
 
-**Native durable contact (#129).** `check-pi-durable-beside` is the deterministic
-beside-test/mutant coordinate in `check:contracts`. The separate
-`check-pi-durable-contact`, `check-pi-durable-send` and `check-pi-durable-receive`
-are CHECKOUT-ONLY SDK/contact gates: they require the provisioned pinned overlay
-runtime (`ENTWURF_PI_DURABLE_RUNTIME`) and a private compiled bridge emitted from
-this candidate (`ENTWURF_PI_DURABLE_BRIDGE_ENTRY`). Missing inputs report SKIP 97,
-never PASS; present invalid inputs fail. Installed packages refuse these developer
-gates. Contact is adapter-direct/harness-bypassed; send/receive exercise scripted
-loopback S plus actual native harness H, not vendor V. Their scoped raw records,
-wire, native view and SQLite oracles do not certify every queue/crash window.
-The installed-bootstrap import in `check-pack-install` proves package closure,
-not runtime supply or native admission. First-release visible fresh/callback and
-native caller/target/cross-harness LIVE are owed by `smoke-pi-durable-fresh-live`, a
-release-gate MUST (LIVE=1; vendor V on a real Pi and a real pi-durable host, operator
-runtime required); SDK or package green does not waive it.
+**Native durable contact (#129, #130 carrier).** `check-pi-durable-beside` is the deterministic
+beside-test/mutant coordinate in `check:contracts`: the adapter, the installed carrier/SDK-set
+verifier, the preflight, the owner join, the carrier's relocation grammar, resolver and
+maintainer emitter (its source reads refuse replace refs), and the bootstrap's explicit
+`--native-module` ingress (#130 P2), driven through the packaged `main`'s own seams: initialization
+before the TUI and the open, named refusals, the identity and directory guards, the contact-first
+order by reference, and the bridge spawn *spec* (not the child's inheritance). `check-pi-runtime-version` asks the
+same verifier whether this checkout resolves exactly the pinned SDK set (the native set; the PATH
+host is setup's subject), and `check-pi-import-surface` asserts the carrier fence. The separate
+`check-pi-durable-contact`, `check-pi-durable-send` and `check-pi-durable-receive` are
+CHECKOUT-ONLY SDK/contact gates: they run the checkout's own carrier — verified first, refused by
+name — and require a private compiled bridge emitted from this candidate
+(`ENTWURF_PI_DURABLE_BRIDGE_ENTRY`). A missing bridge input reports SKIP 97, never PASS; a
+refused carrier fails. Installed packages refuse these developer gates. Contact is
+adapter-direct/harness-bypassed; send/receive exercise scripted loopback S plus actual native
+harness H, not vendor V. `check-pi-durable-send` with `ENTWURF_PI_DURABLE_SEND_CELL=native-module`
+runs the whole packaged `main` with the synthetic module (`test/fixtures/pi-durable-native-module/`):
+its initialization lands before the host's first `@earendil-works`/`entwurf-pi-dist:` resolution
+(one receipt file, observing resolve hook), and one scripted answer calls the module's tool, the
+native `bash` (whose child sees the module's value) and the contact's `entwurf_self`. Their scoped
+raw records, wire, native view and SQLite oracles do not certify every queue/crash window. `check-pack-install` proves the INSTALLED carrier on actual npm
+consumers (Entwurf-only, aligned host, isolated global): the installed verifier, a consumer oracle
+whose every resolved product file lies inside that consumer's own `node_modules` (with a
+same-sandbox neighbour as the rejected control), every reachable physical SDK edge at the pinned
+version and declared name, a mixed-version tree refused by name although it still imports, a
+constructed depth-3 mismatch refused by the verifier and seen by the oracle, the public launch reaching the
+app's own model refusal before any birth — also with one installed `--native-module` initialized
+first, and a reserved extension name refused before anything opens — and the HOST kept a separate subject — a real pi 1.0.2
+binary beside the pinned native set is a named pi FAIL with zero Pi wiring while pi-durable still
+PASSes — not native admission. The maintainer's rebuild
+equality is `emit-pi-durable-carrier --check` against a supplied upstream clone; without one it is
+a named SKIP, not acceptance. First-release visible fresh/callback and native
+caller/target/cross-harness LIVE are owed by `smoke-pi-durable-fresh-live`, a release-gate MUST
+(LIVE=1; vendor V on a real Pi and a real pi-durable host); SDK or package green does not waive it.
 
 | Axis | Required proof | Limit |
 |---|---|---|
@@ -306,7 +325,7 @@ The goal is not merely "invoke Claude Code." We want:
 **One install command to remember: `./run.sh setup <project>`.** It is idempotent — re-run the exact same command whenever anything looks wrong. There is no second install surface to juggle: from a clone `setup` runs the whole floor in order.
 
 1. `pnpm install` — installs the pinned development dependencies and builds the bridge (source-checkout bootstrap only; an installed package never runs npm/pnpm inside `node_modules`)
-2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.0.2 <1.1`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
+2. pi wiring → `<project>/.pi/settings.json` + user-scope registration — only when a `pi` inside the supported range (`>=1.0.4 <1.1`) is on PATH; absent pi is an explicit zero-state SKIP, a below-floor pi is a detected FAIL. The user-scope entry is owner-recorded (#86 C2): another root's live-or-missing ownership makes this step a zero-write refusal (setup: pi FAIL) that names `takeover-user-scope`; the install-states bind the exact managed settings path (a drifted/symlinked/corrupt target is a zero-write refusal) and the inverse removes only the recorded owner's exact entry; `doctor-pi-package` reports the verdict
 3. Claude meta-bridge global plugin — only when `claude` is on PATH; otherwise skipped cleanly
 4. source stable-bin exposure — including certified `entwurf` → this checkout's `run.sh`, the managed runtime Copilot fresh resolves; helper units are attempted independently and a foreign helper is a named FAIL
 5. agy bridge + exact permission + statusline + `PreInvocation` hook — only when `agy` is on PATH; each adapter is idempotent and independently doctorable

package/demo/README.md

@@ -142,7 +142,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 1.0.2)
+- `pi` on PATH (current floor 1.0.4)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)

package/docs/acp-backend-rail.md

@@ -134,7 +134,7 @@ ledger, 2026-10-03).
 | Surface | Declaration | Class | What a green actually says |
 |---|---|---|---|
 | Entwurf package | `package.json` `version` | checkout declaration, not a release receipt | names the package label these rows sit beside; whether that label shipped, and with which rows, is CHANGELOG's record |
-| pi runtime | devDep exact `1.0.2`, peer `>=1.0.2 <1.1` | **exact** oracle + **closed range** | the source pin this checkout builds and gates against; hosts inside the range are accepted, and the ceiling moves only on measurement. Unshipped candidate floor: the published 0.30.0 and 0.30.1 declare floor 1.0.0 with the same next-minor ceiling (`[측정 2026-10-05]` `npm view @junghanacs/entwurf@0.30.1 peerDependencies`; acceptance record CHANGELOG 0.30.0, #125 branch evidence). The 1.0.2 move and its receipts are ROADMAP's 2026-10-05 bump entry |
+| pi runtime | SDK exact `1.0.4`, host `>=1.0.4 <1.1` | **exact** oracle + **closed range** | the SDK set this checkout builds, gates and (since #130) ships as exact production dependencies; an ordinary Pi host inside the range is accepted, and the ceiling moves only on measurement. Unshipped candidate: the published 0.31.0 declares the earlier peer floor 1.0.2 with the same next-minor ceiling; the 1.0.4 move and its receipts are ROADMAP's 2026-10-07 bump entry |
 | ACP wire SDK | `@agentclientprotocol/sdk 1.6.0` | **exact** | the shared wire oracle both adapters speak |
 | Claude ACP adapter | `@agentclientprotocol/claude-agent-acp 0.85.1` | **exact**, bundled | checkout candidate; resolved before any PATH fallback; declaration is not compatibility evidence |
 | Claude Agent SDK | `0.3.286` (transitive) | **exact** oracle | the runtime risk surface behind the adapter |