@junghanacs/entwurf 0.40.0 → 0.41.1

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-visible-resume.js

@@ -1,6 +1,28 @@
 /**
- * entwurf-v2-visible-resume — stand a dormant pi citizen back up in a window the operator can
- * see, under the same garden id, and say only what was actually observed.
+ * entwurf-v2-visible-resume — stand a dormant pi or Claude Code citizen back up in a window the
+ * operator can see, under the same garden id, and say only what was actually observed.
+ *
+ * ── Two backends, one shape (#147 L2) ──
+ *
+ * Both own their transcript and re-attach to their record when the same native session reopens.
+ * What differs is the rail each one proves itself on, so the dormancy proof and the observation are
+ * per backend and nothing else is:
+ *
+ *   pi           dormant = its control socket is dead; back = that socket answers again.
+ *   claude-code  dormant = the LAST VALIDATED owner the Entwurf hook armed for this session is
+ *                proven gone: the receiver marker names an owner `classifyMarkerOwner` calls DEAD,
+ *                AND the record re-read after that verdict still carries the same non-null
+ *                `attachIncarnation` the marker copied (#147 L2 B1) — so no arm-capable attach
+ *                committed after that owner's. An absent, unreadable, mismatched, live,
+ *                inconclusive or unbound marker proves nothing and refuses. A process that holds
+ *                the session without a committed hook attach (hooks disabled, a record-arm lock
+ *                timeout, a store write failure, a launch after the re-read) is invisible to this
+ *                proof. Back = a NEW live owner, in the pane this call opened, re-armed the marker
+ *                for the same session with a fresh binding the current record also carries (same
+ *                createdAt). The old marker read again is never success.
+ *
+ * Every other backend is the leaf's named refusal. The argv is a fixed table per backend; the caller
+ * supplies only the target.
  *
  * ── Where this sits ──
  *
@@ -41,14 +63,19 @@
  *
  * ── Two receipts, never merged ──
  *
- * `launch` says tmux made a window and was asked to start pi. `observation` says whether the
- * citizen's socket came back under the same id. Neither says the resumed citizen did anything:
- * a resume runs no turn (measured — the transcript stayed byte-identical), so there is no turn
- * outcome for this module to claim.
+ * `launch` says tmux made a window and was asked to start the runtime. `observation` says whether
+ * the citizen came back under the same id (pi: its socket; Claude Code: its receiver marker).
+ * Neither says the resumed citizen did anything. This verb submits no prompt. For pi a resume ran
+ * no turn (measured 2026-08-06, pi only — the transcript stayed byte-identical); for Claude Code
+ * the runtime's own activity after resume (its SessionStart hook re-arms the doorbell, and unread
+ * mail may then wake a turn) is unmeasured, so this module claims no turn outcome either way.
+ * The socket-only description in the observation section above is the pi half; the Claude Code
+ * half reads the receiver marker and the record instead.
  */
 import { ACP_MODEL_NOT_CURATED_HINT, AcpModelNotCuratedError } from "./acp/model-ids.js";
 import { buildResumePiArgs } from "./entwurf-resume-args.js";
 import { ENTWURF_V2_LOCK_DIR, acquireLock as realAcquireLock, releaseLock as realReleaseLock, } from "./entwurf-v2-lock.js";
+import { classifyMarkerOwner, metaReceiverMarkerPath, parseMetaReceiverMarker, probePidExistence, processStartKey, readStoreRecordFile, } from "./meta-session.js";
 import { ResumeBackendUnsupportedError, resolveResumeLaunchIdentity, } from "./resume-launch-identity.js";
 import { isValidSessionId } from "./session-id.js";
 import { CONTROL_SOCKET_DIR, inspectTargetControlSocket, mapInspectionToLiveness, } from "./socket-discovery.js";
@@ -68,12 +95,60 @@ export function makeVisibleResumeDeps(launch, overrides = {}) {
         resolveIdentity: resolveResumeLaunchIdentity,
         inspectSocket: (gid) => inspectTargetControlSocket(gid, CONTROL_SOCKET_DIR),
         probeSocket: (socketPath) => probeSocketLiveness(socketPath),
+        inspectReceiver: (gid) => inspectReceiverMarker(gid),
         launch,
         sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
         now: () => Date.now(),
         ...overrides,
     };
 }
+/**
+ * The receiver marker under `gardenId`, read RAW (no owner verification inside the reader — the
+ * path reader's `null` folds absent, corrupt and dead into one answer, and only "dead" may permit
+ * a resume) and judged by `classifyMarkerOwner`, the one place a dead verdict is produced. The
+ * bytes come from `readStoreRecordFile` — `O_NOFOLLOW` open, `fstat` kind and read on that one fd
+ * (#147 L2 D3) — so a symlink or a non-regular entry is corrupt and never followed, with no
+ * window between classifying the entry and reading it. `ENOENT` alone is absent.
+ */
+export function inspectReceiverMarker(gardenId, receiversDir) {
+    const markerPath = metaReceiverMarkerPath(gardenId, receiversDir);
+    let bytes;
+    try {
+        bytes = readStoreRecordFile(markerPath);
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return { kind: "absent" };
+        return { kind: "corrupt" };
+    }
+    let marker;
+    try {
+        marker = parseMetaReceiverMarker(bytes);
+    }
+    catch {
+        return { kind: "corrupt" };
+    }
+    if (marker === null)
+        return { kind: "corrupt" };
+    const owner = classifyMarkerOwner(marker.ownerStartKey, {
+        currentStartKey: processStartKey(marker.ownerPid),
+        pidExists: probePidExistence(marker.ownerPid),
+    });
+    return {
+        kind: "marker",
+        marker: {
+            gardenId: marker.gardenId,
+            backend: marker.backend,
+            nativeSessionId: marker.nativeSessionId,
+            ownerPid: marker.ownerPid,
+            ownerStartKey: marker.ownerStartKey,
+            attachIncarnation: marker.attachIncarnation,
+            ownerKind: marker.ownerKind,
+            armProvenance: marker.armProvenance,
+        },
+        owner,
+    };
+}
 /**
  * Reopen `targetGardenId` in a visible window.
  *
@@ -131,7 +206,7 @@ export async function visibleResume(targetGardenId, deps) {
         }
         catch (err) {
             // #128: the recorded model is not an exact curated ACP id, so Pi would pick another row
-            // by substring. Same shape as `target-not-pi`: a named refusal matched on its FIELD.
+            // by substring. Same shape as `target-backend-unsupported`: a named refusal matched on its FIELD.
             if (err instanceof AcpModelNotCuratedError) {
                 return {
                     ok: false,
@@ -143,12 +218,14 @@ export async function visibleResume(targetGardenId, deps) {
                 return {
                     ok: false,
                     reason: err.reason,
-                    detail: `${targetGardenId} is a ${err.backend} citizen; only pi citizens stand a control socket up, ` +
-                        `so only they can be reopened under the same garden id`,
+                    detail: `${targetGardenId} is a ${err.backend} citizen; only pi and Claude Code citizens can be reopened ` +
+                        `under the same garden id`,
                 };
             }
             throw err;
         }
+        if (identity.backend === "claude-code")
+            return await resumeClaudeCode(targetGardenId, identity, deps);
         // Liveness preflight, still under the lock. A live citizen is addressed with
         // `entwurf_v2 fire-and-forget`, not reopened — and refusing here is also what stops two
         // windows existing for one garden id.
@@ -183,14 +260,14 @@ export async function visibleResume(targetGardenId, deps) {
             provider: identity.provider,
             model: identity.model,
         });
-        const launched = deps.launch({ cwd: identity.cwd, runtimeArgs });
+        const launched = deps.launch({ backend: "pi", cwd: identity.cwd, runtimeArgs });
         if (!launched.ok) {
             return { ok: false, reason: "launch-refused", detail: `${launched.reason} — ${launched.hint}` };
         }
         const observation = await observeSameGidSocket(targetGardenId, mapped.socketPath, deps);
         return {
             ok: true,
-            launch: { targetGardenId, sessionFile: identity.sessionFile, handle: launched.handle },
+            launch: { backend: "pi", targetGardenId, sessionFile: identity.sessionFile, handle: launched.handle },
             observation,
         };
     }
@@ -198,6 +275,153 @@ export async function visibleResume(targetGardenId, deps) {
         release();
     }
 }
+/**
+ * The Claude Code half, still under the caller's lock. Dormancy needs a DEAD owner verdict on the
+ * receiver marker AND the binding: the record re-read AFTER that verdict must still name the same
+ * session and createdAt, and carry the same non-null `attachIncarnation` the marker copied. An
+ * absent marker (never armed, or retired when its process switched session), an unreadable one,
+ * one that names another session, a live owner, an inconclusive one and an unbound one each refuse
+ * by name, with no window. The re-read catches every attach whose atomic record write committed
+ * before it; a launch or attach that begins after it is not predicted. The launch uses the
+ * re-read record (its cwd), never the first read. The marker and the record are never removed or
+ * rewritten here — they are evidence, not something this verb may clear.
+ */
+async function resumeClaudeCode(targetGardenId, identity, deps) {
+    const before = deps.inspectReceiver(targetGardenId);
+    if (before.kind === "absent") {
+        return {
+            ok: false,
+            reason: "target-receiver-absent",
+            detail: `no receiver marker names ${targetGardenId}, so nothing proves its Claude Code process is gone`,
+        };
+    }
+    if (before.kind === "corrupt") {
+        return {
+            ok: false,
+            reason: "target-receiver-corrupt",
+            detail: `the receiver marker for ${targetGardenId} is not a readable regular marker, so its owner cannot be judged`,
+        };
+    }
+    const marker = before.marker;
+    if (marker.gardenId !== targetGardenId ||
+        marker.backend !== "claude-code" ||
+        marker.nativeSessionId !== identity.nativeSessionId) {
+        return {
+            ok: false,
+            reason: "target-receiver-mismatch",
+            detail: `the receiver marker for ${targetGardenId} names ${marker.backend}/${marker.nativeSessionId}, not the ` +
+                `record's claude-code/${identity.nativeSessionId}`,
+        };
+    }
+    if (before.owner === "live") {
+        return {
+            ok: false,
+            reason: "target-live",
+            detail: `${targetGardenId}'s Claude Code process (pid ${marker.ownerPid}) is still running — send to it with entwurf_v2 fire-and-forget instead`,
+        };
+    }
+    if (before.owner !== "dead") {
+        return {
+            ok: false,
+            reason: "target-indeterminate",
+            detail: `the receiver marker's owner (pid ${marker.ownerPid}) for ${targetGardenId} could not be proven gone, ` +
+                `and resuming a session that is still open would put two processes on one transcript`,
+        };
+    }
+    // The binding, read AFTER the dead verdict. A store or record defect here throws, exactly as
+    // the first read does: no window exists yet.
+    const current = deps.resolveIdentity(targetGardenId);
+    if (current.backend !== "claude-code" ||
+        current.nativeSessionId !== identity.nativeSessionId ||
+        current.createdAt !== identity.createdAt) {
+        return {
+            ok: false,
+            reason: "target-receiver-unbound",
+            detail: `the record under ${targetGardenId} changed between the two reads, so the dead marker cannot be bound to it`,
+        };
+    }
+    if (current.attachIncarnation === null || marker.attachIncarnation === null) {
+        return {
+            ok: false,
+            reason: "target-receiver-unbound",
+            detail: `no arm binding was observed for ${targetGardenId} (record ${current.attachIncarnation === null ? "has none" : "has one"}, ` +
+                `marker ${marker.attachIncarnation === null ? "has none" : "has one"}), so the dead owner is not proven to be the last attach`,
+        };
+    }
+    if (current.attachIncarnation !== marker.attachIncarnation) {
+        return {
+            ok: false,
+            reason: "target-receiver-unbound",
+            detail: `the record of ${targetGardenId} carries a later arm binding than its receiver marker — an attach committed ` +
+                `after the dead owner's, and its process is not proven gone`,
+        };
+    }
+    const launched = deps.launch({
+        backend: "claude-code",
+        cwd: current.cwd,
+        runtimeArgs: ["--resume", current.nativeSessionId],
+    });
+    if (!launched.ok) {
+        return { ok: false, reason: "launch-refused", detail: `${launched.reason} — ${launched.hint}` };
+    }
+    const observation = await observeReceiverReattached(targetGardenId, current, { ownerPid: marker.ownerPid, ownerStartKey: marker.ownerStartKey, attachIncarnation: current.attachIncarnation }, launched.handle.panePid, deps);
+    return {
+        ok: true,
+        launch: {
+            backend: "claude-code",
+            targetGardenId,
+            nativeSessionId: current.nativeSessionId,
+            handle: launched.handle,
+        },
+        observation,
+    };
+}
+/**
+ * ONE bounded operation, the Claude Code twin of `observeSameGidSocket`: wait for a NEW live owner
+ * — in the pane this call opened (`panePid`), a join, not an address — to re-arm this garden id's
+ * receiver marker for the same native session with a fresh binding the current record carries
+ * (same createdAt). The dead marker read again is never success: the owner must differ from the one
+ * the dormancy proof judged dead, and the binding from the one it bound. A marker armed by some
+ * other process is simply not-yet, and ends as `resume-unobserved`. A record or store defect is not
+ * a startup state: it stops the wait at once as `record-unreadable`, with its cause.
+ */
+export async function observeReceiverReattached(targetGardenId, identity, previous, panePid, deps, timeoutMs = RESUME_OBSERVE_TIMEOUT_MS, intervalMs = RESUME_OBSERVE_INTERVAL_MS) {
+    const started = deps.now();
+    for (;;) {
+        const seen = deps.inspectReceiver(targetGardenId);
+        if (seen.kind === "marker" &&
+            seen.owner === "live" &&
+            seen.marker.gardenId === targetGardenId &&
+            seen.marker.backend === "claude-code" &&
+            seen.marker.nativeSessionId === identity.nativeSessionId &&
+            String(seen.marker.ownerPid) === panePid &&
+            (seen.marker.ownerPid !== previous.ownerPid || seen.marker.ownerStartKey !== previous.ownerStartKey) &&
+            seen.marker.attachIncarnation !== null &&
+            seen.marker.attachIncarnation !== previous.attachIncarnation) {
+            let current;
+            try {
+                current = deps.resolveIdentity(targetGardenId);
+            }
+            catch (err) {
+                return {
+                    kind: "record-unreadable",
+                    cause: err instanceof Error ? err.message : String(err),
+                    waitedMs: deps.now() - started,
+                };
+            }
+            if (current.backend === "claude-code" &&
+                current.nativeSessionId === identity.nativeSessionId &&
+                current.createdAt === identity.createdAt &&
+                current.attachIncarnation === seen.marker.attachIncarnation) {
+                return { kind: "receiver-armed", ownerPid: seen.marker.ownerPid, waitedMs: deps.now() - started };
+            }
+        }
+        if (deps.now() - started >= timeoutMs) {
+            return { kind: "resume-unobserved", waitedMs: deps.now() - started };
+        }
+        await deps.sleep(intervalMs);
+    }
+}
 /**
  * ONE bounded operation: wait for the SAME garden id's control socket to answer. Alive is the
  * only early exit — an inspection that comes back absent, corrupt or inconclusive during startup
@@ -219,11 +443,15 @@ export async function observeSameGidSocket(targetGardenId, socketPath, deps, tim
 }
 const REJECT_HINT = {
     "target-invalid": "no citizen has that id; discover targets with entwurf_peers",
-    "target-not-pi": "that citizen's backend has no same-id resume — reach it with entwurf_v2, or open a fresh sibling",
+    "target-backend-unsupported": "that citizen's backend has no same-id resume (only pi and Claude Code do) — reach it with entwurf_v2, or open a fresh sibling",
     "acp-model-not-curated": ACP_MODEL_NOT_CURATED_HINT,
     "target-locked": "another resume or dispatch holds this citizen's lock right now",
     "target-live": "that citizen is already running — this verb only reopens dormant ones",
-    "target-indeterminate": "the socket probe could not prove the citizen is dormant, so nothing was started",
+    "target-indeterminate": "the citizen could not be proven dormant (an inconclusive socket probe or receiver owner), so nothing was started",
+    "target-receiver-absent": "a Claude Code citizen is proven dormant only by its receiver marker, and it has none — if its window is closed, reopen it yourself",
+    "target-receiver-corrupt": "the citizen's receiver marker cannot be read as a marker, so its owner cannot be judged",
+    "target-receiver-mismatch": "the receiver marker under this garden id names another backend or native session than the record — look at the store before anything reopens",
+    "target-receiver-unbound": "the dead receiver owner is not bound to the record's last arm (none observed, a later attach, or the record moved), so a Claude Code process may still hold the session — if its window is closed, reopen it yourself",
     "target-address-conflict": "that citizen's control-socket path is corrupt",
     "launch-refused": "tmux was never asked to open a window",
 };
@@ -236,7 +464,7 @@ const REJECT_HINT = {
  * who sees "window opened" and "socket alive" as one sentence has been told the resume worked;
  * a reader who sees them as two facts can tell which one is missing when only one is there.
  */
-export function renderVisibleResume(result) {
+export function renderVisibleResume(result, attribution = { actor: null }) {
     if (!result.ok) {
         return {
             text: `entwurf_resume_call rejected: ${result.reason} — ${REJECT_HINT[result.reason]}. ` +
@@ -245,22 +473,57 @@ export function renderVisibleResume(result) {
         };
     }
     const h = result.launch.handle;
-    const observed = result.observation.kind === "socket-alive";
+    // Who asked is recorded, and it is not authority: the verb decides from the target's record and
+    // live rail facts alone, whoever the caller is.
+    const actor = attribution.actor === null
+        ? `  actor:    unattributed (the caller has no record-backed garden identity)\n`
+        : `  actor:    ${attribution.actor} (record-backed caller; attribution, not authority)\n`;
+    const window = `  runtime:  ${h.runtimePath} (requested start cwd ${h.cwd})\n` +
+        `  window:   ${h.windowId} (index ${h.windowIndex}) in session ${h.sessionId}\n` +
+        `  pane:     ${h.paneId} pid ${h.panePid}\n`;
+    if (result.launch.backend === "claude-code") {
+        const observation = result.observation;
+        return {
+            text: `[entwurf resume call ↻]\n` +
+                `  target:   ${result.launch.targetGardenId}\n` +
+                `  backend:  claude-code\n` +
+                `  session:  ${result.launch.nativeSessionId}\n` +
+                window +
+                actor +
+                `\n` +
+                `LAUNCH receipt: tmux created that window and was asked to start claude --resume on the session above.\n` +
+                (observation.kind === "receiver-armed"
+                    ? `OBSERVATION receipt: receiver-armed — a NEW live Claude Code process in the window this call opened ` +
+                        `(pid ${observation.ownerPid}) re-armed the receiver marker of ${result.launch.targetGardenId} for the ` +
+                        `same session after ${observation.waitedMs}ms, with a fresh arm binding the record also carries ` +
+                        `(same createdAt). entwurf_v2 fire-and-forget now reaches its mailbox. This call submitted no ` +
+                        `prompt; the runtime's own activity after resume (e.g. a doorbell on unread mail) is unmeasured.`
+                    : observation.kind === "record-unreadable"
+                        ? `OBSERVATION receipt: record-unreadable — the record of ${result.launch.targetGardenId} could not be ` +
+                            `read after ${observation.waitedMs}ms: ${observation.cause}. The window is open and visible; the ` +
+                            `lock was released, nothing was retried, and nothing was killed.`
+                        : `OBSERVATION receipt: resume-unobserved — no new live receiver marker from the window this call ` +
+                            `opened, bound to the record, appeared within ${observation.waitedMs}ms. The window is open and ` +
+                            `visible; read it directly. The lock was released, nothing was retried, and nothing was killed.`),
+            isError: false,
+        };
+    }
+    const observation = result.observation;
+    const observed = observation.kind === "socket-alive";
     return {
         text: `[entwurf resume call ↻]\n` +
             `  target:   ${result.launch.targetGardenId}\n` +
             `  session:  ${result.launch.sessionFile}\n` +
-            `  runtime:  ${h.runtimePath} (requested start cwd ${h.cwd})\n` +
-            `  window:   ${h.windowId} (index ${h.windowIndex}) in session ${h.sessionId}\n` +
-            `  pane:     ${h.paneId} pid ${h.panePid}\n` +
+            window +
+            actor +
             `\n` +
             `LAUNCH receipt: tmux created that window and was asked to start pi on the transcript above.\n` +
             (observed
                 ? `OBSERVATION receipt: the control socket for ${result.launch.targetGardenId} answered after ` +
-                    `${result.observation.waitedMs}ms — that citizen is addressable again, and entwurf_v2 fire-and-forget ` +
+                    `${observation.waitedMs}ms — that citizen is addressable again, and entwurf_v2 fire-and-forget ` +
                     `now reaches it. No turn was run by this call.`
                 : `OBSERVATION receipt: resume-unobserved — the control socket did not answer within ` +
-                    `${result.observation.waitedMs}ms. The window is open and visible; read it directly. The lock was ` +
+                    `${observation.waitedMs}ms. The window is open and visible; read it directly. The lock was ` +
                     `released, nothing was retried, and nothing was killed.`),
         isError: false,
     };

package/mcp/entwurf-bridge/dist/pi-extensions/lib/fresh-call-composition.js

@@ -458,6 +458,13 @@ const MODEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._/:[\]-]*$/;
 export function isSafeFreshCallModel(model) {
     return model.length > 0 && model.length <= MODEL_MAX_CHARS && MODEL_PATTERN.test(model);
 }
+/** No model list on purpose: a hand-kept list of "good" ids would be a second catalog that rots
+ * on the next model version. The repair is to name a provider, and both sentences say what the
+ * refusal does NOT prove. */
+export const FRESH_CALL_PROVIDER_HINT = {
+    "model-openrouter-forbidden": "OpenRouter is not a sibling rail — name a subscription or direct provider instead. This refuses the provider name written in the request (in any letter case); it does not inspect which endpoint a differently named provider resolves to",
+    "pi-model-not-provider-qualified": "a pi model is `<provider>/<model id>` — a bare alias resolves to whichever row Pi's catalog prefers, which is not a provider you chose. `entwurf_peers` shows the model each running citizen recorded; that is a record fact, not proof of the endpoint that bills it",
+};
 /**
  * Normalise and validate what the CALLER supplied, in the one order both rails share.
  *

package/mcp/entwurf-bridge/dist/pi-extensions/lib/fresh-call-dispatch.js

@@ -2,12 +2,13 @@
  * fresh-call-dispatch — the ONE place that decides which rail opens a sibling, and the only module
  * allowed to know that there are two.
  *
- * WHY A COMPOSITION ROOT AND NOT A BRANCH IN EACH SURFACE. Two surfaces register
+ * WHY A COMPOSITION ROOT AND NOT A BRANCH IN EACH SURFACE. Two surfaces once registered
  * `entwurf_fresh_call`: pi's own extension and the MCP bridge. Before this file each of them
  * carried the Codex preflight ordering and the render call itself, and adding a rail choice to
  * both would have made four places where the wrong one could be picked. A defect planted in one
- * copy survives on the other, which is precisely the shape a mutant proves nothing about. So the
- * surfaces now supply identity and an env, and this module supplies everything else.
+ * copy survives on the other, which is precisely the shape a mutant proves nothing about. Since
+ * #125 the bridge is the only registration, and it still supplies only identity and an env; this
+ * module supplies everything else.
  *
  * THE RAIL IS A CAPABILITY FACT, NOT A PARAMETER. `HERDR_ENV=1` — exactly that value, herdr's own
  * variable — means this process is inside herdr and the herdr rail is the honest placement. Every
@@ -29,11 +30,47 @@ import { codexCallerFreshPreflight, codexFreshPreflight } from "./codex-fresh-pr
 import { isSafeFreshCallModel, mintNonce } from "./fresh-call-composition.js";
 import { createHerdrRunner, herdrFreshCall, renderHerdrFreshCall, resolveHerdrContext, } from "./herdr-fresh-call.js";
 import { freshCall, renderFreshCall } from "./mux-fresh-call.js";
+import { splitPiDurableModel } from "./pi-durable-fresh-preflight.js";
 /** herdr's own marker, read for its EXACT value. `[측정 2026-09-14]` herdr exports `HERDR_ENV=1`
  * to every process it starts; anything else is not a claim herdr made. */
 export function selectFreshCallRail(env) {
     return env.HERDR_ENV === "1" ? "herdr" : "tmux";
 }
+/**
+ * #76: the provider a Pi-dialect model string NAMES. pi passes the string to `--model` and Pi
+ * resolves it; pi-durable splits it at the first `/` into `--provider`. So for those two backends
+ * the segment before the first `/` is a provider choice, and for every other backend it is that
+ * vendor's own model name, which this does not judge (a claude-code `opus` stays an alias).
+ *
+ *   model-openrouter-forbidden        pi or pi-durable names the OpenRouter provider. Compared in
+ *                                     any letter case: whether Pi folds case is not measured here,
+ *                                     so the spelling difference fails closed instead of passing.
+ *   pi-model-not-provider-qualified   pi names no provider at all. The alias leaves the provider
+ *                                     choice to Pi's catalog instead of the caller naming it — a
+ *                                     bare `terra` once opened on an OpenRouter row. pi-durable
+ *                                     already refuses the same shape in its own preflight, by the
+ *                                     same predicate.
+ *
+ * WHAT THIS IS NOT. A call-time input contract only: it checks the string a caller wrote, never a
+ * model version, never a list of known ids, never a resolved row or the endpoint a provider name
+ * reaches. A later model name passes THIS provider check once it is written `<provider>/<id>` —
+ * which says nothing about whether it launches or what #128 decides after it. It does not touch
+ * resume, which reopens from the record, and it proves nothing about billing beyond the name.
+ * Read trimmed, and only once the rails' grammar admits the model, exactly like #128 below.
+ */
+export function freshCallProviderRefusal(backend, model) {
+    if (backend !== "pi" && backend !== "pi-durable")
+        return null;
+    const trimmed = model.trim();
+    if (!isSafeFreshCallModel(trimmed))
+        return null;
+    const slash = trimmed.indexOf("/");
+    if (slash >= 0 && trimmed.slice(0, slash).toLowerCase() === "openrouter")
+        return "model-openrouter-forbidden";
+    if (backend === "pi" && splitPiDurableModel(trimmed) === null)
+        return "pi-model-not-provider-qualified";
+    return null;
+}
 /**
  * #128: a pi sibling asked for under the `entwurf` provider must name an EXACT curated ACP id. Pi
  * resolves `--model` by substring among that provider's rows, so a retired `entwurf/claude-sonnet-5`
@@ -69,6 +106,13 @@ export function isUncuratedEntwurfPiModel(backend, model) {
  * them rather than inheriting a rule from a topology it does not share.
  */
 export async function dispatchFreshCall(request, env = process.env, spawn, nonce = mintNonce()) {
+    // Before either rail is asked anything: both would open a pane on a provider nobody chose.
+    const providerRefusal = freshCallProviderRefusal(request.backend, request.model);
+    if (providerRefusal !== null) {
+        return selectFreshCallRail(env) === "herdr"
+            ? { rail: "herdr", result: { ok: false, reason: providerRefusal } }
+            : { rail: "tmux", result: { ok: false, reason: providerRefusal } };
+    }
     // Before either rail is asked anything: both would open a pane on the wrong row.
     if (isUncuratedEntwurfPiModel(request.backend, request.model)) {
         return selectFreshCallRail(env) === "herdr"

package/mcp/entwurf-bridge/dist/pi-extensions/lib/herdr-fresh-call.js

@@ -45,7 +45,7 @@ import { statSync } from "node:fs";
 import path from "node:path";
 import { HERDR_FRESH_CALL_BACKENDS } from "../../scripts/herdr-rails.mjs";
 import { callbackEnvAssignments } from "./callback-env.js";
-import { buildOmpBootstrapPayload, composeBackendArgs, composeFreshCallFraming, normalizeFreshCallInputs, TASK_MAX_CHARS, } from "./fresh-call-composition.js";
+import { buildOmpBootstrapPayload, composeBackendArgs, composeFreshCallFraming, FRESH_CALL_PROVIDER_HINT, normalizeFreshCallInputs, TASK_MAX_CHARS, } from "./fresh-call-composition.js";
 /**
  * The pilot set, closed. `[#116 decision]` herdr's own `--kind` enum is much larger, and that is
  * NOT evidence of support: every other backend is a pre-mutation named reject here, and there is
@@ -786,6 +786,8 @@ async function reclaim(pane, run) {
  * they will guess about. The five shared input reasons keep the wording the public verb has always
  * used; the rest are this rail's own. */
 const HERDR_REJECT_HINT = {
+    // #76: decided at the dispatch root, worded once in the shared composition leaf.
+    ...FRESH_CALL_PROVIDER_HINT,
     "caller-identity-unavailable": "this surface has no record-backed identity, so a sibling would have nowhere to call home",
     "model-empty": "pass the model you want the sibling opened with — it is never inherited from this process",
     "model-invalid": "the model is not in the accepted grammar (no whitespace, no leading dash)",