@@ -79,15 +79,23 @@ With these rules, the result no longer depends on when Pi writes the entry.
 - [Workflow server](../WORKFLOW_SERVER.md) and [Workflow step messages](../WORKFLOW_STEP_MESSAGES.md):
   state the rules above, and fix the stale sentence that says the branch report covers the complete
   view window.
+- Pi 1.1.0 for development and CI, at Onur's request after the first review. The development
+  dependencies move from 0.85.0 to 1.1.0, so CI runs the deferred `agent_settled` timing that caused
+  this incident. The new E2E test hangs on Pi 1.1.0 without the fix.
+- `src/builtins/pi-agent-group.ts`: since Pi 0.99.0, `preflightResult` reports a disposition for an
+  accepted prompt (`started`, `handled`, or `queued`) and nothing for a rejected one. The old check
+  waited for `false`, so a handled or queued prompt passed as accepted. The agent group now requires
+  `started`, and it picks the chat entry of a model ID that also has image or classifier entries.
+  The Pi peer ranges move to `>=0.99.0`, the first release with both APIs.
+- `scripts/live-e2e.mjs`: the isolation check accepts the extensions that Pi 1.0 and later ship built
+  in, such as llama.cpp and MCP, and still rejects every other foreign resource.
 
 ## Non-goals
 
 - Pi and its session files stay unchanged, and the branch report keeps its format with one message
   ID.
 - No change to reports that name no message. They keep their current rule.
 - No change to the status text for a pending step.
-- No upgrade of the Pi development dependency from 0.85.0. The unit tests model the deferred Pi
-  delivery directly, and the E2E suite can run on a newer Pi through `PI_WORKFLOWS_E2E_PI_ENTRY`.
 - Post-workflow turns and missing-submission reminders keep their behavior. Reminder steps are a
   second message for a request, so this fix also stops the server from cancelling them.
 
@@ -119,7 +127,8 @@ The E2E test "delivers a step resumed from a model turn and the step after it" r
 on a real Pi with a local mock model. `PI_WORKFLOWS_E2E_PI_ENTRY` points the E2E suite at another Pi
 `cli.js`. With Pi 1.0.4 and without this fix, the test hangs at the second step with "A step is
 pending delivery. It starts a new model turn after this turn ends." With the fix, it passes, and so
-does the whole workflow E2E file:
+does the whole workflow E2E file. The pinned Pi 1.1.0 gives the same results, so CI runs this check
+without the variable:
 
 ```bash
 PI_WORKFLOWS_E2E_PI_ENTRY=/path/to/pi-coding-agent/dist/cli.js \
 
@@ -77,9 +77,9 @@
     "tsx": "^4.23.13"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "0.85.0",
-    "@earendil-works/pi-coding-agent": "0.85.0",
-    "@earendil-works/pi-tui": "0.85.0",
+    "@earendil-works/pi-ai": "1.1.0",
+    "@earendil-works/pi-coding-agent": "1.1.0",
+    "@earendil-works/pi-tui": "1.1.0",
     "@types/better-sqlite3": "^7.6.13",
     "@types/node": "^26.1.1",
     "@vitest/coverage-istanbul": "^4.1.10",
@@ -90,9 +90,9 @@
     "vitest": "^4.1.10"
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": ">=0.84.2",
-    "@earendil-works/pi-coding-agent": ">=0.84.2",
-    "@earendil-works/pi-tui": ">=0.84.2",
+    "@earendil-works/pi-ai": ">=0.99.0",
+    "@earendil-works/pi-coding-agent": ">=0.99.0",
+    "@earendil-works/pi-tui": ">=0.99.0",
     "typebox": "*"
   },
   "engines": {
 
@@ -27,6 +27,10 @@ export function isExpectedWorkflowAbort(
 ): boolean;
 export function parseArgs(argv: string[]): LiveE2eOptions;
 export function configureModelBudget(profile: string, options: LiveE2eOptions): Promise<void>;
+export function assertPackageIsolation(
+  rpc: { request(command: string): Promise<unknown> },
+  candidate: string,
+): Promise<void>;
 export function assertSafeTempRoot(root: string, temporaryDirectory?: string): string;
 export function removeTemporaryRoot(root: string, temporaryDirectory?: string): Promise<void>;
 export function withTemporaryRoot<T>(
 
@@ -686,7 +686,7 @@ async function startPi(context) {
   return rpc;
 }
 
-async function assertPackageIsolation(rpc, candidate) {
+export async function assertPackageIsolation(rpc, candidate) {
   const data = requireObject(await rpc.request("get_commands"), "Pi commands response");
   if (!Array.isArray(data.commands)) throw new Error("Pi commands response has no command list");
   const commandPath = (command) => command.path ?? command.sourceInfo?.path;
@@ -707,6 +707,9 @@ async function assertPackageIsolation(rpc, candidate) {
   }
   const unrelated = data.commands.filter((command) => {
     if (command.source !== "extension") return true;
+    // Pi 1.0 and later ship built-in extensions, such as llama.cpp and MCP. They
+    // belong to base Pi, so they do not break isolation from user resources.
+    if (command.sourceInfo?.source === "builtin") return false;
     const sourcePath = commandPath(command);
     if (typeof sourcePath === "string" && sourcePath.startsWith("<inline:")) return false;
     return (
 
@@ -1,6 +1,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { isModelType } from "@earendil-works/pi-ai";
 import {
   createAgentSession,
   createAgentSessionFromServices,
@@ -79,8 +80,17 @@ export type PiAgentLifecycleEvent = {
 
 type PiAgentEvent = Record<string, unknown>;
 
+/**
+ * How Pi dispatched an accepted prompt. Pi reports no disposition for a rejected
+ * prompt, and only a `started` prompt runs the model.
+ */
+type PromptDisposition = "started" | "handled" | "queued";
+
 type PiAgentSession = {
-  prompt(text: string, options?: { preflightResult?: (accepted: boolean) => void }): Promise<void>;
+  prompt(
+    text: string,
+    options?: { preflightResult?: (disposition: PromptDisposition) => void },
+  ): Promise<void>;
   subscribe(listener: (event: PiAgentEvent) => void): () => void;
   abort(): Promise<void>;
   dispose(): void | Promise<void>;
@@ -823,7 +833,7 @@ async function runOneAgent(
   let session: PiAgentSession | undefined;
   let unsubscribe: (() => void) | undefined;
   let finalMessage: Record<string, unknown> | undefined;
-  let preflightAccepted: boolean | undefined;
+  let preflightDisposition: PromptDisposition | undefined;
   let abortKind: "timeout" | "cancelled" | undefined;
   let abortFailure: unknown;
   let abortWork = Promise.resolve();
@@ -875,8 +885,8 @@ async function runOneAgent(
     }
 
     await session.prompt(request.prompt, {
-      preflightResult: (accepted) => {
-        preflightAccepted = accepted;
+      preflightResult: (disposition) => {
+        preflightDisposition = disposition;
       },
     });
     await abortWork;
@@ -894,8 +904,14 @@ async function runOneAgent(
         `${cancellationReason(options.signal.reason)}${abortSuffix(abortFailure)}`,
       );
     }
-    if (preflightAccepted === false) {
-      throw new PiAgentGroupError(request.id, "rejected prompt", "prompt preflight failed");
+    if (preflightDisposition !== "started") {
+      throw new PiAgentGroupError(
+        request.id,
+        "rejected prompt",
+        preflightDisposition === undefined
+          ? "prompt preflight failed"
+          : `Pi ${preflightDisposition} the prompt without running the model`,
+      );
     }
     lifecycle.emit("running", "finalizing", true);
     const text = finalAssistantText(request.id, finalMessage, options.maxFinalChars!);
@@ -980,10 +996,14 @@ async function createSdkSession(
   signal: AbortSignal,
 ): Promise<PiAgentSession> {
   if (signal.aborted) throw cancellationError(request.id, signal.reason);
-  const model = plan.modelSnapshot.models.find(
-    (candidate) =>
-      candidate.provider === plan.dispatch.provider && candidate.id === plan.dispatch.modelId,
-  );
+  // One provider model ID can name a chat entry and an image or classifier
+  // entry. An agent session needs the chat entry.
+  const model = plan.modelSnapshot.models
+    .filter((candidate) => isModelType(candidate, "chat"))
+    .find(
+      (candidate) =>
+        candidate.provider === plan.dispatch.provider && candidate.id === plan.dispatch.modelId,
+    );
   if (model === undefined) {
     throw new PiAgentGroupError(
       request.id,
 
@@ -5,6 +5,7 @@ import os from "node:os";
 import path from "node:path";
 import { describe, expect, it } from "vitest";
 import {
+  assertPackageIsolation,
   assertSafeTempRoot,
   configureModelBudget,
   isExpectedWorkflowAbort,
@@ -196,6 +197,36 @@ describe("installed live E2E script", () => {
     }
   });
 
+  it("accepts base Pi built-in extensions but no other foreign resource", async () => {
+    const candidate = path.join(os.tmpdir(), "live-e2e-candidate");
+    const own = ["workflow", "resource-manager", "piw"].map((name) => ({
+      name,
+      source: "extension",
+      sourceInfo: { path: path.join(candidate, "src", "extension", "index.ts") },
+    }));
+    const builtin = {
+      name: "llama",
+      source: "extension",
+      sourceInfo: { path: "builtin:llama.cpp", source: "builtin" },
+    };
+    const rpc = (commands: unknown[]) => ({ request: async () => ({ commands }) });
+    await expect(
+      assertPackageIsolation(rpc([...own, builtin]), candidate),
+    ).resolves.toBeUndefined();
+    await expect(
+      assertPackageIsolation(
+        rpc([
+          ...own,
+          { name: "user", source: "extension", sourceInfo: { path: "/home/user/ext.ts" } },
+        ]),
+        candidate,
+      ),
+    ).rejects.toThrow("Base Pi loaded unrelated resources");
+    await expect(
+      assertPackageIsolation(rpc([...own, { name: "skill:x", source: "skill" }]), candidate),
+    ).rejects.toThrow("Base Pi loaded unrelated resources");
+  });
+
   it("refuses cleanup outside one direct guarded temporary root", () => {
     expect(() => assertSafeTempRoot("/", "/tmp")).toThrow("Refusing unsafe");
     expect(() => assertSafeTempRoot(os.homedir(), "/tmp")).toThrow("Refusing unsafe");
 
@@ -89,8 +89,8 @@ describe("Pi package resources", () => {
       "@earendil-works/pi-coding-agent",
       "@earendil-works/pi-tui",
     ]) {
-      expect(manifest.devDependencies?.[packageName]).toBe("0.85.0");
-      expect(manifest.peerDependencies?.[packageName]).toBe(">=0.84.2");
+      expect(manifest.devDependencies?.[packageName]).toBe("1.1.0");
+      expect(manifest.peerDependencies?.[packageName]).toBe(">=0.99.0");
     }
     expect(manifest.dependencies?.["@earendil-works/pi-server"]).toBe(">=0.85.0");
   });
 
@@ -93,7 +93,7 @@ function successfulFactory(
         return () => listeners.delete(listener);
       },
       async prompt(_prompt, options) {
-        options?.preflightResult?.(true);
+        options?.preflightResult?.("started");
         active += 1;
         hooks.active?.(active);
         for (const listener of listeners) {
@@ -218,7 +218,7 @@ describe("Pi agent groups", () => {
           return () => listeners.delete(listener);
         },
         async prompt(_prompt, options) {
-          options?.preflightResult?.(true);
+          options?.preflightResult?.("started");
           for (const listener of listeners) listener(message("", "error", "provider failed"));
         },
         async abort() {},
@@ -257,7 +257,7 @@ describe("Pi agent groups", () => {
       thinkingLevel: "off",
       subscribe: () => () => {},
       async prompt(_prompt, options) {
-        options?.preflightResult?.(true);
+        options?.preflightResult?.("started");
         await new Promise<void>((resolve) => {
           release = resolve;
         });
@@ -414,30 +414,38 @@ describe("Pi agent groups", () => {
   });
 
   it("reports prompt rejection and missing final output", async () => {
-    const rejected: PiAgentSessionFactory = async () => ({
-      model: { provider: "mock", id: "model" },
-      thinkingLevel: "off",
-      subscribe: () => () => {},
-      async prompt(_prompt, options) {
-        options?.preflightResult?.(false);
-      },
-      async abort() {},
-      dispose() {},
-    });
-    await expect(
-      runPiAgentGroup([request("rejected")], {
-        maxConcurrency: 1,
-        signal: new AbortController().signal,
-        sessionFactory: rejected,
-      }),
-    ).rejects.toThrow(/rejected prompt/);
+    // Pi reports no disposition for a rejected prompt, and an extension can
+    // handle a prompt or Pi can queue it without running the model.
+    for (const disposition of [undefined, "handled", "queued"] as const) {
+      const rejected: PiAgentSessionFactory = async () => ({
+        model: { provider: "mock", id: "model" },
+        thinkingLevel: "off",
+        subscribe: () => () => {},
+        async prompt(_prompt, options) {
+          if (disposition !== undefined) options?.preflightResult?.(disposition);
+        },
+        async abort() {},
+        dispose() {},
+      });
+      await expect(
+        runPiAgentGroup([request("rejected")], {
+          maxConcurrency: 1,
+          signal: new AbortController().signal,
+          sessionFactory: rejected,
+        }),
+      ).rejects.toThrow(
+        disposition === undefined
+          ? /rejected prompt: prompt preflight failed/
+          : new RegExp(`rejected prompt: Pi ${disposition} the prompt`),
+      );
+    }
 
     const missing: PiAgentSessionFactory = async () => ({
       model: { provider: "mock", id: "model" },
       thinkingLevel: "off",
       subscribe: () => () => {},
       async prompt(_prompt, options) {
-        options?.preflightResult?.(true);
+        options?.preflightResult?.("started");
       },
       async abort() {},
       dispose() {},
@@ -462,7 +470,7 @@ describe("Pi agent groups", () => {
           return () => listeners.delete(listener);
         },
         async prompt(_prompt, options) {
-          options?.preflightResult?.(true);
+          options?.preflightResult?.("started");
           for (const listener of listeners) {
             listener({
               type: "message_end",
@@ -498,7 +506,8 @@ describe("Pi agent groups", () => {
           listeners.add(listener);
           return () => listeners.delete(listener);
         },
-        async prompt() {
+        async prompt(_prompt, options) {
+          options?.preflightResult?.("started");
           for (const listener of listeners) {
             listener({ type: "tool_execution_start", toolName: "bash" });
             listener(message("old failure", "error", "old"));
@@ -545,7 +554,8 @@ describe("Pi agent groups", () => {
             listeners.add(listener);
             return () => listeners.delete(listener);
           },
-          async prompt() {
+          async prompt(_prompt, options) {
+            options?.preflightResult?.("started");
             for (const event of events) for (const listener of listeners) listener(event);
           },
           async abort() {},
@@ -660,7 +670,8 @@ describe("Pi agent groups", () => {
           listeners.add(listener);
           return () => listeners.delete(listener);
         },
-        async prompt() {
+        async prompt(_prompt, options) {
+          options?.preflightResult?.("started");
           for (const listener of listeners) listener(message("ok"));
         },
         async abort() {},
@@ -818,7 +829,8 @@ describe("Pi agent groups", () => {
           listeners.add(listener);
           return () => listeners.delete(listener);
         },
-        async prompt() {
+        async prompt(_prompt, options) {
+          options?.preflightResult?.("started");
           for (let index = 0; index < 100; index += 1) {
             for (const listener of listeners) {
               listener({