One-install Pipedrive front door over four bounded contract packs. It admits 299 operations from the current official v1 and v2 OpenAPI documents: 151 buildable v2 routes plus 148 still-unique v1 routes. Fifty-three v1 operations with the same official operationId are intentionally superseded by v2, and nineteen transport or connection-bootstrap routes fail closed, including seven DELETE operations whose mandatory JSON bodies cannot be carried by the REST binding. The compatibility root preserves all 31 prior operation IDs; its eleven v1 bindings are corrected from the tenant-only /api/v1 shape to the official global https://api.pipedrive.com/v1 contract and are separately proven against the v1 pin because the composition model permits only one ingredient/source pin. Reads are uncached, sensitive reads are marked sensitive-read, every mutation is grant-off and approval-gated, documented pagination is bounded, binary downloads are isolated as file_ref values, and unsafe JSON integers are handled losslessly.