@junghanacs/entwurf 0.12.6 → 0.12.7

package/scripts/check-agy-sender-identity.ts

@@ -0,0 +1,364 @@
+/**
+ * check-agy-sender-identity — deterministic gate for the #46 sender-identity lane: the agy
+ * hook WRITES the marker, and the bridge's resolver READS it into exactly one identity or
+ * refuses.
+ *
+ * The bug this closes: a birthed agy conversation called entwurf_v2 for real (MCP tool call,
+ * not shell-out) and its message still landed as `external-mcp/unknown-host`, non-replyable.
+ * The bridge held the owner pid but had no marker to look up: the hook wrote only the
+ * meta-record, and the resolver searched the `claude-code` marker directory alone.
+ *
+ * BEHAVIORAL, not source-regex: the resolver runs against isolated marker/record stores, and
+ * the hook runs as a real child process (so the marker's ownerPid is THIS gate's pid — the
+ * same parent-pid join the bridge performs in production).
+ *
+ * Rows:
+ *   WRITER (real subprocess)
+ *     - hook writes an antigravity marker keyed by its PARENT pid, matching the record it minted
+ *     - upsert failure writes NO marker (record authority first — never a garden-id with no record)
+ *   RESOLVER (real store)
+ *     - 0 markers → null (anonymous; the caller decides whether that is fatal)
+ *     - 1 trusted → that identity, on EITHER backend (the claude-code-only lookup was the bug)
+ *     - marker with no backing record → null (a hint is not an identity)
+ *     - marker whose nativeSessionId drifted from its record → null
+ *     - 2 distinct live identities on one owner pid → THROW (never guess, never downgrade)
+ *     - 2 markers naming the SAME identity → NOT a conflict (an older release wrote parent AND
+ *       grandparent markers; both may still sit on disk)
+ *   DOMAIN (the rail the bridge picks the replyable fact from)
+ *     - antigravity is native-push, claude-code is not — so an agy sender's replyable comes from
+ *       the adapter probe, never from a mailbox watch it can never arm (보정①)
+ */
+
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { nativePushSupported } from "../pi-extensions/lib/entwurf-v2-contract.ts";
+import {
+	EntwurfSenderIdentityAmbiguityError,
+	META_SENDER_BACKENDS,
+	probeNativeSenderAlive,
+	resolveTrustedMetaSenderIdentity,
+} from "../pi-extensions/lib/meta-sender-identity.ts";
+import { type MetaIdentity, upsertMetaSession, writeMetaSenderMarker } from "../pi-extensions/lib/meta-session.ts";
+import type { NativePushAdapter } from "../pi-extensions/lib/native-push/adapter.ts";
+
+let passed = 0;
+function ok(label: string, cond: boolean): void {
+	assert.ok(cond, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+const REPO_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const HOOK = path.join(REPO_DIR, "scripts", "agy-imprint.ts");
+
+// Isolated stores — this gate never touches the operator's real garden. XDG_STATE_HOME is
+// isolated too: the hook's own log lives under it, and a gate that appends fabricated
+// "upsert-failed" lines to the operator's real agy-imprint.log would be planting false
+// evidence in the exact file a live agy debugging session reads.
+const ROOT = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-sender-identity-"));
+const SESSIONS_DIR = path.join(ROOT, "meta-sessions");
+const SENDERS_DIR = path.join(ROOT, "meta-senders");
+const STATE_DIR = path.join(ROOT, "state");
+process.env.ENTWURF_META_SESSIONS_DIR = SESSIONS_DIR;
+process.env.ENTWURF_META_SENDERS_DIR = SENDERS_DIR;
+process.env.XDG_STATE_HOME = STATE_DIR;
+
+// The owner pid the markers are keyed to. process.pid is alive by construction, so
+// writeMetaSenderMarker's start-key is a real one and the read-side pid-reuse guard passes —
+// exactly as an agy host pid does in production.
+const OWNER = process.pid;
+const resolve = () => resolveTrustedMetaSenderIdentity({ ownerPids: [OWNER], sendersDir: SENDERS_DIR });
+
+function clearMarkers(): void {
+	fs.rmSync(SENDERS_DIR, { recursive: true, force: true });
+}
+
+try {
+	// ── WRITER: the real hook, as a real child process ───────────────────────
+	{
+		// A synthetic id on purpose: a REAL conversation id here would write plausible-looking
+		// imprint lines that a later reader could mistake for live evidence.
+		const conversationId = "00000000-gate-0000-0000-agyimprint01";
+		const payload = JSON.stringify({
+			conversationId,
+			workspacePaths: [REPO_DIR],
+			modelName: "gemini-3.1-pro-low",
+		});
+		const stdout = execFileSync(
+			process.execPath,
+			["--experimental-strip-types", "--disable-warning=ExperimentalWarning", HOOK],
+			{ input: payload, encoding: "utf8", env: process.env },
+		);
+		ok(
+			"hook still prints the PreInvocation neutral response (the agy loop must never break)",
+			stdout.trim() === '{"injectSteps":[]}',
+		);
+
+		// The hook's parent IS this gate — the same shape as production, where the hook's parent
+		// is the agy host that also parents the bridge. So the marker must land under OUR pid.
+		const markerPath = path.join(SENDERS_DIR, "antigravity", `${OWNER}.json`);
+		ok("hook writes an antigravity sender marker keyed by its PARENT pid", fs.existsSync(markerPath));
+
+		const marker = JSON.parse(fs.readFileSync(markerPath, "utf8"));
+		ok("marker carries backend=antigravity", marker.backend === "antigravity");
+		ok("marker's nativeSessionId is the agy conversationId", marker.nativeSessionId === conversationId);
+		ok(
+			"marker is start-key guarded (pid alone is reused; pid+start is boot-unique)",
+			typeof marker.ownerStartKey === "string" && marker.ownerStartKey.length > 0,
+		);
+
+		// End-to-end: the bridge's resolver, over what the hook actually wrote.
+		const trusted = resolve();
+		ok("resolver turns the hook's marker into ONE trusted identity", trusted !== null);
+		ok("resolved identity is the agy citizen the hook minted", trusted?.identity.gardenId === marker.gardenId);
+		ok(
+			"resolved identity carries backend=antigravity (this is what stops external-mcp/unknown-host)",
+			trusted?.identity.backend === "antigravity",
+		);
+	}
+
+	// ── TRACE CONTRACT: the owner-topology trace is OPT-IN, and stays that way ────
+	// PreInvocation runs before EVERY model turn. A trace left on by default would walk /proc six
+	// times per turn and append to the imprint log forever — an unbounded diagnostic in the file
+	// whose job is to hold birth evidence. It earned its place while proving the pid join and must
+	// now cost nothing until someone asks for it, so the DEFAULT is what this gate owns.
+	{
+		const logFile = path.join(STATE_DIR, "entwurf", "agy-imprint.log");
+		const runHook = (trace: boolean) =>
+			execFileSync(process.execPath, ["--experimental-strip-types", "--disable-warning=ExperimentalWarning", HOOK], {
+				input: JSON.stringify({ conversationId: "00000000-gate-0000-0000-tracecontract", workspacePaths: [REPO_DIR] }),
+				encoding: "utf8",
+				env: trace ? { ...process.env, ENTWURF_AGY_TRACE_OWNER: "1" } : process.env,
+			});
+
+		fs.rmSync(logFile, { force: true });
+		runHook(false);
+		ok(
+			"trace: default env writes NO ancestry line (no per-turn /proc walk, no unbounded log)",
+			!fs.readFileSync(logFile, "utf8").includes("pids conversationId="),
+		);
+		ok(
+			"trace: the useful evidence still lands (the marker write is what a healthy host needs)",
+			fs.readFileSync(logFile, "utf8").includes("sender marker "),
+		);
+
+		fs.rmSync(logFile, { force: true });
+		runHook(true);
+		ok(
+			"trace: ENTWURF_AGY_TRACE_OWNER=1 writes the ancestry line (the only way to say WHY a sender resolves anonymous)",
+			/pids conversationId=.* ppid=\d+ chain=/.test(fs.readFileSync(logFile, "utf8")),
+		);
+	}
+
+	// ── WRITER negative: no record → no marker ───────────────────────────────
+	{
+		clearMarkers();
+		// A file where the record dir must be: upsertMetaSession cannot write, so it throws.
+		const brokenRoot = path.join(ROOT, "broken-sessions");
+		fs.writeFileSync(brokenRoot, "not a directory\n");
+		execFileSync(process.execPath, ["--experimental-strip-types", "--disable-warning=ExperimentalWarning", HOOK], {
+			input: JSON.stringify({ conversationId: "dead-beef-0000", workspacePaths: [REPO_DIR] }),
+			encoding: "utf8",
+			env: { ...process.env, ENTWURF_META_SESSIONS_DIR: brokenRoot },
+		});
+		ok(
+			"upsert failure writes NO sender marker (record authority first — no garden-id without a record)",
+			!fs.existsSync(path.join(SENDERS_DIR, "antigravity")),
+		);
+
+		// The gate must be invisible to the operator's garden: the hook's log follows
+		// XDG_STATE_HOME, so it has to land in the isolated root, never in ~/.local/state.
+		ok(
+			"hook's imprint log stays inside the isolated XDG_STATE_HOME (no writes to the operator's real log)",
+			fs.existsSync(path.join(STATE_DIR, "entwurf", "agy-imprint.log")),
+		);
+	}
+	clearMarkers();
+	ok("no marker → null (anonymous; the caller decides whether that is fatal)", resolve() === null);
+
+	// A trusted identity on EITHER backend. The claude-code-only lookup is the bug — an agy
+	// citizen was invisible to the very bridge its own conversation spawned.
+	for (const backend of META_SENDER_BACKENDS) {
+		clearMarkers();
+		const nativeSessionId = `native-${backend}`;
+		const record = upsertMetaSession({ input: { backend, nativeSessionId, cwd: REPO_DIR } });
+		writeMetaSenderMarker({
+			backend,
+			gardenId: record.record.gardenId,
+			nativeSessionId,
+			cwd: REPO_DIR,
+			ownerPid: OWNER,
+			sendersDir: SENDERS_DIR,
+		});
+		const trusted = resolve();
+		ok(
+			`backend ${backend}: live record-backed marker → trusted identity`,
+			trusted?.identity.gardenId === record.record.gardenId,
+		);
+	}
+	clearMarkers();
+	writeMetaSenderMarker({
+		backend: "antigravity",
+		gardenId: "20260713T161524-0db936",
+		nativeSessionId: "no-such-conversation",
+		cwd: REPO_DIR,
+		ownerPid: OWNER,
+		sendersDir: SENDERS_DIR,
+	});
+	ok("marker with NO backing record → null (a stale marker names nobody)", resolve() === null);
+
+	{
+		clearMarkers();
+		const record = upsertMetaSession({
+			input: { backend: "antigravity", nativeSessionId: "conversation-A", cwd: REPO_DIR },
+		});
+		writeMetaSenderMarker({
+			backend: "antigravity",
+			gardenId: record.record.gardenId,
+			nativeSessionId: "conversation-B", // drifted from the record
+			cwd: REPO_DIR,
+			ownerPid: OWNER,
+			sendersDir: SENDERS_DIR,
+		});
+		ok("marker whose nativeSessionId drifted from its record → null", resolve() === null);
+	}
+
+	// THE REFUSAL. One native host driving two live sessions breaks the pid→conversation
+	// binding the marker rests on. We can see both identities and cannot name the caller, so
+	// we send under neither: a wrong attribution is worse than no send, and a silent fallback
+	// to anonymous would hide an identity we already hold.
+	{
+		clearMarkers();
+		const a = upsertMetaSession({ input: { backend: "antigravity", nativeSessionId: "conv-A", cwd: REPO_DIR } });
+		const b = upsertMetaSession({ input: { backend: "claude-code", nativeSessionId: "sess-B", cwd: REPO_DIR } });
+		writeMetaSenderMarker({
+			backend: "antigravity",
+			gardenId: a.record.gardenId,
+			nativeSessionId: "conv-A",
+			cwd: REPO_DIR,
+			ownerPid: OWNER,
+			sendersDir: SENDERS_DIR,
+		});
+		writeMetaSenderMarker({
+			backend: "claude-code",
+			gardenId: b.record.gardenId,
+			nativeSessionId: "sess-B",
+			cwd: REPO_DIR,
+			ownerPid: OWNER,
+			sendersDir: SENDERS_DIR,
+		});
+		let threw: unknown = null;
+		try {
+			resolve();
+		} catch (err) {
+			threw = err;
+		}
+		ok(
+			"two distinct live identities on one owner pid → THROW (never guess, never downgrade to anonymous)",
+			threw instanceof EntwurfSenderIdentityAmbiguityError,
+		);
+		ok(
+			"the refusal names both citizens so the wiring bug is debuggable",
+			threw instanceof EntwurfSenderIdentityAmbiguityError && threw.gardenIds.length === 2,
+		);
+	}
+
+	// Same identity reached twice is NOT ambiguity: an older release wrote a marker for the
+	// parent AND the grandparent. Throwing there would refuse a send that has one honest answer.
+	{
+		clearMarkers();
+		const record = upsertMetaSession({
+			input: { backend: "antigravity", nativeSessionId: "conv-solo", cwd: REPO_DIR },
+		});
+		for (const pid of [OWNER, process.ppid]) {
+			writeMetaSenderMarker({
+				backend: "antigravity",
+				gardenId: record.record.gardenId,
+				nativeSessionId: "conv-solo",
+				cwd: REPO_DIR,
+				ownerPid: pid,
+				sendersDir: SENDERS_DIR,
+			});
+		}
+		const trusted = resolveTrustedMetaSenderIdentity({
+			ownerPids: [OWNER, process.ppid],
+			sendersDir: SENDERS_DIR,
+		});
+		ok(
+			"two markers naming the SAME identity → not a conflict, one identity",
+			trusted?.identity.gardenId === record.record.gardenId,
+		);
+	}
+	ok(
+		"antigravity is a native-push backend → its replyable comes from the adapter probe",
+		nativePushSupported("antigravity"),
+	);
+	ok(
+		"claude-code is NOT native-push → its replyable stays on the mailbox receiver axis (보정①: the rails never borrow each other's facts)",
+		!nativePushSupported("claude-code"),
+	);
+
+	// ── PROBE ERROR POLICY: an adapter outcome is a FACT, a throw is a DEFECT ────
+	// The adapter reports "not reachable" as a value (dead / indeterminate). So a throw out of the
+	// probe can only be a broken registry or a probe that could not run at all. Folding that into
+	// replyable:false would tell the receiver a lie about this sender AND bury the defect — the
+	// exact Crash-Don't-Warn shape this lane exists to remove. It must propagate.
+	{
+		const identity: Pick<MetaIdentity, "backend" | "nativeSessionId"> = {
+			backend: "antigravity",
+			nativeSessionId: "conv-x",
+		};
+		const adapterWith = (probe: NativePushAdapter["probe"]) => ({ resolveAdapter: () => ({ probe }) });
+
+		ok(
+			"probe alive → replyable true",
+			(await probeNativeSenderAlive(
+				identity,
+				adapterWith(async () => ({ status: "alive", route: { lsAddress: "127.0.0.1:1" } })),
+			)) === true,
+		);
+
+		for (const status of ["dead", "indeterminate"] as const) {
+			ok(
+				`probe ${status} → replyable false (an adapter's OWN outcome is the fact)`,
+				(await probeNativeSenderAlive(
+					identity,
+					adapterWith(async () => ({ status, reason: "gate" })),
+				)) === false,
+			);
+		}
+
+		let registryThrew = false;
+		try {
+			await probeNativeSenderAlive(identity, {
+				resolveAdapter: () => {
+					throw new Error("no native-push adapter owns backend id");
+				},
+			});
+		} catch {
+			registryThrew = true;
+		}
+		ok("unresolvable adapter → THROWS (a registry bug is not a fact about the citizen)", registryThrew);
+
+		let probeThrew = false;
+		try {
+			await probeNativeSenderAlive(
+				identity,
+				adapterWith(async () => {
+					throw new Error("pgrep: command not found");
+				}),
+			);
+		} catch {
+			probeThrew = true;
+		}
+		ok("probe runner blows up → THROWS, never a silent replyable:false (Crash-Don't-Warn)", probeThrew);
+	}
+
+	console.log(`\ncheck-agy-sender-identity: ${passed} checks passed`);
+} finally {
+	fs.rmSync(ROOT, { recursive: true, force: true });
+}

package/scripts/check-entwurf-bridge-boot.ts

@@ -13,8 +13,10 @@
  *   - G1b: `entwurf_v2` is registered on the runtime tools/list surface with the
  *     expected input schema (props ⊇ target/intent/message/mode/wants_reply;
  *     required ⊇ target/intent/message; intent/mode enums).
+ *   - G1c/G1d: the shipped manual native-registration fallback is present and
+ *     retired v1 verbs remain absent.
  *
- * Scope boundary (D1=A안): this gate owns boot + entwurf_v2 registration/schema.
+ * Scope boundary (D1=A안): this gate owns boot + current tool registration/schema.
  * The broad protocol/negative suite stays in check-bridge/test.sh. Only a
  * `tools/list` is sent — no `tools/call` — so there is NO lock/filesystem side
  * effect and no auth/model is needed; it lives in `pnpm check`.
@@ -189,7 +191,11 @@ async function main(): Promise<void> {
 	);
 
 	ok(
-		"G1c: legacy v1 MCP tools are absent",
+		"G1c: native registration fallback is present",
+		tools.some((t) => t?.name === "entwurf_register_native"),
+	);
+	ok(
+		"G1d: legacy v1 MCP tools are absent",
 		!tools.some((t) => ["entwurf", "entwurf_resume", "entwurf_send"].includes(String(t?.name))),
 	);
 

package/scripts/check-entwurf-deliverability.ts

@@ -24,6 +24,8 @@ import { fileURLToPath } from "node:url";
 import {
 	computeMetaReceiverActive,
 	mailboxConversationalDeliverable,
+	type NativePushDeliverabilityFacts,
+	nativePushDeliverable,
 	receiverMarkerMatchesIdentity,
 } from "../pi-extensions/lib/entwurf-deliverability.ts";
 
@@ -144,6 +146,38 @@ ok(
 ok("null marker → false (fail-closed)", !receiverMarkerMatchesIdentity(null, ID));
 ok("undefined marker → false (fail-closed)", !receiverMarkerMatchesIdentity(undefined, ID));
 
+// ── nativePushDeliverable: the SEPARATE native-push axis (봉인 6) ────────────
+// deliverable ⟺ recordBacked ∧ probeAlive. Distinct axis from the mailbox gate: it
+// must NOT depend on watchArmed (the mailbox-only atom), so a native-push target's
+// deliverability is unaffected by any watch/ownerAlive signal.
+const NP = (f: Parameters<typeof nativePushDeliverable>[0]) => nativePushDeliverable(f).deliverable;
+
+ok("native-push: record backed + probe alive → deliverable", NP({ recordBacked: true, probeAlive: true }) === true);
+ok(
+	"native-push: no record → NOT deliverable (record-less native id)",
+	NP({ recordBacked: false, probeAlive: true }) === false,
+);
+ok(
+	"native-push: probe not alive → NOT deliverable (no live conversation)",
+	NP({ recordBacked: true, probeAlive: false }) === false,
+);
+ok("native-push: undefined axes → fail-closed inactive", NP({ recordBacked: true }) === false);
+ok("native-push: both undefined → fail-closed inactive", NP({}) === false);
+// axis separation (보정①): the native-push predicate has NO watchArmed/ownerAlive
+// concept — its shape carries only recordBacked/probeAlive, so a mailbox liveness
+// fact cannot be smuggled into it.
+ok(
+	"native-push: reason distinguishes record-less from dead-probe",
+	nativePushDeliverable({ recordBacked: false, probeAlive: true }).reason !==
+		nativePushDeliverable({ recordBacked: true, probeAlive: false }).reason,
+);
+// Type-level guard: the fact keyset is EXACTLY recordBacked|probeAlive — if a future
+// edit added `watchArmed`/`ownerAlive` (the mailbox atom fields), this stops compiling,
+// so the mailbox atom can never be smuggled into the native-push axis (보정①).
+type NativePushFactKeys = keyof NativePushDeliverabilityFacts;
+const _nativePushKeysGuard: NativePushFactKeys extends "recordBacked" | "probeAlive" ? true : never = true;
+void _nativePushKeysGuard;
+
 // ── WIRING: self-addressability shares the SAME atom ────────────────────────
 const selfSrc = readFileSync(path.join(REPO_DIR, "pi-extensions", "lib", "entwurf-self-address.ts"), "utf8");
 ok(

package/scripts/check-entwurf-self-address.ts

@@ -77,26 +77,93 @@ function row(facts: SelfAddressabilityFacts): { replyable: boolean; socketState:
 	ok("pi + no session id → socketState none", none.socketState === "none");
 }
 
-// meta-session axis: 3-conjunct deliverability (recordBacked ∧ ownerAlive ∧ watchArmed).
+// meta-session / SELF-FETCH rail (claude-code): 3-conjunct deliverability
+// (recordBacked ∧ ownerAlive ∧ watchArmed).
 {
-	const full = row({ origin: "meta-session", recordBacked: true, ownerAlive: true, watchArmed: true });
-	ok("meta + record + owner-alive + watch-armed → replyable", full.replyable === true);
+	const meta = (f: Partial<SelfAddressabilityFacts>): SelfAddressabilityFacts => ({
+		origin: "meta-session",
+		metaDeliveryDomain: "self-fetch",
+		...f,
+	});
+	const full = row(meta({ recordBacked: true, ownerAlive: true, watchArmed: true }));
+	ok("meta/self-fetch + record + owner-alive + watch-armed → replyable", full.replyable === true);
 
 	// (b) REGRESSION-PROOF row: record PRESENT but owner dead.
-	const ownerDead = row({ origin: "meta-session", recordBacked: true, ownerAlive: false, watchArmed: true });
-	ok("meta + record present + owner-dead (start-key mismatch) → NOT replyable", ownerDead.replyable === false);
+	const ownerDead = row(meta({ recordBacked: true, ownerAlive: false, watchArmed: true }));
+	ok(
+		"meta/self-fetch + record present + owner-dead (start-key mismatch) → NOT replyable",
+		ownerDead.replyable === false,
+	);
 
 	// (c) REGRESSION-PROOF row: record + owner present but watch never armed.
-	const watchUnarmed = row({ origin: "meta-session", recordBacked: true, ownerAlive: true, watchArmed: false });
-	ok("meta + record present + owner-alive + watch-unarmed → NOT replyable", watchUnarmed.replyable === false);
+	const watchUnarmed = row(meta({ recordBacked: true, ownerAlive: true, watchArmed: false }));
+	ok("meta/self-fetch + record + owner-alive + watch-unarmed → NOT replyable", watchUnarmed.replyable === false);
 
 	// not backed by a record at all → false (the all-absent baseline; weakest row).
-	const unbacked = row({ origin: "meta-session", recordBacked: false, ownerAlive: false, watchArmed: false });
-	ok("meta + no backing record → NOT replyable", unbacked.replyable === false);
+	const unbacked = row(meta({ recordBacked: false, ownerAlive: false, watchArmed: false }));
+	ok("meta/self-fetch + no backing record → NOT replyable", unbacked.replyable === false);
 
 	// fail-closed on missing axes (undefined treated as false, never optimistic).
-	const partial = row({ origin: "meta-session", recordBacked: true });
-	ok("meta + record but undefined owner/watch → fail-closed NOT replyable", partial.replyable === false);
+	const partial = row(meta({ recordBacked: true }));
+	ok("meta/self-fetch + record but undefined owner/watch → fail-closed NOT replyable", partial.replyable === false);
+}
+
+// meta-session / NATIVE-PUSH rail (antigravity): a SEPARATE axis — recordBacked ∧ probeAlive.
+// The two rails must not be able to borrow each other's facts (보정①): a mailbox signal
+// deciding an agy reply, or a probe deciding a Claude reply, is a category error.
+{
+	const push = (f: Partial<SelfAddressabilityFacts>): SelfAddressabilityFacts => ({
+		origin: "meta-session",
+		metaDeliveryDomain: "native-push",
+		...f,
+	});
+	const reachable = row(push({ recordBacked: true, probeAlive: true }));
+	ok("meta/native-push + record + probe-alive → replyable", reachable.replyable === true);
+
+	// THE ROW THIS RAIL EXISTS FOR: an agy citizen never arms a mailbox watch. Under the
+	// self-fetch atom it would be un-replyable forever; on its own rail it is reachable.
+	ok(
+		"meta/native-push + record + probe-alive + watch NEVER armed → STILL replyable (no mailbox axis leak)",
+		row(push({ recordBacked: true, probeAlive: true, watchArmed: false })).replyable === true,
+	);
+
+	// Dead conversation: the host is gone, so an injected reply has nowhere to land.
+	ok(
+		"meta/native-push + record + probe-dead → NOT replyable",
+		row(push({ recordBacked: true, probeAlive: false })).replyable === false,
+	);
+
+	// No record → not an identity, whatever the probe says.
+	ok(
+		"meta/native-push + no record + probe-alive → NOT replyable",
+		row(push({ recordBacked: false, probeAlive: true })).replyable === false,
+	);
+
+	// fail-closed: an unsupplied probe fact is false, never optimistic.
+	ok(
+		"meta/native-push + record but undefined probe → fail-closed NOT replyable",
+		row(push({ recordBacked: true })).replyable === false,
+	);
+
+	// A native-push citizen must NOT be able to buy replyability with mailbox facts.
+	ok(
+		"meta/native-push + owner-alive + watch-armed but probe-dead → NOT replyable (mailbox facts cannot rescue it)",
+		row(push({ recordBacked: true, ownerAlive: true, watchArmed: true, probeAlive: false })).replyable === false,
+	);
+}
+
+// meta-session with NO rail declared: we cannot say how a reply would travel, so we do not
+// claim it would arrive. The domain is derived from nativePushSupported(backend) — a caller
+// that forgets it gets a refusal, not an optimistic guess.
+{
+	const noDomain = row({
+		origin: "meta-session",
+		recordBacked: true,
+		ownerAlive: true,
+		watchArmed: true,
+		probeAlive: true,
+	});
+	ok("meta + NO delivery domain (all facts true) → fail-closed NOT replyable", noDomain.replyable === false);
 }
 
 // external-mcp: never replyable.