@junghanacs/entwurf 0.12.6 → 0.12.7

package/pi-extensions/lib/entwurf-self-address.ts

@@ -24,13 +24,29 @@
  *                 caller passes watchArmed=false, so meta-self is intentionally
  *                 FAIL-CLOSED until slice 2. Slices 1 and 2 close in the SAME release
  *                 block, so no intermediate "meta self all-false" state is ever pushed.
+ *  - meta-session (native-push backend, e.g. antigravity): replyable ⟺ recordBacked AND
+ *                 probeAlive — the SEPARATE native-push axis (봉인 6 / 보정①). A reply to
+ *                 an agy citizen is a direct injection into a live app-server conversation,
+ *                 so what makes it land is an adapter probe finding that conversation, NOT a
+ *                 mailbox watch. Reusing the receiver atom here would smuggle `watchArmed`
+ *                 (a mailbox-only signal) into a domain with no mailbox, and an agy sender
+ *                 — which never arms a watch — would report replyable:false forever.
  *  - external-mcp: never replyable — no authoritative reply address.
+ *
+ * `origin` stays identity PROVENANCE (where the sender identity came from), never a rail.
+ * Which rail a meta citizen's reply rides is a SECOND axis — `metaDeliveryDomain`, derived
+ * by the caller from `nativePushSupported(backend)`, not from `wakeMode` (direct-inject also
+ * covers codex/pi, which have no native-push adapter). Fail-closed: an unsupplied domain is
+ * not replyable.
  */
 
-import { computeMetaReceiverActive } from "./entwurf-deliverability.ts";
+import { computeMetaReceiverActive, nativePushDeliverable } from "./entwurf-deliverability.ts";
 
 export type SelfOrigin = "pi-session" | "meta-session" | "external-mcp";
 
+/** Which delivery rail carries a reply back to a meta citizen (the second axis, never `origin`). */
+export type MetaDeliveryDomain = "self-fetch" | "native-push";
+
 /**
  * pi control-socket reachability for a reply addressed back to this session.
  *
@@ -49,12 +65,16 @@ export interface SelfAddressabilityFacts {
 	socketAlive?: boolean;
 	/** pi-session: a session id is present so the canonical socket path is computable. */
 	socketPathComputable?: boolean;
+	/** meta-session: which rail a reply rides — from nativePushSupported(backend), NOT wakeMode. */
+	metaDeliveryDomain?: MetaDeliveryDomain;
 	/** meta-session: the sender marker's identity is backed by a live meta-record. */
 	recordBacked?: boolean;
-	/** meta-session: the marker's owner pid is still the same process (start-key match). */
+	/** meta-session (self-fetch): the marker's owner pid is still the same process (start-key match). */
 	ownerAlive?: boolean;
-	/** meta-session: the idle-wake watch is armed (slice-2 presence marker; fail-closed until then). */
+	/** meta-session (self-fetch): the idle-wake watch is armed (slice-2 presence marker; fail-closed until then). */
 	watchArmed?: boolean;
+	/** meta-session (native-push): an adapter probe found this citizen's live native conversation. */
+	probeAlive?: boolean;
 }
 
 export interface SelfAddressabilityResult {
@@ -89,18 +109,41 @@ export function computeSelfAddressability(facts: SelfAddressabilityFacts): SelfA
 			};
 		}
 		case "meta-session": {
-			// Share the active-receiver atom with the deliverability predicate (one
-			// source of truth for "record backed AND owner alive AND watch armed").
-			const recv = computeMetaReceiverActive({
-				recordBacked: facts.recordBacked,
-				ownerAlive: facts.ownerAlive,
-				watchArmed: facts.watchArmed,
-			});
-			return {
-				replyable: recv.active,
-				socketState: "none",
-				reason: recv.active ? `meta receiver active (${recv.reason})` : `meta receiver inactive — ${recv.reason}`,
-			};
+			// TWO rails, pinned apart (보정①). Each branch composes the predicate that OWNS its
+			// axis — the mailbox receiver atom and the native-push predicate share nothing, so a
+			// mailbox liveness fact can never leak into a backend that has no mailbox.
+			switch (facts.metaDeliveryDomain) {
+				case "native-push": {
+					const push = nativePushDeliverable({ recordBacked: facts.recordBacked, probeAlive: facts.probeAlive });
+					return {
+						replyable: push.deliverable,
+						socketState: "none",
+						reason: push.deliverable
+							? `native-push reachable (${push.reason})`
+							: `native-push unreachable — ${push.reason}`,
+					};
+				}
+				case "self-fetch": {
+					// Share the active-receiver atom with the deliverability predicate (one
+					// source of truth for "record backed AND owner alive AND watch armed").
+					const recv = computeMetaReceiverActive({
+						recordBacked: facts.recordBacked,
+						ownerAlive: facts.ownerAlive,
+						watchArmed: facts.watchArmed,
+					});
+					return {
+						replyable: recv.active,
+						socketState: "none",
+						reason: recv.active ? `meta receiver active (${recv.reason})` : `meta receiver inactive — ${recv.reason}`,
+					};
+				}
+				default:
+					return {
+						replyable: false,
+						socketState: "none",
+						reason: "meta delivery domain not supplied — cannot say which rail a reply would ride (fail-closed)",
+					};
+			}
 		}
 		case "external-mcp":
 			return {

package/pi-extensions/lib/entwurf-v2-contract.ts

@@ -67,12 +67,19 @@ export const DISPATCH_LIVENESSES = ["live", "dormant", "indeterminate"] as const
 export type DispatchLiveness = (typeof DISPATCH_LIVENESSES)[number];
 
 // ── Backend liveness domain (R1 + F4) ──────────────────────────────────────
-// Backends whose liveness predicate is DEFINED. Initial = pi only (control-socket
-// connect + RPC `get_info`, entwurf-control.ts). claude-code (self-fetch, no
-// socket) and codex/antigravity (direct-inject without a probe surface yet) are
-// OUT of domain → `unsupported`. Widening this set is a deliberate future
-// decision (Stage 1+), gated by a REAL liveness predicate for that backend —
-// never by silently mapping its sessions to dead/indeterminate (R1 핵심).
+// Backends whose SOCKET liveness predicate is DEFINED — the pi control-socket
+// domain ONLY (connect + RPC `get_info`, entwurf-control.ts). It stays ["pi"].
+// claude-code (self-fetch, no socket) has no liveness predicate at all → `unsupported`.
+// codex/antigravity are direct-inject; antigravity's liveness IS measured, but by the
+// SEPARATE native-push adapter rail (a live app-server conversation probe), NOT this
+// pi-socket domain — so it must NEVER be added here. Adding it would pull agy into the
+// pi socket table (inspectSocket/probeSocket are socket-only); the fact layer keeps
+// reporting agy `unsupported` = "outside the pi-socket liveness domain", NOT
+// unreachable (the native-push rail measures it — entwurf-v2-decider.ts). Widening
+// THIS set is a deliberate future decision (Stage 1+), gated by a REAL pi-shaped
+// control-socket predicate — never by silently mapping sessions to dead/indeterminate
+// (R1 핵심). check-entwurf-facts pins this == ["pi"] and asserts the native-push
+// domain is disjoint from it.
 export const LIVENESS_DOMAIN_BACKENDS = ["pi"] as const;
 export type LivenessDomainBackend = (typeof LIVENESS_DOMAIN_BACKENDS)[number];
 
@@ -80,6 +87,30 @@ export function isLivenessSupported(backend: string): boolean {
 	return (LIVENESS_DOMAIN_BACKENDS as readonly string[]).includes(backend);
 }
 
+// ── Native-push backend domain (봉인 2/4) ───────────────────────────────────
+// A backend whose liveness is measured by the SEPARATE native-push adapter rail (a
+// live app-server conversation probe — antigravity's LS gRPC), NOT the pi control
+// socket. This domain is DISJOINT from LIVENESS_DOMAIN_BACKENDS (pi socket): an agy
+// session is `unsupported` at the pi-socket FACT level (entwurf_peers) yet fully
+// measured + deliverable on the native-push axis. The two are separate rails on
+// purpose — check-entwurf-facts pins both sets and asserts their intersection is ∅
+// (a backend can never be in both a socket-liveness domain and a native-push domain).
+export const NATIVE_PUSH_BACKENDS = ["antigravity"] as const;
+export type NativePushBackend = (typeof NATIVE_PUSH_BACKENDS)[number];
+
+export function nativePushSupported(backend: string): backend is NativePushBackend {
+	return (NATIVE_PUSH_BACKENDS as readonly string[]).includes(backend);
+}
+
+// NativePushLiveness = the 3-value liveness the native-push adapter probe yields.
+// The SAME three values as SocketLiveness, reused so there is ONE 3-value liveness
+// vocabulary — but these are NOT socket-bound (봉인 2: "주석만 socket-전용 오독 정정"):
+// the value is a live-app-server-conversation probe result (agentapi
+// get-conversation-metadata answered = alive; no live port served the conv = dead;
+// probe error/ambiguity = indeterminate). All three are valid FactLiveness values, so
+// a native-push receipt stamps observedLiveness ∈ {alive, dead, indeterminate}.
+export type NativePushLiveness = SocketLiveness;
+
 /**
  * Compose the 4-value FACT liveness from a backend and its socket probe.
  * Out-of-domain backend → `unsupported` (NOT dead/indeterminate, R1). An
@@ -106,6 +137,9 @@ export const ENTWURF_V2_REJECT_REASONS = [
 	"owned-live-no-autosend", // Q2/F1: owned-outcome to a live target is not an auto-send
 	"backend-liveness-unsupported", // R1: backend has no liveness predicate (e.g. claude-code) — owned-outcome only
 	"mailbox-undeliverable", // F-mailbox: fire-and-forget to an unsupported citizen whose mailbox is not deliverable (fail-closed; future pi-backend non-drainable mailbox)
+	"native-push-target-dead", // 봉인 1: fire-and-forget to a native-push (agy) target whose adapter probe found NO live conversation. Post-probe; observedLiveness = dead. NOT `backend-liveness-unsupported` — a native-push backend IS measured, so that name would be a lie.
+	"native-push-probe-indeterminate", // 봉인 1: fire-and-forget to a native-push target whose adapter probe was inconclusive (agy alive but no port served the conv, or a probe error). Post-probe; observedLiveness = indeterminate. Never spawns, never coerced to dead.
+	"native-push-no-resume-authority", // 봉인 1: owned-outcome to a native-push target (any liveness — single, state-independent). A native-push backend has no resume/spawn authority (there is no pi-child to own), so the caller cannot own its completion; use fire-and-forget. Post-probe; observedLiveness = the measured value.
 	"bad-target", // R2: absent/typo garden-id (no existing citizen); spawn-new out of v2 scope
 	"untrusted-fail-fast", // 동결결정 5: controlled launch into an untrusted cwd
 	"socket-only-no-resume-authority", // A1: a record-less socket-only endpoint resolved to a resume verdict (owned-outcome × dormant), but spawn-bg cannot open into it — no trusted cwd/resume authority. Post-probe guard reject (NOT pre-probe, NOT a table resolver cell): the in-domain probe ran and measured the liveness, then `allowResume:false` refused the resume. Carries the honest measured FactLiveness (non-null), unlike the pre-probe `bad-target` it replaces here — a live/addressable socket-only citizen must NEVER be mislabeled absent.
@@ -183,7 +217,18 @@ export const RESOLVER_REJECT_REASONS = [
 // `meta-mailbox` (F-mailbox) = liveness-free delivery via the 0.10.0 meta-bridge
 // mailbox + doorbell. The ack is "enqueued + doorbell rung", NOT a read and NOT a
 // turn injection — so `mode` (steer/follow_up) is meaningless on this transport.
-export const ENTWURF_V2_TRANSPORTS = ["control-socket", "spawn-bg", "tmux-live", "meta-mailbox"] as const;
+// `native-push` (봉인 1) = direct injection into a LIVE native app-server conversation
+// (antigravity `agentapi send-message`). Like meta-mailbox it is a fire-and-forget
+// send arm (ack-only), but it requires a live-probe (NATIVE_PUSH_DISPATCH_TABLE),
+// where meta-mailbox is liveness-free. It is NOT a mailbox enqueue and NOT a pi socket
+// send — it is its own rail.
+export const ENTWURF_V2_TRANSPORTS = [
+	"control-socket",
+	"spawn-bg",
+	"tmux-live",
+	"meta-mailbox",
+	"native-push",
+] as const;
 export type EntwurfV2Transport = (typeof ENTWURF_V2_TRANSPORTS)[number];
 
 // Allow-branch facets (exported so the schema↔types gate asserts every enum).
@@ -196,7 +241,7 @@ export const ENTWURF_V2_OWNERSHIPS = ["ack-only", "owned"] as const;
 export const ENTWURF_V2_MODES = ["steer", "follow_up"] as const;
 
 export type DispatchVerdict =
-	| { action: "send"; transport: "control-socket" | "meta-mailbox"; ownership: "ack-only" }
+	| { action: "send"; transport: "control-socket" | "meta-mailbox" | "native-push"; ownership: "ack-only" }
 	| { action: "resume"; transport: "spawn-bg" | "tmux-live"; ownership: "owned" }
 	| { action: "reject"; reason: EntwurfV2RejectReason };
 
@@ -220,10 +265,13 @@ export const DISPATCH_TABLE: Record<EntwurfIntent, Record<DispatchLiveness, Disp
 };
 
 // ── The unsupported-backend mailbox mini-table (F-mailbox) ─────────────────
-// SEPARATE from the in-domain 6-cell DISPATCH_TABLE (Fable (i)): an `unsupported`
-// backend (claude-code self-fetch, codex/agy without a probe surface) has NO
-// liveness predicate, so it never enters the liveness-keyed table. Instead the
-// domain guard routes it here, keyed on intent alone:
+// SEPARATE from the in-domain 6-cell DISPATCH_TABLE (Fable (i)): a backend with no
+// pi-socket liveness predicate never enters the liveness-keyed table. Instead the
+// domain guard routes it here, keyed on intent alone. Reaches here: claude-code
+// (self-fetch mailbox) and codex (no adapter yet). Does NOT reach here: antigravity —
+// the decider intercepts a native-push backend in its own rail BEFORE this mailbox
+// mini-table (entwurf-v2-decider.ts), so agy is `unsupported` at the fact level yet
+// never falls through to a mailbox it does not have. The cells, keyed on intent alone:
 //  - fire-and-forget needs no liveness — the 0.10.0 meta-bridge mailbox delivers
 //    to any DELIVERABLE citizen. This cell is the deliverable path; resolveDispatch
 //    downgrades it to `mailbox-undeliverable` when the separate mailboxDeliverable
@@ -351,6 +399,66 @@ export function resolveDispatch(
 	};
 }
 
+// ── The native-push dispatch table (봉인 1/2/4) ─────────────────────────────
+// A THIRD table, distinct from both the pi 6-cell DISPATCH_TABLE and the unsupported
+// mailbox mini-table. Keyed intent × NativePushLiveness (NOT intent-only): a
+// native-push backend (antigravity) IS measured by its adapter probe, so the
+// send/reject decision depends on the probed liveness. The decider intercepts a
+// native-push backend in its own rail (nativePushSupported → probe → this table)
+// BEFORE the unsupported branch, so agy never falls through to a mailbox it lacks.
+//
+//   fire-and-forget × alive         → native-push send (the ONE allow cell)
+//   fire-and-forget × dead          → reject native-push-target-dead
+//   fire-and-forget × indeterminate → reject native-push-probe-indeterminate
+//   owned-outcome  × *              → reject native-push-no-resume-authority (state-
+//                                     independent: no pi-child to own; `backend-
+//                                     liveness-unsupported` is NOT reused — false name).
+export const NATIVE_PUSH_DISPATCH_TABLE: Record<EntwurfIntent, Record<NativePushLiveness, DispatchVerdict>> = {
+	"fire-and-forget": {
+		alive: { action: "send", transport: "native-push", ownership: "ack-only" },
+		dead: { action: "reject", reason: "native-push-target-dead" },
+		indeterminate: { action: "reject", reason: "native-push-probe-indeterminate" },
+	},
+	"owned-outcome": {
+		alive: { action: "reject", reason: "native-push-no-resume-authority" },
+		dead: { action: "reject", reason: "native-push-no-resume-authority" },
+		indeterminate: { action: "reject", reason: "native-push-no-resume-authority" },
+	},
+};
+
+// The reasons the native-push resolver emits — a THIRD post-probe reject set, parallel
+// to RESOLVER_REJECT_REASONS (pi/mailbox). All post-probe: resolveNativePushDispatch
+// always has a real probed liveness in hand, so observedLiveness is non-null. None may
+// be pre-probe (they are never in PRE_PROBE_REJECT_REASONS).
+export const NATIVE_PUSH_REJECT_REASONS = [
+	"native-push-target-dead",
+	"native-push-probe-indeterminate",
+	"native-push-no-resume-authority",
+] as const satisfies readonly EntwurfV2RejectReason[];
+
+/**
+ * PURE native-push dispatch decision (봉인 4). Given the caller intent and the adapter
+ * probe's 3-value liveness, mint the receipt from NATIVE_PUSH_DISPATCH_TABLE. Mirrors
+ * resolveDispatch's shape; observedLiveness is ALWAYS the probed value (non-null,
+ * post-probe). The decider calls this only AFTER nativePushSupported(backend) gates the
+ * backend and the adapter probe returns a liveness — it never touches the pi socket
+ * table or the mailbox mini-table (those are other domains). No IO here (the probe is
+ * the decider's injected dep); this only maps (intent, liveness) → verdict.
+ */
+export function resolveNativePushDispatch(intent: EntwurfIntent, liveness: NativePushLiveness): EntwurfV2Receipt {
+	const cell = NATIVE_PUSH_DISPATCH_TABLE[intent][liveness];
+	if (cell.action === "reject") {
+		return makeRejectReceipt(cell.reason, liveness);
+	}
+	return {
+		ok: true,
+		action: cell.action,
+		transport: cell.transport,
+		ownership: cell.ownership,
+		observedLiveness: liveness,
+	};
+}
+
 // ── TypeBox schemas ────────────────────────────────────────────────────────
 // MOVED to `entwurf-v2-contract-schema.ts` (0.12.1 B-1): the pi-ai TypeBox
 // builders (StringEnum/Type) are a pi-lane dependency, so they cannot live in

package/pi-extensions/lib/entwurf-v2-decider.ts

@@ -52,7 +52,10 @@ import {
 	type EntwurfV2Receipt,
 	isLivenessSupported,
 	makeRejectReceipt,
+	type NativePushBackend,
+	nativePushSupported,
 	resolveDispatch,
+	resolveNativePushDispatch,
 } from "./entwurf-v2-contract.ts";
 import type { AcquireLockResult, LockClaim, LockConflict } from "./entwurf-v2-lock.ts";
 import {
@@ -63,6 +66,7 @@ import {
 	type MetaIdentity,
 	metaCapabilityFor,
 } from "./meta-session.ts";
+import type { NativePushProbeResult, NativePushRoute } from "./native-push/adapter.ts";
 import { isValidSessionId } from "./session-id.js";
 import { controlSocketPath, mapInspectionToLiveness, type TargetSocketInspection } from "./socket-discovery.ts";
 import type { SocketLiveness } from "./socket-probe.ts";
@@ -124,6 +128,21 @@ export type ExecutionPlan =
 			expectedSocketPath: string;
 			observeTimeoutMs: number;
 			releaseWhen: "socket-alive-or-child-exited";
+	  }
+	// native-push send (봉인 4): direct-inject into a live app-server conversation. LOCK-FREE
+	// (the DispatchDecision carries lock:null). Carries the decider-probed VOLATILE route so
+	// the executor sends without re-deriving it (봉인 3 "used within the same dispatch"); the
+	// executor still owns the 1-shot re-probe→re-send on failure. `backend` lets the executor
+	// resolve the adapter for that re-probe.
+	| {
+			transport: "native-push";
+			action: "send";
+			targetGardenId: string;
+			backend: NativePushBackend;
+			nativeSessionId: string;
+			route: NativePushRoute;
+			wantsReply: boolean;
+			message: string;
 	  };
 
 // ── DispatchDecision (the decider's only output) ────────────────────────────
@@ -212,6 +231,16 @@ export interface DispatchDeciderDeps {
 	mailboxDeliverabilityFor: (
 		identity: MetaIdentity,
 	) => MailboxDeliverabilityResult | Promise<MailboxDeliverabilityResult>;
+	/**
+	 * 봉인 4: the native-push liveness+route probe seam (REQUIRED, no default). Called ONLY on
+	 * the native-push branch (a nativePushSupported backend, e.g. antigravity), it returns the
+	 * adapter probe result — the 3-value liveness the NATIVE_PUSH table routes on PLUS the
+	 * volatile route the executor sends over. The decider does NOT probe itself (purity); the
+	 * production wrapper resolves the native-push adapter and calls its probe. Making it
+	 * required forces every construction site to wire it, so a native-push dispatch can never
+	 * silently fall through to the pi-socket / mailbox path.
+	 */
+	nativePushProbe: (identity: MetaIdentity) => NativePushProbeResult | Promise<NativePushProbeResult>;
 	mailboxDir?: string;
 	sessionsDir?: string;
 	observeTimeoutMs?: number;
@@ -298,6 +327,37 @@ export async function decideDispatch(input: DispatchInput, deps: DispatchDecider
 	}
 	const identity = resolution.identity;
 
+	// 2d. native-push rail (봉인 4): a native-push backend (antigravity) is measured by its
+	// adapter probe, NOT the pi socket and NOT the mailbox. Intercept it HERE — after identity
+	// resolution + the address-conflict guard, but BEFORE the unsupported mailbox branch — so
+	// agy routes to native-push and never falls through to a mailbox it does not have. This
+	// branch is LOCK-FREE (봉인 4): the pi in-domain lock closes a socket TOCTOU, but a
+	// volatile probe route has no lock meaning (a duplicate-send idempotency is a D8 future).
+	if (nativePushSupported(identity.backend)) {
+		const probe = await deps.nativePushProbe(identity);
+		const receipt = resolveNativePushDispatch(input.intent, probe.status);
+		if (!receipt.ok) return reject(receipt);
+		// The ONLY allow cell is fire-and-forget × alive, so an ok receipt ⟹ the probe is
+		// alive and carries a route. The narrow is defensive: a contract-breaking probe/table
+		// mismatch fails loud rather than planting a routeless send plan.
+		if (probe.status !== "alive") {
+			throw new Error(
+				"entwurf_v2 decider: native-push send verdict without an alive probe route (contract invariant broken).",
+			);
+		}
+		const plan: ExecutionPlan = {
+			transport: "native-push",
+			action: "send",
+			targetGardenId: gardenId,
+			backend: identity.backend,
+			nativeSessionId: identity.nativeSessionId,
+			route: probe.route,
+			wantsReply,
+			message: input.message,
+		};
+		return { kind: "execute", receipt, plan, lock: null };
+	}
+
 	// 3. backend.
 	if (!isLivenessSupported(identity.backend)) {
 		// 6. unsupported path — NO lock (？7). Deliverability comes from the REQUIRED seam

package/pi-extensions/lib/entwurf-v2-native-push.ts

@@ -0,0 +1,86 @@
+/**
+ * entwurf-v2-native-push — the native-push SEND hand (봉인 3/4, the executor half of the
+ * native-push rail). It takes the `native-push` ExecutionPlan the 5b decider ALREADY chose
+ * and direct-injects the message into the live conversation via the adapter. It DECIDES NO
+ * ROUTING (the NATIVE_PUSH_DISPATCH_TABLE did) and carries NO release seam — a native-push
+ * plan is the LOCK-FREE path (봉인 4), so a lock leak is structurally impossible here.
+ *
+ * This is where the 1-shot retry lives — NOT in the adapter leaf (봉인 3). The decider
+ * probed a fresh route and planted it in the plan; the executor sends over it, and on a
+ * failure it re-probes ONCE (the volatile LS port may have shifted between decide and
+ * execute) and re-sends. A second failure is fail-loud (no infinite loop). This mirrors the
+ * control-socket send-fallback pattern: the decider stays pure, the hand owns the retry.
+ *
+ * A native-push send has NO in-band refuse (there is no live receiver to answer
+ * success:false) — like a mailbox enqueue, it either succeeds or THROWS. The hand never
+ * folds a throw into {success:false}; the runner maps a thrown error to execution-failed.
+ */
+
+import type { ExecutionPlan } from "./entwurf-v2-decider.ts";
+import type { LockClaim } from "./entwurf-v2-lock.ts";
+import { type NativePushAdapter, type NativePushRoute, resolveNativePushAdapter } from "./native-push/adapter.ts";
+
+/** The native-push slice of the ExecutionPlan union (the decider plants it, this consumes it). */
+export type NativePushPlan = Extract<ExecutionPlan, { transport: "native-push" }>;
+
+export interface NativePushSendResult {
+	success: true;
+	/** Whether the 1-shot re-probe→re-send fired (the first send over the planted route failed). */
+	retried: boolean;
+}
+
+/**
+ * Deliver `content` into the conversation, owning the 1-shot retry (봉인 3). Send over the
+ * planted (decider-probed) route first; on failure re-probe ONCE and re-send over the fresh
+ * route; a second failure PROPAGATES (fail-loud). If the re-probe finds the target no longer
+ * alive, throw — a failed send into a now-dead conversation is an honest non-delivery, never
+ * a silent success. The re-probe is the ONLY re-derivation of the volatile route.
+ */
+export async function deliverViaNativePush(
+	adapter: NativePushAdapter,
+	route: NativePushRoute,
+	nativeSessionId: string,
+	content: string,
+): Promise<NativePushSendResult> {
+	try {
+		await adapter.send(route, nativeSessionId, content);
+		return { success: true, retried: false };
+	} catch (firstErr) {
+		// 1-shot re-probe → re-send: the volatile LS route may have shifted since the decider
+		// probed it. Re-discover it fresh and retry exactly once.
+		const reprobe = await adapter.probe(nativeSessionId);
+		if (reprobe.status !== "alive") {
+			throw new Error(
+				`native-push deliver: first send failed and re-probe found target ${reprobe.status} (${reprobe.reason}) — not retried`,
+				{ cause: firstErr },
+			);
+		}
+		// A second failure THROWS out of this call (fail-loud) — no third attempt.
+		await adapter.send(reprobe.route, nativeSessionId, content);
+		return { success: true, retried: true };
+	}
+}
+
+/** Deps for the production native-push send hand — the adapter resolver (default: the real
+ *  registry). Injected so the 5d gate proves the wiring with a fake adapter. */
+export interface NativePushSendDeps {
+	resolveAdapter?: (backend: string) => NativePushAdapter;
+}
+
+/**
+ * Build the production `sendNativePush(plan, lock)` adapter the runner consumes. It IGNORES
+ * `lock` entirely (a native-push plan is lock-free, 봉인 4) — the field exists only to match
+ * the DispatchExecutorDeps hand signature. It resolves the adapter from the plan's backend
+ * and delivers with the 1-shot retry. A delivery throw surfaces as a REJECTED promise (the
+ * runner's try/catch maps it to execution-failed).
+ */
+export function makeNativePushSend(
+	deps: NativePushSendDeps = {},
+): (plan: NativePushPlan, lock: LockClaim | null) => Promise<NativePushSendResult> {
+	const resolveAdapter = deps.resolveAdapter ?? resolveNativePushAdapter;
+	// `_lock` is named for the hand contract but NEVER read — native-push owns/releases no lock.
+	return async (plan: NativePushPlan, _lock: LockClaim | null): Promise<NativePushSendResult> => {
+		const adapter = resolveAdapter(plan.backend);
+		return deliverViaNativePush(adapter, plan.route, plan.nativeSessionId, plan.message);
+	};
+}

package/pi-extensions/lib/entwurf-v2-production.ts

@@ -60,6 +60,7 @@ import {
 	releaseLock as realReleaseLock,
 } from "./entwurf-v2-lock.ts";
 import { makeProductionSendViaMailbox } from "./entwurf-v2-mailbox.ts";
+import { makeNativePushSend } from "./entwurf-v2-native-push.ts";
 import type { DispatchExecutorDeps, EntwurfV2RunDeps } from "./entwurf-v2-runner.ts";
 import {
 	type ControlSocketPlan,
@@ -85,6 +86,11 @@ import {
 	readMetaIdentityByGardenId,
 	readMetaReceiverMarker,
 } from "./meta-session.ts";
+import {
+	type NativePushAdapter,
+	type NativePushProbeResult,
+	resolveNativePushAdapter as realResolveNativePushAdapter,
+} from "./native-push/adapter.ts";
 import {
 	CONTROL_SOCKET_DIR,
 	controlSocketPath,
@@ -121,6 +127,11 @@ export interface ProductionEntwurfV2Seams {
 	classifyConnect: (code: string | undefined) => "dead" | "indeterminate";
 	sendRpc: (socketPath: string, command: RpcCommand, options?: RpcClientOptions) => Promise<{ response: RpcResponse }>;
 	enqueue: (opts: EnqueueMetaMessageOptions) => EnqueueMetaMessageResult;
+	/** Resolve the native-push adapter for a backend id (봉인 4). The SAME resolver feeds the
+	 * decider's `nativePushProbe` AND the executor's `sendNativePush`, so a single injected
+	 * fake adapter drives both the probe (routing decision) and the send (delivery + retry).
+	 * Default: the real registry resolver. */
+	resolveNativePushAdapter: (backend: string) => NativePushAdapter;
 	/** Extra spawn-factory overrides (timers/spawnChild/probe) for a deterministic spawn gate.
 	 * `releaseFn` is NOT overridable here — the factory injects the shared `release` (QB3). */
 	spawnOverrides: Omit<ProductionSpawnOpts, "releaseFn">;
@@ -211,6 +222,7 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 		classifyConnect: s.classifyConnect ?? classifyConnectError,
 		sendRpc: s.sendRpc ?? realSendRpc,
 		enqueue: s.enqueue ?? enqueueMetaMessage,
+		resolveNativePushAdapter: s.resolveNativePushAdapter ?? realResolveNativePushAdapter,
 		spawnOverrides: s.spawnOverrides ?? {},
 	};
 
@@ -290,6 +302,11 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 		preflightForCwd: (cwd: string): PreflightOutcome | Promise<PreflightOutcome> =>
 			io.preflight({ cwd, agentDir: opts.agentDir, prefixRoots: opts.prefixRoots }),
 		mailboxDeliverabilityFor,
+		// 봉인 4: resolve the native-push adapter for this backend + probe the conversation.
+		// Only reached on a nativePushSupported backend (the decider gates it), so the resolver
+		// never throws for a non-native-push backend here.
+		nativePushProbe: (identity: MetaIdentity): Promise<NativePushProbeResult> =>
+			Promise.resolve(io.resolveNativePushAdapter(identity.backend).probe(identity.nativeSessionId)),
 		mailboxDir,
 		sessionsDir,
 		observeTimeoutMs: opts.observeTimeoutMs,
@@ -339,6 +356,9 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 				}),
 			),
 		sendMailbox: (plan, _lock) => sendViaMailbox(plan as MetaMailboxPlan, _lock as LockClaim),
+		// native-push (봉인 4): the SAME injected adapter resolver drives the executor send,
+		// so the decider's probe and the delivery use one adapter. Lock-free (lock ignored).
+		sendNativePush: makeNativePushSend({ resolveAdapter: io.resolveNativePushAdapter }),
 	};
 
 	return {

package/pi-extensions/lib/entwurf-v2-release.ts

@@ -96,6 +96,15 @@ export function decideReleasePolicy(plan: ExecutionPlan, lock: LockClaim | null)
 				throw new Error("entwurf-v2-release: a meta-mailbox plan must carry no lock (？7 invariant violated).");
 			}
 			return { kind: "no-lock" };
+		case "native-push":
+			// Native-push is the other lock-free rail (봉인 4) — like meta-mailbox it holds no
+			// lock, so a non-null lock is a decider contract violation. (The native-push hand
+			// never actually routes through this reducer; the case keeps the switch exhaustive
+			// and pins the lock-free invariant.)
+			if (lock !== null) {
+				throw new Error("entwurf-v2-release: a native-push plan must carry no lock (봉인 4 lock-free rail violated).");
+			}
+			return { kind: "no-lock" };
 		case "control-socket":
 			assertInDomainLock(plan, lock);
 			return { kind: "release-after-send-final" };

package/pi-extensions/lib/entwurf-v2-runner.ts

@@ -38,6 +38,7 @@ import type {
 	SuccessReceipt,
 } from "./entwurf-v2-decider.ts";
 import type { LockClaim } from "./entwurf-v2-lock.ts";
+import type { NativePushPlan, NativePushSendResult } from "./entwurf-v2-native-push.ts";
 import {
 	type ControlSocketPlan,
 	type ControlSocketSendResult,
@@ -58,6 +59,9 @@ export interface DispatchExecutorDeps {
 	sendControl: (plan: ControlSocketPlan, lock: LockClaim | null) => Promise<ControlSocketSendResult>;
 	resumeSpawnBg: (plan: SpawnBgPlan, lock: LockClaim | null) => Promise<SpawnBgResumeResult>;
 	sendMailbox: (plan: MetaMailboxPlan, lock: LockClaim | null) => Promise<RpcSendResult>;
+	// native-push (봉인 4): lock-free like meta-mailbox — the runner passes the null lock
+	// verbatim and the hand ignores it. Owns the 1-shot re-probe→re-send retry internally.
+	sendNativePush: (plan: NativePushPlan, lock: LockClaim | null) => Promise<NativePushSendResult>;
 }
 
 /** The per-transport success outcome, discriminated by transport so the surface renders
@@ -68,7 +72,9 @@ export interface DispatchExecutorDeps {
 export type ExecutedOutcome =
 	| { transport: "control-socket"; outcome: SendFinalOutcome; rejectReason?: string }
 	| { transport: "spawn-bg"; result: SpawnBgResumeResult }
-	| { transport: "meta-mailbox"; success: true };
+	| { transport: "meta-mailbox"; success: true }
+	// native-push carries `retried` so the surface can note the 1-shot re-probe retry fired.
+	| { transport: "native-push"; success: true; retried: boolean };
 
 /** The single outcome-rich result the 5d surface renders. `rejected` = the decider
  * refused (no execution). `executed` = a hand ran to a terminal result. `execution-failed`
@@ -164,6 +170,28 @@ export async function executeDispatch(
 				return { kind: "execution-failed", receipt, transport, error: errorMessage(err), retrySafe: false };
 			}
 		}
+		case "native-push": {
+			try {
+				// lock is null here (lock-free rail, 봉인 4) — passed verbatim; the hand ignores it.
+				const r = await deps.sendNativePush(plan, lock);
+				// Like meta-mailbox, native-push has NO in-band reject (no live receiver answers
+				// success:false). A `success:false` is therefore a CONTRACT VIOLATION — fail loud
+				// rather than render a non-delivery as delivered ("Never warn. Throw.").
+				if (r.success !== true) {
+					throw new Error(
+						"entwurf-v2-runner: native-push send returned success:false (contract violation; native-push has no in-band reject).",
+					);
+				}
+				return {
+					kind: "executed",
+					receipt,
+					transport,
+					outcome: { transport: "native-push", success: true, retried: r.retried },
+				};
+			} catch (err) {
+				return { kind: "execution-failed", receipt, transport, error: errorMessage(err), retrySafe: false };
+			}
+		}
 	}
 }
 

package/pi-extensions/lib/entwurf-v2-send.ts

@@ -217,6 +217,13 @@ async function driveDeadFallback(
 			// contract violation (a send and a spawn are different actions), so fail loud
 			// rather than silently mis-execute.
 			throw new Error("entwurf-v2-send: re-resolve returned a spawn-bg plan for a send fallback (contract violation).");
+		case "native-push":
+			// The dead-control-socket fallback re-resolves only the pi socket domain
+			// (control-socket / mailbox / spawn); it never routes the native-push rail. A
+			// native-push rePlan here is structurally impossible — fail loud.
+			throw new Error(
+				"entwurf-v2-send: re-resolve returned a native-push plan for a send fallback (contract violation).",
+			);
 	}
 }
 

package/pi-extensions/lib/entwurf-v2-surface.ts

@@ -106,6 +106,16 @@ export function actionableRejectHint(reason: string): string | undefined {
 		case "owned-live-no-autosend":
 			// A live target is reachable, but owned-outcome is not an auto-send (Q2/F1).
 			return "target is live — owned-outcome never auto-sends. Use intent: fire-and-forget (with wants_reply if you need a reply).";
+		case "native-push-no-resume-authority":
+			// A native-push backend (antigravity) has no pi-child to own, so owned-outcome has
+			// nothing to own. Delivery is a direct inject via fire-and-forget.
+			return "native-push target (e.g. antigravity) has no resume/spawn authority → owned-outcome is unsupported. Use intent: fire-and-forget to direct-inject into the live conversation.";
+		case "native-push-target-dead":
+			// The adapter probe found no live host process for the conversation.
+			return "native-push conversation is not live (no host process found). Re-open the conversation, then retry — there is nothing to inject into.";
+		case "native-push-probe-indeterminate":
+			// Host up, but no LS port served the conversation — inconclusive, not a hard dead.
+			return "native-push host is up but no port served this conversation (probe inconclusive). Retry once the conversation is loaded, or verify the conversation id.";
 		default:
 			return undefined;
 	}
@@ -163,6 +173,13 @@ export function renderEntwurfV2Result(result: EntwurfV2RunResult): EntwurfV2Surf
 				const exit = res.kind === "child-exited" ? ` exitCode=${res.exitCode}` : "";
 				return { text: `entwurf_v2 spawn-bg → ${res.kind}${pid}${exit}, lock released`, isError: false };
 			}
+			if (o.transport === "native-push") {
+				// direct-inject succeeded; note if the 1-shot re-probe retry fired.
+				return {
+					text: `entwurf_v2 native-push → delivered${o.retried ? " (after a 1-shot re-probe retry)" : ""}`,
+					isError: false,
+				};
+			}
 			// meta-mailbox
 			return { text: "entwurf_v2 meta-mailbox → enqueued", isError: false };
 		}