@junghanacs/entwurf 0.20.0 → 0.21.0

package/pi-extensions/lib/codex-fresh-preflight.ts

@@ -0,0 +1,363 @@
+import * as crypto from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { parse } from "smol-toml";
+
+import {
+	type CodexProtocolOpener,
+	type CodexRpcProtocol,
+	type CodexSocketFileCheck,
+	checkCodexSocketFile,
+	realCodexProtocolOpener,
+	resolveCodexDefaultSocketPath,
+} from "./native-push/codex-ws-client.ts";
+
+export type CodexPreflightRejectReason =
+	| "codex-birth-unit-missing"
+	| "codex-mcp-hand-missing"
+	| "codex-visible-identity-missing"
+	| "codex-birth-trust-missing"
+	| "codex-app-server-unavailable";
+
+export const CODEX_PREFLIGHT_HINT: Record<CodexPreflightRejectReason, string> = {
+	"codex-birth-unit-missing":
+		"the Codex SessionStart birth unit is absent, drifted from its recorded digests, or unsafely owned; run `entwurf install-codex-birth`, then `entwurf doctor-codex-birth`",
+	"codex-birth-trust-missing":
+		"the vendor has recorded no trust receipt for this birth declaration, so the hook is declared and never runs; open a visible plain Codex, answer its prompt with `Trust all and continue`, send one first turn, then `entwurf doctor-codex-birth`",
+	"codex-mcp-hand-missing":
+		"the Codex user config does not expose the managed entwurf bridge; run `entwurf install-codex-mcp`, then `entwurf doctor-codex-mcp`",
+	"codex-visible-identity-missing":
+		"Codex tui.status_line does not include thread-title; run `entwurf install-codex-statusline`, then `entwurf doctor-codex-statusline`",
+	"codex-app-server-unavailable":
+		"the operator-owned Codex app-server default socket is absent or unsafe; start `codex app-server --listen unix://$CODEX_HOME/app-server-control/app-server-control.sock` and retry",
+};
+
+export interface CodexUnitPaths {
+	hooksFile: string;
+	helperDir: string;
+	stateFile: string;
+}
+
+export interface CodexPreflightDeps {
+	unitPathsOverride?: CodexUnitPaths;
+	operatorUid?: number;
+	checkSocket?: (socketPath: string) => CodexSocketFileCheck;
+	openProtocol?: CodexProtocolOpener;
+	appServerTimeoutMs?: number;
+}
+
+/**
+ * The unit's paths are the operator's own, derived from the SAME environment the installer
+ * reads — never a system location and never a flag. A preflight that resolved them any other
+ * way could pass while the installed unit sat somewhere else.
+ */
+function unitPaths(env: NodeJS.ProcessEnv): CodexUnitPaths {
+	const home = env.HOME?.trim() ?? "";
+	const codexHome = env.CODEX_HOME?.trim() || path.join(home, ".codex");
+	const dataHome = env.XDG_DATA_HOME?.trim() || path.join(home, ".local", "share");
+	const unitRoot = path.join(dataHome, "entwurf", "codex-birth");
+	return {
+		hooksFile: path.join(codexHome, "hooks.json"),
+		helperDir: path.join(unitRoot, "helper"),
+		stateFile: path.join(unitRoot, "install-state.json"),
+	};
+}
+
+const CODEX_MCP_ENV_VARS = [
+	"CODEX_HOME",
+	"ENTWURF_DIR",
+	"PI_CODING_AGENT_DIR",
+	"ENTWURF_META_SESSIONS_DIR",
+	"ENTWURF_META_MAILBOX_DIR",
+	"ENTWURF_META_SENDERS_DIR",
+	"ENTWURF_META_RECEIVERS_DIR",
+	"TMUX",
+	"TMUX_PANE",
+] as const;
+
+function isSafeOwnedFile(file: string, expectedUid: number, executable = false): boolean {
+	try {
+		const stat = fs.lstatSync(file);
+		return (
+			stat.isFile() &&
+			!stat.isSymbolicLink() &&
+			stat.uid === expectedUid &&
+			(stat.mode & 0o022) === 0 &&
+			(!executable || (stat.mode & 0o111) !== 0)
+		);
+	} catch {
+		return false;
+	}
+}
+
+function isSafeOwnedDir(dir: string, expectedUid: number): boolean {
+	try {
+		const stat = fs.lstatSync(dir);
+		return stat.isDirectory() && !stat.isSymbolicLink() && stat.uid === expectedUid && (stat.mode & 0o022) === 0;
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * The unit's own ownership state, read as the digest inventory it is. Bytes that merely
+ * EXIST prove nothing: the launcher codex is about to exec must be the one this unit
+ * published, so every recorded member is compared to its recorded digest before a sibling
+ * is opened. No digest is computed for the VENDOR here — that is a different axis below.
+ */
+function closureDriftedFromState(paths: CodexUnitPaths, expectedUid: number): boolean {
+	// The directory holding the state carries the state's authority: anyone who can write it
+	// can replace the inventory every digest below is compared against.
+	if (!isSafeOwnedDir(path.dirname(paths.stateFile), expectedUid)) return true;
+	if (!isSafeOwnedDir(path.dirname(path.dirname(paths.stateFile)), expectedUid)) return true;
+	if (!isSafeOwnedFile(paths.stateFile, expectedUid)) return true;
+	let state: Record<string, unknown>;
+	try {
+		state = JSON.parse(fs.readFileSync(paths.stateFile, "utf8")) as Record<string, unknown>;
+	} catch {
+		return true;
+	}
+	if (state.schema !== "codex-birth-install-state/v1" || state.status !== "installed") return true;
+	if (state.hooksFile !== paths.hooksFile || state.helperDir !== paths.helperDir) return true;
+	const digest = (file: string): string | null => {
+		try {
+			return crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+		} catch {
+			return null;
+		}
+	};
+	if (typeof state.hooksSha256 !== "string" || digest(paths.hooksFile) !== state.hooksSha256) return true;
+	const members = state.helperFiles;
+	if (!Array.isArray(members)) return true;
+	// Exactly the closure the installer publishes: a short inventory would leave a member
+	// nothing compares, which is the same hole as not checking digests at all.
+	const named = members.map((raw) => (raw as Record<string, unknown>)?.path);
+	const expected = [
+		"codex-birth-launch.sh",
+		"meta-bridge-hook-codex.ts",
+		"lib/meta-session.ts",
+		"lib/native-push/codex-ws-client.ts",
+		"lib/session-id.js",
+		"entwurf-capabilities.json",
+	];
+	if (named.length !== expected.length) return true;
+	if (expected.some((name) => !named.includes(name))) return true;
+	if (named.some((name, index) => named.indexOf(name) !== index)) return true;
+	for (const raw of members) {
+		const member = raw as Record<string, unknown>;
+		const rel = member.path;
+		if (typeof rel !== "string" || rel.length === 0 || rel.startsWith("/") || rel.split("/").includes("..")) {
+			return true;
+		}
+		if (typeof member.sha256 !== "string" || digest(path.join(paths.helperDir, rel)) !== member.sha256) return true;
+	}
+	return false;
+}
+
+function birthMissing(paths: CodexUnitPaths, expectedUid: number): boolean {
+	const launcher = path.join(paths.helperDir, "codex-birth-launch.sh");
+	const directories = [
+		path.dirname(paths.hooksFile),
+		paths.helperDir,
+		path.join(paths.helperDir, "lib"),
+		path.join(paths.helperDir, "lib", "native-push"),
+	];
+	if (directories.some((dir) => !isSafeOwnedDir(dir, expectedUid))) return true;
+	if (!isSafeOwnedFile(paths.hooksFile, expectedUid)) return true;
+	const closure = [
+		[launcher, true],
+		[path.join(paths.helperDir, "meta-bridge-hook-codex.ts"), false],
+		[path.join(paths.helperDir, "lib", "meta-session.ts"), false],
+		[path.join(paths.helperDir, "lib", "native-push", "codex-ws-client.ts"), false],
+		[path.join(paths.helperDir, "lib", "session-id.js"), false],
+		[path.join(paths.helperDir, "entwurf-capabilities.json"), false],
+	] as const;
+	if (closure.some(([file, executable]) => !isSafeOwnedFile(file, expectedUid, executable))) return true;
+	try {
+		const parsed = JSON.parse(fs.readFileSync(paths.hooksFile, "utf8")) as Record<string, unknown>;
+		const events = (parsed.hooks as Record<string, unknown> | undefined)?.SessionStart;
+		if (!Array.isArray(events) || events.length !== 1) return true;
+		const group = events[0] as Record<string, unknown>;
+		if ("matcher" in group || !Array.isArray(group.hooks) || group.hooks.length !== 1) return true;
+		const hook = group.hooks[0] as Record<string, unknown>;
+		if (Object.keys(hook).sort().join(",") !== "command,timeout,type") return true;
+		if (hook.type !== "command" || hook.command !== `'${launcher}'` || hook.timeout !== 30) return true;
+	} catch {
+		return true;
+	}
+	return closureDriftedFromState(paths, expectedUid);
+}
+
+/**
+ * The vendor's own receipt for THIS declaration, read and never written. The key the vendor
+ * writes is `<declaration path>:<event>:<group>:<handler>`; the value must be a
+ * `trusted_hash` of the shape `sha256:<64 hex>`. What this asserts is that a receipt EXISTS
+ * for our declaration identity — never that the hash is correct, which only the vendor can
+ * say, and never by launching Codex to find out.
+ */
+function trustReceiptMissing(config: Record<string, unknown>, hooksFile: string): boolean {
+	const hooks = config.hooks;
+	if (hooks == null || typeof hooks !== "object" || Array.isArray(hooks)) return true;
+	const state = (hooks as Record<string, unknown>).state;
+	if (state == null || typeof state !== "object" || Array.isArray(state)) return true;
+	const entry = (state as Record<string, unknown>)[`${hooksFile}:session_start:0:0`];
+	if (entry == null || typeof entry !== "object" || Array.isArray(entry)) return true;
+	const digest = (entry as Record<string, unknown>).trusted_hash;
+	return typeof digest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(digest);
+}
+
+function readConfig(env: NodeJS.ProcessEnv): Record<string, unknown> | null {
+	try {
+		const text = fs.readFileSync(
+			path.join(env.CODEX_HOME?.trim() || path.join(env.HOME ?? "", ".codex"), "config.toml"),
+			"utf8",
+		);
+		const value = parse(text);
+		return value && typeof value === "object" && !Array.isArray(value) ? (value as Record<string, unknown>) : null;
+	} catch {
+		return null;
+	}
+}
+
+function mcpMissing(config: Record<string, unknown>): boolean {
+	const servers = config.mcp_servers;
+	if (servers == null || typeof servers !== "object" || Array.isArray(servers)) return true;
+	const entry = (servers as Record<string, unknown>)["entwurf-bridge"];
+	if (entry == null || typeof entry !== "object" || Array.isArray(entry)) return true;
+	const server = entry as Record<string, unknown>;
+	if (Object.keys(server).sort().join(",") !== "command,env,env_vars") return true;
+	const envVars = server.env_vars;
+	if (
+		!Array.isArray(envVars) ||
+		envVars.length !== CODEX_MCP_ENV_VARS.length ||
+		envVars.some((name, index) => name !== CODEX_MCP_ENV_VARS[index])
+	)
+		return true;
+	const env = server.env;
+	if (env == null || typeof env !== "object" || Array.isArray(env)) return true;
+	const serverEnv = env as Record<string, unknown>;
+	return (
+		server.command !== "entwurf-bridge" ||
+		Object.keys(serverEnv).join(",") !== "ENTWURF_BRIDGE_NATIVE_HOST" ||
+		serverEnv.ENTWURF_BRIDGE_NATIVE_HOST !== "codex"
+	);
+}
+
+function visibleIdentityMissing(config: Record<string, unknown>): boolean {
+	const tui = config.tui;
+	if (tui == null || typeof tui !== "object" || Array.isArray(tui)) return true;
+	const statusLine = (tui as Record<string, unknown>).status_line;
+	return !Array.isArray(statusLine) || !statusLine.includes("thread-title");
+}
+
+const DEFAULT_APP_SERVER_TIMEOUT_MS = 5_000;
+
+function withTimeout<T>(promise: Promise<T>, timeoutMs: number): Promise<T> {
+	return new Promise((resolve, reject) => {
+		const timer = setTimeout(() => reject(new Error("codex app-server exchange timed out")), timeoutMs);
+		promise.then(
+			(value) => {
+				clearTimeout(timer);
+				resolve(value);
+			},
+			(error) => {
+				clearTimeout(timer);
+				reject(error);
+			},
+		);
+	});
+}
+
+/**
+ * A bounded real initialize/liveness exchange over the app-server's own JSON-RPC. The inode
+ * check above only proves a socket FILE with the right owner and mode exists — a dead
+ * app-server's stale socket a new process has not reclaimed yet passes that check identically
+ * to a live one. Only a real connection plus a real `initialize` round trip distinguishes them.
+ * Any failure — refused/hung connection, a response that never lands within the bound, or a
+ * reply the transport itself rejects — answers identically: not live. This is deliberately not
+ * `probeCodexThread`: preflight asks "is the app-server there to talk to", never "is a specific
+ * thread loaded", so it carries no thread id and no retry/backoff policy.
+ */
+async function appServerIsLive(
+	socketPath: string,
+	openProtocol: CodexProtocolOpener,
+	timeoutMs: number,
+): Promise<boolean> {
+	let protocol: CodexRpcProtocol;
+	const opening = openProtocol.open(socketPath);
+	try {
+		protocol = await withTimeout(opening, timeoutMs);
+	} catch {
+		// The bound expired (or the connect failed), but a slow open can still LAND afterwards.
+		// Nothing else holds that handle, so a late success would leave a live connection to the
+		// operator's app-server open for the rest of this process. Close it when it arrives —
+		// the answer stays "not live" either way; this only refuses to leak.
+		void opening.then(
+			(late) => {
+				try {
+					late.close();
+				} catch {
+					// best-effort: the socket may already be gone.
+				}
+			},
+			() => {
+				// The open failed; there is nothing to close.
+			},
+		);
+		return false;
+	}
+	try {
+		await withTimeout(
+			protocol.request("initialize", {
+				clientInfo: { name: "entwurf-fresh-preflight", title: "entwurf-fresh-preflight", version: "0" },
+				capabilities: { experimentalApi: true, requestAttestation: false },
+			}),
+			timeoutMs,
+		);
+		return true;
+	} catch {
+		return false;
+	} finally {
+		try {
+			protocol.close();
+		} catch {
+			// best-effort: the socket may already be gone.
+		}
+	}
+}
+
+/**
+ * Async because the app-server axis now performs a real bounded protocol exchange, not just an
+ * inode check (see `appServerIsLive`). Every other axis stays synchronous filesystem/config
+ * work; only the last `await` point can suspend.
+ */
+export async function codexFreshPreflight(
+	env: NodeJS.ProcessEnv,
+	deps: CodexPreflightDeps = {},
+): Promise<CodexPreflightRejectReason | null> {
+	const paths = deps.unitPathsOverride ?? unitPaths(env);
+	// A relative root would make the declaration's launcher path — the very string the vendor
+	// keys its trust receipt to — depend on this process's cwd.
+	if (!path.isAbsolute(paths.hooksFile) || !path.isAbsolute(paths.helperDir) || !path.isAbsolute(paths.stateFile)) {
+		return "codex-birth-unit-missing";
+	}
+	if (birthMissing(paths, deps.operatorUid ?? process.getuid?.() ?? -1)) {
+		return "codex-birth-unit-missing";
+	}
+	const config = readConfig(env);
+	// The vendor receipt is a SEPARATE reject from our bytes: perfect bytes the vendor will
+	// not run and absent bytes are two different repairs, and folding them would send the
+	// operator to the installer for something only they can answer in their own Codex.
+	if (config === null || trustReceiptMissing(config, paths.hooksFile)) return "codex-birth-trust-missing";
+	if (mcpMissing(config)) return "codex-mcp-hand-missing";
+	if (visibleIdentityMissing(config)) return "codex-visible-identity-missing";
+	const socketPath = resolveCodexDefaultSocketPath(env);
+	const socket = (deps.checkSocket ?? checkCodexSocketFile)(socketPath);
+	if (!socket.ok) return "codex-app-server-unavailable";
+	const live = await appServerIsLive(
+		socketPath,
+		deps.openProtocol ?? realCodexProtocolOpener,
+		deps.appServerTimeoutMs ?? DEFAULT_APP_SERVER_TIMEOUT_MS,
+	);
+	return live ? null : "codex-app-server-unavailable";
+}

package/pi-extensions/lib/compaction-send-guard.ts

@@ -0,0 +1,80 @@
+/**
+ * compaction-send-guard — whether a control-socket `send` may call `pi.sendMessage`.
+ *
+ * Pi 0.85.1 has no public `ExtensionContext.isCompacting()`. Compaction is non-idle
+ * (`AgentSession.isIdle` = no agent run AND not compacting) but `sendCustomMessage`
+ * does not refuse it. A non-streaming `triggerTurn:true` send starts `_runAgentPrompt`
+ * while `compact()` is rewriting the session tree — the field path that can make
+ * compaction "풀린다" and still return `delivered:true` (#111).
+ *
+ * Public facts the resident can see, without reaching into `AgentSession`:
+ *   - `ctx.isIdle()`
+ *   - `ctx.signal` — `agent.activeRun?.abortController.signal`, undefined when
+ *     there is no low-level agent run. This is NOT `AgentSession.isStreaming`
+ *     (`_isAgentRunActive`). After `agent.prompt()` returns, `_handlePostAgentRun`
+ *     retry / auto-compaction / continuation keeps `_isAgentRunActive=true` while
+ *     `ctx.signal` is already undefined.
+ *   - `session_before_compact` / `session_compact` / `session_compact_failed`
+ *
+ * Terminal semantics, read from installed `agent-session.js`:
+ *   - `session_before_compact` fires AFTER the abort controller is set (manual
+ *     compact then awaits summarization auth — a real start-race window).
+ *   - `session_compact` is NOT guaranteed (only if the saved compaction entry is
+ *     found by summary-text match).
+ *   - `session_compact_failed` fires on cancel / abort / fail.
+ *   - `isIdle()` becoming true is the honest recovery for a missed success event.
+ *
+ * Auto-compaction can run inside `_handlePostAgentRun` while `_isAgentRunActive`
+ * stays true, so only the event flag can name that window `compacting`.
+ *
+ * Quiet unknown (`!idle && !hasAgentSignal && !armed`) is fail-closed as `busy`,
+ * not `compacting`: the public pair cannot tell manual-compact start race from
+ * branch summary, post-run retry, or continuation. Calling those `compacting`
+ * is a false claim. The start-race guarantee is still "do not call sendMessage".
+ *
+ * The predicate takes no send mode. Every mode is refused the same way.
+ */
+
+export const COMPACTION_SEND_REJECT = "compacting" as const;
+export const BUSY_SEND_REJECT = "busy" as const;
+export type CompactionSendReject = typeof COMPACTION_SEND_REJECT | typeof BUSY_SEND_REJECT;
+
+export type CompactionGuard = {
+	/** Armed by `session_before_compact`; disarmed by either terminal event or idle recovery. */
+	armed: boolean;
+};
+
+export type CompactionSendFacts = {
+	idle: boolean;
+	/** `ctx.signal !== undefined`. Not `AgentSession.isStreaming`. */
+	hasAgentSignal: boolean;
+};
+
+export function createCompactionGuard(): CompactionGuard {
+	return { armed: false };
+}
+
+export function noteCompactionBefore(guard: CompactionGuard): void {
+	guard.armed = true;
+}
+
+export function noteCompactionTerminal(guard: CompactionGuard): void {
+	guard.armed = false;
+}
+
+/**
+ * `null` = admit (caller may `pi.sendMessage`).
+ * `"compacting"` = event-armed compaction; `"busy"` = quiet unknown non-idle.
+ * Either way: do not call `pi.sendMessage`; do not emit `delivered:true`.
+ */
+export function compactionSendReject(guard: CompactionGuard, facts: CompactionSendFacts): CompactionSendReject | null {
+	if (facts.idle) {
+		// Idle means Pi is neither in an agent run nor compacting. Also recovers a
+		// missed `session_compact` so a later ordinary stream is not stuck refused.
+		guard.armed = false;
+		return null;
+	}
+	if (guard.armed) return COMPACTION_SEND_REJECT;
+	if (!facts.hasAgentSignal) return BUSY_SEND_REJECT;
+	return null; // live agent run — steer/followUp unchanged
+}

package/pi-extensions/lib/entwurf-fact-provider.ts

@@ -32,6 +32,7 @@ import {
 	isOutOfSocketDomainGardenIdConflict,
 	type PeerObserver,
 	resolveFactList,
+	UNOBSERVED_PEER,
 } from "./entwurf-facts.ts";
 import { observePeerFacts } from "./entwurf-peer-observe.ts";
 import { isLivenessSupported } from "./entwurf-v2-contract.ts";
@@ -102,9 +103,12 @@ export interface EntwurfFactsDeps {
 	/** Observation axis (#101): per-citizen receiver + transcript facts. Defaults to the
 	 * REAL measurement — the same seam shape `makeProductionEntwurfV2Deps` uses, so the two
 	 * wiring sites (MCP + pi-native) cannot drift by each passing their own observer, and a
-	 * gate still drives the assembly with a fake and no filesystem. A caller that injects
-	 * nothing gets facts; a caller that injects `() => UNOBSERVED_PEER` says so on every row. */
+	 * gate still drives the assembly with a fake and no filesystem. */
 	observe?: PeerObserver;
+	/** Optional presentation budget. Undefined preserves the generic fact provider's full
+	 * observation contract; peers surfaces pass their shared render limit. Older machine
+	 * payload rows then say `unobserved` rather than fabricating `active` / `exists`. */
+	observationLimit?: number;
 }
 
 function diagnosticSortKey(d: EntwurfDiagnostic): string {
@@ -195,9 +199,31 @@ export async function listEntwurfFacts(deps: EntwurfFactsDeps): Promise<EntwurfF
 	// 4. resolveFactList over CLEAN inputs only. Its throws (duplicate identity /
 	//    unprobed in-domain citizen) are impossible wiring invariants — left to
 	//    fire as the last line of defense, never caught here.
+	//
+	//    A peers surface may bound observation to its SAME newest rendered rows. Receiver
+	//    observation can inspect process state and historical Claude markers, so doing it
+	//    for every retained record made bounded text grow linearly with history. The generic
+	//    provider stays unbounded when no limit is supplied. Either way the full clean
+	//    identity/probe arrays reach the core: certification, duplicate detection,
+	//    diagnostics, liveness, and the machine payload remain complete. Only an observation
+	//    not performed becomes `unobserved`.
 	const cleanIdentities = identities.filter((i) => !conflictGids.has(i.gardenId));
 	const cleanProbes = probes.filter((p) => !conflictGids.has(p.gardenId));
-	const facts: FactList = resolveFactList(cleanIdentities, cleanProbes, deps.observe ?? observePeerFacts);
+	const observe = deps.observe ?? observePeerFacts;
+	let selectedObserve = observe;
+	if (deps.observationLimit !== undefined) {
+		if (!Number.isSafeInteger(deps.observationLimit) || deps.observationLimit < 0) {
+			throw new Error("listEntwurfFacts: observationLimit must be a non-negative safe integer");
+		}
+		const observedGardenIds = new Set(
+			[...cleanIdentities]
+				.sort((a, b) => (a.gardenId < b.gardenId ? -1 : a.gardenId > b.gardenId ? 1 : 0))
+				.slice(Math.max(0, cleanIdentities.length - deps.observationLimit))
+				.map((identity) => identity.gardenId),
+		);
+		selectedObserve = (identity) => (observedGardenIds.has(identity.gardenId) ? observe(identity) : UNOBSERVED_PEER);
+	}
+	const facts: FactList = resolveFactList(cleanIdentities, cleanProbes, selectedObserve);
 
 	// 5. #50 C4 demotion: a record-less socket is a diagnostic, not a listing
 	//    section. One diagnostic per socket (subjects aggregate at render, F8);

package/pi-extensions/lib/entwurf-peers-render.ts

@@ -39,6 +39,9 @@ export interface EntwurfPeersRender {
 	payload: EntwurfPeersPayload;
 }
 
+/** Human rows and expensive provider observations share this one presentation budget. */
+export const ENTWURF_PEERS_RENDER_LIMIT = 32;
+
 // `receiver` and `transcript` are OBSERVED facts, not routing (#101): they say what was
 // found on disk for this citizen, and a caller still asks entwurf_v2 what may be done
 // about it. They earn a column because for every claude-code row `liveness` reads
@@ -124,7 +127,7 @@ function renderDiagnosticLines(diagnostics: EntwurfDiagnostic[]): string[] {
 	return lines;
 }
 
-function compactLines(lines: string[], max: number = 32): string[] {
+function compactLines(lines: string[], max: number = ENTWURF_PEERS_RENDER_LIMIT): string[] {
 	if (lines.length <= max) return lines;
 	const omitted = lines.length - max;
 	return [`  … (${omitted} older entries omitted; showing latest ${max})`, ...lines.slice(-max)];

package/pi-extensions/lib/entwurf-v2-contract.ts

@@ -122,13 +122,12 @@ export function isLivenessSupported(backend: string): boolean {
 
 // ── Native-push backend domain (봉인 2/4) ───────────────────────────────────
 // A backend whose liveness is measured by the SEPARATE native-push adapter rail (a
-// live app-server conversation probe — antigravity's LS gRPC), NOT a control
-// socket. This domain is DISJOINT from LIVENESS_DOMAIN_BACKENDS: an agy session
-// is `unsupported` on the socket FACT axis (entwurf_peers) yet fully
-// measured + deliverable on the native-push axis. The two are separate rails on
-// purpose — check-entwurf-facts pins both sets and asserts their intersection is ∅
-// (a backend can never be in both domains).
-export const NATIVE_PUSH_BACKENDS = ["antigravity"] as const;
+// live vendor app-server target probe), NOT a control socket. This domain is DISJOINT
+// from LIVENESS_DOMAIN_BACKENDS: an Antigravity or Codex session is `unsupported` on
+// the socket FACT axis (entwurf_peers) yet independently measured on the native-push
+// axis. The two are separate rails on purpose — check-entwurf-facts pins both sets
+// and asserts their intersection is ∅ (a backend can never be in both domains).
+export const NATIVE_PUSH_BACKENDS = ["antigravity", "codex"] as const;
 export type NativePushBackend = (typeof NATIVE_PUSH_BACKENDS)[number];
 
 export function nativePushSupported(backend: string): backend is NativePushBackend {

package/pi-extensions/lib/entwurf-v2-native-push.ts

@@ -5,11 +5,10 @@
  * ROUTING (the NATIVE_PUSH_DISPATCH_TABLE did) and carries NO release seam — a native-push
  * plan is the LOCK-FREE path (봉인 4), so a lock leak is structurally impossible here.
  *
- * This is where the 1-shot retry lives — NOT in the adapter leaf (봉인 3). The decider
- * probed a fresh route and planted it in the plan; the executor sends over it, and on a
- * failure it re-probes ONCE (the volatile LS port may have shifted between decide and
- * execute) and re-sends. A second failure is fail-loud (no infinite loop). This mirrors the
- * control-socket send-fallback pattern: the decider stays pure, the hand owns the retry.
+ * Retry is an adapter capability, not a rail-wide assumption. Antigravity re-probes once
+ * because its volatile LS port can shift before send. Codex never retries: `codex queue`
+ * may have accepted the message before its receipt failed, so replay could duplicate it.
+ * The decider stays pure; this hand enforces the adapter's declared policy.
  *
  * A native-push send has NO in-band refuse (there is no live receiver to answer
  * success:false) — like a mailbox enqueue, it either succeeds or THROWS. The hand never
@@ -18,6 +17,7 @@
 
 import type { ExecutionPlan } from "./entwurf-v2-decider.ts";
 import type { LockClaim } from "./entwurf-v2-lock.ts";
+import { formatMetaMailboxBody, type MailboxSenderEnvelope } from "./meta-mailbox-body.ts";
 import { type NativePushAdapter, type NativePushRoute, resolveNativePushAdapter } from "./native-push/adapter.ts";
 
 /** The native-push slice of the ExecutionPlan union (the decider plants it, this consumes it). */
@@ -25,16 +25,14 @@ export type NativePushPlan = Extract<ExecutionPlan, { transport: "native-push" }
 
 export interface NativePushSendResult {
 	success: true;
-	/** Whether the 1-shot re-probe→re-send fired (the first send over the planted route failed). */
+	/** Whether the adapter's one permitted re-probe→re-send fired. */
 	retried: boolean;
 }
 
 /**
- * Deliver `content` into the conversation, owning the 1-shot retry (봉인 3). Send over the
- * planted (decider-probed) route first; on failure re-probe ONCE and re-send over the fresh
- * route; a second failure PROPAGATES (fail-loud). If the re-probe finds the target no longer
- * alive, throw — a failed send into a now-dead conversation is an honest non-delivery, never
- * a silent success. The re-probe is the ONLY re-derivation of the volatile route.
+ * Deliver `content` through the decider-probed route. A non-retriable adapter propagates
+ * the first failure unchanged. A retriable adapter re-probes once and sends once more only
+ * when the target is still alive; no adapter gets a third attempt.
  */
 export async function deliverViaNativePush(
 	adapter: NativePushAdapter,
@@ -46,8 +44,8 @@ export async function deliverViaNativePush(
 		await adapter.send(route, nativeSessionId, content);
 		return { success: true, retried: false };
 	} catch (firstErr) {
-		// 1-shot re-probe → re-send: the volatile LS route may have shifted since the decider
-		// probed it. Re-discover it fresh and retry exactly once.
+		if (!adapter.retriable) throw firstErr;
+		// One re-probe and one retry for adapters whose send boundary is safe to replay.
 		const reprobe = await adapter.probe(nativeSessionId);
 		if (reprobe.status !== "alive") {
 			throw new Error(
@@ -65,22 +63,41 @@ export async function deliverViaNativePush(
  *  registry). Injected so the 5d gate proves the wiring with a fake adapter. */
 export interface NativePushSendDeps {
 	resolveAdapter?: (backend: string) => NativePushAdapter;
+	/** The SAME provider the mailbox hand receives (`makeProductionEntwurfV2Deps` passes one
+	 * `opts.senderProvider` to both). When it yields an envelope, the injected content is the
+	 * mailbox-serialized body — see the render note on `makeNativePushSend`. Absent/undefined
+	 * preserves the raw `plan.message`. */
+	senderProvider?: () => MailboxSenderEnvelope | undefined;
 }
 
 /**
  * Build the production `sendNativePush(plan, lock)` adapter the runner consumes. It IGNORES
- * `lock` entirely (a native-push plan is lock-free, 봉인 4) — the field exists only to match
- * the DispatchExecutorDeps hand signature. It resolves the adapter from the plan's backend
- * and delivers with the 1-shot retry. A delivery throw surfaces as a REJECTED promise (the
- * runner's try/catch maps it to execution-failed).
+ * `lock` entirely (a native-push plan is lock-free, 봉인 4), resolves the adapter, then applies
+ * that adapter's retry policy. A delivery throw surfaces as a REJECTED promise (the runner's
+ * try/catch maps it to execution-failed).
+ *
+ * SENDER ENVELOPE (measured #95). Direct injection used to hand the adapter the raw
+ * `plan.message`, so a native-push citizen received a body with no sender. The #95 A LIVE run
+ * measured what that costs: a fresh Pi's nonce-only callback landed in the Codex thread as
+ * bare text, and Codex could not name who called it — the callback was uncorrelatable. The
+ * control-socket rail carries the envelope in its RPC framing and the mailbox rail serializes
+ * it into the body; this rail has neither, so it renders the SAME `formatMetaMailboxBody` SSOT
+ * the mailbox uses. Rendered ONCE, before `deliverViaNativePush`, so an Antigravity re-probe
+ * retry replays byte-identical content (including its timestamp) instead of a second render.
+ * The adapter stays a dumb pipe — its signature is unchanged and it never learns about senders.
  */
 export function makeNativePushSend(
 	deps: NativePushSendDeps = {},
 ): (plan: NativePushPlan, lock: LockClaim | null) => Promise<NativePushSendResult> {
 	const resolveAdapter = deps.resolveAdapter ?? resolveNativePushAdapter;
+	const senderProvider = deps.senderProvider;
 	// `_lock` is named for the hand contract but NEVER read — native-push owns/releases no lock.
 	return async (plan: NativePushPlan, _lock: LockClaim | null): Promise<NativePushSendResult> => {
+		// Resolve the sender BEFORE the adapter is resolved or touched: a provider throw must
+		// reject this send with nothing injected, not leave a half-delivered conversation.
+		const sender = senderProvider?.();
+		const content = sender ? formatMetaMailboxBody(sender, plan.message, plan.wantsReply) : plan.message;
 		const adapter = resolveAdapter(plan.backend);
-		return deliverViaNativePush(adapter, plan.route, plan.nativeSessionId, plan.message);
+		return deliverViaNativePush(adapter, plan.route, plan.nativeSessionId, content);
 	};
 }