@junghanacs/entwurf 0.20.0 → 0.21.0

package/scripts/check-entwurf-peers-surface.ts

@@ -31,7 +31,7 @@ import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { type EntwurfFactsResult, recordLessSocketMessage } from "../pi-extensions/lib/entwurf-fact-provider.ts";
 import type { PeerFact } from "../pi-extensions/lib/entwurf-facts.ts";
-import { renderEntwurfPeers } from "../pi-extensions/lib/entwurf-peers-render.ts";
+import { ENTWURF_PEERS_RENDER_LIMIT, renderEntwurfPeers } from "../pi-extensions/lib/entwurf-peers-render.ts";
 import type { FactLiveness } from "../pi-extensions/lib/entwurf-v2-contract.ts";
 import type { MetaCitizenBackend } from "../pi-extensions/lib/meta-session.ts";
 import type { SocketLiveness } from "../pi-extensions/lib/socket-probe.ts";
@@ -199,6 +199,10 @@ function main(): void {
 		);
 		const bounded = renderEntwurfPeers({ facts: { peers: manyPeers, recordLessSockets: [] }, diagnostics: [] });
 		ok("bounded text omits older entries when peer list is large", bounded.text.includes("older entries omitted"));
+		ok(
+			"#112: human row budget remains exactly 32",
+			ENTWURF_PEERS_RENDER_LIMIT === 32 && bounded.text.includes("(8 older entries omitted; showing latest 32)"),
+		);
 		ok("bounded text shows latest entries", bounded.text.includes("20260612T000039-aaaaaa"));
 		ok("bounded text omits oldest entry", !bounded.text.includes("20260612T000000-aaaaaa  backend="));
 		ok("bounded payload still carries every peer", bounded.payload.peers.length === 40);
@@ -255,6 +259,14 @@ function main(): void {
 		ok("wiring: bridge calls renderEntwurfPeers(", bridgeSrc.includes("renderEntwurfPeers("));
 		ok("wiring: native pi tool calls listEntwurfFacts(", nativeSrc.includes("listEntwurfFacts("));
 		ok("wiring: native pi tool calls renderEntwurfPeers(", nativeSrc.includes("renderEntwurfPeers("));
+		ok(
+			"#112 wiring: MCP observation uses the render limit",
+			bridgeSrc.includes("observationLimit: ENTWURF_PEERS_RENDER_LIMIT"),
+		);
+		ok(
+			"#112 wiring: native pi observation uses the render limit",
+			nativeSrc.includes("observationLimit: render.ENTWURF_PEERS_RENDER_LIMIT"),
+		);
 		ok(
 			"wiring: bridge does not paste full JSON payload into human text",
 			!bridgeSrc.includes("JSON.stringify(payload)"),

package/scripts/check-entwurf-self-address.ts

@@ -266,14 +266,14 @@ ok(
 	/existsSync\s*\(/.test(piBody) && /controlSocketPathIn\s*\(\s*ENTWURF_DIR\s*,/.test(piBody),
 );
 
-const metaBuilder = functionBody("buildTrustedMetaSenderEnvelope");
+const metaBuilder = functionBody("buildMetaSenderEnvelope");
 // FIRST of the two derivation claims so a binary-fallback mutant dies here, not at the seam pin.
 ok(
-	"buildTrustedMetaSenderEnvelope does not fall back every non-native-push backend to self-fetch [QK:SELFADDR-NO-FALLBACK-SELF-FETCH]",
+	"buildMetaSenderEnvelope does not fall back every non-native-push backend to self-fetch [QK:SELFADDR-NO-FALLBACK-SELF-FETCH]",
 	!/\?\s*"native-push"\s*:\s*"self-fetch"/.test(metaBuilder),
 );
 ok(
-	"buildTrustedMetaSenderEnvelope derives self-fetch through resolveMailboxWakeModeCapability(identity), not a backend-name list [QK:SELFADDR-MAILBOX-WAKE-SEAM]",
+	"buildMetaSenderEnvelope derives self-fetch through resolveMailboxWakeModeCapability(identity), not a backend-name list [QK:SELFADDR-MAILBOX-WAKE-SEAM]",
 	/resolveMailboxWakeModeCapability\s*\(\s*identity\s*\)/.test(metaBuilder),
 );
 
@@ -443,14 +443,13 @@ function metaRailRenderIsHonest(region: string): { honest: boolean; reason: stri
 		throw new Error(`class ${name} body never closed`);
 	};
 
-	// Anchored per class (not a repo-wide grep) so a mention somewhere else in the file
-	// cannot make either row vacuously green.
+	// Anchored per class (not a repo-wide grep) so a mention elsewhere cannot make
+	// either row vacuously green. Native hook mechanisms vary by backend; Codex
+	// carries request-scoped identity instead of a shared process marker.
 	for (const cls of ["EntwurfEnvelopeWiringError", "EntwurfSenderIdentityError"]) {
 		const body = classBody(cls);
-		ok(
-			`${cls} names BOTH native hooks (SessionStart AND PreInvocation)`,
-			/SessionStart/.test(body) && /PreInvocation/.test(body),
-		);
+		ok(`${cls} names a native sender marker path`, /native (sender )?(claim|hook)|sender marker/.test(body));
+		ok(`${cls} names the managed Codex request identity path`, /managed Codex/.test(body));
 		ok(
 			`${cls} no longer presents SessionStart/Claude as THE marker writer`,
 			!/The native SessionStart hook writes that marker/.test(body) &&
@@ -465,33 +464,33 @@ function metaRailRenderIsHonest(region: string): { honest: boolean; reason: stri
 // THIS session's own receiver inbox can actually wake (slice-2 presence marker), not a
 // hardcoded true. An inactive receiver must still return the meta identity (replyable:false)
 // — degrading to null would erase who-sent and fall through to external-mcp.
-const metaBody = functionBody("buildTrustedMetaSenderEnvelope");
-ok("buildTrustedMetaSenderEnvelope calls computeSelfAddressability", /computeSelfAddressability\s*\(/.test(metaBody));
-ok("buildTrustedMetaSenderEnvelope no longer hardcodes `replyable: true`", !/replyable:\s*true/.test(metaBody));
+const metaBody = functionBody("buildMetaSenderEnvelope");
+ok("buildMetaSenderEnvelope calls computeSelfAddressability", /computeSelfAddressability\s*\(/.test(metaBody));
+ok("buildMetaSenderEnvelope no longer hardcodes `replyable: true`", !/replyable:\s*true/.test(metaBody));
 ok(
 	// #101: the identity match alone is no longer the whole answer. `entwurf_self` composes
 	// the SAME `resolveMailboxReceiverFacts` the v2 dispatch seam uses — reading the receiver
 	// marker AND, where the watch owner is the sender-marker process, the join that says that
 	// owner is still serving this garden. A citizen's self-reported replyability and what
 	// dispatch decides about it come from one measurement, so they cannot disagree.
-	"buildTrustedMetaSenderEnvelope derives active-receiver from the SHARED receiver composition (both markers)",
+	"buildMetaSenderEnvelope derives active-receiver from the SHARED receiver composition (both markers)",
 	/resolveMailboxReceiverFacts\s*\(/.test(metaBody) &&
 		/readMetaReceiverMarker\s*\(/.test(metaBody) &&
 		/readMetaSenderMarker\s*\(/.test(metaBody),
 );
 ok(
-	"buildTrustedMetaSenderEnvelope no longer copies one match into both receiver facts",
+	"buildMetaSenderEnvelope no longer copies one match into both receiver facts",
 	!/ownerAlive:\s*active/.test(metaBody) && !/watchArmed:\s*active/.test(metaBody),
 );
 ok(
 	// #101 (cross-review): both markers are read with their liveness guards ON. A reader that
 	// opted out would accept a dead session's leftover file as "which garden this pid serves
 	// now", and every fixture pid in a gate is live, so nothing dynamic here could tell.
-	"buildTrustedMetaSenderEnvelope reads neither marker with the owner guard disabled",
+	"buildMetaSenderEnvelope reads neither marker with the owner guard disabled",
 	!/verifyOwner:\s*false/.test(metaBody),
 );
 ok(
-	"buildTrustedMetaSenderEnvelope keeps meta identity + derived replyable (inactive → not null)",
+	"buildMetaSenderEnvelope keeps meta identity + derived replyable (inactive → not null)",
 	/origin:\s*"meta-session"/.test(metaBody) && /replyable:\s*self\.replyable/.test(metaBody),
 );
 

package/scripts/check-entwurf-v2-contract.ts

@@ -280,8 +280,8 @@ ok(
 // ── native-push (봉인 1/2/4): a THIRD table, disjoint from pi socket + mailbox ──
 const NATIVE_PUSH_LIVENESSES = ["alive", "dead", "indeterminate"] as const;
 
-// domain: antigravity is native-push; pi/claude-code are NOT; the domain is DISJOINT
-// from the pi socket liveness domain (a backend is never in both rails).
+// domain: antigravity and Codex are native-push; pi/claude-code are NOT; the domain
+// is DISJOINT from pi socket liveness (a backend is never in both rails).
 eq("native-push domain: antigravity supported", nativePushSupported("antigravity"), true);
 eq("native-push domain: pi is NOT native-push (it is pi-socket)", nativePushSupported("pi"), false);
 eq(
@@ -289,7 +289,8 @@ eq(
 	nativePushSupported("claude-code"),
 	false,
 );
-eq("native-push domain: NATIVE_PUSH_BACKENDS == ['antigravity']", [...NATIVE_PUSH_BACKENDS], ["antigravity"]);
+eq("native-push domain: Codex supported", nativePushSupported("codex"), true);
+eq("native-push domain: NATIVE_PUSH_BACKENDS exact", [...NATIVE_PUSH_BACKENDS], ["antigravity", "codex"]);
 ok(
 	"native-push ∩ pi-socket liveness domain = ∅ (separate rails)",
 	!NATIVE_PUSH_BACKENDS.some((b) => (LIVENESS_DOMAIN_BACKENDS as readonly string[]).includes(b)),

package/scripts/check-entwurf-v2-decider.ts

@@ -381,7 +381,7 @@ async function main(): Promise<void> {
 	// ── 8: unsupported + ff + seam says undeliverable → reject, no plan, no lock ─
 	{
 		const t = mkDeps({
-			resolution: { identity: identity("codex"), preProbeAddressConflict: false },
+			resolution: { identity: identity("omp"), preProbeAddressConflict: false },
 			mailboxDeliverable: false,
 		});
 		const d = await decideDispatch({ target: GID, intent: "fire-and-forget", message: "mail" }, t.deps);
@@ -399,8 +399,7 @@ async function main(): Promise<void> {
 	// reject, NO plan, NO lock, NO inspect/probe. This is the v2 closure of the gap slice
 	// 2d-2 closed for v1: the decider no longer trusts wake-mode alone; the required seam's
 	// active-receiver verdict governs, so a reply to a dead claude-code is refused, not
-	// enqueued as mailbox garbage. (Indistinguishable here from the codex case at the
-	// receipt level — that is the point: the seam, not the backend, decides.) ────────────
+	// enqueued as mailbox garbage. ───────────────────────────────────────────────────
 	{
 		const t = mkDeps({
 			resolution: { identity: identity("claude-code"), preProbeAddressConflict: false },
@@ -581,7 +580,7 @@ async function main(): Promise<void> {
 		// ff × alive → execute native-push send; plan carries route/backend/nativeSessionId; lock null.
 		const t = mkDeps({
 			resolution: npResolution,
-			nativePush: { status: "alive", route: { lsAddress: "127.0.0.1:5599" } },
+			nativePush: { status: "alive", route: { backend: "antigravity", lsAddress: "127.0.0.1:5599" } },
 		});
 		const d = await decideDispatch({ target: GID, intent: "fire-and-forget", message: "yo" }, t.deps);
 		ok("native-push ff+alive: execute", isExecute(d));
@@ -594,7 +593,10 @@ async function main(): Promise<void> {
 			t.mailboxCalls.length === 0,
 		);
 		if (isExecute(d) && d.plan.transport === "native-push") {
-			ok("native-push ff+alive: plan route = probed route", d.plan.route.lsAddress === "127.0.0.1:5599");
+			ok(
+				"native-push ff+alive: plan route = probed route",
+				d.plan.route.backend === "antigravity" && d.plan.route.lsAddress === "127.0.0.1:5599",
+			);
 			ok("native-push ff+alive: plan backend = antigravity", d.plan.backend === "antigravity");
 			ok("native-push ff+alive: plan nativeSessionId from identity", d.plan.nativeSessionId === `native-${GID}`);
 			ok(

package/scripts/check-entwurf-v2-native-push.ts

@@ -35,7 +35,11 @@ function ok(label: string, cond: boolean): void {
 }
 
 const CONV = "conv-xyz";
-const PLANTED: NativePushRoute = { lsAddress: "127.0.0.1:5600" };
+const PLANTED: NativePushRoute = { backend: "antigravity", lsAddress: "127.0.0.1:5600" };
+
+function agyAddress(route: NativePushRoute | undefined): string | undefined {
+	return route?.backend === "antigravity" ? route.lsAddress : undefined;
+}
 
 interface SendCall {
 	route: NativePushRoute;
@@ -48,6 +52,7 @@ interface FakeAdapterConfig {
 	probes: NativePushProbeResult[];
 	/** 0-based indices of send() calls that THROW. */
 	sendFailAt?: number[];
+	retriable?: boolean;
 }
 
 function makeFakeAdapter(config: FakeAdapterConfig): {
@@ -60,6 +65,7 @@ function makeFakeAdapter(config: FakeAdapterConfig): {
 	const sends: SendCall[] = [];
 	const adapter: NativePushAdapter = {
 		id: "antigravity",
+		retriable: config.retriable ?? true,
 		async probe() {
 			const p = config.probes[probeIdx] ?? { status: "dead", reason: "fake: probes exhausted" };
 			probeIdx++;
@@ -81,31 +87,53 @@ async function main(): Promise<void> {
 		const r = await deliverViaNativePush(adapter, PLANTED, CONV, "hi");
 		ok("success: retried:false", r.success === true && r.retried === false);
 		ok("success: exactly ONE send", sends.length === 1);
-		ok("success: send used the PLANTED route (no re-probe)", sends[0]?.route.lsAddress === "127.0.0.1:5600");
+		ok("success: send used the PLANTED route (no re-probe)", agyAddress(sends[0]?.route) === "127.0.0.1:5600");
 		ok("success: ZERO re-probe", probeCount() === 0);
 	}
 
+	// Codex's vendor queue may accept before its receipt fails: no re-probe, no replay.
+	{
+		const { adapter, sends, probeCount } = makeFakeAdapter({
+			probes: [{ status: "alive", route: { backend: "antigravity", lsAddress: "must-not-be-used" } }],
+			sendFailAt: [0, 1],
+			retriable: false,
+		});
+		await assert.rejects(() => deliverViaNativePush(adapter, PLANTED, CONV, "hi"), /fake send fail/);
+		ok("non-retriable failure makes exactly ONE send", sends.length === 1);
+		ok("non-retriable failure makes ZERO probes", probeCount() === 0);
+	}
+
 	// ── fail → re-probe alive → re-send success: retried, fresh route ────────────
 	{
 		const { adapter, sends, probeCount } = makeFakeAdapter({
-			probes: [{ status: "alive", route: { lsAddress: "127.0.0.1:5601" } }],
+			probes: [{ status: "alive", route: { backend: "antigravity", lsAddress: "127.0.0.1:5601" } }],
 			sendFailAt: [0],
 		});
 		const r = await deliverViaNativePush(adapter, PLANTED, CONV, "hi");
 		ok("retry: retried:true", r.success === true && r.retried === true);
 		ok("retry: TWO sends (initial + one retry)", sends.length === 2);
 		ok("retry: exactly ONE re-probe", probeCount() === 1);
-		ok("retry: 1st send used the planted route", sends[0]?.route.lsAddress === "127.0.0.1:5600");
+		ok("retry: 1st send used the planted route", agyAddress(sends[0]?.route) === "127.0.0.1:5600");
 		ok(
 			"retry: 2nd send used the RE-DISCOVERED route (not the stale one)",
-			sends[1]?.route.lsAddress === "127.0.0.1:5601",
+			agyAddress(sends[1]?.route) === "127.0.0.1:5601",
+		);
+		// The retry replays CONTENT, never re-derives it. The caller hands this leaf one already
+		// rendered string (the #95 sender envelope is rendered ONCE, upstream, with its own
+		// timestamp), so the only honest retry is the same bytes — a second render, or any
+		// per-attempt decoration here, would deliver a body that disagrees with the first
+		// attempt the target may already have accepted. Asserted at this leaf so the claim holds
+		// without coupling sender rendering into the adapter hand.
+		ok(
+			"[QK:NATIVE-PUSH-RETRY-BYTE-IDENTITY] the retry replays byte-identical content, never a re-derived body",
+			sends[0]?.content === sends[1]?.content,
 		);
 	}
 
 	// ── fail → re-probe alive → re-send FAIL: throws (fail-loud, no 3rd attempt) ──
 	{
 		const { adapter, sends } = makeFakeAdapter({
-			probes: [{ status: "alive", route: { lsAddress: "127.0.0.1:5601" } }],
+			probes: [{ status: "alive", route: { backend: "antigravity", lsAddress: "127.0.0.1:5601" } }],
 			sendFailAt: [0, 1],
 		});
 		let threw = false;
@@ -182,7 +210,7 @@ async function main(): Promise<void> {
 		);
 		ok(
 			"makeNativePushSend: sent the plan message over the plan route",
-			sends[0]?.content === "payload" && sends[0]?.route.lsAddress === "127.0.0.1:5600",
+			sends[0]?.content === "payload" && agyAddress(sends[0]?.route) === "127.0.0.1:5600",
 		);
 		ok("makeNativePushSend: lock IGNORED (lock-free — a bogus lock did not break delivery)", sends.length === 1);
 	}

package/scripts/check-entwurf-v2-production.ts

@@ -27,8 +27,14 @@ import {
 	makeProductionEntwurfV2Deps,
 	type ProductionEntwurfV2Opts,
 } from "../pi-extensions/lib/entwurf-v2-production.ts";
-import { runEntwurfV2 } from "../pi-extensions/lib/entwurf-v2-runner.ts";
+import {
+	type EntwurfV2RunDeps,
+	type EntwurfV2RunResult,
+	executeDispatch,
+	runEntwurfV2,
+} from "../pi-extensions/lib/entwurf-v2-runner.ts";
 import type { ControlSocketPlan, MetaMailboxPlan } from "../pi-extensions/lib/entwurf-v2-send.ts";
+import { formatMetaMailboxBody, type MailboxSenderEnvelope } from "../pi-extensions/lib/meta-mailbox-body.ts";
 import type { MetaIdentity, MetaReceiverMarker, MetaSenderMarker } from "../pi-extensions/lib/meta-session.ts";
 import type { NativePushAdapter, NativePushProbeResult } from "../pi-extensions/lib/native-push/adapter.ts";
 import type { TargetSocketInspection } from "../pi-extensions/lib/socket-discovery.ts";
@@ -43,6 +49,13 @@ function ok(label: string, cond: boolean): void {
 const GID = "20260613T100000-aaaaaa";
 /** The garden a switched-away owner serves instead (#101). */
 const OTHER_GID = "20260613T100000-bbbbbb";
+/** The one trusted sender every rail in this gate renders from. */
+const SENDER: MailboxSenderEnvelope = {
+	sessionId: "self",
+	agentId: "pi/x",
+	cwd: "/cwd",
+	timestamp: "2026-06-13T00:00:00.000Z",
+};
 const LOCK_DIR = "/fake/locks";
 const SESSIONS_DIR = "/fake/sessions";
 const MAILBOX_DIR = "/fake/mailbox";
@@ -132,7 +145,36 @@ interface Spies {
 	/** which backend the native-push adapter resolver was asked for (decide + execute). */
 	nativePushResolve: string[];
 	nativePushProbe: { conv: string }[];
-	nativePushSend: { lsAddress: string; conv: string; content: string }[];
+	nativePushSend: { route: string; conv: string; content: string }[];
+	/** every `senderProvider()` call — ONE provider feeds all three rails, so a hand that
+	 * resolves the envelope twice (or not at all) is visible here. */
+	senderCalls: number[];
+	/** ORDERED trace of the native-push hand's observable steps. Counts alone cannot see
+	 * ORDER, and order is the whole safety claim: the envelope must be resolved BEFORE the
+	 * adapter is touched, so a provider throw leaves the target's conversation untouched
+	 * rather than half-delivered. `runInTwoPhases` marks where the execute phase starts. */
+	events: ("sender" | "resolve" | "probe" | "send")[];
+}
+
+/**
+ * `runEntwurfV2` split at its own seam so the EXECUTE phase has a MEASURED boundary. The decide
+ * phase legitimately resolves the adapter and probes (봉인 4: one adapter for both hands), so an
+ * order claim about the send hand has to start after decide returns — but the boundary must be
+ * the index recorded between the two calls, never something inferred from the event VALUES. An
+ * earlier version sliced after the last `probe`, which a regression could defeat: an executor
+ * that resolved and probed before the sender would make its own probe the "last" one and hide
+ * the illegal prefix it just produced. This records the length instead, so ANY extra execute-side
+ * resolve or probe ahead of the sender stays inside the slice and fails.
+ */
+async function runInTwoPhases(
+	input: DispatchInput,
+	deps: EntwurfV2RunDeps,
+	spies: Spies,
+): Promise<{ result: EntwurfV2RunResult; executeEvents: string[] }> {
+	const decision = await deps.decide(input);
+	const executeStart = spies.events.length;
+	const result = await executeDispatch(decision, deps.executor);
+	return { result, executeEvents: spies.events.slice(executeStart) };
 }
 
 /** Build a factory whose every leaf IO is a spy. `over` lets a case shape the decision
@@ -146,6 +188,8 @@ function makeSpiedFactory(over: {
 	classifyDead?: boolean;
 	/** #50 C3 — a caller with no authoritative sender (senderProvider → undefined). */
 	noSender?: boolean;
+	/** #95 — the envelope source itself fails: the send must reject with NOTHING injected. */
+	senderThrows?: boolean;
 	/** the native-push adapter probe result (only reached on a native-push backend). */
 	nativePushProbe?: NativePushProbeResult;
 	/** SE-2 2d-3 — the target's receiver presence marker: "active" (matches identity,
@@ -166,12 +210,16 @@ function makeSpiedFactory(over: {
 		nativePushResolve: [],
 		nativePushProbe: [],
 		nativePushSend: [],
+		senderCalls: [],
+		events: [],
 	};
 	const opts: ProductionEntwurfV2Opts = {
-		senderProvider: () =>
-			over.noSender
-				? undefined
-				: { sessionId: "self", agentId: "pi/x", cwd: "/cwd", timestamp: "2026-06-13T00:00:00.000Z" },
+		senderProvider: () => {
+			spies.senderCalls.push(spies.senderCalls.length + 1);
+			spies.events.push("sender");
+			if (over.senderThrows) throw new Error("fake: sender envelope unavailable");
+			return over.noSender ? undefined : SENDER;
+		},
 		lockDir: LOCK_DIR,
 		sessionsDir: SESSIONS_DIR,
 		mailboxDir: MAILBOX_DIR,
@@ -231,14 +279,19 @@ function makeSpiedFactory(over: {
 			// two hands never resolve different adapters.
 			resolveNativePushAdapter: (backend: string): NativePushAdapter => {
 				spies.nativePushResolve.push(backend);
+				spies.events.push("resolve");
 				return {
-					id: "antigravity",
+					id: backend as NativePushAdapter["id"],
+					retriable: backend === "antigravity",
 					async probe(conv) {
 						spies.nativePushProbe.push({ conv });
+						spies.events.push("probe");
 						return over.nativePushProbe ?? { status: "dead", reason: "fake: no native-push probe configured" };
 					},
 					async send(route, conv, content) {
-						spies.nativePushSend.push({ lsAddress: route.lsAddress, conv, content });
+						const routeLabel = route.backend === "antigravity" ? route.lsAddress : route.socketPath;
+						spies.nativePushSend.push({ route: routeLabel, conv, content });
+						spies.events.push("send");
 					},
 				};
 			},
@@ -277,14 +330,14 @@ async function main(): Promise<void> {
 	{
 		const { deps, spies } = makeSpiedFactory({
 			backend: "antigravity",
-			nativePushProbe: { status: "alive", route: { lsAddress: "127.0.0.1:5599" } },
+			nativePushProbe: { status: "alive", route: { backend: "antigravity", lsAddress: "127.0.0.1:5599" } },
 		});
 		const result = await runEntwurfV2({ target: GID, intent: "fire-and-forget", message: "hi agy" }, deps);
 		ok("A3: antigravity ff → native-push delivered", result.kind === "executed" && result.transport === "native-push");
 		ok("A3: decider probed the native-push adapter once (decide side)", spies.nativePushProbe.length === 1);
 		ok("A3: executor sent via the native-push adapter once (execute side)", spies.nativePushSend.length === 1);
-		ok("A3: send used the DECIDER-probed route", spies.nativePushSend[0]?.lsAddress === "127.0.0.1:5599");
-		ok("A3: send carried the dispatch message", spies.nativePushSend[0]?.content === "hi agy");
+		ok("A3: send used the DECIDER-probed route", spies.nativePushSend[0]?.route === "127.0.0.1:5599");
+		ok("A3: send carried the dispatch message", spies.nativePushSend[0]?.content.includes("hi agy") === true);
 		ok(
 			"A3: BOTH hands resolved the SAME adapter (for 'antigravity')",
 			spies.nativePushResolve.length === 2 && spies.nativePushResolve.every((b) => b === "antigravity"),
@@ -292,6 +345,145 @@ async function main(): Promise<void> {
 		ok("A3: native-push is LOCK-FREE (no acquire)", spies.acquire.length === 0);
 		ok("A3: native-push did NOT enqueue a mailbox (not the unsupported path)", spies.enqueue.length === 0);
 	}
+	{
+		const { deps, spies } = makeSpiedFactory({
+			backend: "codex",
+			nativePushProbe: {
+				status: "alive",
+				route: { backend: "codex", socketPath: "/home/operator/.codex/app-server-control/app-server-control.sock" },
+			},
+		});
+		const result = await runEntwurfV2({ target: GID, intent: "fire-and-forget", message: "hi codex" }, deps);
+		ok(
+			"[QK:CODEX-NATIVE-PRODUCTION-WIRING] Codex ff → native-push delivered",
+			result.kind === "executed" && result.transport === "native-push",
+		);
+		ok(
+			"A3c: both hands resolve the Codex adapter",
+			spies.nativePushResolve.length === 2 && spies.nativePushResolve.every((b) => b === "codex"),
+		);
+		ok(
+			"A3c: planted Codex UDS reaches the send hand",
+			spies.nativePushSend[0]?.route.endsWith("/app-server-control.sock") === true,
+		);
+		ok(
+			"A3c: Codex native-push remains lock-free and mailbox-free",
+			spies.acquire.length === 0 && spies.enqueue.length === 0,
+		);
+	}
+	// ── A3d (#95): the native-push rail injects the MAILBOX-SERIALIZED sender envelope ──
+	// Measured in the #95 A LIVE run: a nonce-only fresh-call callback direct-injected into a
+	// Codex thread arrived as bare text, so the receiving citizen could not name who called it
+	// and the callback was uncorrelatable. Direct injection has neither the control socket's RPC
+	// framing nor a mailbox file, so the envelope must ride IN the body — the same bytes
+	// `formatMetaMailboxBody` gives the mailbox rail. ONE rail: both native-push backends, no
+	// per-backend branch.
+	{
+		const route = { backend: "antigravity", lsAddress: "127.0.0.1:5599" } as const;
+		const { deps, spies } = makeSpiedFactory({
+			backend: "antigravity",
+			nativePushProbe: { status: "alive", route },
+		});
+		const { result, executeEvents } = await runInTwoPhases(
+			{ target: GID, intent: "fire-and-forget", message: "hi agy", wantsReply: true },
+			deps,
+			spies,
+		);
+		// WIRING FIRST, and it is its own claim: the factory must hand the native-push hand the
+		// SAME `opts.senderProvider` the mailbox hand gets. A render that is reachable but never
+		// fed falls back to raw silently, so "the provider was consulted exactly once on this
+		// rail" is asserted BEFORE the body is compared — that way a dropped wiring fails here
+		// at its own QK instead of borrowing the envelope claim's failure.
+		ok(
+			"[QK:NATIVE-PUSH-SENDER-PROVIDER-WIRING] the factory fed the native-push hand its one senderProvider, exactly once",
+			result.kind === "executed" && spies.senderCalls.length === 1,
+		);
+		ok(
+			"[QK:NATIVE-PUSH-SENDER-ENVELOPE] agy direct injection carries the mailbox-serialized trusted envelope",
+			spies.nativePushSend[0]?.content === formatMetaMailboxBody(SENDER, "hi agy", true),
+		);
+		ok(
+			"A3d: the enveloped body is NOT the raw plan message (an envelope was actually added)",
+			spies.nativePushSend[0]?.content !== "hi agy",
+		);
+		ok(
+			"A3d: wants_reply rides the envelope on this rail",
+			spies.nativePushSend[0]?.content.includes("wants reply: yes") === true,
+		);
+		// ORDER, not counts. The envelope must be resolved BEFORE the adapter is resolved or
+		// touched. Counts would be identical if the hand resolved the adapter first and the
+		// provider second — but then a provider throw would land after the adapter was already
+		// in hand, and the safety claim ("a failing envelope source injects nothing") would
+		// rest on luck rather than sequence.
+		ok(
+			"[QK:NATIVE-PUSH-SENDER-BEFORE-ADAPTER] the send hand resolves the envelope, THEN the adapter, THEN sends",
+			JSON.stringify(executeEvents) === JSON.stringify(["sender", "resolve", "send"]),
+		);
+	}
+	{
+		// Same rail, other backend — codex renders identically. A backend branch would show here.
+		const route = {
+			backend: "codex",
+			socketPath: "/home/operator/.codex/app-server-control/app-server-control.sock",
+		} as const;
+		const { deps, spies } = makeSpiedFactory({ backend: "codex", nativePushProbe: { status: "alive", route } });
+		const result = await runEntwurfV2({ target: GID, intent: "fire-and-forget", message: "hi codex" }, deps);
+		ok(
+			"A3d: codex direct injection carries the SAME mailbox-serialized envelope (one rail, no backend branch)",
+			result.kind === "executed" &&
+				spies.nativePushSend[0]?.content === formatMetaMailboxBody(SENDER, "hi codex", false),
+		);
+		ok("A3d: the codex body is NOT the raw plan message either", spies.nativePushSend[0]?.content !== "hi codex");
+		ok("A3d: codex resolved the envelope EXACTLY once", spies.senderCalls.length === 1);
+	}
+	{
+		// #50 C3 parity: no authoritative sender → the raw message is preserved, never a
+		// fabricated envelope. This is the same fallback the mailbox hand has.
+		const { deps, spies } = makeSpiedFactory({
+			backend: "codex",
+			noSender: true,
+			nativePushProbe: {
+				status: "alive",
+				route: { backend: "codex", socketPath: "/home/operator/.codex/app-server-control/app-server-control.sock" },
+			},
+		});
+		const result = await runEntwurfV2({ target: GID, intent: "fire-and-forget", message: "raw only" }, deps);
+		ok(
+			"A3d: no authoritative sender → the RAW message is injected, no fabricated envelope",
+			result.kind === "executed" && spies.nativePushSend[0]?.content === "raw only",
+		);
+	}
+	{
+		// A throwing provider must reject the send with NOTHING injected — a half-delivered
+		// conversation is worse than a rejected dispatch. No new reject reason, no fallback.
+		const { deps, spies } = makeSpiedFactory({
+			backend: "codex",
+			senderThrows: true,
+			nativePushProbe: {
+				status: "alive",
+				route: { backend: "codex", socketPath: "/home/operator/.codex/app-server-control/app-server-control.sock" },
+			},
+		});
+		const { result, executeEvents } = await runInTwoPhases(
+			{ target: GID, intent: "fire-and-forget", message: "never sent" },
+			deps,
+			spies,
+		);
+		ok(
+			"A3d: a throwing sender provider fails the dispatch EXACTLY as execution-failed",
+			result.kind === "execution-failed",
+		);
+		ok("A3d: a throwing sender provider called its provider exactly once", spies.senderCalls.length === 1);
+		ok("A3d: a throwing sender provider never resolved the adapter", executeEvents.includes("resolve") === false);
+		ok("A3d: a throwing sender provider injected NOTHING", spies.nativePushSend.length === 0);
+		// The whole execute phase is ONE event: the envelope source was asked, it failed, and the
+		// target's conversation was never reached. No partial delivery, no adapter in hand.
+		ok(
+			"A3d: the failed execute phase is exactly ['sender'] — nothing downstream ran",
+			JSON.stringify(executeEvents) === JSON.stringify(["sender"]),
+		);
+	}
+
 	{
 		// antigravity + dead probe → reject native-push-target-dead, NO send.
 		const { deps, spies } = makeSpiedFactory({

package/scripts/check-entwurf-v2-runner.ts

@@ -101,7 +101,7 @@ const NATIVE_PUSH_PLAN: NativePushPlan = {
 	targetGardenId: GID,
 	backend: "antigravity",
 	nativeSessionId: "conv-xyz",
-	route: { lsAddress: "127.0.0.1:5599" },
+	route: { backend: "antigravity", lsAddress: "127.0.0.1:5599" },
 	wantsReply: false,
 	message: "m",
 };

package/scripts/check-entwurf-v2-surface.ts

@@ -729,7 +729,7 @@ async function main(): Promise<void> {
 			v2Start !== -1 && after > v2Start,
 		);
 		const v2Block = src.slice(v2Start, after);
-		ok("5: MCP — v2 handler builds buildSendSenderEnvelope()", /buildSendSenderEnvelope\(\)/.test(v2Block));
+		ok("5: MCP — v2 handler builds buildSendSenderEnvelope(context)", /buildSendSenderEnvelope\s*\(/.test(v2Block));
 		ok("5: MCP — v2 handler passes senderProvider: () => sender", /senderProvider:\s*\(\)\s*=>\s*sender/.test(v2Block));
 		ok(
 			"5: MCP — v2 handler calls runAndRenderEntwurfV2FromSurface",

package/scripts/check-gate-qualification.ts

@@ -832,9 +832,12 @@ let manifestCount: number;
 		"bridge-boot-resume": 3,
 		"bridge-command-boot": 9,
 		"capability-cache": 3,
+		"codex-native": 68,
+		"compaction-send-guard": 7,
 		"copilot-birth": 19,
 		"copilot-launch": 14,
 		"copilot-receive": 20,
+		"entwurf-peers": 1,
 		"fresh-cut": 3,
 		"gate-qualification": 2,
 		"meta-facts": 4,
@@ -842,23 +845,23 @@ let manifestCount: number;
 		"meta-identity": 4,
 		"meta-retire": 3,
 		"mux-boundary": 16,
-		"mux-fresh-call": 44,
+		"mux-fresh-call": 45,
 		"mux-launcher-fence": 7,
 		"mux-parent-artifact": 3,
 		"pack-install": 2,
-		"pi-package-ownership": 6,
+		"pi-package-ownership": 8,
 		"mux-resume-call": 12,
 		"omp-birth": 13,
 		"omp-fresh": 24,
 		"omp-receive": 11,
 		"probe-ordering": 1,
-		"release-gate": 18,
+		"release-gate": 19,
 		"resume-args": 6,
 		"resume-launch-identity": 6,
 		"self-address": 5,
 		"setup-verdict": 14,
 		"source-install": 2,
-		"v2-surface": 7,
+		"v2-surface": 11,
 		"v2-visible-resume": 17,
 	};
 	const laneTally: Record<string, number> = {};

package/scripts/check-harness-admission-parity.ts

@@ -81,7 +81,6 @@ const PRE_82_LEGACY: Partial<Record<MetaCitizenBackend, [file: string, sentence:
 		"DELIVERY.md",
 		"Admitted before the #82 step 9 contract and not re-evaluated under it, so it is legacy citizen evidence, not a step-9 supported harness",
 	],
-	codex: ["DELIVERY.md", "No owned native-citizen install/invocation lane."],
 };
 
 const fresh = new Set<string>(FRESH_CALL_BACKENDS);