@junghanacs/entwurf 0.20.1 → 0.22.0

package/pi-extensions/lib/mux-fresh-call.ts

@@ -1,7 +1,9 @@
 /**
  * mux-fresh-call — open ONE visible sibling in the caller's own tmux server (its own session by
  * default, or one named existing session on that server since #105), hand it its first task in
- * the launch argv, and let it name itself back to the caller.
+ * the launch argv, and let it name itself back to the caller. A Codex CALLER is the one measured
+ * exception to "the caller's own session": it opens beside its own TUI pane, found by that
+ * pane's terminal title (#95 lane B), never by a TUI guess.
  *
  * ── Why this is a third module and not a parameter on the leaf ──
  *
@@ -38,6 +40,14 @@
  *     byte-identical to the pre-#73 shape. Anything else is taken LITERALLY — no trim, no
  *     realpath, no project-name resolution, no store/peers/record lookup. The caller is the
  *     only cwd authority this module knows.
+ *   - when a CODEX caller omits it, the surface supplies that citizen's own record cwd and it
+ *     becomes an explicit `-c` (#95 lane C). This is not a second authority: it is the same
+ *     caller, named more precisely, because a codex caller's PROCESS directory is the
+ *     operator-owned app-server's rather than its own. Every other caller keeps the inherited
+ *     directory and an unchanged argv.
+ *   - the chosen value reaches codex TWICE, and that is one value with two carriers rather than
+ *     two inputs: tmux `-c` places the pane, and codex `-C` places the THREAD, which a
+ *     `--remote` attachment would otherwise take from the app-server (see `buildBackendArgs`).
  *   - the value is classified by the shared `classify-tmux-cwd.ts` leaf BEFORE any mutation
  *     (same four stable reasons as resume; the measured tmux 3.6a facts live on that leaf).
  *     This module's hints phrase them as the REQUESTED cwd; resume's say RECORDED.
@@ -78,6 +88,19 @@
 
 import { randomBytes } from "node:crypto";
 import { classifyTmuxCwd, type TmuxCwdRejectReason } from "./classify-tmux-cwd.ts";
+import {
+	CODEX_CALLER_SEAT_HINT,
+	type CodexCallerSeatRejectReason,
+	resolveCodexCallerSeat,
+} from "./codex-caller-seat.ts";
+import {
+	CODEX_CALLER_PREFLIGHT_HINT,
+	CODEX_LAUNCH_CWD_PREFLIGHT_HINT,
+	CODEX_PREFLIGHT_HINT,
+	type CodexCallerPreflightRejectReason,
+	type CodexPreflightRejectReason,
+	codexLaunchCwdFreshPreflight,
+} from "./codex-fresh-preflight.ts";
 import {
 	COPILOT_PREFLIGHT_HINT,
 	type CopilotPreflightRejectReason,
@@ -100,15 +123,16 @@ import {
 	runTmux,
 	type WindowHandle,
 } from "./mux-placement.ts";
+import { resolveCodexDefaultSocketPath } from "./native-push/codex-ws-client.ts";
 import { OMP_PREFLIGHT_HINT, type OmpPreflightRejectReason, ompFreshPreflight } from "./omp-fresh-preflight.ts";
 import { classifyTmuxSessionName, resolveTmuxSessionId, type TmuxSessionRejectReason } from "./resolve-tmux-session.ts";
 
 /** The backends this rail can open. Fixed set, not a profile — a further one is a decision,
- * not a config entry. `copilot` was added by #82 RAIL 9 under the step 9 admission contract, and
- * `omp` by #87 Bundle C under the same one. The set is joined to the citizen backends by
- * `check-harness-admission-parity`: a harness that mints records but is missing HERE is not an
- * unwired convenience, it is a release blocker. */
-export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp"] as const;
+ * not a config entry. `copilot` was added by #82 RAIL 9, `omp` by #87 Bundle C, and `codex`
+ * by #95 after its system birth and app-server rails were measured. The set is joined to the
+ * citizen backends by `check-harness-admission-parity`: a harness that mints records but is
+ * missing HERE is not an unwired convenience, it is a release blocker. */
+export const FRESH_CALL_BACKENDS = ["pi", "claude-code", "copilot", "omp", "codex"] as const;
 export type FreshCallBackend = (typeof FRESH_CALL_BACKENDS)[number];
 
 /**
@@ -138,6 +162,7 @@ export const FRESH_CALL_RUNTIME: Record<FreshCallBackend, string> = {
 	"claude-code": "claude",
 	copilot: "entwurf",
 	omp: "omp",
+	codex: "codex",
 };
 
 /**
@@ -166,6 +191,7 @@ export const FRESH_CALL_CALLBACK_TOOL: Record<FreshCallBackend, string> = {
 	"claude-code": "mcp__entwurf-bridge__entwurf_v2",
 	copilot: "entwurf-bridge-entwurf_v2",
 	omp: "mcp__entwurf_bridge_entwurf_v",
+	codex: "mcp__entwurf_bridge__entwurf_v2",
 };
 
 /** Mirrors the `entwurf_v2` message bound. This is an INTERFACE cap for symmetry with the
@@ -271,11 +297,37 @@ export function isSafeFreshCallModel(model: string): boolean {
  * have needed its own quoting, its own lifetime and its own refusal rules; argv already owns
  * all three. This is deliberately NOT a general `--flag value` passthrough — an arbitrary
  * carrier would hand callers the launch-shaping power this rail exists to refuse.
+ *
+ * CODEX ALONE CARRIES A DIRECTORY IN ITS ARGV, AND OMITTING IT IS A WRONG ANSWER RATHER THAN A
+ * NEUTRAL ONE. `[source rust-v0.153.4]` an explicit `--remote <endpoint>` — which this argv
+ * always passes — resolves to `AppServerTarget::Remote` (`codex-rs/tui/src/lib.rs:875-876`;
+ * `LocalDaemon` is only the IMPLICIT no-flag reuse path), and a Remote target takes its new
+ * thread's directory from `remote_cwd_override` ALONE: `thread_cwd_from_config`
+ * (`codex-rs/tui/src/app_server_session.rs:2022-2033`) answers `None` without it, and the
+ * app-server then opens the thread in ITS OWN directory. That override is exactly `-C/--cd`,
+ * retained only for a remote target (`codex-rs/tui/src/startup_orchestration.rs:191-194`), and
+ * the flag lives on the shared interactive options this argv already uses for
+ * `--dangerously-bypass-approvals-and-sandbox` (`codex-rs/utils/cli/src/shared_options.rs:53-68`)
+ * — not only on the `agents` subcommand that also spells it (`codex-rs/cli/src/main.rs:334`).
+ *
+ * `[측정 2026-09-16]` with the flag absent, three citizens of one chain (pi → Codex → Claude
+ * Code) all recorded the app-server's `~/repos/gh/entwurf` while the panes themselves sat in
+ * `~/repos/gh/agent-config`, and the birth hook wrote that vendor-supplied cwd into each record
+ * honestly (#95 lane C §1). So the token is ALWAYS present for codex: ONE directory, TWO
+ * CARRIERS — tmux `-c` places the PANE, codex `-C` places the THREAD, and `launchCwd` is the
+ * single value both receive. It is not a new input axis: the value is chosen by the cwd rules
+ * this module already has, one layer up.
  */
 export function buildBackendArgs(
 	backend: FreshCallBackend,
 	composition: FreshCallComposition,
 	model: string,
+	env: NodeJS.ProcessEnv = process.env,
+	/** Where the sibling will actually start: the directory `freshCall` chose when it chose one,
+	 * and otherwise THIS process's own — which is what tmux gives a window opened with no `-c`
+	 * (`[측정 ×2]`, module header). The default is that inherited fact rather than a
+	 * convenience, so a caller that omits it still names the truth to codex. */
+	launchCwd: string = process.cwd(),
 ): string[] {
 	switch (backend) {
 		case "pi":
@@ -286,11 +338,22 @@ export function buildBackendArgs(
 			return ["copilot", "--interactive", composition.prompt, "--model", model, "--yolo"];
 		case "omp":
 			return [`--${OMP_BOOTSTRAP_FLAG}`, composition.bootstrapPayload, "--model", model, "--approval-mode", "yolo"];
+		case "codex":
+			return [
+				"--remote",
+				`unix://${resolveCodexDefaultSocketPath(env)}`,
+				"-C",
+				launchCwd,
+				"--model",
+				model,
+				"--dangerously-bypass-approvals-and-sandbox",
+				composition.prompt,
+			];
 	}
 }
 
 /**
- * What a launch has to say, in the two shapes the four backends need. Three of them are
+ * What a launch has to say, in the two shapes the five backends need. Four of them are
  * handed a first-turn PROMPT; omp is handed a bootstrap PAYLOAD its own installed extension
  * unpacks. Both are always built, because building one is cheap and a backend switch must
  * never be able to reach a field that was not composed.
@@ -375,6 +438,9 @@ export type FreshCallRejectReason =
 	| TmuxSessionRejectReason
 	| CopilotPreflightRejectReason
 	| OmpPreflightRejectReason
+	| CodexPreflightRejectReason
+	| CodexCallerPreflightRejectReason
+	| CodexCallerSeatRejectReason
 	| "caller-identity-unavailable"
 	| "model-empty"
 	| "model-invalid"
@@ -389,20 +455,66 @@ export interface FreshCallPlacement {
 	tmuxSession: string;
 }
 
+/** Which rule chose the start directory. Mirrors `FreshCallSeatSource` deliberately: one axis,
+ * one NAMED source, and no third value that means "we worked it out". `codex-caller-record` is
+ * the codex caller's own record cwd, consulted only when the caller requested none (#95 lane C).
+ */
+export type FreshCallCwdSource = "requested" | "codex-caller-record";
+
+export type FreshCallSeatSource = "requested" | "codex-title-anchor";
+export interface FreshCallSeat {
+	tmuxSession: string;
+	source: FreshCallSeatSource;
+}
+
+/**
+ * WHICH RULE PICKS THE TARGET SESSION. Three in strict order, and the order is the contract:
+ *
+ *   1. an explicit `placement` — the expert override, and it wins over everything below.
+ *   2. a CODEX CALLER with placement omitted — the sibling opens beside the caller's own TUI
+ *      pane, found by the title anchor (#95 lane B). This one is NOT a named seat and is
+ *      therefore not decided here: it resolves to a native `$id` with no name in between, so
+ *      `freshCall` owns it directly (see the anchor step below) and this function answers
+ *      `null` so the name grammar and the name→id lookup stay out of a path that has neither.
+ *   3. anything else — the caller's own session, with no named seat at all.
+ *
+ * THE SEAT FOLLOWS THE CALLER, NEVER THE BACKEND BEING OPENED. #95 first shipped a fourth rule —
+ * an omitted-placement Codex TARGET selected a fixed existing session named `codex`, where the
+ * operator seated the app-server and their TUIs — and #95 D1 retired it (GLG, 2026-09-16). It
+ * was a workaround for a mapping that did not exist yet: nothing could find the pane a Codex
+ * caller was sitting in, so the operator was asked to keep every Codex in one known room. Rule 2
+ * is that mapping, so the room is no longer load-bearing, and keeping it would have meant Codex
+ * alone answering "where does a sibling open?" differently from every other backend. The
+ * operator-owned app-server keeps its own seat wherever the operator puts it; Entwurf still
+ * never creates, moves or supervises it.
+ */
+export function selectFreshCallSeat(placement: FreshCallPlacement | undefined): FreshCallSeat | null {
+	if (placement !== undefined) return { tmuxSession: placement.tmuxSession, source: "requested" };
+	return null;
+}
+
 /** Coordinates plus what was handed to tmux. Read `runtimePath` as "what we asked to start".
  * There is deliberately NO field here for the callback, the nonce's arrival, or the sibling's
  * garden id — see the module header. */
 export interface FreshCallReceipt extends WindowHandle {
 	backend: FreshCallBackend;
 	model: string;
-	/** The REQUESTED start directory — present only when the caller supplied one. The same kind
-	 * of fact as `runtimePath`: what tmux was asked for, never an observation of where the pane
-	 * landed. */
+	/** The start directory this launch CHOSE — present only when one was chosen: the caller's
+	 * requested cwd, or a codex caller's own record cwd when it requested none. The same kind of
+	 * fact as `runtimePath`: what tmux was asked for, never an observation of where the pane
+	 * landed. ABSENT means no directory was named at all and the pane inherits this process's —
+	 * that inheritance is not invented into a receipt field here. */
 	cwd?: string;
-	/** The REQUESTED session name — present only when the caller named a seat. The RESOLVED
-	 * target is the inherited `sessionId`, which is the session the window is actually in; this
-	 * field is the request that produced it, exactly as `cwd` is. */
+	/** Which rule chose `cwd`. Present exactly when `cwd` is. */
+	cwdSource?: FreshCallCwdSource;
+	/** The caller-REQUESTED session name. The RESOLVED target is the inherited `sessionId`, which
+	 * is the session the window is actually in. Absent for `codex-title-anchor`, which has no
+	 * name to echo: a caller's own pane was OBSERVED, not requested by name, and inventing one
+	 * here would report a seat the caller never named. */
 	tmuxSession?: string;
+	/** Which rule selected the target session. Absent exactly when the caller's own session was
+	 * used with no seat rule at all. */
+	tmuxSessionSource?: FreshCallSeatSource;
 	runtimePath: string;
 	nonce: string;
 }
@@ -435,9 +547,9 @@ function defaultRandomHex(): string {
  * for. That is sufficient and not a compromise: every reader of the carrier trims and tests
  * truthiness (`index.ts:212-217`), so empty and absent are the same answer by construction.
  *
- * It is applied to all four backends because the leak is a property of tmux, not of a vendor. A
+ * It is applied to all five backends because the leak is a property of tmux, not of a vendor. A
  * scrub only on the backend whose measurement surfaced it would encode the claim that the other
- * three are immune, which is false. It costs the legitimate case nothing: a carrier is only ever
+ * four are immune, which is false. It costs the legitimate case nothing: a carrier is only ever
  * authoritative when the process that owns it exported it ITSELF, and a fresh `pi` sibling does
  * exactly that after this argv has run. This is a fixed two-variable seam and deliberately NOT a
  * general env carrier — an arbitrary `-e` passthrough would hand callers the environment-shaping
@@ -492,6 +604,20 @@ export function buildFreshCallArgs(
  * `callerGardenId` is supplied by the SURFACE that registered this tool, from its own
  * record-backed context. It is not a tool parameter and this module never derives, validates
  * against a store, or guesses it: an empty value is a named refusal, not a lookup.
+ *
+ * `callerNativeSessionId` is supplied by the same surface under the same rule, and its PRESENCE
+ * is the whole signal: it is set exactly when the reconciled sender is a record-backed codex
+ * citizen, and it carries that citizen's `nativeSessionId` (the `_meta.threadId` the vendor put
+ * on this very request). This module never resolves it, never reads `_meta`, and never asks a
+ * store who is calling — it only turns a thread id into a pane, and only for placement.
+ *
+ * `callerCwd` rides the same surface rule and the same condition: it is that codex citizen's
+ * RECORD cwd, and it exists because a codex caller's process directory is NOT its own (the
+ * bridge runs as a child of the operator-owned app-server, so the directory that process
+ * reports is the app-server's — #95 lane C §2). It is consulted only when the caller requested
+ * no cwd, so an
+ * explicit request always wins, and this module never looks a cwd up, resolves it, or infers it
+ * from a seat, a workspace map or a project name.
  */
 export function freshCall(
 	params: {
@@ -501,6 +627,8 @@ export function freshCall(
 		cwd?: string;
 		placement?: FreshCallPlacement;
 		callerGardenId: string | null;
+		callerNativeSessionId?: string;
+		callerCwd?: string;
 	},
 	env: NodeJS.ProcessEnv = process.env,
 	nonce: string = mintNonce(),
@@ -516,8 +644,27 @@ export function freshCall(
 	if (task.length > TASK_MAX_CHARS) return { ok: false, reason: "task-too-long" };
 	// ONLY `undefined` and the exact empty string mean "no cwd". Everything else is the literal
 	// value — deliberately untrimmed, so a whitespace-mangled path is refused loudly by the
-	// classification below instead of being silently repaired into a different directory.
-	const cwd = params.cwd === undefined || params.cwd === "" ? undefined : params.cwd;
+	// classification below instead of being silently repaired into a different directory. The
+	// caller's own record directory answers the SAME two-value emptiness rule and is consulted
+	// ONLY second: an explicit request always wins, and a caller that supplies neither leaves the
+	// pane to inherit this process's directory exactly as before — a pi caller's argv is
+	// byte-identical, because its process directory IS its own and a `-c` token would change
+	// nothing about where that window lands.
+	const requestedCwd = params.cwd === undefined || params.cwd === "" ? undefined : params.cwd;
+	const callerCwd = params.callerCwd === undefined || params.callerCwd === "" ? undefined : params.callerCwd;
+	const chosenCwd: { value: string; source: FreshCallCwdSource } | undefined =
+		requestedCwd !== undefined
+			? { value: requestedCwd, source: "requested" }
+			: callerCwd !== undefined
+				? { value: callerCwd, source: "codex-caller-record" }
+				: undefined;
+	const cwd = chosenCwd?.value;
+	// SEAM (#95 lane C): a caller-record directory is classified by the SAME shared leaf and
+	// answers the same four `cwd-*` reasons, whose hint text says REQUESTED. When a codex
+	// caller's recorded directory has since been deleted, the repair that hint points at is
+	// still the right one — that directory does not exist — but the noun belongs to the caller
+	// rather than to the request. Kept shared on purpose: doubling the reason set for a wording
+	// difference would double the refusal contract two surfaces and one leaf already agree on.
 	if (cwd !== undefined) {
 		const badCwd = classifyTmuxCwd(cwd);
 		if (badCwd) return { ok: false, reason: badCwd };
@@ -526,8 +673,11 @@ export function freshCall(
 	// without tmux, so an unresolvable name is answered before anything else runs. Whether that
 	// session EXISTS is a tmux question and is asked below, after the caller's own context is
 	// proven — a name check that needed a live server would refuse for the wrong reason on a
-	// host with no tmux at all.
-	const seat = params.placement?.tmuxSession;
+	// host with no tmux at all. An explicit seat is an expert override and is reported as such; a
+	// CODEX CALLER's own pane is deliberately not a name at all, so it is absent here and
+	// resolved after the context proof below — see `selectFreshCallSeat` for the three-rule order.
+	const selectedSeat = selectFreshCallSeat(params.placement);
+	const seat = selectedSeat?.tmuxSession;
 	if (seat !== undefined) {
 		const badSeat = classifyTmuxSessionName(seat);
 		if (badSeat) return { ok: false, reason: badSeat };
@@ -555,7 +705,6 @@ export function freshCall(
 		const missing = ompFreshPreflight(env);
 		if (missing) return { ok: false, reason: missing };
 	}
-
 	const inspected = inspectPlacement(env);
 	if (!inspected.ok) return { ok: false, reason: inspected.reason };
 	const placement = inspected.placement;
@@ -566,10 +715,24 @@ export function freshCall(
 	// native id continues; the name does not travel past this line. STILL PRE-MUTATION: an
 	// absent seat refuses with no window anywhere.
 	let targetSessionId = placement.sessionId;
+	let anchoredSeat = false;
 	if (seat !== undefined) {
 		const resolved = resolveTmuxSessionId(seat, (args) => runTmux(args, env));
 		if (!resolved.ok) return { ok: false, reason: resolved.reason };
 		targetSessionId = resolved.sessionId;
+	} else if (params.placement === undefined && params.callerNativeSessionId !== undefined) {
+		// Rule 2: the caller is a codex citizen and named no seat, so the sibling belongs beside
+		// the caller's own TUI. The pane is found by the title anchor and ONLY its `$session`
+		// continues — a pane title is forgeable, so it may never become an address, a liveness
+		// claim or a delivery input (Hard Rule 16). `params.placement` is re-read here rather
+		// than inferred from `seat === undefined`: "an explicit seat always wins" is the one
+		// invariant a later edit must not be able to lose by accident.
+		// STILL PRE-MUTATION: 0 or 2+ matching panes refuse with no window anywhere and no
+		// fallback to any other session.
+		const anchor = resolveCodexCallerSeat(params.callerNativeSessionId, (args) => runTmux(args, env));
+		if (!anchor.ok) return { ok: false, reason: anchor.reason };
+		targetSessionId = anchor.seat.sessionId;
+		anchoredSeat = true;
 	}
 
 	const composition: FreshCallComposition = {
@@ -581,10 +744,38 @@ export function freshCall(
 		}),
 		bootstrapPayload: buildOmpBootstrapPayload({ callerGardenId: params.callerGardenId, nonce, task }),
 	};
-	const run = runTmux(
-		buildFreshCallArgs(targetSessionId, runtimePath, buildBackendArgs(params.backend, composition, model), cwd),
-		env,
-	);
+	const backendArgs = buildBackendArgs(params.backend, composition, model, env, cwd);
+	// THE LAUNCH-DIRECTORY NOTE, AND IT IS A DIAGNOSTIC RATHER THAN A GATE. `[측정 2026-09-16]` a
+	// Codex sibling opened into a directory this Codex has no answer for stops on the vendor's
+	// folder-consent screen: no first turn, no rollout, no callback. It is tempting to refuse
+	// that, and refusing is the wrong product. The consent screen is SELF-REPAIRING when a human
+	// is there — one answer and the vendor records the directory, so every later launch runs —
+	// and an operator at the keyboard is exactly who a visible-first rail is built for. A refusal
+	// would replace that one answer with "no window, go run codex yourself, then call again", and
+	// it would have to be right about a decision this process cannot fully see (the vendor merges
+	// system, managed and cloud layers around the file this leaf reads). So the launch proceeds
+	// and says what it saw.
+	//
+	// The UNATTENDED case is not answered here and must not be: a gate with nobody at the keyboard
+	// needs its precondition named before it spends a model turn, which is its own oracle's job —
+	// `smoke-codex-fresh-live` asserts this same leaf up front, so a missing answer reads as a
+	// named precondition instead of a callback timeout.
+	//
+	// The directory asked about is READ BACK off codex's own `-C` token rather than recomputed:
+	// one resolution, one authority, and no way for the note to name a directory the thread will
+	// not start in (this module is deliberately not allowed to resolve the inherited default a
+	// second time — `FRESHCALL-CWD-CALLER-ONLY`).
+	if (params.backend === "codex") {
+		const at = backendArgs.indexOf("-C");
+		const launchCwd = backendArgs[at + 1] ?? "";
+		const unanswered = codexLaunchCwdFreshPreflight(env, launchCwd);
+		if (unanswered) {
+			console.error(
+				`[fresh-call] ${unanswered}: ${launchCwd}\n` + `            ${CODEX_LAUNCH_CWD_PREFLIGHT_HINT[unanswered]}`,
+			);
+		}
+	}
+	const run = runTmux(buildFreshCallArgs(targetSessionId, runtimePath, backendArgs, cwd), env);
 	assertTmuxOk("new-window", run);
 
 	let fields: ReturnType<typeof parseWindowFields>;
@@ -609,8 +800,12 @@ export function freshCall(
 			...fields,
 			backend: params.backend,
 			model,
-			...(cwd === undefined ? {} : { cwd }),
-			...(seat === undefined ? {} : { tmuxSession: seat }),
+			...(chosenCwd === undefined ? {} : { cwd: chosenCwd.value, cwdSource: chosenCwd.source }),
+			...(selectedSeat === null
+				? anchoredSeat
+					? { tmuxSessionSource: "codex-title-anchor" as const }
+					: {}
+				: { tmuxSession: selectedSeat.tmuxSession, tmuxSessionSource: selectedSeat.source }),
 			runtimePath,
 			nonce,
 		},
@@ -624,6 +819,9 @@ const REJECT_HINT: Record<FreshCallRejectReason, string> = {
 	// the sentence an operator reads cannot drift away from the predicate that produced it.
 	...COPILOT_PREFLIGHT_HINT,
 	...OMP_PREFLIGHT_HINT,
+	...CODEX_PREFLIGHT_HINT,
+	...CODEX_CALLER_PREFLIGHT_HINT,
+	...CODEX_CALLER_SEAT_HINT,
 	"no-tmux-context": "this agent is not running inside tmux, so there is no session to open a sibling beside",
 	"anchor-malformed": "TMUX_PANE is not a native pane id",
 	"anchor-unresolved": "tmux resolved no pane for this agent's anchor",
@@ -675,10 +873,16 @@ export function renderFreshCall(result: FreshCallResult): { text: string; isErro
 			`[entwurf fresh call →]\n` +
 			`  backend:  ${r.backend} (${r.runtimePath})\n` +
 			`  model:    ${r.model} (requested on the runtime CLI)\n` +
-			(r.cwd === undefined ? "" : `  cwd:      ${r.cwd} (requested start directory — not an observation)\n`) +
-			(r.tmuxSession === undefined
+			(r.cwd === undefined
+				? ""
+				: r.cwdSource === "codex-caller-record"
+					? `  cwd:      ${r.cwd} (the Codex caller's own record directory, used because no cwd was requested — not an observation)\n`
+					: `  cwd:      ${r.cwd} (requested start directory — not an observation)\n`) +
+			(r.tmuxSessionSource === undefined
 				? ""
-				: `  seat:     ${r.tmuxSession} (requested tmux session, resolved to ${r.sessionId})\n`) +
+				: r.tmuxSessionSource === "codex-title-anchor"
+					? `  seat:     ${r.sessionId} (the Codex caller's own pane, found by its thread-id terminal title — an OBSERVED session, not a requested name)\n`
+					: `  seat:     ${r.tmuxSession} (requested tmux session, resolved to ${r.sessionId})\n`) +
 			`  window:   ${r.windowId} (index ${r.windowIndex}) in session ${r.sessionId}\n` +
 			`  pane:     ${r.paneId} pid ${r.panePid}\n` +
 			`  nonce:    ${r.nonce}\n` +

package/pi-extensions/lib/native-push/adapter.ts

@@ -1,7 +1,7 @@
 /**
  * native-push adapter rail — the transport LEAF by which a native-push backend
- * (antigravity, the first) is (1) probed for a LIVE conversation and (2) direct-injected
- * with a message. Mirrors the ACP backend-adapter rail (acp/backend-adapter.ts §ADAPTERS
+ * is (1) probed for a LIVE native target and (2) direct-injected with a message.
+ * Mirrors the ACP backend-adapter rail (acp/backend-adapter.ts §ADAPTERS
  * /resolveAcpBackendAdapter): one interface, one registry, a fail-fast resolver.
  *
  * Purity contract (봉인 3):
@@ -26,6 +26,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 
 import type { NativePushBackend } from "../entwurf-v2-contract.ts";
+import { codexNativePushAdapter } from "./codex-ws-client.ts";
 
 // ── runner seam (injectable process exec) ───────────────────────────────────
 
@@ -85,14 +86,13 @@ export const realNativePushRunner: NativePushRunner = {
 // ── route + probe result ────────────────────────────────────────────────────
 
 /**
- * A VOLATILE native-push route — the live LS address (`127.0.0.1:PORT`) a probe found
- * serving the conversation. MUST NOT be stored (봉인 3): it is re-derived every dispatch
- * by a fresh probe (the LS port is per-process and shifts). Carried only within a single
- * `send` call, handed straight from a fresh `probe`.
+ * A VOLATILE native-push route. Antigravity carries its live LS address; Codex carries
+ * the one app-server UDS that proved the target thread loaded. Routes are never stored:
+ * every dispatch derives one from a fresh probe and hands it straight to `send`.
  */
-export interface NativePushRoute {
-	readonly lsAddress: string;
-}
+export type NativePushRoute =
+	| { readonly backend: "antigravity"; readonly lsAddress: string }
+	| { readonly backend: "codex"; readonly socketPath: string };
 
 /**
  * A probe outcome. `alive` carries the volatile route; `dead`/`indeterminate` carry a
@@ -108,17 +108,12 @@ export type NativePushProbeResult =
 export interface NativePushAdapter {
 	/** Backend discriminator (a member of NATIVE_PUSH_BACKENDS). */
 	readonly id: NativePushBackend;
-	/**
-	 * Full-scan probe: find a LIVE route serving `nativeSessionId`, else report
-	 * dead/indeterminate. Scans EVERY host pid (never `head -1`) and re-discovers the
-	 * route on every call (no cache — volatile-route discipline, 봉인 3).
-	 */
+	/** Whether the executor may re-probe and retry once after an ambiguous send failure.
+	 * Codex is false: `codex queue` may accept before its receipt fails, so retry can duplicate. */
+	readonly retriable: boolean;
+	/** Probe the backend's current native route for `nativeSessionId`. */
 	probe(nativeSessionId: string): Promise<NativePushProbeResult>;
-	/**
-	 * Direct-inject `content` into the conversation over `route`. Single attempt: throws
-	 * on failure (fail-loud). Does NOT probe and does NOT retry — the executor hand owns
-	 * re-probe/retry (봉인 3), so the adapter can never silently paper over a dead route.
-	 */
+	/** Direct-inject once through the just-probed route. Throws on failure. */
 	send(route: NativePushRoute, nativeSessionId: string, content: string): Promise<void>;
 }
 
@@ -211,6 +206,7 @@ export function createAntigravityAdapter(deps: AntigravityAdapterDeps): NativePu
 
 	return {
 		id: "antigravity",
+		retriable: true,
 
 		async probe(nativeSessionId) {
 			let pids: number[];
@@ -237,7 +233,7 @@ export function createAntigravityAdapter(deps: AntigravityAdapterDeps): NativePu
 			for (const pid of pids) {
 				for (const lsAddress of portsByPid.get(pid) ?? []) {
 					if (await servesConversation(lsAddress, nativeSessionId)) {
-						return { status: "alive", route: { lsAddress } };
+						return { status: "alive", route: { backend: "antigravity", lsAddress } };
 					}
 				}
 			}
@@ -251,12 +247,13 @@ export function createAntigravityAdapter(deps: AntigravityAdapterDeps): NativePu
 		},
 
 		async send(route, nativeSessionId, content) {
+			if (route.backend !== "antigravity") {
+				throw new Error(`antigravity adapter received ${route.backend} route`);
+			}
 			const r = await runner.exec([binary, "agentapi", "send-message", nativeSessionId, content], {
 				env: { ANTIGRAVITY_LS_ADDRESS: route.lsAddress },
 				timeoutMs: AGY_SEND_TIMEOUT_MS,
 			});
-			// A non-zero code — including a timeout kill (124) on a stalled route — THROWS
-			// (fail-loud); the executor hand owns the 1-shot re-probe→re-send on that throw.
 			if (r.code !== 0) {
 				throw new Error(
 					`native-push send failed (agentapi send-message exit ${r.code}) via ${route.lsAddress}: ${
@@ -268,12 +265,12 @@ export function createAntigravityAdapter(deps: AntigravityAdapterDeps): NativePu
 	};
 }
 
-/** The production antigravity adapter (real runner + env-resolved binary). */
+/** Production adapters. */
 export const antigravityAdapter: NativePushAdapter = createAntigravityAdapter({ runner: realNativePushRunner });
 
 // ── registry + fail-fast resolver (mirror resolveAcpBackendAdapter) ──────────
 
-const ADAPTERS: readonly NativePushAdapter[] = [antigravityAdapter];
+const ADAPTERS: readonly NativePushAdapter[] = [antigravityAdapter, codexNativePushAdapter];
 
 /**
  * Resolve the native-push adapter that owns backend `id`. Fail-fast, like