@junghanacs/entwurf 0.20.1 → 0.22.0

package/scripts/check-entwurf-peers-surface.ts

@@ -31,7 +31,7 @@ import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import { type EntwurfFactsResult, recordLessSocketMessage } from "../pi-extensions/lib/entwurf-fact-provider.ts";
 import type { PeerFact } from "../pi-extensions/lib/entwurf-facts.ts";
-import { renderEntwurfPeers } from "../pi-extensions/lib/entwurf-peers-render.ts";
+import { ENTWURF_PEERS_RENDER_LIMIT, renderEntwurfPeers } from "../pi-extensions/lib/entwurf-peers-render.ts";
 import type { FactLiveness } from "../pi-extensions/lib/entwurf-v2-contract.ts";
 import type { MetaCitizenBackend } from "../pi-extensions/lib/meta-session.ts";
 import type { SocketLiveness } from "../pi-extensions/lib/socket-probe.ts";
@@ -199,6 +199,10 @@ function main(): void {
 		);
 		const bounded = renderEntwurfPeers({ facts: { peers: manyPeers, recordLessSockets: [] }, diagnostics: [] });
 		ok("bounded text omits older entries when peer list is large", bounded.text.includes("older entries omitted"));
+		ok(
+			"#112: human row budget remains exactly 32",
+			ENTWURF_PEERS_RENDER_LIMIT === 32 && bounded.text.includes("(8 older entries omitted; showing latest 32)"),
+		);
 		ok("bounded text shows latest entries", bounded.text.includes("20260612T000039-aaaaaa"));
 		ok("bounded text omits oldest entry", !bounded.text.includes("20260612T000000-aaaaaa  backend="));
 		ok("bounded payload still carries every peer", bounded.payload.peers.length === 40);
@@ -255,6 +259,14 @@ function main(): void {
 		ok("wiring: bridge calls renderEntwurfPeers(", bridgeSrc.includes("renderEntwurfPeers("));
 		ok("wiring: native pi tool calls listEntwurfFacts(", nativeSrc.includes("listEntwurfFacts("));
 		ok("wiring: native pi tool calls renderEntwurfPeers(", nativeSrc.includes("renderEntwurfPeers("));
+		ok(
+			"#112 wiring: MCP observation uses the render limit",
+			bridgeSrc.includes("observationLimit: ENTWURF_PEERS_RENDER_LIMIT"),
+		);
+		ok(
+			"#112 wiring: native pi observation uses the render limit",
+			nativeSrc.includes("observationLimit: render.ENTWURF_PEERS_RENDER_LIMIT"),
+		);
 		ok(
 			"wiring: bridge does not paste full JSON payload into human text",
 			!bridgeSrc.includes("JSON.stringify(payload)"),

package/scripts/check-entwurf-self-address.ts

@@ -266,14 +266,14 @@ ok(
 	/existsSync\s*\(/.test(piBody) && /controlSocketPathIn\s*\(\s*ENTWURF_DIR\s*,/.test(piBody),
 );
 
-const metaBuilder = functionBody("buildTrustedMetaSenderEnvelope");
+const metaBuilder = functionBody("buildMetaSenderEnvelope");
 // FIRST of the two derivation claims so a binary-fallback mutant dies here, not at the seam pin.
 ok(
-	"buildTrustedMetaSenderEnvelope does not fall back every non-native-push backend to self-fetch [QK:SELFADDR-NO-FALLBACK-SELF-FETCH]",
+	"buildMetaSenderEnvelope does not fall back every non-native-push backend to self-fetch [QK:SELFADDR-NO-FALLBACK-SELF-FETCH]",
 	!/\?\s*"native-push"\s*:\s*"self-fetch"/.test(metaBuilder),
 );
 ok(
-	"buildTrustedMetaSenderEnvelope derives self-fetch through resolveMailboxWakeModeCapability(identity), not a backend-name list [QK:SELFADDR-MAILBOX-WAKE-SEAM]",
+	"buildMetaSenderEnvelope derives self-fetch through resolveMailboxWakeModeCapability(identity), not a backend-name list [QK:SELFADDR-MAILBOX-WAKE-SEAM]",
 	/resolveMailboxWakeModeCapability\s*\(\s*identity\s*\)/.test(metaBuilder),
 );
 
@@ -443,14 +443,13 @@ function metaRailRenderIsHonest(region: string): { honest: boolean; reason: stri
 		throw new Error(`class ${name} body never closed`);
 	};
 
-	// Anchored per class (not a repo-wide grep) so a mention somewhere else in the file
-	// cannot make either row vacuously green.
+	// Anchored per class (not a repo-wide grep) so a mention elsewhere cannot make
+	// either row vacuously green. Native hook mechanisms vary by backend; Codex
+	// carries request-scoped identity instead of a shared process marker.
 	for (const cls of ["EntwurfEnvelopeWiringError", "EntwurfSenderIdentityError"]) {
 		const body = classBody(cls);
-		ok(
-			`${cls} names BOTH native hooks (SessionStart AND PreInvocation)`,
-			/SessionStart/.test(body) && /PreInvocation/.test(body),
-		);
+		ok(`${cls} names a native sender marker path`, /native (sender )?(claim|hook)|sender marker/.test(body));
+		ok(`${cls} names the managed Codex request identity path`, /managed Codex/.test(body));
 		ok(
 			`${cls} no longer presents SessionStart/Claude as THE marker writer`,
 			!/The native SessionStart hook writes that marker/.test(body) &&
@@ -465,33 +464,33 @@ function metaRailRenderIsHonest(region: string): { honest: boolean; reason: stri
 // THIS session's own receiver inbox can actually wake (slice-2 presence marker), not a
 // hardcoded true. An inactive receiver must still return the meta identity (replyable:false)
 // — degrading to null would erase who-sent and fall through to external-mcp.
-const metaBody = functionBody("buildTrustedMetaSenderEnvelope");
-ok("buildTrustedMetaSenderEnvelope calls computeSelfAddressability", /computeSelfAddressability\s*\(/.test(metaBody));
-ok("buildTrustedMetaSenderEnvelope no longer hardcodes `replyable: true`", !/replyable:\s*true/.test(metaBody));
+const metaBody = functionBody("buildMetaSenderEnvelope");
+ok("buildMetaSenderEnvelope calls computeSelfAddressability", /computeSelfAddressability\s*\(/.test(metaBody));
+ok("buildMetaSenderEnvelope no longer hardcodes `replyable: true`", !/replyable:\s*true/.test(metaBody));
 ok(
 	// #101: the identity match alone is no longer the whole answer. `entwurf_self` composes
 	// the SAME `resolveMailboxReceiverFacts` the v2 dispatch seam uses — reading the receiver
 	// marker AND, where the watch owner is the sender-marker process, the join that says that
 	// owner is still serving this garden. A citizen's self-reported replyability and what
 	// dispatch decides about it come from one measurement, so they cannot disagree.
-	"buildTrustedMetaSenderEnvelope derives active-receiver from the SHARED receiver composition (both markers)",
+	"buildMetaSenderEnvelope derives active-receiver from the SHARED receiver composition (both markers)",
 	/resolveMailboxReceiverFacts\s*\(/.test(metaBody) &&
 		/readMetaReceiverMarker\s*\(/.test(metaBody) &&
 		/readMetaSenderMarker\s*\(/.test(metaBody),
 );
 ok(
-	"buildTrustedMetaSenderEnvelope no longer copies one match into both receiver facts",
+	"buildMetaSenderEnvelope no longer copies one match into both receiver facts",
 	!/ownerAlive:\s*active/.test(metaBody) && !/watchArmed:\s*active/.test(metaBody),
 );
 ok(
 	// #101 (cross-review): both markers are read with their liveness guards ON. A reader that
 	// opted out would accept a dead session's leftover file as "which garden this pid serves
 	// now", and every fixture pid in a gate is live, so nothing dynamic here could tell.
-	"buildTrustedMetaSenderEnvelope reads neither marker with the owner guard disabled",
+	"buildMetaSenderEnvelope reads neither marker with the owner guard disabled",
 	!/verifyOwner:\s*false/.test(metaBody),
 );
 ok(
-	"buildTrustedMetaSenderEnvelope keeps meta identity + derived replyable (inactive → not null)",
+	"buildMetaSenderEnvelope keeps meta identity + derived replyable (inactive → not null)",
 	/origin:\s*"meta-session"/.test(metaBody) && /replyable:\s*self\.replyable/.test(metaBody),
 );
 

package/scripts/check-entwurf-v2-contract.ts

@@ -280,8 +280,8 @@ ok(
 // ── native-push (봉인 1/2/4): a THIRD table, disjoint from pi socket + mailbox ──
 const NATIVE_PUSH_LIVENESSES = ["alive", "dead", "indeterminate"] as const;
 
-// domain: antigravity is native-push; pi/claude-code are NOT; the domain is DISJOINT
-// from the pi socket liveness domain (a backend is never in both rails).
+// domain: antigravity and Codex are native-push; pi/claude-code are NOT; the domain
+// is DISJOINT from pi socket liveness (a backend is never in both rails).
 eq("native-push domain: antigravity supported", nativePushSupported("antigravity"), true);
 eq("native-push domain: pi is NOT native-push (it is pi-socket)", nativePushSupported("pi"), false);
 eq(
@@ -289,7 +289,8 @@ eq(
 	nativePushSupported("claude-code"),
 	false,
 );
-eq("native-push domain: NATIVE_PUSH_BACKENDS == ['antigravity']", [...NATIVE_PUSH_BACKENDS], ["antigravity"]);
+eq("native-push domain: Codex supported", nativePushSupported("codex"), true);
+eq("native-push domain: NATIVE_PUSH_BACKENDS exact", [...NATIVE_PUSH_BACKENDS], ["antigravity", "codex"]);
 ok(
 	"native-push ∩ pi-socket liveness domain = ∅ (separate rails)",
 	!NATIVE_PUSH_BACKENDS.some((b) => (LIVENESS_DOMAIN_BACKENDS as readonly string[]).includes(b)),

package/scripts/check-entwurf-v2-decider.ts

@@ -381,7 +381,7 @@ async function main(): Promise<void> {
 	// ── 8: unsupported + ff + seam says undeliverable → reject, no plan, no lock ─
 	{
 		const t = mkDeps({
-			resolution: { identity: identity("codex"), preProbeAddressConflict: false },
+			resolution: { identity: identity("omp"), preProbeAddressConflict: false },
 			mailboxDeliverable: false,
 		});
 		const d = await decideDispatch({ target: GID, intent: "fire-and-forget", message: "mail" }, t.deps);
@@ -399,8 +399,7 @@ async function main(): Promise<void> {
 	// reject, NO plan, NO lock, NO inspect/probe. This is the v2 closure of the gap slice
 	// 2d-2 closed for v1: the decider no longer trusts wake-mode alone; the required seam's
 	// active-receiver verdict governs, so a reply to a dead claude-code is refused, not
-	// enqueued as mailbox garbage. (Indistinguishable here from the codex case at the
-	// receipt level — that is the point: the seam, not the backend, decides.) ────────────
+	// enqueued as mailbox garbage. ───────────────────────────────────────────────────
 	{
 		const t = mkDeps({
 			resolution: { identity: identity("claude-code"), preProbeAddressConflict: false },
@@ -581,7 +580,7 @@ async function main(): Promise<void> {
 		// ff × alive → execute native-push send; plan carries route/backend/nativeSessionId; lock null.
 		const t = mkDeps({
 			resolution: npResolution,
-			nativePush: { status: "alive", route: { lsAddress: "127.0.0.1:5599" } },
+			nativePush: { status: "alive", route: { backend: "antigravity", lsAddress: "127.0.0.1:5599" } },
 		});
 		const d = await decideDispatch({ target: GID, intent: "fire-and-forget", message: "yo" }, t.deps);
 		ok("native-push ff+alive: execute", isExecute(d));
@@ -594,7 +593,10 @@ async function main(): Promise<void> {
 			t.mailboxCalls.length === 0,
 		);
 		if (isExecute(d) && d.plan.transport === "native-push") {
-			ok("native-push ff+alive: plan route = probed route", d.plan.route.lsAddress === "127.0.0.1:5599");
+			ok(
+				"native-push ff+alive: plan route = probed route",
+				d.plan.route.backend === "antigravity" && d.plan.route.lsAddress === "127.0.0.1:5599",
+			);
 			ok("native-push ff+alive: plan backend = antigravity", d.plan.backend === "antigravity");
 			ok("native-push ff+alive: plan nativeSessionId from identity", d.plan.nativeSessionId === `native-${GID}`);
 			ok(

package/scripts/check-entwurf-v2-native-push.ts

@@ -35,7 +35,11 @@ function ok(label: string, cond: boolean): void {
 }
 
 const CONV = "conv-xyz";
-const PLANTED: NativePushRoute = { lsAddress: "127.0.0.1:5600" };
+const PLANTED: NativePushRoute = { backend: "antigravity", lsAddress: "127.0.0.1:5600" };
+
+function agyAddress(route: NativePushRoute | undefined): string | undefined {
+	return route?.backend === "antigravity" ? route.lsAddress : undefined;
+}
 
 interface SendCall {
 	route: NativePushRoute;
@@ -48,6 +52,7 @@ interface FakeAdapterConfig {
 	probes: NativePushProbeResult[];
 	/** 0-based indices of send() calls that THROW. */
 	sendFailAt?: number[];
+	retriable?: boolean;
 }
 
 function makeFakeAdapter(config: FakeAdapterConfig): {
@@ -60,6 +65,7 @@ function makeFakeAdapter(config: FakeAdapterConfig): {
 	const sends: SendCall[] = [];
 	const adapter: NativePushAdapter = {
 		id: "antigravity",
+		retriable: config.retriable ?? true,
 		async probe() {
 			const p = config.probes[probeIdx] ?? { status: "dead", reason: "fake: probes exhausted" };
 			probeIdx++;
@@ -81,31 +87,53 @@ async function main(): Promise<void> {
 		const r = await deliverViaNativePush(adapter, PLANTED, CONV, "hi");
 		ok("success: retried:false", r.success === true && r.retried === false);
 		ok("success: exactly ONE send", sends.length === 1);
-		ok("success: send used the PLANTED route (no re-probe)", sends[0]?.route.lsAddress === "127.0.0.1:5600");
+		ok("success: send used the PLANTED route (no re-probe)", agyAddress(sends[0]?.route) === "127.0.0.1:5600");
 		ok("success: ZERO re-probe", probeCount() === 0);
 	}
 
+	// Codex's vendor queue may accept before its receipt fails: no re-probe, no replay.
+	{
+		const { adapter, sends, probeCount } = makeFakeAdapter({
+			probes: [{ status: "alive", route: { backend: "antigravity", lsAddress: "must-not-be-used" } }],
+			sendFailAt: [0, 1],
+			retriable: false,
+		});
+		await assert.rejects(() => deliverViaNativePush(adapter, PLANTED, CONV, "hi"), /fake send fail/);
+		ok("non-retriable failure makes exactly ONE send", sends.length === 1);
+		ok("non-retriable failure makes ZERO probes", probeCount() === 0);
+	}
+
 	// ── fail → re-probe alive → re-send success: retried, fresh route ────────────
 	{
 		const { adapter, sends, probeCount } = makeFakeAdapter({
-			probes: [{ status: "alive", route: { lsAddress: "127.0.0.1:5601" } }],
+			probes: [{ status: "alive", route: { backend: "antigravity", lsAddress: "127.0.0.1:5601" } }],
 			sendFailAt: [0],
 		});
 		const r = await deliverViaNativePush(adapter, PLANTED, CONV, "hi");
 		ok("retry: retried:true", r.success === true && r.retried === true);
 		ok("retry: TWO sends (initial + one retry)", sends.length === 2);
 		ok("retry: exactly ONE re-probe", probeCount() === 1);
-		ok("retry: 1st send used the planted route", sends[0]?.route.lsAddress === "127.0.0.1:5600");
+		ok("retry: 1st send used the planted route", agyAddress(sends[0]?.route) === "127.0.0.1:5600");
 		ok(
 			"retry: 2nd send used the RE-DISCOVERED route (not the stale one)",
-			sends[1]?.route.lsAddress === "127.0.0.1:5601",
+			agyAddress(sends[1]?.route) === "127.0.0.1:5601",
+		);
+		// The retry replays CONTENT, never re-derives it. The caller hands this leaf one already
+		// rendered string (the #95 sender envelope is rendered ONCE, upstream, with its own
+		// timestamp), so the only honest retry is the same bytes — a second render, or any
+		// per-attempt decoration here, would deliver a body that disagrees with the first
+		// attempt the target may already have accepted. Asserted at this leaf so the claim holds
+		// without coupling sender rendering into the adapter hand.
+		ok(
+			"[QK:NATIVE-PUSH-RETRY-BYTE-IDENTITY] the retry replays byte-identical content, never a re-derived body",
+			sends[0]?.content === sends[1]?.content,
 		);
 	}
 
 	// ── fail → re-probe alive → re-send FAIL: throws (fail-loud, no 3rd attempt) ──
 	{
 		const { adapter, sends } = makeFakeAdapter({
-			probes: [{ status: "alive", route: { lsAddress: "127.0.0.1:5601" } }],
+			probes: [{ status: "alive", route: { backend: "antigravity", lsAddress: "127.0.0.1:5601" } }],
 			sendFailAt: [0, 1],
 		});
 		let threw = false;
@@ -182,7 +210,7 @@ async function main(): Promise<void> {
 		);
 		ok(
 			"makeNativePushSend: sent the plan message over the plan route",
-			sends[0]?.content === "payload" && sends[0]?.route.lsAddress === "127.0.0.1:5600",
+			sends[0]?.content === "payload" && agyAddress(sends[0]?.route) === "127.0.0.1:5600",
 		);
 		ok("makeNativePushSend: lock IGNORED (lock-free — a bogus lock did not break delivery)", sends.length === 1);
 	}

package/scripts/check-entwurf-v2-production.ts

@@ -9,6 +9,10 @@
  *      (a pi-alive citizen → control-socket execute; acquireLock spy saw {dir: lockDir}).
  *   B. control `sendOverSocket` builds the RpcSendCommand (type/message/mode/wants_reply/
  *      sender) and maps response.success→outcome; the hand releases under `lockDir`.
+ *   B2. #115 — the SAME closure carries `response.error` onto the RpcSendResult, so a
+ *      completed-but-refused RPC reaches the caller as `rejected` WITH the receiver's
+ *      named reason. Dropping that one field renders a reasonless reject, which is the
+ *      field symptom; no other deterministic gate holds this wiring.
  *   D. the meta-mailbox hand enqueues onto the wired sessionsDir/mailboxDir.
  *   E. Q3 + Q5 — a dead control send re-resolves (claude-code citizen) to the mailbox and
  *      enqueues through the SAME sendViaMailbox instance (same enqueue spy) on the SAME dirs
@@ -27,8 +31,14 @@ import {
 	makeProductionEntwurfV2Deps,
 	type ProductionEntwurfV2Opts,
 } from "../pi-extensions/lib/entwurf-v2-production.ts";
-import { runEntwurfV2 } from "../pi-extensions/lib/entwurf-v2-runner.ts";
+import {
+	type EntwurfV2RunDeps,
+	type EntwurfV2RunResult,
+	executeDispatch,
+	runEntwurfV2,
+} from "../pi-extensions/lib/entwurf-v2-runner.ts";
 import type { ControlSocketPlan, MetaMailboxPlan } from "../pi-extensions/lib/entwurf-v2-send.ts";
+import { formatMetaMailboxBody, type MailboxSenderEnvelope } from "../pi-extensions/lib/meta-mailbox-body.ts";
 import type { MetaIdentity, MetaReceiverMarker, MetaSenderMarker } from "../pi-extensions/lib/meta-session.ts";
 import type { NativePushAdapter, NativePushProbeResult } from "../pi-extensions/lib/native-push/adapter.ts";
 import type { TargetSocketInspection } from "../pi-extensions/lib/socket-discovery.ts";
@@ -43,10 +53,21 @@ function ok(label: string, cond: boolean): void {
 const GID = "20260613T100000-aaaaaa";
 /** The garden a switched-away owner serves instead (#101). */
 const OTHER_GID = "20260613T100000-bbbbbb";
+/** The one trusted sender every rail in this gate renders from. */
+const SENDER: MailboxSenderEnvelope = {
+	sessionId: "self",
+	agentId: "pi/x",
+	cwd: "/cwd",
+	timestamp: "2026-06-13T00:00:00.000Z",
+};
 const LOCK_DIR = "/fake/locks";
 const SESSIONS_DIR = "/fake/sessions";
 const MAILBOX_DIR = "/fake/mailbox";
 const CONTROL_DIR = "/fake/ctl";
+/** The named in-band refusal a real receiver answers with while it compacts (#115).
+ * It is a plain opaque string here on purpose: the production seam must carry WHATEVER
+ * reason the receiver named, not a vocabulary this gate recognises. */
+const IN_BAND_REJECT_REASON = "compacting";
 
 function identity(backend: MetaIdentity["backend"], gardenId = GID): MetaIdentity {
 	return {
@@ -132,7 +153,36 @@ interface Spies {
 	/** which backend the native-push adapter resolver was asked for (decide + execute). */
 	nativePushResolve: string[];
 	nativePushProbe: { conv: string }[];
-	nativePushSend: { lsAddress: string; conv: string; content: string }[];
+	nativePushSend: { route: string; conv: string; content: string }[];
+	/** every `senderProvider()` call — ONE provider feeds all three rails, so a hand that
+	 * resolves the envelope twice (or not at all) is visible here. */
+	senderCalls: number[];
+	/** ORDERED trace of the native-push hand's observable steps. Counts alone cannot see
+	 * ORDER, and order is the whole safety claim: the envelope must be resolved BEFORE the
+	 * adapter is touched, so a provider throw leaves the target's conversation untouched
+	 * rather than half-delivered. `runInTwoPhases` marks where the execute phase starts. */
+	events: ("sender" | "resolve" | "probe" | "send")[];
+}
+
+/**
+ * `runEntwurfV2` split at its own seam so the EXECUTE phase has a MEASURED boundary. The decide
+ * phase legitimately resolves the adapter and probes (봉인 4: one adapter for both hands), so an
+ * order claim about the send hand has to start after decide returns — but the boundary must be
+ * the index recorded between the two calls, never something inferred from the event VALUES. An
+ * earlier version sliced after the last `probe`, which a regression could defeat: an executor
+ * that resolved and probed before the sender would make its own probe the "last" one and hide
+ * the illegal prefix it just produced. This records the length instead, so ANY extra execute-side
+ * resolve or probe ahead of the sender stays inside the slice and fails.
+ */
+async function runInTwoPhases(
+	input: DispatchInput,
+	deps: EntwurfV2RunDeps,
+	spies: Spies,
+): Promise<{ result: EntwurfV2RunResult; executeEvents: string[] }> {
+	const decision = await deps.decide(input);
+	const executeStart = spies.events.length;
+	const result = await executeDispatch(decision, deps.executor);
+	return { result, executeEvents: spies.events.slice(executeStart) };
 }
 
 /** Build a factory whose every leaf IO is a spy. `over` lets a case shape the decision
@@ -142,10 +192,15 @@ function makeSpiedFactory(over: {
 	recordExists?: boolean;
 	inspectKind?: TargetSocketInspection["kind"];
 	probe?: "alive" | "dead" | "indeterminate";
-	rpc?: "success" | "dead-throw";
+	/** `in-band-reject` (#115): the RPC COMPLETES and the receiver refuses in band
+	 * (`{success:false,error:"compacting"}`) — distinct from `dead-throw`, which never
+	 * reaches a response at all. It is the only arm that carries `response.error`. */
+	rpc?: "success" | "dead-throw" | "in-band-reject";
 	classifyDead?: boolean;
 	/** #50 C3 — a caller with no authoritative sender (senderProvider → undefined). */
 	noSender?: boolean;
+	/** #95 — the envelope source itself fails: the send must reject with NOTHING injected. */
+	senderThrows?: boolean;
 	/** the native-push adapter probe result (only reached on a native-push backend). */
 	nativePushProbe?: NativePushProbeResult;
 	/** SE-2 2d-3 — the target's receiver presence marker: "active" (matches identity,
@@ -166,12 +221,16 @@ function makeSpiedFactory(over: {
 		nativePushResolve: [],
 		nativePushProbe: [],
 		nativePushSend: [],
+		senderCalls: [],
+		events: [],
 	};
 	const opts: ProductionEntwurfV2Opts = {
-		senderProvider: () =>
-			over.noSender
-				? undefined
-				: { sessionId: "self", agentId: "pi/x", cwd: "/cwd", timestamp: "2026-06-13T00:00:00.000Z" },
+		senderProvider: () => {
+			spies.senderCalls.push(spies.senderCalls.length + 1);
+			spies.events.push("sender");
+			if (over.senderThrows) throw new Error("fake: sender envelope unavailable");
+			return over.noSender ? undefined : SENDER;
+		},
 		lockDir: LOCK_DIR,
 		sessionsDir: SESSIONS_DIR,
 		mailboxDir: MAILBOX_DIR,
@@ -219,6 +278,11 @@ function makeSpiedFactory(over: {
 					e.code = "ECONNREFUSED";
 					throw e;
 				}
+				if (over.rpc === "in-band-reject") {
+					return {
+						response: { type: "response", command: command.type, success: false, error: IN_BAND_REJECT_REASON },
+					};
+				}
 				return { response: { type: "response", command: command.type, success: true } };
 			},
 			enqueue: (o) => {
@@ -231,14 +295,19 @@ function makeSpiedFactory(over: {
 			// two hands never resolve different adapters.
 			resolveNativePushAdapter: (backend: string): NativePushAdapter => {
 				spies.nativePushResolve.push(backend);
+				spies.events.push("resolve");
 				return {
-					id: "antigravity",
+					id: backend as NativePushAdapter["id"],
+					retriable: backend === "antigravity",
 					async probe(conv) {
 						spies.nativePushProbe.push({ conv });
+						spies.events.push("probe");
 						return over.nativePushProbe ?? { status: "dead", reason: "fake: no native-push probe configured" };
 					},
 					async send(route, conv, content) {
-						spies.nativePushSend.push({ lsAddress: route.lsAddress, conv, content });
+						const routeLabel = route.backend === "antigravity" ? route.lsAddress : route.socketPath;
+						spies.nativePushSend.push({ route: routeLabel, conv, content });
+						spies.events.push("send");
 					},
 				};
 			},
@@ -277,14 +346,14 @@ async function main(): Promise<void> {
 	{
 		const { deps, spies } = makeSpiedFactory({
 			backend: "antigravity",
-			nativePushProbe: { status: "alive", route: { lsAddress: "127.0.0.1:5599" } },
+			nativePushProbe: { status: "alive", route: { backend: "antigravity", lsAddress: "127.0.0.1:5599" } },
 		});
 		const result = await runEntwurfV2({ target: GID, intent: "fire-and-forget", message: "hi agy" }, deps);
 		ok("A3: antigravity ff → native-push delivered", result.kind === "executed" && result.transport === "native-push");
 		ok("A3: decider probed the native-push adapter once (decide side)", spies.nativePushProbe.length === 1);
 		ok("A3: executor sent via the native-push adapter once (execute side)", spies.nativePushSend.length === 1);
-		ok("A3: send used the DECIDER-probed route", spies.nativePushSend[0]?.lsAddress === "127.0.0.1:5599");
-		ok("A3: send carried the dispatch message", spies.nativePushSend[0]?.content === "hi agy");
+		ok("A3: send used the DECIDER-probed route", spies.nativePushSend[0]?.route === "127.0.0.1:5599");
+		ok("A3: send carried the dispatch message", spies.nativePushSend[0]?.content.includes("hi agy") === true);
 		ok(
 			"A3: BOTH hands resolved the SAME adapter (for 'antigravity')",
 			spies.nativePushResolve.length === 2 && spies.nativePushResolve.every((b) => b === "antigravity"),
@@ -292,6 +361,145 @@ async function main(): Promise<void> {
 		ok("A3: native-push is LOCK-FREE (no acquire)", spies.acquire.length === 0);
 		ok("A3: native-push did NOT enqueue a mailbox (not the unsupported path)", spies.enqueue.length === 0);
 	}
+	{
+		const { deps, spies } = makeSpiedFactory({
+			backend: "codex",
+			nativePushProbe: {
+				status: "alive",
+				route: { backend: "codex", socketPath: "/home/operator/.codex/app-server-control/app-server-control.sock" },
+			},
+		});
+		const result = await runEntwurfV2({ target: GID, intent: "fire-and-forget", message: "hi codex" }, deps);
+		ok(
+			"[QK:CODEX-NATIVE-PRODUCTION-WIRING] Codex ff → native-push delivered",
+			result.kind === "executed" && result.transport === "native-push",
+		);
+		ok(
+			"A3c: both hands resolve the Codex adapter",
+			spies.nativePushResolve.length === 2 && spies.nativePushResolve.every((b) => b === "codex"),
+		);
+		ok(
+			"A3c: planted Codex UDS reaches the send hand",
+			spies.nativePushSend[0]?.route.endsWith("/app-server-control.sock") === true,
+		);
+		ok(
+			"A3c: Codex native-push remains lock-free and mailbox-free",
+			spies.acquire.length === 0 && spies.enqueue.length === 0,
+		);
+	}
+	// ── A3d (#95): the native-push rail injects the MAILBOX-SERIALIZED sender envelope ──
+	// Measured in the #95 A LIVE run: a nonce-only fresh-call callback direct-injected into a
+	// Codex thread arrived as bare text, so the receiving citizen could not name who called it
+	// and the callback was uncorrelatable. Direct injection has neither the control socket's RPC
+	// framing nor a mailbox file, so the envelope must ride IN the body — the same bytes
+	// `formatMetaMailboxBody` gives the mailbox rail. ONE rail: both native-push backends, no
+	// per-backend branch.
+	{
+		const route = { backend: "antigravity", lsAddress: "127.0.0.1:5599" } as const;
+		const { deps, spies } = makeSpiedFactory({
+			backend: "antigravity",
+			nativePushProbe: { status: "alive", route },
+		});
+		const { result, executeEvents } = await runInTwoPhases(
+			{ target: GID, intent: "fire-and-forget", message: "hi agy", wantsReply: true },
+			deps,
+			spies,
+		);
+		// WIRING FIRST, and it is its own claim: the factory must hand the native-push hand the
+		// SAME `opts.senderProvider` the mailbox hand gets. A render that is reachable but never
+		// fed falls back to raw silently, so "the provider was consulted exactly once on this
+		// rail" is asserted BEFORE the body is compared — that way a dropped wiring fails here
+		// at its own QK instead of borrowing the envelope claim's failure.
+		ok(
+			"[QK:NATIVE-PUSH-SENDER-PROVIDER-WIRING] the factory fed the native-push hand its one senderProvider, exactly once",
+			result.kind === "executed" && spies.senderCalls.length === 1,
+		);
+		ok(
+			"[QK:NATIVE-PUSH-SENDER-ENVELOPE] agy direct injection carries the mailbox-serialized trusted envelope",
+			spies.nativePushSend[0]?.content === formatMetaMailboxBody(SENDER, "hi agy", true),
+		);
+		ok(
+			"A3d: the enveloped body is NOT the raw plan message (an envelope was actually added)",
+			spies.nativePushSend[0]?.content !== "hi agy",
+		);
+		ok(
+			"A3d: wants_reply rides the envelope on this rail",
+			spies.nativePushSend[0]?.content.includes("wants reply: yes") === true,
+		);
+		// ORDER, not counts. The envelope must be resolved BEFORE the adapter is resolved or
+		// touched. Counts would be identical if the hand resolved the adapter first and the
+		// provider second — but then a provider throw would land after the adapter was already
+		// in hand, and the safety claim ("a failing envelope source injects nothing") would
+		// rest on luck rather than sequence.
+		ok(
+			"[QK:NATIVE-PUSH-SENDER-BEFORE-ADAPTER] the send hand resolves the envelope, THEN the adapter, THEN sends",
+			JSON.stringify(executeEvents) === JSON.stringify(["sender", "resolve", "send"]),
+		);
+	}
+	{
+		// Same rail, other backend — codex renders identically. A backend branch would show here.
+		const route = {
+			backend: "codex",
+			socketPath: "/home/operator/.codex/app-server-control/app-server-control.sock",
+		} as const;
+		const { deps, spies } = makeSpiedFactory({ backend: "codex", nativePushProbe: { status: "alive", route } });
+		const result = await runEntwurfV2({ target: GID, intent: "fire-and-forget", message: "hi codex" }, deps);
+		ok(
+			"A3d: codex direct injection carries the SAME mailbox-serialized envelope (one rail, no backend branch)",
+			result.kind === "executed" &&
+				spies.nativePushSend[0]?.content === formatMetaMailboxBody(SENDER, "hi codex", false),
+		);
+		ok("A3d: the codex body is NOT the raw plan message either", spies.nativePushSend[0]?.content !== "hi codex");
+		ok("A3d: codex resolved the envelope EXACTLY once", spies.senderCalls.length === 1);
+	}
+	{
+		// #50 C3 parity: no authoritative sender → the raw message is preserved, never a
+		// fabricated envelope. This is the same fallback the mailbox hand has.
+		const { deps, spies } = makeSpiedFactory({
+			backend: "codex",
+			noSender: true,
+			nativePushProbe: {
+				status: "alive",
+				route: { backend: "codex", socketPath: "/home/operator/.codex/app-server-control/app-server-control.sock" },
+			},
+		});
+		const result = await runEntwurfV2({ target: GID, intent: "fire-and-forget", message: "raw only" }, deps);
+		ok(
+			"A3d: no authoritative sender → the RAW message is injected, no fabricated envelope",
+			result.kind === "executed" && spies.nativePushSend[0]?.content === "raw only",
+		);
+	}
+	{
+		// A throwing provider must reject the send with NOTHING injected — a half-delivered
+		// conversation is worse than a rejected dispatch. No new reject reason, no fallback.
+		const { deps, spies } = makeSpiedFactory({
+			backend: "codex",
+			senderThrows: true,
+			nativePushProbe: {
+				status: "alive",
+				route: { backend: "codex", socketPath: "/home/operator/.codex/app-server-control/app-server-control.sock" },
+			},
+		});
+		const { result, executeEvents } = await runInTwoPhases(
+			{ target: GID, intent: "fire-and-forget", message: "never sent" },
+			deps,
+			spies,
+		);
+		ok(
+			"A3d: a throwing sender provider fails the dispatch EXACTLY as execution-failed",
+			result.kind === "execution-failed",
+		);
+		ok("A3d: a throwing sender provider called its provider exactly once", spies.senderCalls.length === 1);
+		ok("A3d: a throwing sender provider never resolved the adapter", executeEvents.includes("resolve") === false);
+		ok("A3d: a throwing sender provider injected NOTHING", spies.nativePushSend.length === 0);
+		// The whole execute phase is ONE event: the envelope source was asked, it failed, and the
+		// target's conversation was never reached. No partial delivery, no adapter in hand.
+		ok(
+			"A3d: the failed execute phase is exactly ['sender'] — nothing downstream ran",
+			JSON.stringify(executeEvents) === JSON.stringify(["sender"]),
+		);
+	}
+
 	{
 		// antigravity + dead probe → reject native-push-target-dead, NO send.
 		const { deps, spies } = makeSpiedFactory({
@@ -339,6 +547,31 @@ async function main(): Promise<void> {
 		);
 	}
 
+	// ── B2: #115 — the production seam CARRIES the receiver's named in-band reason ─
+	// B above proves the success half of the map. This is the other half, and it is the
+	// half the field symptom lived in: a completed RPC answering `{success:false,
+	// error:"compacting"}`. The reason has to cross THREE production hops the fake cannot
+	// short-circuit — `response.error` → `RpcSendResult.error` (the factory's own
+	// `sendOverSocket` closure) → `driveSend`'s `inBandRejected` → the
+	// `executeControlSocketSend` result — so deleting the factory's `error:` wiring alone
+	// strands the reason and this cell goes red. `outcome` alone is NOT the assertion:
+	// a bare `rejected` is exactly what the defect rendered.
+	{
+		const { deps, spies } = makeSpiedFactory({ rpc: "in-band-reject" });
+		const res = await deps.executor.sendControl(CONTROL_PLAN, lockClaim());
+		ok("B2: in-band {success:false} → outcome 'rejected' (not failed, not sent)", res.outcome === "rejected");
+		ok(
+			"B2: [QK:V2PROD-INBAND-ERROR-WIRED] response.error reaches the send result verbatim",
+			res.rejectReason === IN_BAND_REJECT_REASON,
+		);
+		ok("B2: an in-band reject is a COMPLETED rpc — the socket hand ran once", spies.rpc.length === 1);
+		ok(
+			"B2: a rejected send still releases under the wired lockDir",
+			spies.release.length === 1 && spies.release[0].dir === LOCK_DIR,
+		);
+		ok("B2: an in-band reject never falls back to the mailbox", spies.enqueue.length === 0);
+	}
+
 	// ── C2: #50 C3 — the dormant rail carries the caller edge (<sender_info>) ──
 	// ── D: meta-mailbox hand enqueues onto the wired dirs ─────────────────────
 	{

package/scripts/check-entwurf-v2-runner.ts

@@ -101,7 +101,7 @@ const NATIVE_PUSH_PLAN: NativePushPlan = {
 	targetGardenId: GID,
 	backend: "antigravity",
 	nativeSessionId: "conv-xyz",
-	route: { lsAddress: "127.0.0.1:5599" },
+	route: { backend: "antigravity", lsAddress: "127.0.0.1:5599" },
 	wantsReply: false,
 	message: "m",
 };