@junghanacs/entwurf 0.38.1 → 0.40.0

package/mcp/entwurf-bridge/src/index.ts

@@ -108,6 +108,15 @@ import {
 } from "../../../pi-extensions/lib/meta-session.ts";
 import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.ts";
 import { registerNativeConversation } from "../../../pi-extensions/lib/native-push/register.ts";
+import {
+	makeLocalTraceFact,
+	readRemotePairOptIn,
+	remotePairOptInPath,
+	runEntwurfV2WithRemoteRoute,
+} from "../../../pi-extensions/lib/remote-pair-send.ts";
+import { processTransport } from "../../../pi-extensions/lib/remote-pair-transport.ts";
+import { CONTROL_SOCKET_DIR } from "../../../pi-extensions/lib/socket-discovery.ts";
+import { probeSocketLiveness } from "../../../pi-extensions/lib/socket-probe.ts";
 
 const HOME = os.homedir();
 
@@ -137,6 +146,14 @@ try {
 // ENTWURF_DIR override the pi side does not. The path GRAMMAR is the shared leaf.
 const ENTWURF_DIR = process.env.ENTWURF_DIR ?? defaultControlSocketDir(HOME);
 
+/** Is this session's own control address up? A socket file's presence on Linux/macOS. On
+ * Windows (#78) the address is a named pipe, which has no file to look at and must not be
+ * opened by a stat (that connects): the owner-validated probe answers instead. */
+async function controlAddressPresent(socketPath: string): Promise<boolean> {
+	if (process.platform === "win32") return (await probeSocketLiveness(socketPath)) === "alive";
+	return existsSync(socketPath);
+}
+
 // ============================================================================
 // Live control-socket discovery for entwurf_peers lives in the TS fact-provider
 // (pi-extensions/lib/entwurf-fact-provider.ts → listEntwurfFacts), which the
@@ -219,7 +236,7 @@ class EntwurfSenderIdentityError extends Error {
 	}
 }
 
-function buildStrictPiSenderEnvelope(): SenderEnvelope {
+async function buildStrictPiSenderEnvelope(): Promise<SenderEnvelope> {
 	const sessionId = process.env.PI_SESSION_ID?.trim();
 	const agentId = process.env.PI_AGENT_ID?.trim();
 	const cwd = process.cwd();
@@ -239,7 +256,7 @@ function buildStrictPiSenderEnvelope(): SenderEnvelope {
 	const socketPath = controlSocketPathIn(ENTWURF_DIR, sessionId as string);
 	const self = computeSelfAddressability({
 		origin: "pi-session",
-		socketAlive: existsSync(socketPath),
+		socketAlive: await controlAddressPresent(socketPath),
 		socketPathComputable: true,
 	});
 	return {
@@ -338,7 +355,7 @@ async function resolveAuthoritativeSender(
 ): Promise<AuthoritativeSelf | null> {
 	const sessionId = process.env.PI_SESSION_ID?.trim();
 	const agentId = process.env.PI_AGENT_ID?.trim();
-	const pi = sessionId && agentId && cwd ? buildStrictPiSenderEnvelope() : null;
+	const pi = sessionId && agentId && cwd ? await buildStrictPiSenderEnvelope() : null;
 	const marker = resolveTrustedMetaSenderIdentity({
 		markerPath: process.env.ENTWURF_META_SENDER_MARKER?.trim() || undefined,
 	});
@@ -511,12 +528,24 @@ server.tool(
 			// Resolved ONCE so the dispatch-moment timestamp is fixed and the control RPC sender
 			// + the mailbox body sender share one envelope. No replyability gate (see above).
 			const sender = await buildSendSenderEnvelope({ requestMeta: extra._meta });
-			const rendered = await runAndRenderEntwurfV2FromSurface(
+			// #107: the operator's remote-pair opt-in is read per send. Absent = off and the local
+			// surface below runs exactly as before; a declared target goes over that one route.
+			const rendered = await runEntwurfV2WithRemoteRoute(
 				{ target, intent, message, mode, wants_reply },
-				// No trust-preflight inputs are passed, and none exist to pass: the preflight on this
-				// path guarded the resume verdict and left with `owned-outcome`. `senderProvider` is
-				// the whole options surface now.
-				{ senderProvider: () => sender },
+				{
+					senderProvider: () => sender,
+					route: readRemotePairOptIn(remotePairOptInPath()),
+					// The decider's canonical socket dir AND this bridge's ENTWURF_DIR: a trace in either is local.
+					localTrace: makeLocalTraceFact({
+						sessionsDir: defaultMetaSessionsDir(),
+						controlSocketDirs: [CONTROL_SOCKET_DIR, ENTWURF_DIR],
+					}),
+					transport: processTransport,
+					// No trust-preflight inputs are passed, and none exist to pass: the preflight on this
+					// path guarded the resume verdict and left with `owned-outcome`. `senderProvider` is
+					// the whole options surface now.
+					runLocal: (params, opts) => runAndRenderEntwurfV2FromSurface(params, opts),
+				},
 			);
 			return rendered.isError ? textErr(rendered.text) : textOk(rendered.text);
 		} catch (err) {
@@ -559,7 +588,7 @@ server.tool(
 				// live socket). The old code synthesized the path and printed it as if
 				// it existed — a lie when the session has no --entwurf-control (SE-1).
 				const socketPath = controlSocketPathIn(ENTWURF_DIR, sender.sessionId);
-				const socketState = existsSync(socketPath) ? "alive" : "expected";
+				const socketState = (await controlAddressPresent(socketPath)) ? "alive" : "expected";
 				extra.socketPath = socketPath;
 				extra.socketState = socketState;
 				lines.push(

package/mcp/entwurf-bridge/tsconfig.build.json

@@ -141,6 +141,12 @@
 	// only repo import is meta-session.ts, ALREADY emitted for the store-doctor, so this adds
 	// ONE leaf JS and ZERO new deps. It is an omp-loaded extension module, never in
 	// index.ts's boot closure, so check-entwurf-bridge-pi-free is unaffected.
+	// WHY remote-pair-receive rides THIS build (#107): the sending host's ssh runs the receiving
+	// host's `entwurf remote-pair-receive`, and on an installed host run.sh lives under
+	// node_modules, where run_ts needs a compiled twin. Its repo imports (remote-pair-receive,
+	// remote-pair-send, entwurf-v2-surface, meta-session) are ALREADY emitted for the bridge's own
+	// entwurf_v2 handler, so this adds ONE leaf JS and ZERO new deps. It is never in index.ts's boot
+	// closure.
 	"include": [
 		"./src/index.ts",
 		"../../protocol.js",
@@ -156,6 +162,7 @@
 		"../../scripts/omp-receive-facts.ts",
 		"../../scripts/codex-socket-path.ts",
 		"../../scripts/codex-socket-classify.ts",
+		"../../scripts/remote-pair-receive.ts",
 		"../../pi-extensions/meta-bridge-hook.ts",
 		"../../pi-extensions/meta-bridge-hook-copilot.ts",
 		"../../pi-extensions/meta-bridge-hook-codex.ts",

package/native/win32-x64/manifest.json

@@ -0,0 +1,45 @@
+{
+	"schema": 1,
+	"platform": "win32",
+	"arch": "x64",
+	"file": "entwurf_win.node",
+	"sha256": "9837893521ec1d033913ca6cd1b705cb6e942e8d5c288948a1ed0ca0e28655e5",
+	"napiVersion": 8,
+	"builtWith": {
+		"node": "24.18.1",
+		"nodeGyp": "13.1.0",
+		"platformToolset": "v145",
+		"windowsTargetPlatformVersion": "10.0.26100.0",
+		"visualStudio": {
+			"displayName": "Visual Studio Enterprise 2026",
+			"installationVersion": "18.10.12224.181"
+		}
+	},
+	"source": {
+		"entwurf_win.c": "aa8a2994833d6dbbbf56c78687d42df52f645f3f35073943d897f58169219c31",
+		"binding.gyp": "be95dcfb152a91377a011aedbadd7943965ede251612394eacb405b20689f18e",
+		"package.json": "6ba65c909857f18a5d8e16b63fa55201b1d17261cc4afb1f2eea10514b2cac6a",
+		"package-lock.json": "d7dc3c48d003f2356d961972ad5515f192f2c846af8d0b551fa08d20ce155ede",
+		"build.mjs": "68120f85289e9598f440b1e0be506feb50a37897414d234ffc6698b754b2988e"
+	},
+	"provenance": {
+		"statement": "tracked C + declared upstream build glue",
+		"compiled": {
+			"entwurf_win.c": "tracked source",
+			"node-gyp/src/win_delay_load_hook.cc": {
+				"version": "13.1.0",
+				"sha256": "ec2357ffdf512151c21a52326ad3396aaa650b83e5c4a31153d216a155f68ecc",
+				"license": "MIT",
+				"notice": "LICENSES/node-gyp.txt",
+				"licenseSha256": "662a1b0115251cfb29c6aed0f221f8847bc49c6365d1c53a62c9f4bccc2489c3"
+			}
+		},
+		"declaredLinkInputs": [
+			"advapi32.lib",
+			"kernel32.lib",
+			"node.lib (import library, Node v24.18.1 win-x64)",
+			"MSVC static CRT (/MT)"
+		],
+		"headers": "Node v24.18.1 headers tarball (MIT), declarations only"
+	}
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.38.1",
+	"version": "0.40.0",
 	"description": "Visible sibling sessions across independent agent harnesses: launch in Herdr or tmux, reopen pi in tmux, and deliver messages by garden id; native bridges and Claude/Cortex ACP adapters.",
 	"license": "MIT",
 	"author": {
@@ -41,6 +41,8 @@
 	"files": [
 		"protocol.js",
 		"pi-extensions/",
+		"native/win32-x64/",
+		"LICENSES/node-gyp.txt",
 		"mcp/",
 		"scripts/",
 		"prompts/",
@@ -193,8 +195,8 @@
 		"check:full": "bash scripts/check-elapsed.sh check:full check:core check:hermetic check:package",
 		"check:core": "pnpm run check:toolchain && pnpm run check:vitest && pnpm run check:contracts",
 		"check:toolchain": "pnpm lint && pnpm typecheck",
-		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior",
-		"check:contracts": "./run.sh check-demo-reproducibility && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-set-model-readback && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-pi-durable-beside && ./run.sh check-pi-durable-carrier && ./run.sh check-pi-durable-native-module",
+		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit",
+		"check:contracts": "./run.sh check-demo-reproducibility && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-win32-preview && ./run.sh check-pack-win32-carrier && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-set-model-readback && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-pi-durable-beside && ./run.sh check-pi-durable-carrier && ./run.sh check-pi-durable-native-module",
 		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-pi-launch && ./run.sh check-codex-app-server-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-birth-hook && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-peer-facts && ./run.sh check-herdr-plugin && ./run.sh check-herdr-plugin-profile && ./run.sh check-herdr-plugin-build && ./run.sh check-herdr-runtime-bootstrap && ./run.sh check-herdr-activation && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-typing-call-fence && ./run.sh check-gate-manifests && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex && ./run.sh check-codex-bridge-identity && ./run.sh check-pi-bridge-sender && ./run.sh check-pi-mcp-register && ./run.sh check-pi-mcp-bridge && ./run.sh check-codex-birth-hook && ./run.sh smoke-codex-config-state && ./run.sh smoke-codex-birth && ./run.sh check-herdr-sandbox",
 		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-pack-consumer-roots && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},

package/pi-extensions/entwurf-control.ts

@@ -147,8 +147,12 @@ async function ensureControlDir(): Promise<void> {
 	await fs.mkdir(ENTWURF_DIR, { recursive: true });
 }
 
+// On Windows the control address is a named pipe (`\\.\pipe\…`, #78): the kernel owns the
+// name and drops it with the last handle, so there is no file to unlink and none to sweep.
+const PIPE_ADDRESSED = process.platform === "win32";
+
 async function removeSocket(socketPath: string | null): Promise<void> {
-	if (!socketPath) return;
+	if (!socketPath || PIPE_ADDRESSED) return;
 	try {
 		await fs.unlink(socketPath);
 	} catch (error) {
@@ -162,6 +166,7 @@ async function removeSocket(socketPath: string | null): Promise<void> {
 // alias-era artifacts. Runs once per startControlServer call. We only touch
 // entries that are demonstrably dead — a live peer's socket survives.
 async function gcStaleSockets(): Promise<void> {
+	if (PIPE_ADDRESSED) return;
 	let entries: import("node:fs").Dirent[];
 	try {
 		entries = await fs.readdir(ENTWURF_DIR, { withFileTypes: true });

package/pi-extensions/lib/control-socket-path.js

@@ -24,9 +24,18 @@
  * adapter keeps its own root policy: the pi side derives from HOME, the MCP
  * bridge honours `ENTWURF_DIR`. What is unified is the grammar, not the policy.
  *
- * Keep dependency-free except `node:path`.
+ * Windows (#78) has no socket files: the address is a named pipe,
+ * `\\.\pipe\entwurf-<sha256(canonRoot(dir))[:16]>-<gardenId>`. The digest keeps two
+ * store roots on one host apart without putting a path in the pipe namespace; it is not
+ * a new address axis (still the garden id plus the store root). The inverse grammar has
+ * no Windows half because nothing scans the pipe namespace: candidates come from records.
+ *
+ * Keep dependency-free except node builtins (`node:path`, and `node:crypto`/`node:fs`
+ * for the Windows root canonicalisation only).
  */
 
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
 import * as path from "node:path";
 
 /** Control-socket filename suffix. The stem is a bare garden id. */
@@ -51,9 +60,55 @@ export function defaultControlSocketDir(home) {
  * @returns {string}
  */
 export function controlSocketPathIn(dir, gardenId) {
+	if (process.platform === "win32") return win32PipeNameFor(dir, gardenId);
 	return path.join(dir, `${gardenId}${CONTROL_SOCKET_SUFFIX}`);
 }
 
+/** Every Windows control pipe this package names starts here. */
+export const WIN32_PIPE_PREFIX = "\\\\.\\pipe\\entwurf-";
+
+/**
+ * The one spelling of a Windows store root, so Pi A, Pi B, the bridge and peer-facts
+ * derive the same pipe name from differently written paths. The nearest EXISTING ancestor
+ * of `path.win32.resolve(dir)` goes through `realpath` (8.3 names expanded, case from the
+ * filesystem); the components below it are appended as written. Separators become `\`,
+ * there is no trailing separator, and the whole string is lower-cased. Nothing is created
+ * or touched, so the control dir need not exist yet. A failure other than ENOENT throws.
+ *
+ * @param {string} dir
+ * @param {(p: string) => string} [realpath]
+ * @returns {string}
+ */
+export function canonRootWin32(dir, realpath = fs.realpathSync.native) {
+	let head = path.win32.resolve(dir);
+	/** @type {string[]} */
+	const tail = [];
+	for (;;) {
+		try {
+			const joined = path.win32.join(realpath(head), ...tail);
+			return joined.replace(/[\\/]+$/, "").toLowerCase();
+		} catch (err) {
+			const parent = path.win32.dirname(head);
+			if (/** @type {{ code?: unknown }} */ (err).code !== "ENOENT" || parent === head) throw err;
+			tail.unshift(path.win32.basename(head));
+			head = parent;
+		}
+	}
+}
+
+/**
+ * Forward grammar on Windows: `\\.\pipe\entwurf-<16 hex>-<gardenId>`.
+ *
+ * @param {string} dir
+ * @param {string} gardenId
+ * @param {(p: string) => string} [realpath]
+ * @returns {string}
+ */
+export function win32PipeNameFor(dir, gardenId, realpath) {
+	const digest = createHash("sha256").update(canonRootWin32(dir, realpath), "utf8").digest("hex").slice(0, 16);
+	return `${WIN32_PIPE_PREFIX}${digest}-${gardenId}`;
+}
+
 /**
  * Inverse grammar: a socket filename back to its garden id, or `null` when the
  * name does not carry the suffix.

package/pi-extensions/lib/entwurf-control-rpc.ts

@@ -15,6 +15,7 @@
  */
 
 import * as net from "node:net";
+import { win32Native } from "./win32-native.js";
 
 // `sender` carries the transparency envelope (agentId / sessionId / cwd /
 // timestamp). All four fields are mandatory whenever `sender` is present —
@@ -199,6 +200,7 @@ export async function sendRpcCommand(
 	options: RpcClientOptions = {},
 ): Promise<{ response: RpcResponse }> {
 	const { timeout = 5000 } = options;
+	if (process.platform === "win32") return await sendPipeRpcCommand(socketPath, command, timeout);
 
 	return new Promise((resolve, reject) => {
 		const socket = net.createConnection(socketPath);
@@ -277,3 +279,33 @@ export async function sendRpcCommand(
 		});
 	});
 }
+
+/**
+ * The Windows client (#78). The addon makes one owner-validated connect, writes the request
+ * line and returns the first response line, all inside one deadline; a timeout is
+ * `ETIMEDOUT`, a pipe owned by anyone but this token's expected owner is `EPERM` before any
+ * byte. The protocol is request-bound on its own connection, so that first line IS the
+ * answer: anything other than this command's response is refused, never waited past.
+ */
+async function sendPipeRpcCommand(
+	pipeName: string,
+	command: RpcCommand,
+	timeout: number,
+): Promise<{ response: RpcResponse }> {
+	const { responseLine } = await win32Native().pipeRpc(
+		pipeName,
+		JSON.stringify(command),
+		Math.max(0, Math.floor(timeout)),
+	);
+	let msg: unknown;
+	try {
+		msg = JSON.parse(responseLine.trim());
+	} catch {
+		throw new Error(`control pipe answered ${command.type} with a line that is not JSON`);
+	}
+	const response = msg as RpcResponse & { type?: unknown };
+	if (response?.type !== "response" || response.command !== command.type) {
+		throw new Error(`control pipe answered something other than the ${command.type} response`);
+	}
+	return { response };
+}

package/pi-extensions/lib/meta-mailbox-body.ts

@@ -35,6 +35,9 @@ export interface MailboxSenderEnvelope {
 	timestamp: string; // ISO 8601 UTC
 	origin?: "pi-session" | "external-mcp" | "meta-session";
 	replyable?: boolean;
+	/** #107: set only by the receiving half of a declared remote pair. `via` is the route label;
+	 * `replyRoute` says whether this host declares a route back. Neither is a probe. */
+	remote?: { via: string; replyRoute: "declared" | "none" };
 }
 
 /** `~`-abbreviate a home-relative cwd for display. Reads process.env.HOME. */
@@ -72,14 +75,20 @@ export function formatMetaMailboxBody(sender: MailboxSenderEnvelope, message: st
 	const replyable = sender.replyable === true;
 	const isMeta = sender.origin === "meta-session";
 	const kind = isMeta ? "meta-session, " : "";
+	// A remote sender is never replyable here: no reply route was probed. Its cwd is a path on the
+	// SENDING host, so it is neither abbreviated against this host's HOME nor shown as a local path.
+	const remote = !replyable ? sender.remote : undefined;
 	const sessionLine = replyable
 		? `${sender.sessionId} (${kind}replyable — reply via entwurf_v2 to this sessionId, intent=fire-and-forget)`
-		: isMeta
-			? `${sender.sessionId} (meta-session, non-replyable)`
-			: `${sender.sessionId} (external, non-replyable)`;
+		: remote
+			? `${sender.sessionId} (remote via ${remote.via}; ${remote.replyRoute === "declared" ? "reply route declared, not probed" : "no reply route declared"})`
+			: isMeta
+				? `${sender.sessionId} (meta-session, non-replyable)`
+				: `${sender.sessionId} (external, non-replyable)`;
+	const where = remote ? `${sender.cwd} (sender-host path)` : abbreviateHome(sender.cwd);
 	return (
 		`[entwurf received ⟵]\n` +
-		`  from:        ${sender.agentId} @ ${abbreviateHome(sender.cwd)}\n` +
+		`  from:        ${sender.agentId} @ ${where}\n` +
 		`  session:     ${sessionLine}\n` +
 		`  at:          ${formatKstTimestamp(sender.timestamp)}\n` +
 		`  wants reply: ${wantsReply ? "yes" : "no"}\n` +

package/pi-extensions/lib/meta-session.ts

@@ -53,6 +53,7 @@
 import { execFileSync } from "node:child_process";
 import * as crypto from "node:crypto";
 import * as fs from "node:fs";
+import { createRequire } from "node:module";
 import * as os from "node:os";
 import * as path from "node:path";
 import { generateSessionId, SESSION_ID_RE } from "./session-id.js";
@@ -1017,6 +1018,7 @@ const O_NONBLOCK_FLAG = typeof fs.constants.O_NONBLOCK === "number" ? fs.constan
  * Shaping a message is the job of the caller that knows what the answer is FOR.
  */
 export function readStoreRecordFile(file: string): string {
+	if (process.platform === "win32") return win32RecordReader()(file).toString("utf8");
 	if (O_NOFOLLOW_FLAG === 0) {
 		throw new MetaRecordError(
 			`cannot read meta-record ${path.basename(file)} safely: this platform exposes no O_NOFOLLOW, so a record ` +
@@ -1039,6 +1041,18 @@ export function readStoreRecordFile(file: string): string {
 	}
 }
 
+/**
+ * Windows has no `O_NOFOLLOW` (libuv defines it as 0), so the same three decisions — a
+ * final-component reparse point refused as `ELOOP`, a non-regular entry as
+ * `ENTWURF_ENOTREG`, both on the handle the read uses — are made by the preview addon
+ * (#78). It is reached only here and only on win32, through `createRequire`, so the
+ * installers that copy this file without its siblings never load it on Linux or macOS.
+ */
+function win32RecordReader(): (file: string) => Buffer {
+	const native = createRequire(import.meta.url)("./win32-native.js") as typeof import("./win32-native.js");
+	return native.win32ReadNoFollow;
+}
+
 /** The reader every store-WIDE scan pairs with {@link readActiveStoreEntries}. The
  * caller's entry kind decides the POLICY — whether a non-regular entry is a defect
  * (certification), a diagnostic (listing) or a non-candidate (the rival scan) — because

package/pi-extensions/lib/remote-pair-receive.ts

@@ -0,0 +1,184 @@
+/**
+ * remote-pair-receive — the RECEIVING half of #107's one declared remote pair (rail 1).
+ *
+ * The host that owns the target record runs this once per SSH call. It reads one JSON claim
+ * from stdin, checks it against the operator-written pair declaration, and hands a matching
+ * claim to the existing v2 dispatch. The record, owner and deliverability checks stay the
+ * dispatch's own: nothing here writes a mailbox, resolves a rail, or retries.
+ *
+ * Trust model (GLG, #107 D3 (a)): the boundary is the same operator's SSH account. The pair
+ * check is a SCOPE limit, not authentication: a claim whose `from`/`target` is not the declared
+ * pair is refused before any mutation. It does not detect that same account sending the
+ * declared gid falsely; nothing here claims to.
+ *
+ * Sender: the stdin claim is the only sender input. Ambient carriers (`PI_SESSION_ID`,
+ * `PI_AGENT_ID`, sender markers) in the SSH environment are never consulted, so this module
+ * does not import the authoritative-sender resolver at all.
+ *
+ * Display (rail 2b): the envelope keeps the existing `external-mcp` / non-replyable origin, so no
+ * receiver, control renderer or self-address table learns a new origin value. A `remote` field
+ * carries the route label and whether a route back is declared; the mailbox body renders it as
+ * `remote via <route>; reply route declared, not probed` (or `no reply route declared`), with the
+ * sender's cwd marked as a sender-host path. The pilot's display proof is the self-fetch mailbox
+ * body only: whether another rail (a live control socket, native-push injection) shows the same
+ * label is NOT PROVEN here, and nothing in this lane unifies the display across rails.
+ */
+
+import type { SenderEnvelope } from "./entwurf-control-rpc.ts";
+import type { EntwurfV2SurfaceRendered, SurfaceEntwurfV2Params } from "./entwurf-v2-surface.ts";
+import type { MailboxSenderEnvelope } from "./meta-mailbox-body.ts";
+import { requireGardenId } from "./meta-session.ts";
+
+/** One operator-declared pair, as written on the RECEIVING host. */
+export interface RemotePairDeclaration {
+	/** The sender's garden id on the other host. */
+	remoteGardenId: string;
+	/** The SSH alias this host uses to reach it (route label; never an identity). */
+	ssh: string;
+	/** The garden id on THIS host the remote sender may address. */
+	localGardenId: string;
+}
+
+/** What the sending host writes to stdin. */
+export interface RemoteClaim {
+	from: string;
+	fromAgentId: string;
+	/** A path on the SENDING host. Shown, never checked here. */
+	fromCwd: string;
+	target: string;
+	message: string;
+	wantsReply: boolean;
+}
+
+export type RemotePairRejectReason = "remote-pair-from-mismatch" | "remote-pair-target-mismatch";
+
+export type RemoteReceiveReceipt =
+	| { kind: "rejected"; reason: RemotePairRejectReason; detail: string }
+	| { kind: "dispatched"; isError: boolean; text: string };
+
+export interface RemoteReceiveDeps {
+	dispatch: (params: SurfaceEntwurfV2Params, sender: SenderEnvelope) => Promise<EntwurfV2SurfaceRendered>;
+	now?: () => Date;
+	/** Whether THIS host declares a route back to the sender. Shown, never probed. Default: none. */
+	replyRoute?: "declared" | "none";
+}
+
+const MESSAGE_CAP = 16000;
+
+/** Every Unicode control character (the class herdr-fresh-call.ts refuses). A header field is
+ * rendered unescaped into the body's `[entwurf received]` block, so a newline in one could forge a
+ * `session:` or `wants reply:` line. The message body keeps its newlines. */
+const CONTROL_CHAR = /\p{Cc}/u;
+
+export class RemotePairInputError extends Error {}
+
+function parseObject(text: string, what: string): Record<string, unknown> {
+	let raw: unknown;
+	try {
+		raw = JSON.parse(text);
+	} catch (err) {
+		throw new RemotePairInputError(`${what}: not JSON (${err instanceof Error ? err.message : String(err)})`);
+	}
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+		throw new RemotePairInputError(`${what}: must be a JSON object`);
+	}
+	return raw as Record<string, unknown>;
+}
+
+function requireExactKeys(obj: Record<string, unknown>, keys: readonly string[], what: string): void {
+	const got = Object.keys(obj).sort();
+	const want = [...keys].sort();
+	if (got.length !== want.length || got.some((k, i) => k !== want[i])) {
+		throw new RemotePairInputError(`${what}: keys must be exactly ${want.join(", ")} (got ${got.join(", ")})`);
+	}
+}
+
+function requireString(obj: Record<string, unknown>, key: string, what: string): string {
+	const v = obj[key];
+	if (typeof v !== "string" || v.length === 0) {
+		throw new RemotePairInputError(`${what}: "${key}" must be a non-empty string`);
+	}
+	return v;
+}
+
+/** A field that lands in the rendered sender header: non-empty and free of control characters. */
+function requireHeaderString(obj: Record<string, unknown>, key: string, what: string): string {
+	const v = requireString(obj, key, what);
+	if (CONTROL_CHAR.test(v)) {
+		throw new RemotePairInputError(`${what}: "${key}" must not contain control characters`);
+	}
+	return v;
+}
+
+export function parseRemoteClaim(text: string): RemoteClaim {
+	const what = "remote claim";
+	const obj = parseObject(text, what);
+	requireExactKeys(obj, ["from", "fromAgentId", "fromCwd", "target", "message", "wantsReply"], what);
+	const message = requireString(obj, "message", what);
+	if (message.length > MESSAGE_CAP) {
+		throw new RemotePairInputError(`${what}: "message" exceeds ${MESSAGE_CAP} chars`);
+	}
+	if (typeof obj.wantsReply !== "boolean") {
+		throw new RemotePairInputError(`${what}: "wantsReply" must be a boolean`);
+	}
+	return {
+		from: requireGardenId(obj.from),
+		fromAgentId: requireHeaderString(obj, "fromAgentId", what),
+		fromCwd: requireHeaderString(obj, "fromCwd", what),
+		target: requireGardenId(obj.target),
+		message,
+		wantsReply: obj.wantsReply,
+	};
+}
+
+/** The scope check. Null = inside the declared pair. */
+export function checkRemotePair(
+	claim: RemoteClaim,
+	decl: RemotePairDeclaration,
+): { reason: RemotePairRejectReason; detail: string } | null {
+	if (claim.from !== decl.remoteGardenId) {
+		return {
+			reason: "remote-pair-from-mismatch",
+			detail: `from ${claim.from} is not the declared remote ${decl.remoteGardenId}`,
+		};
+	}
+	if (claim.target !== decl.localGardenId) {
+		return {
+			reason: "remote-pair-target-mismatch",
+			detail: `target ${claim.target} is not the declared local ${decl.localGardenId}`,
+		};
+	}
+	return null;
+}
+
+export function buildRemoteSenderEnvelope(
+	claim: RemoteClaim,
+	decl: RemotePairDeclaration,
+	now: Date,
+	replyRoute: "declared" | "none" = "none",
+): SenderEnvelope & MailboxSenderEnvelope {
+	return {
+		sessionId: claim.from,
+		agentId: claim.fromAgentId,
+		cwd: claim.fromCwd,
+		timestamp: now.toISOString(),
+		origin: "external-mcp",
+		replyable: false,
+		remote: { via: decl.ssh, replyRoute },
+	};
+}
+
+export async function receiveRemoteClaim(
+	claim: RemoteClaim,
+	decl: RemotePairDeclaration,
+	deps: RemoteReceiveDeps,
+): Promise<RemoteReceiveReceipt> {
+	const mismatch = checkRemotePair(claim, decl);
+	if (mismatch) return { kind: "rejected", ...mismatch };
+	const sender = buildRemoteSenderEnvelope(claim, decl, (deps.now ?? (() => new Date()))(), deps.replyRoute);
+	const rendered = await deps.dispatch(
+		{ target: claim.target, intent: "fire-and-forget", message: claim.message, wants_reply: claim.wantsReply },
+		sender,
+	);
+	return { kind: "dispatched", isError: rendered.isError, text: rendered.text };
+}