@junghanacs/entwurf 0.41.0 → 0.41.2

package/docs/setup-clean-host.md

@@ -23,18 +23,22 @@ evidence split, and its three states must not collapse into "macOS is supported"
 
 ## Requirements
 
+This table is the published `@junghanacs/entwurf@0.41.1`'s, which ships the Pi 1.4.0 SDK set.
+The previous package, `0.41.0`, ships the Pi 1.3.0 SDK set and requires Pi 1.3.x; the setup guide
+inside that tarball is its contract.
+
 | Component | Requirement | Needed for |
 |---|---|---|
 | Node | **`>=24.0.0`** | package and bridge runtime |
 | npm/pnpm | npm is bundled with Node; pnpm is required for source setup | package or source installation |
 | Python 3 | required by `setup`/`install` (project-path normalization + settings writers); `--help`/`check-bridge` stay Python-free | pi/Claude/agy/Copilot/Codex wiring writers |
 | entwurf | global/project-local `@junghanacs/entwurf`, or a source checkout | operator command and garden capability |
-| pi | optional-by-presence, `>=1.3.0 <1.4` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
-| Native durable (`pi-durable`) | supplied by the Entwurf package (#130): Entwurf's owned app carrier plus the exact 1.3.0 pi SDK set as production dependencies — setup PASS when they verify, a named FAIL otherwise (never SKIP) | the `entwurf pi-durable` contact; native birth/LIVE on this supply surface is a separate release proof (§2b) |
+| pi | optional-by-presence, `>=1.4.0 <1.5` — absent is an explicit setup SKIP, below-floor is a named FAIL | ACP provider, control sockets |
+| Native durable (`pi-durable`) | supplied by the Entwurf package (#130): Entwurf's owned app carrier plus the exact 1.4.0 pi SDK set as production dependencies — setup PASS when they verify, a named FAIL otherwise (never SKIP) | the `entwurf pi-durable` contact; native birth/LIVE on this supply surface is a separate release proof (§2b) |
 | Claude Code | optional, **`>=2.1.306`** — the exec-form hook floor | Claude ACP auth/runtime and mailbox-backed native citizen |
 | GitHub Copilot CLI | optional-by-presence, operator-installed and authenticated — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/receiver/footer) | self-fetch citizen and visible fresh |
 | OMP (`omp`) | optional-by-presence, operator-installed — absent is an explicit setup SKIP; detected composes all four units (birth/MCP/`tools.xdev` setting/receiver) | self-fetch citizen and visible fresh (accepted on one host — see §4b) |
-| Antigravity `agy` | optional, operator-installed and authenticated | native-push citizen |
+| Antigravity `agy` | optional, operator-installed and authenticated | legacy citizen; native push paused (#152) |
 | OpenAI Codex CLI | optional-by-presence, operator-installed and authenticated; detected composes all four operator-owned units (birth/MCP/status-line/terminal-title) and stays non-green until the operator trusts the birth declaration once in a visible Codex; visible fresh also requires the operator-owned app-server, started with `entwurf codex-app-server` in a tmux session of the operator's choosing (#95 D1 retired the fixed `codex` home) | native-push and visible fresh, supported in 0.21.0 |
 | Cortex Code | optional, operator-installed and authenticated | Cortex ACP backend |
 
@@ -79,11 +83,14 @@ node --version
 npm --version
 ```
 
+The two npm forms below install the **published** package, `0.41.1` (Pi 1.4.x, the Pi 1.4.0 SDK
+set).
+
 Global install is simplest when native harnesses should find stable bins from every
 working directory:
 
 ```bash
-npm install -g @junghanacs/entwurf
+npm install -g @junghanacs/entwurf@0.41.1
 entwurf --help
 entwurf setup /path/to/your-project
 entwurf check-bridge
@@ -94,7 +101,7 @@ A project-local installation is also supported:
 ```bash
 mkdir -p ~/entwurf-smoke && cd ~/entwurf-smoke
 npm init -y
-npm install --save-dev @junghanacs/entwurf
+npm install --save-dev @junghanacs/entwurf@0.41.1
 npx entwurf setup .
 npx entwurf check-bridge
 ```
@@ -104,7 +111,7 @@ project-local install, or `./run.sh <command>` from a source checkout. Keep that
 same scope when upgrading and checking; native process restarts are separate (§7).
 
 `check-bridge` is auth-free. It proves the installed prebuilt MCP server boots and
-lists the nine garden tools (0.41.0); it does not prove a backend model turn, native hook or retirement permission.
+lists the nine garden tools (0.41.1); it does not prove a backend model turn, native hook or retirement permission.
 
 Neither npm form installs a harness runtime. `pi`, Claude Code, Copilot CLI, Codex CLI, agy,
 Cortex, and their authentication remain operator-owned optional prerequisites for the
@@ -119,11 +126,19 @@ with a nonzero setup result):
 ```bash
 git clone https://github.com/junghan0611/entwurf ~/repos/gh/entwurf
 cd ~/repos/gh/entwurf
+git checkout "$CANDIDATE_REF"   # set it first to the commit you mean to run; a bare clone gives the default branch
 ./run.sh setup /path/to/consumer-project
 ```
 
+Set `CANDIDATE_REF` explicitly to a published branch or tag that carries the commit you mean;
+a bare clone selects the default branch, not a promised candidate. A validation branch is not a
+release acceptance. A checkout that already holds the intended commit skips the clone and the
+`git checkout`.
+
 This owns `~/.local/bin/entwurf` as a symlink to that checkout's `run.sh` and fails if the
-link is foreign, outside PATH, or shadowed by another command. It detects and wires
+link is foreign, outside PATH, or shadowed by another command, or if another root still answers to
+a package bin name in PATH or in the global bin dir `pnpm bin -g` / `npm prefix -g` report (it
+removes nothing). It detects and wires
 pi/Claude/agy/Copilot/OMP/Codex by presence and prints a computed per-component
 PASS/SKIP/FAIL summary — a detected harness that cannot be completed makes setup exit nonzero.
 A detected `copilot` composes all four native units, and a detected `omp` composes its own four.
@@ -207,10 +222,12 @@ physical-Darwin receipt. `entwurf install` may write `.pi/settings.json`
 on Darwin; that is wiring, not a rail receipt. If `pi` is on PATH,
 `setup` names the pi row FAIL with the §1 Darwin wording.
 
-Install the exact release floor, then wire the project:
+Install the exact release floor, then wire the project. The previous 0.41.0 instead takes the
+Pi 1.3.x its own setup guide names. A source checkout passes its checkout path to `-e` in place of
+the global package root:
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@1.3.0
+npm install -g @earendil-works/pi-coding-agent@1.4.0
 pi --version
 
 cd ~/entwurf-smoke
@@ -218,7 +235,7 @@ entwurf install .
 pi -e "$(npm root -g)/@junghanacs/entwurf" --list-models entwurf
 ```
 
-The supported range is `>=1.3.0 <1.4`. It is a hard minimum: installing this
+The supported range is `>=1.4.0 <1.5`. It is a hard minimum: installing this
 release onto a 0.83.x pi host upgrades the runtime rather than keeping the older
 minor. A host using only the external MCP bridge can skip pi until it needs a
 control socket; no delivery rail launches a pi process.
@@ -240,14 +257,14 @@ A plain `pi` can load the package without becoming a citizen.
 In that session ask for `entwurf_self`, then `entwurf_peers`. Pick an existing
 live garden id and ask for `entwurf_v2` with `intent: "fire-and-forget"` and your
 message. These are harness tools, not shell subcommands; pi exposes them through
-Pi's built-in MCP as `mcp__entwurf_bridge__<verb>`. The 0.41.0 bridge has nine tools;
+Pi's built-in MCP as `mcp__entwurf_bridge__<verb>`. The 0.41.1 bridge has nine tools;
 pi hides `entwurf_inbox_read` and `entwurf_register_native`, leaving seven active.
 The added `entwurf_retire_call` is only for one target/action explicitly requested by the
 human operator, never autonomous cleanup. Where a host provides or is configured with an approval
 step, that step applies as well; Pi and pi-durable 1.3.0 have no built-in approval prompt by
 default. The configured Claude ACP child is also [set to run without per-call permission prompts](./acp-backend-rail.md#configured-claude-acp-permissions); ACP retirement remains unmeasured.
 Tool availability, annotations and caller identity are not a grant.
-These candidate counts do not claim that an older installed package or running host has rolled
+These counts do not claim that an older installed package or running host has rolled
 forward; see [applying new source to a running host](#applying-new-source-to-a-running-host).
 Tool-call ingress is MCP; delivery to a pi citizen is still its record-addressed
 control address (a Unix socket; a named pipe on the experimental native-Windows Pi
@@ -322,7 +339,7 @@ by `entwurf pi` or by registering ordinary Pi's adapter.
 What the Entwurf package supplies:
 
 1. **The pi SDK set** — `@earendil-works/{pi-coding-agent, pi-ai, pi-tui, pi-agent-core,
-   pi-durable, chord, pi-mcp, pi-codemode, pi-telemetry}` at exactly `1.3.0`, plus
+   pi-durable, chord, pi-mcp, pi-codemode, pi-telemetry}` at exactly `1.4.0`, plus
    `proper-lockfile`, as Entwurf's own production dependencies (declared once in
    `pi/pi-durable/overlay/upstream-pin.json` `sdk`). Model data rides the published
    `pi-ai`; there is no catalog copy.
@@ -335,7 +352,7 @@ What the Entwurf package supplies:
    (`pi/pi-durable/carrier-resolver.mjs`), which maps them to the published package's
    own `dist/` as installed — never through a source checkout.
 
-The upstream [library guide](https://github.com/earendil-works/pi/blob/v1.3.0/packages/durable/README.md)
+The upstream [library guide](https://github.com/earendil-works/pi/blob/v1.4.0/packages/durable/README.md)
 and the [experimental app guide](https://github.com/earendil-works/pi/blob/v1.1.0/packages/coding-agent/src/experimental/durable/README.md)
 (last published at v1.1.0) describe what the carrier is. Running the bare upstream app does not attach Entwurf's
 garden contact. Entwurf does not rebuild the controller/model/auth/storage system or
@@ -420,7 +437,7 @@ tree (for example an override that binds pi-durable's `pi-ai` to an older publis
   manifest field; it is a known constraint of supplying both from one package, accepted for 0.32,
   not a claim that every load path is harmless.
 
-The ordinary Pi CLI on PATH is a separate subject (§2, range `>=1.3.0 <1.4`): a host Pi is
+The ordinary Pi CLI on PATH is a separate subject (§2, range `>=1.4.0 <1.5`): a host Pi is
 not needed to run pi-durable, and a host inside the range need not be the same copy as the
 carrier's. Native Pi owns credentials, model settings and durable SQLite sessions; keep them
 in place rather than copying credentials or migrating ordinary Pi transcripts. Native
@@ -431,6 +448,29 @@ to the app's own model resolution; the checkout contact/send/receive gates run t
 with scripted S plus native H; Pi ↔ pi-durable LIVE on this supply surface is a separate release
 proof ([#130](https://github.com/junghan0611/entwurf/issues/130)).
 
+### Moving durable sessions from the Pi 1.3 SDK to 1.4
+
+0.41.1 is published; moving a live host onto it remains a separate operator decision for each
+host. When you do:
+
+1. **Confirm the old owner is gone.** Close the 0.41 (SDK 1.3) durable session normally and check
+   that its process has exited. A stale session lock alone is not proof.
+2. **Back up first.** Before the first 1.4 open, copy the target session directory whole
+   (`session.sqlite` with any `-wal`/`-shm`) as one consistent set.
+3. **Choose the session by name.** Reopen with the `--resume` picker and pick the entry you mean;
+   do not use `--continue` on a host with more than one session.
+4. **Package downgrade is not data rollback.** The first 1.4 open migrates SQLite storage to
+   schema 2, which SDK 1.3 (Entwurf 0.41) refuses to open. Reinstalling the old package does not
+   undo that. Restoring the backup does, and work done after the 1.4 open is not in the backup.
+5. **Inspect parked work before retrying.** On its first open, 1.4 counts a task that SDK 1.3 left
+   running as one restart, and after repeated cut-offs it parks the task (`restart_limit`). Read
+   what the task already did before you resend anything: recovery of a parked model turn is not
+   measured, and its side effects or outcome may be unknown. The existing conversation abort is
+   cancellation, not retry; it need not affect background tasks.
+
+The measurements behind these points, and what they do not cover, are in the
+[#148 checkpoint](https://github.com/junghan0611/entwurf/issues/148#issuecomment-6339048361).
+
 ### Maintainer: re-emitting the carrier
 
 Only a maintainer changing the pi-durable app runs `scripts/emit-pi-durable-carrier.ts`. Its
@@ -458,31 +498,45 @@ re-emitted with `--write`, and its generated digest is reviewed like any other c
 
 ## 2c. Optional remote pair between two hosts (#107)
 
-This lets one declared pair of existing citizens on two hosts reach each other over SSH that you already run. [DELIVERY](../DELIVERY.md#remote-pair-107-one-declared-pair-across-two-hosts) owns the contract. The machine boundary is set by a person, and nothing here is automatic.
+This lets declared pairs of existing citizens on two or more hosts reach each other over SSH that you already run. Each pair is one route; one host's file may carry several (#149). [DELIVERY](../DELIVERY.md#remote-pairs-107-149-declared-pairs-across-hosts) owns the contract. The machine boundary is set by a person, and nothing here is automatic.
 
-1. **Connect the hosts yourself.** Use a private network (Tailscale or similar is recommended) and SSH keys and authorization you already trust. From each host, `ssh -o BatchMode=yes <alias> true` must succeed non-interactively, and the other host's non-interactive `command -v entwurf` must resolve to the installation you intend. Entwurf edits no SSH config, key, known-hosts file or network setting. Whatever SSH itself writes under your own policy, such as host-key updates, stays yours.
+1. **Connect the hosts yourself.** Use a private network (Tailscale or similar is recommended) and SSH keys and authorization you already trust. From each host, `ssh -o BatchMode=yes <alias> true` must succeed non-interactively, and the other host's non-interactive `command -v entwurf` must resolve to the installation you intend. Entwurf edits no SSH config, key, known-hosts file or network setting. Whatever SSH itself writes under your own policy, such as host-key updates, stays yours. Everything that can log in to an account is inside that account's trust: if two other hosts' keys reach the same account, either can claim any garden id that account's file declares.
 2. **Run the accepted bytes on both hosts, in the processes that matter.** See [applying new source to a running host](#applying-new-source-to-a-running-host). A pulled checkout or a green setup line does not, by itself, show what a running bridge loaded.
 3. **Write one file on each host,** at `remotePairOptInPath()`. That is the pi agent dir unless `ENTWURF_META_SESSIONS_DIR` moves the meta-record store. Check that the sending bridge's environment and the SSH receive environment resolve the same path. Use mode `0600` and never overwrite a file you did not inspect:
 
    ```json
    {
-     "remoteGardenId": "<the other host's garden id>",
-     "ssh": "<your existing alias for the other host>",
-     "localGardenId": "<this host's garden id that talks to it>",
-     "remotePairFile": "<absolute path of the other host's own file>"
+     "version": 2,
+     "routes": [
+       {
+         "localGardenId": "<this host's garden id that talks to it>",
+         "remoteGardenId": "<the other host's garden id>",
+         "ssh": "<your existing alias for the other host>",
+         "remotePairFile": "<absolute path of the other host's own file>"
+       }
+     ]
    }
    ```
 
-   The two files mirror each other: one host's `remoteGardenId` is the other's `localGardenId`. The other host's `remotePairFile` must spell this path as it is normalized, not through a symlinked alias.
+   Add one route per pair. One local citizen may appear in several routes, and so may one remote citizen or one alias. The file is refused if it repeats a pair, uses one garden id as both local and remote, reaches one remote garden id through two aliases or files, or gives one alias two different files. For each route, the other host's file needs the mirror route: there, this route's `remoteGardenId` is the `localGardenId`. That host's `remotePairFile` must spell this path as it is normalized, not through a symlinked alias.
 
    To check a file, read it with the repository's internal parser from a source checkout. Use the same agent/store-root settings the bridge runs with. This is a read-only dev-clone check: there is no installed operator validation verb, and it performs no send and no model input.
 
    ```bash
-   node --experimental-strip-types -e 'import("./pi-extensions/lib/remote-pair-send.ts").then(m=>console.log(m.readRemotePairOptIn(m.remotePairOptInPath())))'
+   node --experimental-strip-types -e 'import("./pi-extensions/lib/remote-pair-send.ts").then(m=>console.log(JSON.stringify(m.readRemotePairOptIn(m.remotePairOptInPath()),null,2)))'
    ```
 
    Do not validate the configuration by sending a test message.
-4. **Use it only between siblings you have open.** The measured self-fetch pair must be active and armed, and the target rail's own admission still applies. Delivery never starts, resumes or wakes an OFF citizen. To an active, armed one it rings the normal doorbell, which may start a turn at once in the receiving TUI. Remove the file to switch the pair off; there is nothing to stop or reconnect.
+4. **Use it only between siblings you have open.** The measured self-fetch pair must be active and armed, and the target rail's own admission still applies. Delivery never starts, resumes or wakes an OFF citizen. To an active, armed one it rings the normal doorbell, which may start a turn at once in the receiving TUI. Remove the file to switch every route off; there is nothing to stop or reconnect.
+
+**Converting a file from 0.41 or earlier.** The earlier versionless file (the four keys alone) is refused by name. It is not read as one route, and it is not read as off. Convert each host by hand, one host at a time:
+
+1. Inspect the existing file.
+2. Install the new bytes on that host.
+3. Restart the processes whose bridge you use. A bridge that is already running keeps the code it loaded.
+4. Rewrite the file as `{"version":2,"routes":[<the old object>]}`, mode `0600`.
+
+While the bytes and the file disagree, **every** `entwurf_v2` call of that host's bridges is refused, local targets included, because the file is read before the target is classified. That applies either way: new code with the old file, or old code with the new file. Keep that window short, and do not hide it with a fallback. The other host can stay on its own release and file until it converts. The claim, SSH argv, exit codes and receipt did not change, so the two hosts should still interoperate, but that mixed state has not been measured, and neither has any exchange over the new file.
 
 ## 3. Optional Claude Code native citizen
 
@@ -647,7 +701,7 @@ as a note rather than a fault.
 
 **entwurf sets no OMP version floor in code, and will not grow one on schedule.** Detection is
 presence-only (`command -v "${OMP_BIN:-omp}"`); there is no `entwurf.ompFloor`, no coherence
-gate, and no exact pin — unlike Node (`engines.node`), pi (`>=1.3.0 <1.4`) and Claude Code
+gate, and no exact pin — unlike Node (`engines.node`), pi (`>=1.4.0 <1.5`) and Claude Code
 (`entwurf.claudeCodeFloor`), each of which has an enforcement point. That asymmetry is a
 decision, not an omission. A floor is the answer to a vendor that fails SILENTLY — Claude Code
 earned one because an older binary validates the exec manifest, drops `args` at runtime, and
@@ -899,9 +953,14 @@ mechanism, because both the anchor and the env fallback would answer the same ro
 
 ## 5. Optional Antigravity native citizen
 
-This rail is CERTIFIED on Linux; on macOS it is NOT CERTIFIED — pending
-physical host. The installers may write on Darwin; a green install is
-not a native-push receipt.
+Native-push send on this rail is paused (#152, below). Its Linux certification is
+history: the last live bidirectional round trip was on agy 1.1.0 (2026-07-14), and it
+is not a current certification. What remains is the legacy identity surface — install,
+birth, statusline and sender identity. While the pause holds, a release accepts agy
+through the deterministic pause cell and the install/sender gates only; checking these
+surfaces in a fresh conversation is an optional diagnostic, not a release certification of
+the installed host. On macOS it is NOT CERTIFIED — pending physical host. The installers may write on Darwin; a green install is not a native-push
+receipt.
 
 Install the three independently owned surfaces:
 
@@ -920,9 +979,16 @@ owns its subtree; the hook owns one `PreInvocation` entry. Unrelated settings ar
 preserved. A fresh conversation initially may show `🪛 ? agy`; the first invocation
 births the record by native `conversationId`, after which the garden id appears.
 
-Real native-push acceptance needs an already-running conversation:
+Native push to agy is paused (#152): on the external path entwurf measured, the agy
+language server refused `agentapi` calls for a missing CSRF token (a first-party token
+path is unmeasured), so `entwurf_v2` refuses an agy target as
+`native-push-paused`, `entwurf_self` reports `replyable: false`, and
+`entwurf_register_native` refuses. The citizen keeps its garden id and statusline. While
+the pause holds, the LIVE smoke exits 2 with `[entwurf:paused]` before it reads the
+conversation id, which is not a PASS, and no conversation needs to be opened for it:
 
 ```bash
+# exits 2 [entwurf:paused] while #152 holds — not a PASS, not a SKIP
 LIVE=1 AGY_CONVERSATION_ID=<id> entwurf smoke-agy-native-push-live
 ```
 

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -77,7 +77,7 @@ import { resolveMailboxReceiverFacts } from "../../../pi-extensions/lib/entwurf-
 import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provider.js";
 import { ENTWURF_PEERS_RENDER_LIMIT, renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.js";
 import { computeSelfAddressability } from "../../../pi-extensions/lib/entwurf-self-address.js";
-import { nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contract.js";
+import { nativePushPaused, nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contract.js";
 import { resolveMailboxWakeModeCapability } from "../../../pi-extensions/lib/entwurf-v2-decider.js";
 import { retireCitizen } from "../../../pi-extensions/lib/entwurf-v2-retire.js";
 import { makeProductionRetireDeps } from "../../../pi-extensions/lib/entwurf-v2-retire-production.js";
@@ -235,6 +235,7 @@ async function buildMetaSenderEnvelope(identity, cwd, trustedMarker) {
             metaDeliveryDomain,
             recordBacked: true,
             probeAlive: await probeNativeSenderAlive(identity),
+            nativePushPaused: nativePushPaused(identity.backend),
         }
         : metaDeliveryDomain === "self-fetch"
             ? (() => {
@@ -402,7 +403,7 @@ server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids: message, r
     "mailbox only while deliverable, native-push direct injection only while its adapter probe is alive, " +
     "or a THIRD RESULT: rejection when neither holds. An inactive self-fetch citizen is mailbox-undeliverable; " +
     "native-push has NO mailbox: dead → native-push-target-dead; indeterminate → " +
-    "native-push-probe-indeterminate. " +
+    "native-push-probe-indeterminate; agy (paused, #152) → native-push-paused, no probe. " +
     "DORMANT IS UNREACHABLE: a socket-domain citizen that is not running gets dormant-fire-forget-unsupported " +
     "— same receiver rule as the mailbox, no active drainer means no delivery. " +
     "The intent that used to answer there, owned-outcome, resumed it by launching a hidden background child " +
@@ -417,7 +418,8 @@ server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids: message, r
         .describe("fire-and-forget = send/reply/hand-off to a LIVE socket target or to any citizen with no " +
         "socket liveness — the decider picks its rail, and a rail can also REJECT (self-fetch → " +
         "mailbox when deliverable, else mailbox-undeliverable; native-push → alive: direct injection, " +
-        "dead: native-push-target-dead, indeterminate: native-push-probe-indeterminate); set " +
+        "dead: native-push-target-dead, indeterminate: native-push-probe-indeterminate; a paused " +
+        "backend — agy, #152 — rejects as native-push-paused before any probe); set " +
         "wants_reply for an answer. This is the ONLY intent: owned-outcome, which resumed a dormant " +
         "citizen by launching a hidden background child, was withdrawn under the visible-first rule. " +
         "It is not selectable, not deprecated-but-tolerated; a dormant citizen is currently " +
@@ -438,11 +440,11 @@ server.tool("entwurf_v2", "CANONICAL DELIVERY SURFACE for garden ids: message, r
         // Resolved ONCE so the dispatch-moment timestamp is fixed and the control RPC sender
         // + the mailbox body sender share one envelope. No replyability gate (see above).
         const sender = await buildSendSenderEnvelope({ requestMeta: extra._meta });
-        // #107: the operator's remote-pair opt-in is read per send. Absent = off and the local
-        // surface below runs exactly as before; a declared target goes over that one route.
+        // #107/#149: the operator's remote-pair opt-in is read per send. Absent = off and the local
+        // surface below runs exactly as before; a declared target goes over its one exact route.
         const rendered = await runEntwurfV2WithRemoteRoute({ target, intent, message, mode, wants_reply }, {
             senderProvider: () => sender,
-            route: readRemotePairOptIn(remotePairOptInPath()),
+            optIn: readRemotePairOptIn(remotePairOptInPath()),
             // The decider's canonical socket dir AND this bridge's ENTWURF_DIR: a trace in either is local.
             localTrace: makeLocalTraceFact({
                 sessionsDir: defaultMetaSessionsDir(),
@@ -546,7 +548,7 @@ server.tool("entwurf_peers", "List the entwurf fact surface: garden citizens (fr
     "or a REJECT when neither holds: mailbox-undeliverable for a self-fetch citizen whose inbox " +
     "nobody drains, and on the native-push probe dead → native-push-target-dead vs " +
     "indeterminate → native-push-probe-indeterminate, kept apart because an unestablished probe " +
-    "is not a departed host. So " +
+    "is not a departed host; an agy target rejects as native-push-paused (#152) without being probed. So " +
     "`unsupported` does not promise reachability either: a record whose backend has no adapter on " +
     "this lane resolves to that reject. " +
     "Note: this is the *active* world and it is facts-only — it creates nothing. Pass an " +
@@ -616,8 +618,9 @@ server.tool("entwurf_register_native", "Register an ALREADY-RUNNING native conve
     "must be LIVE: it is probed first, and a dead/indeterminate probe is refused (no garden id is " +
     "minted for a pointer that does not resolve to a real host). Re-registering the same " +
     "conversation attaches to the SAME garden id and refreshes the cwd. Only 'antigravity' is " +
-    "registerable on this lane. No mailbox receiver marker is written — native-push has no " +
-    "idle-wake watch; the returned garden id is the reply handle.", {
+    "registerable on this lane, and antigravity native-push is PAUSED (#152): this verb refuses it by " +
+    "name before any probe and mints no garden id. No mailbox receiver marker is written — native-push " +
+    "has no idle-wake watch; the returned garden id is the reply handle.", {
     backend: z
         .enum(["antigravity"])
         .describe("The native backend hosting the conversation. Only 'antigravity' — codex is a separate lane."),
@@ -659,8 +662,8 @@ server.tool("entwurf_fresh_call", "Open ONE fresh visible sibling beside you and
     "herdr workspace, pi and claude-code " +
     "only; everywhere else it opens in the operator's tmux with all six backends (pi, " +
     "claude-code, copilot, omp, codex, pi-durable). No fallback: an incomplete herdr context is refused by name, " +
-    "never by a tmux window you cannot see from herdr. The sibling's FIRST action " +
-    "is a callback to you carrying a nonce, whose sender envelope is its garden id — that is how you learn the " +
+    "never by a tmux window you cannot see from herdr. If proceeding, the sibling calls back before its task with a nonce; " +
+    "the sender envelope names its garden id — that is how you learn the " +
     "address of a thing that did not exist a moment ago. This returns a LAUNCH receipt (the owner's " +
     "coordinates plus that nonce): it does NOT mean the runtime started, the first turn ran, or " +
     "the task was delivered. Those coordinates are a VIEW, never an address — a herdr tab/pane id can change under " +

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-self-address.js

@@ -75,6 +75,16 @@ export function computeSelfAddressability(facts) {
             // default fail-closed row).
             switch (facts.metaDeliveryDomain) {
                 case "native-push": {
+                    // #152 policy, decided BEFORE the pure record+probe predicate and kept out of it:
+                    // only a record-backed citizen can be "paused" (a record-less one keeps its own
+                    // reason), and no probe was run for this answer, so none is reported.
+                    if (facts.recordBacked === true && facts.nativePushPaused === true) {
+                        return {
+                            replyable: false,
+                            socketState: "none",
+                            reason: "native-push unreachable — native-push for this backend is paused (#152); no probe ran for this answer",
+                        };
+                    }
                     const push = nativePushDeliverable({ recordBacked: facts.recordBacked, probeAlive: facts.probeAlive });
                     return {
                         replyable: push.deliverable,

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-contract.js

@@ -119,6 +119,24 @@ export const NATIVE_PUSH_BACKENDS = ["antigravity", "codex"];
 export function nativePushSupported(backend) {
     return NATIVE_PUSH_BACKENDS.includes(backend);
 }
+// ── Paused native-push backends (#152) ─────────────────────────────────────
+// A native-push backend whose SEND is paused by product policy. On the external send path
+// entwurf measured, Antigravity's language server refused the `agentapi` call with
+// `Unauthenticated: missing CSRF token` (agy 1.2.16 in #128; agy 1.4.6 again for #152).
+// Whether a first-party own-tool shell holds a token entwurf could legitimately present is
+// UNMEASURED, not ruled out. So instead of probing a port that refused on that path and
+// reporting it as an inconclusive liveness, the three public entries that would reach the agy LS —
+// v2 dispatch, a sender's own `replyable`, and `entwurf_register_native` — refuse by name
+// BEFORE any probe. This is a fixed constant, not a flag: no env, config or runtime toggle
+// can lift it. The backend stays in NATIVE_PUSH_BACKENDS, so existing agy records, the V3
+// reader and the peers listing are unchanged; only the native-push traffic stops.
+// The one probe that is NOT behind this guard is the fresh-cut quiescence check
+// (scripts/meta-bridge-fresh-cut.ts), which protects an operator-named archive and must keep
+// failing closed rather than read the pause as a departed host.
+export const NATIVE_PUSH_PAUSED_BACKENDS = ["antigravity"];
+export function nativePushPaused(backend) {
+    return NATIVE_PUSH_PAUSED_BACKENDS.includes(backend);
+}
 /**
  * Compose the 4-value FACT liveness from a backend and its socket probe.
  * Out-of-domain backend → `unsupported` (NOT dead/indeterminate, R1). An
@@ -148,18 +166,20 @@ export const ENTWURF_V2_REJECT_REASONS = [
     "mailbox-undeliverable", // F-mailbox: fire-and-forget to an unsupported citizen whose mailbox is not deliverable (fail-closed; future pi-backend non-drainable mailbox)
     "native-push-target-dead", // 봉인 1: fire-and-forget to a native-push (agy) target whose adapter probe found NO live conversation. Post-probe; observedLiveness = dead.
     "native-push-probe-indeterminate", // 봉인 1: fire-and-forget to a native-push target whose adapter probe was inconclusive (agy alive but no port served the conv, or a probe error). Post-probe; observedLiveness = indeterminate. Never coerced to dead.
+    "native-push-paused", // #152: fire-and-forget to a native-push backend whose send is paused by product policy (NATIVE_PUSH_PAUSED_BACKENDS — antigravity). Pre-probe, observedLiveness = null: nothing was probed, so no liveness is claimed — never coerced to dead or indeterminate.
     "bad-target", // R2: absent/typo garden-id (no existing citizen); fresh creation out of v2 scope
     "record-less-socket", // #50 C4: a gid-shaped non-symlink control socket exists but NO meta-record claims it. The record is the sole address authority (목표 ②), so a bare socket is not an addressable citizen — it is a diagnostic state, refused for EVERY intent before any lock/probe (pre-probe, observedLiveness=null). NOT `bad-target`: something real answers to this gid, and mislabeling it absent would hide the very state the reject exists to surface.
     "target-locked", // R5 pre-claim for bucket B F2 per-gid lockfile conflict
     "target-address-conflict", // F3: a quarantined citizen (garden-id-socket-conflict / symlinked socket) — the gid resolves to two different receivers (record vs socket), so dispatch refuses to pick. The ONLY in-band honest channel for a dispatch-level identity-split (the listing diagnostic channel is not visible to a v2 caller, who only gets a receipt). Pre-resolver, like bad-target/target-locked — NOT a RESOLVER_REJECT_REASONS member.
 ];
 // ── Pre-probe reject reasons (？6 — observedLiveness = null) ────────────────
-// These four rejects are decided BEFORE any liveness probe runs, so there is no
+// These five rejects are decided BEFORE any liveness probe runs, so there is no
 // honest 4-value FactLiveness to stamp: `bad-target` (no citizen/backend),
 // `target-locked` (5a lock conflict, before lstat/connect), `target-address-conflict`
 // (address-subject conflict → probing is forbidden), `record-less-socket` (#50 C4:
 // no record ⇒ not a citizen ⇒ no in-domain probe ever runs — the presence hint is
-// a single lstat, not a liveness measurement). `indeterminate` means an
+// a single lstat, not a liveness measurement), `native-push-paused` (#152: the backend's
+// native-push send is paused by policy, so its adapter is never probed). `indeterminate` means an
 // in-domain probe was inconclusive (≠ "not looked yet"); `unsupported` means the
 // backend has no predicate (≠ "pre-probe"). So a pre-probe reject's
 // observedLiveness is `null`, NOT one of the four values. Every OTHER reject —
@@ -176,6 +196,7 @@ export const PRE_PROBE_REJECT_REASONS = [
     "target-locked",
     "target-address-conflict",
     "record-less-socket",
+    "native-push-paused",
 ];
 export function isPreProbeReject(reason) {
     return PRE_PROBE_REJECT_REASONS.includes(reason);

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-decider.js

@@ -44,7 +44,7 @@
  * be bypassed.
  */
 import { isOutOfSocketDomainGardenIdConflict } from "./entwurf-facts.js";
-import { isLivenessSupported, makeRejectReceipt, nativePushSupported, resolveDispatch, resolveNativePushDispatch, } from "./entwurf-v2-contract.js";
+import { isLivenessSupported, makeRejectReceipt, nativePushPaused, nativePushSupported, resolveDispatch, resolveNativePushDispatch, } from "./entwurf-v2-contract.js";
 import { defaultMetaMailboxDir, defaultMetaSessionsDir, metaCapabilityFor, } from "./meta-session.js";
 import { isValidSessionId } from "./session-id.js";
 import { controlSocketPath, mapInspectionToLiveness } from "./socket-discovery.js";
@@ -121,6 +121,12 @@ export async function decideDispatch(input, deps) {
     // branch is LOCK-FREE (봉인 4): the pi in-domain lock closes a socket TOCTOU, but a
     // volatile probe route has no lock meaning (a duplicate-send idempotency is a D8 future).
     if (nativePushSupported(identity.backend)) {
+        // #152: a paused native-push backend is refused by name BEFORE its adapter is probed —
+        // on the measured external path that language server refused the call (missing CSRF token),
+        // and a refusal must not be reported as a measured liveness. Pre-probe, observedLiveness null.
+        if (nativePushPaused(identity.backend)) {
+            return reject(makeRejectReceipt("native-push-paused", null));
+        }
         const probe = await deps.nativePushProbe(identity);
         const receipt = resolveNativePushDispatch(input.intent, probe.status);
         if (!receipt.ok)

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-surface.js

@@ -74,6 +74,9 @@ export function actionableRejectHint(reason) {
             // Native host up, but nothing served this conversation/thread — inconclusive, not a
             // hard dead. Backend-neutral for the same reason as the dead cell above.
             return "the native host (harness process or app-server) is up, but nothing served this conversation/thread, so the probe is INCONCLUSIVE — not a measured death. Retry once it is loaded, or verify the conversation/thread id.";
+        case "native-push-paused":
+            // #152: a policy refusal, not a liveness verdict — this dispatch probed and sent nothing.
+            return "native-push for this backend is paused (#152): its language server refused entwurf's measured external calls for a missing CSRF token, so this dispatch probed and sent nothing. The citizen and its record are kept; reach it from inside its own harness instead.";
         case "record-less-socket":
             // #50 C4: name the true cause AND the fix — a bare socket is a diagnostic
             // state, not an addressable citizen (the record is the address).

package/mcp/entwurf-bridge/dist/pi-extensions/lib/fresh-call-composition.js

@@ -63,7 +63,7 @@ export const FRESH_CALL_CALLBACK_TOOL = {
     copilot: "entwurf-bridge-entwurf_callback",
     omp: "mcp__entwurf_bridge_entwurf_callback",
     // Codex's tool process is the operator app-server, not the pane: the no-arg
-    // verb refuses there by name. First action stays the delivery verb with args.
+    // verb refuses there by name. Its callback stays the delivery verb with args.
     codex: "mcp__entwurf_bridge__entwurf_v2",
     // The durable contact registers the bridge verbs as its OWN tools under their bare names, and the
     // app offers a tool to the model by its registered name (`durable/harness/registry.ts:99`
@@ -348,8 +348,8 @@ export function composeBackendArgs(backend, composition, model, resolveCodexSock
  * PLACEMENT SENTENCE. The first line names where the sibling was opened, and only the RAIL knows
  * that — "the operator's tmux session" is true of a `new-window` launch and false of a herdr
  * pane. It is therefore supplied by the caller rather than composed here. Everything BELOW that
- * line is rail-independent and stays the contract: the callback is the first action, the task
- * follows it, and the three prohibitions are measured rather than polite.
+ * line is rail-independent and stays the contract: the callback comes before the task, an optional
+ * read-only check of the caller may come before the callback, and the steering is stated as fact.
  */
 /**
  * The first-turn framing, WITHOUT the task.
@@ -361,8 +361,13 @@ export function composeBackendArgs(backend, composition, model, resolveCodexSock
  * the halves separate is what lets the framing stay plain prose on both rails while the operator's
  * task text keeps every byte it was written with.
  *
- * Order is the contract: the callback is the FIRST action and the task follows it, so a sibling
- * that gets stuck in the task has already told the caller who it is.
+ * Order is the contract: the callback comes BEFORE THE TASK, so a sibling that gets stuck in the
+ * task has already told the caller who it is. It is not the literal first tool call. `[GLG 직접,
+ * 2026-10-24]` checking the caller and then calling back is the right order, and the framing used
+ * to say both "FIRST ACTION … call back" and "you can corroborate the caller first" — two
+ * sentences that cannot both be obeyed. What may come before the callback is the one read-only
+ * check offered below (and, where a dialect needs it, loading the tools); reading files, running
+ * commands or starting the task may not.
  *
  * WHAT THIS SAYS AND WHY IT STOPPED SAYING THE REST (#116). Until 2026-09-17 this framing carried
  * three prohibitions, including "Do not inspect environment variables, do not call entwurf_self".
@@ -390,7 +395,7 @@ export function composeFreshCallFraming(params) {
     }
     const firstAction = params.backend === "codex"
         ? [
-            `FIRST ACTION, before reading files or anything else: call ${birthTool} with ` +
+            `BEFORE THE TASK, and before reading files or running commands: call ${birthTool} with ` +
                 `target=${params.callerGardenId}, intent=fire-and-forget, wants_reply=false, and ` +
                 `message set to exactly ${params.nonce} — that string alone, nothing added.`,
             `${params.nonce} is a correlation tag this caller minted for this one launch: it names no`,
@@ -400,7 +405,7 @@ export function composeFreshCallFraming(params) {
             "entwurf_callback is refused on this rail: the tool process is the operator app-server, not this pane.",
         ]
         : [
-            `FIRST ACTION, before reading files or anything else: call ${birthTool} with no arguments.`,
+            `BEFORE THE TASK, and before reading files or running commands: call ${birthTool} with no arguments.`,
             "That call is how the caller learns the garden id you were born with. There are no",
             "parameters: a target or message you type would be a second address axis.",
             "Your own record does not carry the caller's address, so reporting your identity here does not reach it — that tool call does.",
@@ -410,9 +415,15 @@ export function composeFreshCallFraming(params) {
         "",
         ...firstAction,
         "",
-        `You can corroborate the caller first if you want to: ${peersTool} is a read-only listing of`,
-        `this garden's citizens and ${params.callerGardenId} is one of them. That listing is capped, so`,
-        "a caller you do not happen to see in it is not a reason to skip the callback.",
+        // THE CHECK IS THE SIBLING'S, AND SO IS ITS VERDICT. `[GLG 직접, 2026-10-24]` a capped listing that
+        // does not show the caller proves nothing about the caller, but a sibling whose check does not hold
+        // up may say so and hold back. Entwurf decides nothing here — no trust store, no fallback, no
+        // watcher — and the cost of holding back is stated, not hidden: no callback, no address.
+        `You may corroborate the caller before that call: ${peersTool} is a read-only listing of`,
+        `this garden's citizens and ${params.callerGardenId} is one of them. That listing is capped, so not`,
+        "seeing the caller in it does not show the caller is absent. If what you can check is not enough,",
+        "or it conflicts with this message, you may say so here and hold the callback and the task; the",
+        "caller then has no address for you.",
         ...hintBlock,
         "",
         // WHERE THE RESULT GOES, said once, as topology. `[GLG 직접, 2026-09-18]` a Sonnet sibling

package/mcp/entwurf-bridge/dist/pi-extensions/lib/herdr-fresh-call.js

@@ -899,10 +899,12 @@ export function renderHerdrFreshCall(result) {
             `mean the sibling is running, that its first turn ran, or that the task was delivered. The tab and pane ` +
             `coordinates are a view and can change under the sibling — they are not an address and nothing may be ` +
             `dispatched to them.\n` +
-            `The sibling's garden id arrives separately — its first action is the zero-argument callback verb, and ` +
+            `The sibling's garden id arrives separately — before its task it calls the zero-argument callback verb ` +
+            `(a read-only look at the caller may come first), and ` +
             `the sender envelope of THAT message is the address. The nonce above is the correlation tag it carries; ` +
             `the sibling reads it from its own launch env, never from this receipt. Nothing is polling for it; if it ` +
-            `never comes, the pane is visible and can be read directly.`,
+            `never comes — not started, stuck, or held back after its check; this receipt cannot tell which — the ` +
+            `pane is visible and can be read directly.`,
         isError: false,
     };
 }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-sender-identity.js

@@ -46,6 +46,7 @@
  * rails never merge — `codex` is deliberately absent from {@link META_SENDER_BACKENDS}, since
  * a backend listed there is one whose hook writes a pid marker, and codex birth writes none.
  */
+import { nativePushPaused } from "./entwurf-v2-contract.js";
 import { defaultMetaSessionsDir, describe, isPlausibleOwnerPid, listAllMetaIdentities, makeStoreRecordReader, metaRecordExistsByGardenId, parentPid, readActiveStoreEntries, readMetaIdentityByGardenId, readMetaSenderMarker, } from "./meta-session.js";
 import { resolveNativePushAdapter } from "./native-push/adapter.js";
 /** Every native backend that mints a garden-id from its own hook and writes a sender marker.
@@ -193,6 +194,10 @@ export function resolveTrustedMetaSenderIdentity(opts = {}) {
  * exactly the Crash-Don't-Warn shape this lane exists to remove. Let them propagate.
  */
 export async function probeNativeSenderAlive(identity, deps = {}) {
+    // #152: a paused native-push backend cannot receive a reply, so its `replyable` is false by
+    // POLICY — no adapter is resolved or probed. This is not a liveness verdict about the citizen.
+    if (nativePushPaused(identity.backend))
+        return false;
     const resolveAdapter = deps.resolveAdapter ?? resolveNativePushAdapter;
     const probe = await resolveAdapter(identity.backend).probe(identity.nativeSessionId);
     return probe.status === "alive";

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-fresh-call.js

@@ -514,11 +514,13 @@ export function renderFreshCall(result) {
             `\n` +
             `This is a LAUNCH receipt: tmux created that window and was asked to start the runtime with the model above. It does ` +
             `NOT mean the sibling is running, that its first turn ran, or that the task was delivered.\n` +
-            `The sibling's garden id arrives separately — its first action is the zero-argument callback verb ` +
-            `(codex is the one arm that still sends the nonce as arguments), and the sender envelope of THAT ` +
+            `The sibling's garden id arrives separately — before its task it calls the zero-argument callback verb ` +
+            `(codex is the one arm that still sends the nonce as arguments; a read-only look at the caller may come ` +
+            `first), and the sender envelope of THAT ` +
             `message is the address. The nonce above is the correlation tag it carries; the sibling reads it ` +
-            `from its own launch env, never from this receipt. Nothing is polling for it; if it never comes, ` +
-            `the window is visible and can be read directly.`,
+            `from its own launch env, never from this receipt. Nothing is polling for it; if it never comes — ` +
+            `not started, stuck, or held back after its check; this receipt cannot tell which — the window is visible ` +
+            `and can be read directly.`,
         isError: false,
     };
 }