@junghanacs/entwurf 0.41.0 → 0.41.2

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.41.0",
+	"version": "0.41.2",
 	"description": "Visible sibling sessions across independent agent harnesses: launch in Herdr or tmux, retire on request and reopen pi or Claude Code in tmux, and deliver messages by garden id; native bridges and Claude/Cortex ACP adapters.",
 	"license": "MIT",
 	"author": {
@@ -89,7 +89,8 @@
 		"CHANGELOG.md",
 		"!**/__pycache__",
 		"!**/*.pyc",
-		"!pi-extensions/**/*.test.ts"
+		"!pi-extensions/**/*.test.ts",
+		"!pi-extensions/**/fixtures/**"
 	],
 	"engines": {
 		"node": ">=24.0.0"
@@ -101,15 +102,15 @@
 		"@agentclientprotocol/claude-agent-acp": "0.90.0",
 		"@agentclientprotocol/sdk": "1.8.0",
 		"@anthropic-ai/sdk": "0.100.1",
-		"@earendil-works/chord": "1.3.0",
-		"@earendil-works/pi-agent-core": "1.3.0",
-		"@earendil-works/pi-ai": "1.3.0",
-		"@earendil-works/pi-codemode": "1.3.0",
-		"@earendil-works/pi-coding-agent": "1.3.0",
-		"@earendil-works/pi-durable": "1.3.0",
-		"@earendil-works/pi-mcp": "1.3.0",
-		"@earendil-works/pi-telemetry": "1.3.0",
-		"@earendil-works/pi-tui": "1.3.0",
+		"@earendil-works/chord": "1.4.0",
+		"@earendil-works/pi-agent-core": "1.4.0",
+		"@earendil-works/pi-ai": "1.4.0",
+		"@earendil-works/pi-codemode": "1.4.0",
+		"@earendil-works/pi-coding-agent": "1.4.0",
+		"@earendil-works/pi-durable": "1.4.0",
+		"@earendil-works/pi-mcp": "1.4.0",
+		"@earendil-works/pi-telemetry": "1.4.0",
+		"@earendil-works/pi-tui": "1.4.0",
 		"@modelcontextprotocol/sdk": "^1.12.1",
 		"proper-lockfile": "4.1.2",
 		"smol-toml": "^1.8.0",
@@ -195,10 +196,10 @@
 		"check:full": "bash scripts/check-elapsed.sh check:full check:core check:hermetic check:package",
 		"check:core": "pnpm run check:toolchain && pnpm run check:vitest && pnpm run check:contracts",
 		"check:toolchain": "pnpm lint && pnpm typecheck",
-		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit",
-		"check:contracts": "./run.sh check-demo-reproducibility && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-control-retire && ./run.sh check-pi-retire-request && ./run.sh check-cc-retire-pidfd && ./run.sh check-cc-retire-request && ./run.sh check-retirement-event && ./run.sh check-entwurf-v2-retire && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-win32-preview && ./run.sh check-pack-win32-carrier && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-fresh-call-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-set-model-readback && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-pi-durable-beside && ./run.sh check-pi-durable-carrier && ./run.sh check-pi-durable-native-module",
+		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit && ./run.sh check-chain-terminus-publication",
+		"check:contracts": "./run.sh check-demo-reproducibility && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-control-retire && ./run.sh check-pi-retire-request && ./run.sh check-cc-retire-pidfd && ./run.sh check-cc-retire-request && ./run.sh check-retirement-event && ./run.sh check-entwurf-v2-retire && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-win32-preview && ./run.sh check-pack-win32-carrier && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-fresh-call-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-native-push-paused && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-set-model-readback && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-pi-durable-beside && ./run.sh check-pi-durable-carrier && ./run.sh check-pi-durable-native-module && ./run.sh check-remote-pair-beside",
 		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-pi-launch && ./run.sh check-codex-app-server-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-birth-hook && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-peer-facts && ./run.sh check-herdr-plugin && ./run.sh check-herdr-plugin-profile && ./run.sh check-herdr-plugin-build && ./run.sh check-herdr-runtime-bootstrap && ./run.sh check-herdr-activation && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-typing-call-fence && ./run.sh check-gate-manifests && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex && ./run.sh check-codex-bridge-identity && ./run.sh check-pi-bridge-sender && ./run.sh check-pi-mcp-register && ./run.sh check-pi-mcp-bridge && ./run.sh check-codex-birth-hook && ./run.sh smoke-codex-config-state && ./run.sh smoke-codex-birth && ./run.sh check-herdr-sandbox",
-		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-pack-consumer-roots && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
+		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-pack-argv-matcher && ./run.sh check-pack-consumer-roots && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},
 	"pi": {
 		"extensions": [

package/pi/pi-durable/carrier/tui.js

@@ -219,6 +219,7 @@ export class TaskBadge                      {
 			...tally("aborting", (node) => node.abortRequested),
 			...tally("completing", (node) => !node.abortRequested && node.state.status === "completing"),
 			...tally("waiting", (node) => !node.abortRequested && node.state.status === "waiting"),
+			...tally("sleeping", (node) => !node.abortRequested && node.state.status === "sleeping"),
 			...tally("pending", (node) => !node.abortRequested && node.state.status === "pending"),
 		].join(", ");
 	}
@@ -621,19 +622,33 @@ class DurableTui {
 	}
 }
 
-function describeTask(node               )         {
+/** A task's line in the tasks panel: a sleeping task says when it wakes, a blocked one why it cannot run. */
+export function describeTask(node               )         {
 	const state = node.state;
 	const status =
 		state.status === "waiting"
 			? `waiting on ${state.on.join(", ")}`
 			: state.status === "completing"
 				? `completing (${state.outcome})`
-				: `${state.status} ${state.phase}`;
-	const flags = [node.background ? "background" : "", node.abortRequested ? "aborting" : ""].filter(Boolean);
+				: state.status === "sleeping"
+					? `sleeping ${state.phase} until ${localTime(state.until)}`
+					: `${state.status} ${state.phase}`;
+	const flags = [
+		node.background ? "background" : "",
+		node.abortRequested ? "aborting" : "",
+		node.blocked !== undefined ? `blocked:${node.blocked}` : "",
+	].filter(Boolean);
 	const owned = node.conversations.length > 0 ? ` owns conversation ${node.conversations.join(", ")}` : "";
 	return `${node.kind} #${node.id}: ${status}${flags.length > 0 ? ` [${flags.join(", ")}]` : ""}${owned}`;
 }
 
+/** Epoch milliseconds as local wall-clock time, `YYYY-MM-DD HH:MM:SS`. */
+function localTime(epoch        )         {
+	const at = new Date(epoch);
+	const pad = (n        ) => String(n).padStart(2, "0");
+	return `${at.getFullYear()}-${pad(at.getMonth() + 1)}-${pad(at.getDate())} ${pad(at.getHours())}:${pad(at.getMinutes())}:${pad(at.getSeconds())}`;
+}
+
 function userText(content                        )         {
 	if (typeof content === "string") return content;
 	return content

package/pi/pi-durable/overlay/upstream-pin.json

@@ -76,8 +76,8 @@
 			{
 				"name": "tui.js",
 				"source": "pi/pi-durable/src/experimental/durable/tui.ts",
-				"blob": "eb5e2ec4e98919cd3ff4f81f166eb52afe6555af",
-				"sha256": "a1b0d9d9358c5b54ac0974de84068b7792669171917ebd7b7351374ed625c9c5"
+				"blob": "405600f6ba1558bf6bf22d144afdcf3f1295c282",
+				"sha256": "d4bf4e2861bde917e1dcdea6f063bdc3e101ab500107a9c5fab0e3ce97fb2c4a"
 			},
 			{
 				"name": "harness-setup.js",
@@ -132,17 +132,17 @@
 		]
 	},
 	"sdk": {
-		"comment": "The published library set the carrier runs against, derived from the 1.3.0 declarations. members: the @earendil-works packages the carrier imports and every @earendil-works package those declare. direct: a third-party package a carrier file imports itself (sessions.ts: proper-lockfile, at the version pi-coding-agent 1.3.0 pins). Each is an exact production dependency in package.json. Since 1.3.0 the members' own edges are exact too (upstream #10865), and the installed physical edges are still what must equal these versions.",
+		"comment": "The published library set the carrier runs against, derived from the 1.4.0 declarations. members: the @earendil-works packages the carrier imports and every @earendil-works package those declare. direct: a third-party package a carrier file imports itself (sessions.ts: proper-lockfile, at the version pi-coding-agent 1.4.0 pins). Each is an exact production dependency in package.json. Since 1.3.0 the members' own edges are exact too (upstream #10865), and the installed physical edges are still what must equal these versions.",
 		"members": {
-			"@earendil-works/chord": "1.3.0",
-			"@earendil-works/pi-agent-core": "1.3.0",
-			"@earendil-works/pi-ai": "1.3.0",
-			"@earendil-works/pi-codemode": "1.3.0",
-			"@earendil-works/pi-coding-agent": "1.3.0",
-			"@earendil-works/pi-durable": "1.3.0",
-			"@earendil-works/pi-mcp": "1.3.0",
-			"@earendil-works/pi-telemetry": "1.3.0",
-			"@earendil-works/pi-tui": "1.3.0"
+			"@earendil-works/chord": "1.4.0",
+			"@earendil-works/pi-agent-core": "1.4.0",
+			"@earendil-works/pi-ai": "1.4.0",
+			"@earendil-works/pi-codemode": "1.4.0",
+			"@earendil-works/pi-coding-agent": "1.4.0",
+			"@earendil-works/pi-durable": "1.4.0",
+			"@earendil-works/pi-mcp": "1.4.0",
+			"@earendil-works/pi-telemetry": "1.4.0",
+			"@earendil-works/pi-tui": "1.4.0"
 		},
 		"direct": {
 			"proper-lockfile": "4.1.2"

package/pi-extensions/lib/acp/backend-adapter.ts

@@ -239,9 +239,11 @@ export interface AcpBackendAdapter {
 
 	/** OPTIONAL capability (#127): recognise a typed vendor rejection of `session/prompt`
 	 *  whose raw text must not become pi's `errorMessage`. pi decides a whole-prompt replay
-	 *  from `errorMessage` alone, and a vendor's "Internal error" — or any digit run in the
-	 *  ids it carries — reads as transient, so a turn whose tools already ran would be resent
-	 *  from a cold session. A recognised rejection returns a fixed, authored verdict for
+	 *  from `errorMessage` alone, and a vendor's "Internal error" reads as transient
+	 *  (pi-ai's `internal.?error` term), so a turn whose tools already ran would be resent
+	 *  from a cold session. Through pi-ai 1.3 a digit run inside the ids it carries (`…8503…`)
+	 *  read as an HTTP status too; pi-ai 1.4 bounds the status terms (upstream #11057), so
+	 *  the ids no longer trigger it — the "Internal error" text alone still does. A recognised rejection returns a fixed, authored verdict for
 	 *  `errorMessage`; backend.ts keeps the raw rejection as a pi diagnostic instead.
 	 *
 	 *  ABSENT means every failure of this backend keeps the verbatim-first `errorMessage`.

package/pi-extensions/lib/acp/backend.ts

@@ -668,13 +668,15 @@ async function settleChildEnd(latch: ChildEndLatch, ms: number): Promise<void> {
  * may appear here, or a dead child would put a full cold prompt replay back on
  * the table — with the tool side effects this turn already produced.
  *
- * That pattern is a bare substring alternation (`new RegExp(terms.join("|"), "i")`
- * — NO word boundaries) and its terms enumerate the HTTP statuses "429", "500",
- * "502", "503", "504" and "524". So the settle bound is deliberately NOT interpolated: rendering
- * CHILD_END_SETTLE_MS made this line say "within 500ms", which pi read as an
- * HTTP 500 and classified as transient. Naming the window in prose keeps a later
- * change of that constant from silently re-arming the replay — do not "improve"
- * this by putting the number back; the bound belongs in the code and the gate.
+ * That pattern is a substring alternation (`new RegExp(terms.join("|"), "i")` — NO word
+ * boundaries on its word terms). Through pi-ai 1.3 its HTTP status terms ("429", "500",
+ * "502", "503", "504", "520", "524") were bare substrings too, and rendering
+ * CHILD_END_SETTLE_MS made this line say "within 500ms", which pi read as an HTTP 500 and
+ * classified as transient. pi-ai 1.4 bounds only those status terms (upstream #11057), so
+ * "500ms" no longer matches; the word terms above are still unbounded. The settle bound
+ * stays deliberately NOT interpolated: naming the window in prose keeps a later change of
+ * that constant, or of the classifier, from silently re-arming the replay — do not
+ * "improve" this by putting the number back; the bound belongs in the code and the gate.
  *
  * The three endings are kept DISTINCT on purpose (issue #72 Done-when): an
  * exit code, a signal, and "we waited and it never said" are three different
@@ -1468,8 +1470,9 @@ export function streamAcpTurn(
 		// the turn-scoped full-transcript-replay cause.
 		const hint = aborted ? undefined : actionableAcpBackendHint(full);
 		// #127: pi's retry and overflow classifiers read `errorMessage` ALONE, and a
-		// vendor's "Internal error" or any digit run in its ids/stderr reads as transient
-		// — a replay of a turn whose tools already ran. A rejection the adapter names gets
+		// vendor's "Internal error" reads as transient — a replay of a turn whose tools
+		// already ran. (Through pi-ai 1.3 a digit run in its ids/stderr did too; 1.4 bounds
+		// the status terms, upstream #11057.) A rejection the adapter names gets
 		// its fixed verdict there; every raw part rides one diagnostic, appended after any
 		// existing ones. An abort keeps the abort path.
 		const rejection = aborted ? undefined : adapter?.readPromptRejection?.(err);

package/pi-extensions/lib/entwurf-self-address.ts

@@ -77,6 +77,8 @@ export interface SelfAddressabilityFacts {
 	watchArmed?: boolean;
 	/** meta-session (native-push): an adapter probe found this citizen's live native conversation. */
 	probeAlive?: boolean;
+	/** meta-session (native-push): #152 — this backend's native-push is paused, so no probe ran. */
+	nativePushPaused?: boolean;
 }
 
 export interface SelfAddressabilityResult {
@@ -118,6 +120,17 @@ export function computeSelfAddressability(facts: SelfAddressabilityFacts): SelfA
 			// default fail-closed row).
 			switch (facts.metaDeliveryDomain) {
 				case "native-push": {
+					// #152 policy, decided BEFORE the pure record+probe predicate and kept out of it:
+					// only a record-backed citizen can be "paused" (a record-less one keeps its own
+					// reason), and no probe was run for this answer, so none is reported.
+					if (facts.recordBacked === true && facts.nativePushPaused === true) {
+						return {
+							replyable: false,
+							socketState: "none",
+							reason:
+								"native-push unreachable — native-push for this backend is paused (#152); no probe ran for this answer",
+						};
+					}
 					const push = nativePushDeliverable({ recordBacked: facts.recordBacked, probeAlive: facts.probeAlive });
 					return {
 						replyable: push.deliverable,

package/pi-extensions/lib/entwurf-v2-contract.ts

@@ -134,6 +134,26 @@ export function nativePushSupported(backend: string): backend is NativePushBacke
 	return (NATIVE_PUSH_BACKENDS as readonly string[]).includes(backend);
 }
 
+// ── Paused native-push backends (#152) ─────────────────────────────────────
+// A native-push backend whose SEND is paused by product policy. On the external send path
+// entwurf measured, Antigravity's language server refused the `agentapi` call with
+// `Unauthenticated: missing CSRF token` (agy 1.2.16 in #128; agy 1.4.6 again for #152).
+// Whether a first-party own-tool shell holds a token entwurf could legitimately present is
+// UNMEASURED, not ruled out. So instead of probing a port that refused on that path and
+// reporting it as an inconclusive liveness, the three public entries that would reach the agy LS —
+// v2 dispatch, a sender's own `replyable`, and `entwurf_register_native` — refuse by name
+// BEFORE any probe. This is a fixed constant, not a flag: no env, config or runtime toggle
+// can lift it. The backend stays in NATIVE_PUSH_BACKENDS, so existing agy records, the V3
+// reader and the peers listing are unchanged; only the native-push traffic stops.
+// The one probe that is NOT behind this guard is the fresh-cut quiescence check
+// (scripts/meta-bridge-fresh-cut.ts), which protects an operator-named archive and must keep
+// failing closed rather than read the pause as a departed host.
+export const NATIVE_PUSH_PAUSED_BACKENDS: readonly NativePushBackend[] = ["antigravity"];
+
+export function nativePushPaused(backend: string): boolean {
+	return (NATIVE_PUSH_PAUSED_BACKENDS as readonly string[]).includes(backend);
+}
+
 // NativePushLiveness = the 3-value liveness the native-push adapter probe yields.
 // The SAME three values as SocketLiveness, reused so there is ONE 3-value liveness
 // vocabulary — but these are NOT socket-bound (봉인 2: "주석만 socket-전용 오독 정정"):
@@ -173,6 +193,7 @@ export const ENTWURF_V2_REJECT_REASONS = [
 	"mailbox-undeliverable", // F-mailbox: fire-and-forget to an unsupported citizen whose mailbox is not deliverable (fail-closed; future pi-backend non-drainable mailbox)
 	"native-push-target-dead", // 봉인 1: fire-and-forget to a native-push (agy) target whose adapter probe found NO live conversation. Post-probe; observedLiveness = dead.
 	"native-push-probe-indeterminate", // 봉인 1: fire-and-forget to a native-push target whose adapter probe was inconclusive (agy alive but no port served the conv, or a probe error). Post-probe; observedLiveness = indeterminate. Never coerced to dead.
+	"native-push-paused", // #152: fire-and-forget to a native-push backend whose send is paused by product policy (NATIVE_PUSH_PAUSED_BACKENDS — antigravity). Pre-probe, observedLiveness = null: nothing was probed, so no liveness is claimed — never coerced to dead or indeterminate.
 	"bad-target", // R2: absent/typo garden-id (no existing citizen); fresh creation out of v2 scope
 	"record-less-socket", // #50 C4: a gid-shaped non-symlink control socket exists but NO meta-record claims it. The record is the sole address authority (목표 ②), so a bare socket is not an addressable citizen — it is a diagnostic state, refused for EVERY intent before any lock/probe (pre-probe, observedLiveness=null). NOT `bad-target`: something real answers to this gid, and mislabeling it absent would hide the very state the reject exists to surface.
 	"target-locked", // R5 pre-claim for bucket B F2 per-gid lockfile conflict
@@ -181,12 +202,13 @@ export const ENTWURF_V2_REJECT_REASONS = [
 export type EntwurfV2RejectReason = (typeof ENTWURF_V2_REJECT_REASONS)[number];
 
 // ── Pre-probe reject reasons (？6 — observedLiveness = null) ────────────────
-// These four rejects are decided BEFORE any liveness probe runs, so there is no
+// These five rejects are decided BEFORE any liveness probe runs, so there is no
 // honest 4-value FactLiveness to stamp: `bad-target` (no citizen/backend),
 // `target-locked` (5a lock conflict, before lstat/connect), `target-address-conflict`
 // (address-subject conflict → probing is forbidden), `record-less-socket` (#50 C4:
 // no record ⇒ not a citizen ⇒ no in-domain probe ever runs — the presence hint is
-// a single lstat, not a liveness measurement). `indeterminate` means an
+// a single lstat, not a liveness measurement), `native-push-paused` (#152: the backend's
+// native-push send is paused by policy, so its adapter is never probed). `indeterminate` means an
 // in-domain probe was inconclusive (≠ "not looked yet"); `unsupported` means the
 // backend has no predicate (≠ "pre-probe"). So a pre-probe reject's
 // observedLiveness is `null`, NOT one of the four values. Every OTHER reject —
@@ -203,6 +225,7 @@ export const PRE_PROBE_REJECT_REASONS = [
 	"target-locked",
 	"target-address-conflict",
 	"record-less-socket",
+	"native-push-paused",
 ] as const satisfies readonly EntwurfV2RejectReason[];
 export type PreProbeRejectReason = (typeof PRE_PROBE_REJECT_REASONS)[number];
 

package/pi-extensions/lib/entwurf-v2-decider.ts

@@ -52,6 +52,7 @@ import {
 	isLivenessSupported,
 	makeRejectReceipt,
 	type NativePushBackend,
+	nativePushPaused,
 	nativePushSupported,
 	resolveDispatch,
 	resolveNativePushDispatch,
@@ -306,6 +307,12 @@ export async function decideDispatch(input: DispatchInput, deps: DispatchDecider
 	// branch is LOCK-FREE (봉인 4): the pi in-domain lock closes a socket TOCTOU, but a
 	// volatile probe route has no lock meaning (a duplicate-send idempotency is a D8 future).
 	if (nativePushSupported(identity.backend)) {
+		// #152: a paused native-push backend is refused by name BEFORE its adapter is probed —
+		// on the measured external path that language server refused the call (missing CSRF token),
+		// and a refusal must not be reported as a measured liveness. Pre-probe, observedLiveness null.
+		if (nativePushPaused(identity.backend)) {
+			return reject(makeRejectReceipt("native-push-paused", null));
+		}
 		const probe = await deps.nativePushProbe(identity);
 		const receipt = resolveNativePushDispatch(input.intent, probe.status);
 		if (!receipt.ok) return reject(receipt);

package/pi-extensions/lib/entwurf-v2-surface.ts

@@ -107,6 +107,9 @@ export function actionableRejectHint(reason: string): string | undefined {
 			// Native host up, but nothing served this conversation/thread — inconclusive, not a
 			// hard dead. Backend-neutral for the same reason as the dead cell above.
 			return "the native host (harness process or app-server) is up, but nothing served this conversation/thread, so the probe is INCONCLUSIVE — not a measured death. Retry once it is loaded, or verify the conversation/thread id.";
+		case "native-push-paused":
+			// #152: a policy refusal, not a liveness verdict — this dispatch probed and sent nothing.
+			return "native-push for this backend is paused (#152): its language server refused entwurf's measured external calls for a missing CSRF token, so this dispatch probed and sent nothing. The citizen and its record are kept; reach it from inside its own harness instead.";
 		case "record-less-socket":
 			// #50 C4: name the true cause AND the fix — a bare socket is a diagnostic
 			// state, not an addressable citizen (the record is the address).

package/pi-extensions/lib/fresh-call-composition.ts

@@ -67,7 +67,7 @@ export const FRESH_CALL_CALLBACK_TOOL: Record<FreshCallBackend, string> = {
 	copilot: "entwurf-bridge-entwurf_callback",
 	omp: "mcp__entwurf_bridge_entwurf_callback",
 	// Codex's tool process is the operator app-server, not the pane: the no-arg
-	// verb refuses there by name. First action stays the delivery verb with args.
+	// verb refuses there by name. Its callback stays the delivery verb with args.
 	codex: "mcp__entwurf_bridge__entwurf_v2",
 	// The durable contact registers the bridge verbs as its OWN tools under their bare names, and the
 	// app offers a tool to the model by its registered name (`durable/harness/registry.ts:99`
@@ -381,8 +381,8 @@ export function composeBackendArgs(
  * PLACEMENT SENTENCE. The first line names where the sibling was opened, and only the RAIL knows
  * that — "the operator's tmux session" is true of a `new-window` launch and false of a herdr
  * pane. It is therefore supplied by the caller rather than composed here. Everything BELOW that
- * line is rail-independent and stays the contract: the callback is the first action, the task
- * follows it, and the three prohibitions are measured rather than polite.
+ * line is rail-independent and stays the contract: the callback comes before the task, an optional
+ * read-only check of the caller may come before the callback, and the steering is stated as fact.
  */
 /**
  * The first-turn framing, WITHOUT the task.
@@ -394,8 +394,13 @@ export function composeBackendArgs(
  * the halves separate is what lets the framing stay plain prose on both rails while the operator's
  * task text keeps every byte it was written with.
  *
- * Order is the contract: the callback is the FIRST action and the task follows it, so a sibling
- * that gets stuck in the task has already told the caller who it is.
+ * Order is the contract: the callback comes BEFORE THE TASK, so a sibling that gets stuck in the
+ * task has already told the caller who it is. It is not the literal first tool call. `[GLG 직접,
+ * 2026-10-24]` checking the caller and then calling back is the right order, and the framing used
+ * to say both "FIRST ACTION … call back" and "you can corroborate the caller first" — two
+ * sentences that cannot both be obeyed. What may come before the callback is the one read-only
+ * check offered below (and, where a dialect needs it, loading the tools); reading files, running
+ * commands or starting the task may not.
  *
  * WHAT THIS SAYS AND WHY IT STOPPED SAYING THE REST (#116). Until 2026-09-17 this framing carried
  * three prohibitions, including "Do not inspect environment variables, do not call entwurf_self".
@@ -433,7 +438,7 @@ export function composeFreshCallFraming(params: {
 	const firstAction =
 		params.backend === "codex"
 			? [
-					`FIRST ACTION, before reading files or anything else: call ${birthTool} with ` +
+					`BEFORE THE TASK, and before reading files or running commands: call ${birthTool} with ` +
 						`target=${params.callerGardenId}, intent=fire-and-forget, wants_reply=false, and ` +
 						`message set to exactly ${params.nonce} — that string alone, nothing added.`,
 					`${params.nonce} is a correlation tag this caller minted for this one launch: it names no`,
@@ -443,7 +448,7 @@ export function composeFreshCallFraming(params: {
 					"entwurf_callback is refused on this rail: the tool process is the operator app-server, not this pane.",
 				]
 			: [
-					`FIRST ACTION, before reading files or anything else: call ${birthTool} with no arguments.`,
+					`BEFORE THE TASK, and before reading files or running commands: call ${birthTool} with no arguments.`,
 					"That call is how the caller learns the garden id you were born with. There are no",
 					"parameters: a target or message you type would be a second address axis.",
 					"Your own record does not carry the caller's address, so reporting your identity here does not reach it — that tool call does.",
@@ -453,9 +458,15 @@ export function composeFreshCallFraming(params: {
 		"",
 		...firstAction,
 		"",
-		`You can corroborate the caller first if you want to: ${peersTool} is a read-only listing of`,
-		`this garden's citizens and ${params.callerGardenId} is one of them. That listing is capped, so`,
-		"a caller you do not happen to see in it is not a reason to skip the callback.",
+		// THE CHECK IS THE SIBLING'S, AND SO IS ITS VERDICT. `[GLG 직접, 2026-10-24]` a capped listing that
+		// does not show the caller proves nothing about the caller, but a sibling whose check does not hold
+		// up may say so and hold back. Entwurf decides nothing here — no trust store, no fallback, no
+		// watcher — and the cost of holding back is stated, not hidden: no callback, no address.
+		`You may corroborate the caller before that call: ${peersTool} is a read-only listing of`,
+		`this garden's citizens and ${params.callerGardenId} is one of them. That listing is capped, so not`,
+		"seeing the caller in it does not show the caller is absent. If what you can check is not enough,",
+		"or it conflicts with this message, you may say so here and hold the callback and the task; the",
+		"caller then has no address for you.",
 		...hintBlock,
 		"",
 		// WHERE THE RESULT GOES, said once, as topology. `[GLG 직접, 2026-09-18]` a Sonnet sibling

package/pi-extensions/lib/herdr-fresh-call.ts

@@ -1232,10 +1232,12 @@ export function renderHerdrFreshCall(result: HerdrFreshCallResult): { text: stri
 			`mean the sibling is running, that its first turn ran, or that the task was delivered. The tab and pane ` +
 			`coordinates are a view and can change under the sibling — they are not an address and nothing may be ` +
 			`dispatched to them.\n` +
-			`The sibling's garden id arrives separately — its first action is the zero-argument callback verb, and ` +
+			`The sibling's garden id arrives separately — before its task it calls the zero-argument callback verb ` +
+			`(a read-only look at the caller may come first), and ` +
 			`the sender envelope of THAT message is the address. The nonce above is the correlation tag it carries; ` +
 			`the sibling reads it from its own launch env, never from this receipt. Nothing is polling for it; if it ` +
-			`never comes, the pane is visible and can be read directly.`,
+			`never comes — not started, stuck, or held back after its check; this receipt cannot tell which — the ` +
+			`pane is visible and can be read directly.`,
 		isError: false,
 	};
 }

package/pi-extensions/lib/meta-sender-identity.ts

@@ -47,6 +47,7 @@
  * a backend listed there is one whose hook writes a pid marker, and codex birth writes none.
  */
 
+import { nativePushPaused } from "./entwurf-v2-contract.ts";
 import {
 	defaultMetaSessionsDir,
 	describe,
@@ -229,6 +230,9 @@ export async function probeNativeSenderAlive(
 	identity: Pick<MetaIdentity, "backend" | "nativeSessionId">,
 	deps: { resolveAdapter?: (id: string) => Pick<NativePushAdapter, "probe"> } = {},
 ): Promise<boolean> {
+	// #152: a paused native-push backend cannot receive a reply, so its `replyable` is false by
+	// POLICY — no adapter is resolved or probed. This is not a liveness verdict about the citizen.
+	if (nativePushPaused(identity.backend)) return false;
 	const resolveAdapter = deps.resolveAdapter ?? resolveNativePushAdapter;
 	const probe = await resolveAdapter(identity.backend).probe(identity.nativeSessionId);
 	return probe.status === "alive";

package/pi-extensions/lib/mux-fresh-call.ts

@@ -709,11 +709,13 @@ export function renderFreshCall(result: FreshCallResult): { text: string; isErro
 			`\n` +
 			`This is a LAUNCH receipt: tmux created that window and was asked to start the runtime with the model above. It does ` +
 			`NOT mean the sibling is running, that its first turn ran, or that the task was delivered.\n` +
-			`The sibling's garden id arrives separately — its first action is the zero-argument callback verb ` +
-			`(codex is the one arm that still sends the nonce as arguments), and the sender envelope of THAT ` +
+			`The sibling's garden id arrives separately — before its task it calls the zero-argument callback verb ` +
+			`(codex is the one arm that still sends the nonce as arguments; a read-only look at the caller may come ` +
+			`first), and the sender envelope of THAT ` +
 			`message is the address. The nonce above is the correlation tag it carries; the sibling reads it ` +
-			`from its own launch env, never from this receipt. Nothing is polling for it; if it never comes, ` +
-			`the window is visible and can be read directly.`,
+			`from its own launch env, never from this receipt. Nothing is polling for it; if it never comes — ` +
+			`not started, stuck, or held back after its check; this receipt cannot tell which — the window is visible ` +
+			`and can be read directly.`,
 		isError: false,
 	};
 }

package/pi-extensions/lib/native-push/register.ts

@@ -19,10 +19,12 @@
  * deliverability semantics. `check-native-push-register` asserts this file references no
  * receiver-marker writer. (A dedicated register-provenance slot is a future concern.)
  *
- * LEAF-adjacent + pi-free: imports only the native-push adapter (pi-free) and the meta-session
- * upsert (pi-free), so the harness-neutral MCP bridge can reach it at boot.
+ * LEAF-adjacent + pi-free: imports only the native-push adapter (pi-free), the meta-session
+ * upsert (pi-free) and the pure v2 contract's paused-backend policy, so the harness-neutral MCP
+ * bridge can reach it at boot.
  */
 
+import { nativePushPaused } from "../entwurf-v2-contract.ts";
 import { type MetaCitizenBackend, type UpsertAction, upsertMetaSession } from "../meta-session.ts";
 import { type NativePushAdapter, resolveNativePushAdapter } from "./adapter.ts";
 
@@ -62,6 +64,19 @@ export async function registerNativeConversation(
 	input: RegisterNativeConversationInput,
 	deps: RegisterNativeConversationDeps = {},
 ): Promise<RegisterNativeConversationResult> {
+	// #152: a paused native-push backend is refused by name BEFORE any adapter is resolved or
+	// probed — registration would otherwise reach a language server that refused the measured
+	// external calls (missing CSRF token).
+	// Nothing is probed and no record is written.
+	if (nativePushPaused(input.backend)) {
+		throw new Error(
+			`entwurf_register_native: refusing to register ${input.backend} conversation ${JSON.stringify(
+				input.nativeSessionId,
+			)} — native-push for ${input.backend} is paused (#152: its language server refused ` +
+				"entwurf's measured external calls for a missing CSRF token). Nothing was probed and no garden id was minted; " +
+				"existing records stay readable.",
+		);
+	}
 	const resolveAdapter = deps.resolveAdapter ?? resolveNativePushAdapter;
 	const adapter = resolveAdapter(input.backend);
 	const probe = await adapter.probe(input.nativeSessionId);

package/pi-extensions/lib/omp-fresh-preflight.ts

@@ -20,8 +20,8 @@
  *   callback callable — THE OMP-SPECIFIC ONE. `tools.xdev` defaults to TRUE, which mounts MCP
  *                      tools as `xd://` devices whose schemas never reach the prompt. The tool
  *                      would be configured, the bridge would be running, and the model still
- *                      could not call `mcp__entwurf_bridge_entwurf_v`. Step 9 clause 5 makes the
- *                      callback the FIRST action, so a fresh call onto a default-config host
+ *                      could not call `mcp__entwurf_bridge_entwurf_v`. Step 9 clause 5 puts the
+ *                      callback before the task, so a fresh call onto a default-config host
  *                      opens a window that can never name itself. `[측정]` #87 A-lane: the
  *                      vendor default wrapped the send tool and produced a false delivery report.
  *

package/pi-extensions/lib/pi-durable-fresh-preflight.ts

@@ -15,7 +15,7 @@
  *                 provider spelled out (the bootstrap refuses a model resolved by inference), so
  *                 the model here is `<provider>/<model id>` split at the FIRST `/` — a catalog id
  *                 that itself contains `/` keeps it. A model with no provider part is refused.
- *   first input   the whole framing (callback first, then the task) rides the bootstrap's closed
+ *   first input   the whole framing (callback before the task) rides the bootstrap's closed
  *                 `{v:2,task}` payload, whose decoder caps `task` at 16000 characters. A framed
  *                 task over that cap would open a window whose bootstrap refuses its own argv.
  *