@junghanacs/entwurf 0.41.0 → 0.41.2

package/scripts/check-entwurf-v2-contract.ts

@@ -430,9 +430,9 @@ ok(
 // cannot enforce it — these semantic fixtures (the SSOT predicate the 5b decider
 // mints against) do.
 eq(
-	"？6: PRE_PROBE_REJECT_REASONS = bad-target/target-locked/target-address-conflict/record-less-socket",
+	"？6: PRE_PROBE_REJECT_REASONS = bad-target/target-locked/target-address-conflict/record-less-socket/native-push-paused",
 	[...PRE_PROBE_REJECT_REASONS],
-	["bad-target", "target-locked", "target-address-conflict", "record-less-socket"],
+	["bad-target", "target-locked", "target-address-conflict", "record-less-socket", "native-push-paused"],
 );
 // the partition is exhaustive + disjoint: every reject reason is pre-probe XOR not.
 for (const r of ENTWURF_V2_REJECT_REASONS) {
@@ -467,6 +467,28 @@ ok(
 	"taxonomy: record-less-socket is NOT a resolver reason (target-resolution stage, not a table cell)",
 	!(RESOLVER_REJECT_REASONS as readonly string[]).includes("record-less-socket"),
 );
+
+// #152: native-push-paused — a native-push backend paused by policy (antigravity: its LS
+// refused entwurf's measured external agentapi calls for a missing CSRF token). The decider refuses it BEFORE
+// any adapter probe, so it is pre-probe (null liveness), never a resolver table cell and
+// never one of the post-probe native-push outcomes it must not impersonate (dead /
+// indeterminate).
+ok(
+	"taxonomy: native-push-paused is in the enum (#152)",
+	(ENTWURF_V2_REJECT_REASONS as readonly string[]).includes("native-push-paused"),
+);
+ok(
+	"？6: native-push-paused is pre-probe (#152 — refused before any adapter probe)",
+	isPreProbeReject("native-push-paused"),
+);
+ok(
+	"taxonomy: native-push-paused is NOT a resolver reason (#152)",
+	!(RESOLVER_REJECT_REASONS as readonly string[]).includes("native-push-paused"),
+);
+ok(
+	"taxonomy: native-push-paused is NOT a post-probe native-push reject (#152 — not dead, not indeterminate)",
+	!(NATIVE_PUSH_REJECT_REASONS as readonly string[]).includes("native-push-paused"),
+);
 ok(
 	"taxonomy: the retired socket-only-no-resume-authority is GONE from the enum (#50 C4)",
 	!(ENTWURF_V2_REJECT_REASONS as readonly string[]).includes("socket-only-no-resume-authority"),

package/scripts/check-entwurf-v2-production.ts

@@ -344,45 +344,54 @@ async function main(): Promise<void> {
 		ok("A2: a quarantined target is never lock-acquired", spies.acquire.length === 0);
 	}
 
-	// ── A3: native-push wiring — ONE injected adapter feeds BOTH decider + executor ─
+	// ── A3: antigravity native-push is PAUSED (#152) — the production factory refuses it ─
+	// The agy LS refused entwurf's measured external agentapi calls (missing CSRF token), so the public dispatch
+	// must stop at the decider with the named pre-probe reject: no adapter resolved, nothing
+	// probed or sent, no lock, no mailbox, and no sender envelope asked for. The probe fake is
+	// configured ALIVE on purpose — a regression that reached it would deliver, not hide.
 	{
 		const { deps, spies } = makeSpiedFactory({
 			backend: "antigravity",
 			nativePushProbe: { status: "alive", route: { backend: "antigravity", lsAddress: "127.0.0.1:5599" } },
 		});
 		const result = await runEntwurfV2({ target: GID, intent: "fire-and-forget", message: "hi agy" }, deps);
-		ok("A3: antigravity ff → native-push delivered", result.kind === "executed" && result.transport === "native-push");
-		ok("A3: decider probed the native-push adapter once (decide side)", spies.nativePushProbe.length === 1);
-		ok("A3: executor sent via the native-push adapter once (execute side)", spies.nativePushSend.length === 1);
-		ok("A3: send used the DECIDER-probed route", spies.nativePushSend[0]?.route === "127.0.0.1:5599");
-		ok("A3: send carried the dispatch message", spies.nativePushSend[0]?.content.includes("hi agy") === true);
 		ok(
-			"A3: BOTH hands resolved the SAME adapter (for 'antigravity')",
-			spies.nativePushResolve.length === 2 && spies.nativePushResolve.every((b) => b === "antigravity"),
+			"A3: antigravity ff → rejected native-push-paused (#152), observedLiveness null",
+			result.kind === "rejected" &&
+				result.receipt.reason === "native-push-paused" &&
+				result.receipt.observedLiveness === null,
 		);
-		ok("A3: native-push is LOCK-FREE (no acquire)", spies.acquire.length === 0);
-		ok("A3: native-push did NOT enqueue a mailbox (not the unsupported path)", spies.enqueue.length === 0);
+		ok("A3: paused agy resolved NO native-push adapter (neither hand)", spies.nativePushResolve.length === 0);
+		ok(
+			"A3: paused agy probed and sent nothing",
+			spies.nativePushProbe.length === 0 && spies.nativePushSend.length === 0,
+		);
+		ok("A3: paused agy took no lock and enqueued no mailbox", spies.acquire.length === 0 && spies.enqueue.length === 0);
+		ok("A3: paused agy never asked the sender provider (no execute phase)", spies.senderCalls.length === 0);
 	}
+	// ── A3c: native-push wiring — ONE injected adapter feeds BOTH decider + executor (Codex,
+	// the active native-push backend while agy is paused) ─
 	{
+		const socketPath = "/home/operator/.codex/app-server-control/app-server-control.sock";
 		const { deps, spies } = makeSpiedFactory({
 			backend: "codex",
-			nativePushProbe: {
-				status: "alive",
-				route: { backend: "codex", socketPath: "/home/operator/.codex/app-server-control/app-server-control.sock" },
-			},
+			nativePushProbe: { status: "alive", route: { backend: "codex", socketPath } },
 		});
 		const result = await runEntwurfV2({ target: GID, intent: "fire-and-forget", message: "hi codex" }, deps);
 		ok(
 			"[QK:CODEX-NATIVE-PRODUCTION-WIRING] Codex ff → native-push delivered",
 			result.kind === "executed" && result.transport === "native-push",
 		);
+		ok("A3c: decider probed the native-push adapter once (decide side)", spies.nativePushProbe.length === 1);
+		ok("A3c: executor sent via the native-push adapter once (execute side)", spies.nativePushSend.length === 1);
 		ok(
-			"A3c: both hands resolve the Codex adapter",
-			spies.nativePushResolve.length === 2 && spies.nativePushResolve.every((b) => b === "codex"),
+			"A3c: send used the DECIDER-probed route (the planted Codex UDS)",
+			spies.nativePushSend[0]?.route === socketPath,
 		);
+		ok("A3c: send carried the dispatch message", spies.nativePushSend[0]?.content.includes("hi codex") === true);
 		ok(
-			"A3c: planted Codex UDS reaches the send hand",
-			spies.nativePushSend[0]?.route.endsWith("/app-server-control.sock") === true,
+			"A3c: BOTH hands resolved the SAME adapter (for 'codex')",
+			spies.nativePushResolve.length === 2 && spies.nativePushResolve.every((b) => b === "codex"),
 		);
 		ok(
 			"A3c: Codex native-push remains lock-free and mailbox-free",
@@ -394,16 +403,20 @@ async function main(): Promise<void> {
 	// Codex thread arrived as bare text, so the receiving citizen could not name who called it
 	// and the callback was uncorrelatable. Direct injection has neither the control socket's RPC
 	// framing nor a mailbox file, so the envelope must ride IN the body — the same bytes
-	// `formatMetaMailboxBody` gives the mailbox rail. ONE rail: both native-push backends, no
-	// per-backend branch.
+	// `formatMetaMailboxBody` gives the mailbox rail. ONE rail, no per-backend branch; it is
+	// proven on Codex, the native-push backend public dispatch still reaches while agy is
+	// paused (#152).
 	{
-		const route = { backend: "antigravity", lsAddress: "127.0.0.1:5599" } as const;
+		const route = {
+			backend: "codex",
+			socketPath: "/home/operator/.codex/app-server-control/app-server-control.sock",
+		} as const;
 		const { deps, spies } = makeSpiedFactory({
-			backend: "antigravity",
+			backend: "codex",
 			nativePushProbe: { status: "alive", route },
 		});
 		const { result, executeEvents } = await runInTwoPhases(
-			{ target: GID, intent: "fire-and-forget", message: "hi agy", wantsReply: true },
+			{ target: GID, intent: "fire-and-forget", message: "hi codex", wantsReply: true },
 			deps,
 			spies,
 		);
@@ -417,12 +430,12 @@ async function main(): Promise<void> {
 			result.kind === "executed" && spies.senderCalls.length === 1,
 		);
 		ok(
-			"[QK:NATIVE-PUSH-SENDER-ENVELOPE] agy direct injection carries the mailbox-serialized trusted envelope",
-			spies.nativePushSend[0]?.content === formatMetaMailboxBody(SENDER, "hi agy", true),
+			"[QK:NATIVE-PUSH-SENDER-ENVELOPE] native-push direct injection carries the mailbox-serialized trusted envelope",
+			spies.nativePushSend[0]?.content === formatMetaMailboxBody(SENDER, "hi codex", true),
 		);
 		ok(
 			"A3d: the enveloped body is NOT the raw plan message (an envelope was actually added)",
-			spies.nativePushSend[0]?.content !== "hi agy",
+			spies.nativePushSend[0]?.content !== "hi codex",
 		);
 		ok(
 			"A3d: wants_reply rides the envelope on this rail",
@@ -439,7 +452,7 @@ async function main(): Promise<void> {
 		);
 	}
 	{
-		// Same rail, other backend — codex renders identically. A backend branch would show here.
+		// Same rail, wants_reply=false — the envelope is still rendered, without the reply line.
 		const route = {
 			backend: "codex",
 			socketPath: "/home/operator/.codex/app-server-control/app-server-control.sock",
@@ -447,7 +460,7 @@ async function main(): Promise<void> {
 		const { deps, spies } = makeSpiedFactory({ backend: "codex", nativePushProbe: { status: "alive", route } });
 		const result = await runEntwurfV2({ target: GID, intent: "fire-and-forget", message: "hi codex" }, deps);
 		ok(
-			"A3d: codex direct injection carries the SAME mailbox-serialized envelope (one rail, no backend branch)",
+			"A3d: wants_reply=false direct injection carries the mailbox-serialized envelope for that flag",
 			result.kind === "executed" &&
 				spies.nativePushSend[0]?.content === formatMetaMailboxBody(SENDER, "hi codex", false),
 		);
@@ -503,14 +516,15 @@ async function main(): Promise<void> {
 	}
 
 	{
-		// antigravity + dead probe → reject native-push-target-dead, NO send.
+		// codex + dead probe → reject native-push-target-dead, NO send. (agy never reaches a
+		// probe while paused, #152 — A3.)
 		const { deps, spies } = makeSpiedFactory({
-			backend: "antigravity",
+			backend: "codex",
 			nativePushProbe: { status: "dead", reason: "no host" },
 		});
 		const result = await runEntwurfV2({ target: GID, intent: "fire-and-forget", message: "x" }, deps);
 		ok(
-			"A3b: antigravity ff + dead → rejected native-push-target-dead",
+			"A3b: codex ff + dead → rejected native-push-target-dead",
 			result.kind === "rejected" && result.receipt.reason === "native-push-target-dead",
 		);
 		ok("A3b: no send attempted on a dead target", spies.nativePushSend.length === 0);

package/scripts/check-gate-qualification.ts

@@ -3459,7 +3459,9 @@ let manifestCount: number;
 		"retirement-event": 16,
 		"control-retire": 9,
 		"control-send-receipt": 19,
-		"codex-native": 87,
+		"codex-native": 95,
+		"native-push-paused": 1,
+		"chain-terminus-publication": 1,
 		"compaction-send-guard": 7,
 		"control-socket-disconnect": 4,
 		"demo-reproducibility": 12,
@@ -3470,7 +3472,7 @@ let manifestCount: number;
 		"pi-bridge-sender": 4,
 		"pi-mcp-bridge": 2,
 		"pi-mcp-register": 3,
-		"pi-durable": 89,
+		"pi-durable": 94,
 		"copilot-receive": 20,
 		"entwurf-peers": 1,
 		"fresh-call-dispatch": 15,
@@ -3491,30 +3493,30 @@ let manifestCount: number;
 		"meta-identity": 9,
 		"meta-retire": 4,
 		"mux-boundary": 16,
-		"mux-fresh-call": 65,
+		"mux-fresh-call": 66,
 		"mux-launcher-fence": 8,
 		"mux-parent-artifact": 3,
-		"pack-install": 5,
+		"pack-install": 9,
 		"pi-package-ownership": 8,
 		"qualification-ledger": 42,
 		"mux-resume-call": 13,
 		"omp-birth": 13,
-		"omp-fresh": 24,
+		"omp-fresh": 25,
 		"omp-receive": 11,
 		"probe-ordering": 1,
 		"release-gate": 21,
 		"remote-pair-display": 3,
 		"remote-pair-installed-audit": 2,
-		"remote-pair-receive": 8,
-		"remote-pair-roundtrip": 5,
-		"remote-pair-send": 12,
+		"remote-pair-receive": 10,
+		"remote-pair-roundtrip": 9,
+		"remote-pair-send": 21,
 		"remote-pair-transport": 4,
 		"retired-sent-surface": 2,
 		"resume-args": 6,
 		"resume-launch-identity": 10,
 		"self-address": 8,
 		"setup-verdict": 14,
-		"source-install": 2,
+		"source-install": 8,
 		"typing-call-fence": 1,
 		"v2-surface": 14,
 		"v2-visible-resume": 40,

package/scripts/check-native-push-adapter.ts

@@ -18,6 +18,10 @@
  *   - resolver fail-fast: resolveNativePushAdapter("antigravity") resolves; unknown throws.
  *
  * Pure; no backend, no socket, no real process.
+ *
+ * #152: this is the adapter LEAF only. Public agy delivery, sender replyability and
+ * registration are paused before any adapter is resolved; a green here is not agy
+ * availability and not a live pass.
  */
 
 import assert from "node:assert/strict";

package/scripts/check-native-push-register.ts

@@ -4,17 +4,16 @@
  * agy) and an ISOLATED temp meta-record store (never the real ~/.pi).
  *
  * Proves:
- *   - live probe → CREATE: a fresh live conversation mints a garden citizen whose meta-record
- *     carries the backend / nativeSessionId / caller-stated cwd; the action is "create".
- *   - re-register → ATTACH: the same conversation resolves to the SAME garden id and REFRESHES
- *     the cwd (봉인 5) — it never mints a second id.
- *   - not-live probe → REFUSE: a dead / indeterminate probe THROWS and writes NO record (no
- *     garden id is engraved onto a pointer that does not resolve to a live host).
+ *   - #152 PAUSE: antigravity — the only registerable backend — is refused by name BEFORE any
+ *     adapter is resolved or probed, and NO record is written. While the pause holds, the create /
+ *     attach / refuse-not-live mechanics behind that guard are unreachable, so this gate no longer
+ *     claims them; they return with the pause's lift.
+ *   - the paused-policy check sits BEFORE the probe in the register source.
  *   - RECEIVER-MARKER ABSTINENCE (보정①): the register source references NO receiver-marker
  *     writer — a native-push citizen has no idle-wake watch, so arming one would smuggle
  *     native-push liveness into the mailbox deliverability atom.
  *
- * Deterministic (fake adapter); the only IO is an isolated mkdtemp store (like the meta gates).
+ * Deterministic (trap adapter); the only IO is an isolated mkdtemp store (like the meta gates).
  */
 
 import assert from "node:assert/strict";
@@ -22,8 +21,6 @@ import { mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
-import { readMetaIdentityByGardenId } from "../pi-extensions/lib/meta-session.ts";
-import type { NativePushAdapter, NativePushProbeResult } from "../pi-extensions/lib/native-push/adapter.ts";
 import { registerNativeConversation } from "../pi-extensions/lib/native-push/register.ts";
 
 let passed = 0;
@@ -35,83 +32,31 @@ function ok(label: string, cond: boolean): void {
 
 const REPO_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
-/** A fake native-push adapter whose probe returns a fixed result and whose send is unused. */
-function fakeAdapter(probe: NativePushProbeResult): NativePushAdapter {
-	return {
-		id: "antigravity",
-		retriable: true,
-		async probe() {
-			return probe;
-		},
-		async send() {
-			throw new Error("register gate: adapter.send must not be called during registration");
-		},
-	};
-}
-
-const ALIVE: NativePushProbeResult = {
-	status: "alive",
-	route: { backend: "antigravity", lsAddress: "127.0.0.1:5599" },
-};
-
 async function main(): Promise<void> {
 	const dir = mkdtempSync(path.join(os.tmpdir(), "entwurf-register-"));
 	try {
-		// ── live probe → CREATE ───────────────────────────────────────────────────
-		const created = await registerNativeConversation(
-			{ backend: "antigravity", nativeSessionId: "conv-abc", cwd: "/work/one" },
-			{ resolveAdapter: () => fakeAdapter(ALIVE), sessionsDir: dir },
-		);
-		ok("create: action = create", created.action === "create");
-		ok("create: gardenId shaped YYYYMMDDTHHMMSS-xxxxxx", /^\d{8}T\d{6}-[0-9a-f]{6}$/.test(created.gardenId));
-		ok("create: backend antigravity", created.backend === "antigravity");
-		ok("create: nativeSessionId echoed", created.nativeSessionId === "conv-abc");
-		ok("create: cwd = caller-stated", created.cwd === "/work/one");
-		// the on-disk record agrees (read back through the authority).
-		const rec = readMetaIdentityByGardenId(created.gardenId, dir);
-		ok("create: record backend antigravity", rec.backend === "antigravity");
-		ok("create: record nativeSessionId bound", rec.nativeSessionId === "conv-abc");
-		ok("create: record cwd recorded", rec.cwd === "/work/one");
-
-		// ── re-register same conversation → ATTACH (same gid, cwd refreshed) ───────
-		const reattached = await registerNativeConversation(
-			{ backend: "antigravity", nativeSessionId: "conv-abc", cwd: "/work/two" },
-			{ resolveAdapter: () => fakeAdapter(ALIVE), sessionsDir: dir },
-		);
-		ok("attach: action = attach", reattached.action === "attach");
-		ok("attach: SAME garden id (no second mint)", reattached.gardenId === created.gardenId);
-		ok(
-			"attach: cwd REFRESHED to the new value",
-			reattached.gardenId === created.gardenId && reattached.cwd === "/work/two",
-		);
-		const rec2 = readMetaIdentityByGardenId(created.gardenId, dir);
-		ok("attach: on-disk cwd refreshed", rec2.cwd === "/work/two");
-		// exactly ONE record file for this conversation (no duplicate mint).
-		const records = readdirSync(dir).filter((f) => f.endsWith(".meta.json"));
-		ok("attach: exactly ONE meta-record (no duplicate garden id)", records.length === 1);
-
-		// ── not-live probe → REFUSE (throw), NO record written ────────────────────
-		for (const probe of [
-			{ status: "dead", reason: "no host" } as const,
-			{ status: "indeterminate", reason: "no port served" } as const,
-		]) {
-			const before = readdirSync(dir).length;
-			let threw = false;
-			try {
-				await registerNativeConversation(
-					{ backend: "antigravity", nativeSessionId: "conv-ghost", cwd: "/work/x" },
-					{ resolveAdapter: () => fakeAdapter(probe), sessionsDir: dir },
-				);
-			} catch (err) {
-				threw = true;
-				ok(
-					`refuse(${probe.status}): error names the non-live probe`,
-					new RegExp(probe.status).test((err as Error).message),
-				);
-			}
-			ok(`refuse(${probe.status}): THROWS (no garden id for a non-live conversation)`, threw);
-			ok(`refuse(${probe.status}): NO record written`, readdirSync(dir).length === before);
+		// ── #152: antigravity is PAUSED → REFUSE by name, no adapter, NO record ──────
+		let resolved = 0;
+		const before = readdirSync(dir).length;
+		let message = "";
+		try {
+			await registerNativeConversation(
+				{ backend: "antigravity", nativeSessionId: "conv-abc", cwd: "/work/one" },
+				{
+					resolveAdapter: () => {
+						resolved++;
+						throw new Error("register gate: no adapter may be resolved for a paused backend");
+					},
+					sessionsDir: dir,
+				},
+			);
+		} catch (err) {
+			message = (err as Error).message;
 		}
+		ok("paused: register THROWS for antigravity", message !== "");
+		ok("paused: the error names the pause (#152)", /paused/.test(message) && /#152/.test(message));
+		ok("paused: no adapter resolved (nothing probed)", resolved === 0);
+		ok("paused: NO record written", readdirSync(dir).length === before);
 	} finally {
 		rmSync(dir, { recursive: true, force: true });
 	}
@@ -127,6 +72,11 @@ async function main(): Promise<void> {
 	// it DOES reuse the upsert authority (봉인 5) and the adapter probe.
 	ok("wiring: register reuses upsertMetaSession", /upsertMetaSession/.test(src));
 	ok("wiring: register probes the adapter before minting", /\.probe\(/.test(src));
+	ok(
+		"wiring: the paused-policy check precedes the adapter probe",
+		src.indexOf("nativePushPaused(input.backend)") > 0 &&
+			src.indexOf("nativePushPaused(input.backend)") < src.indexOf(".probe("),
+	);
 
 	console.log(`\ncheck-native-push-register: ${passed} assertions passed`);
 }

package/scripts/check-remote-pair-installed.ts

@@ -190,8 +190,8 @@ try {
 	);
 	const summary = (vitest.stdout.match(/Tests\s+.*$/m) ?? [""])[0].trim();
 	ok(
-		"[QK:RPI-ROUNDTRIP-ON-INSTALL] the T2 cells (A→B, reverse dispatch, opt-in absent off, other host refuses, both socket dirs) pass against the installed bridge and entry",
-		vitest.status === 0 && /^Tests\s+5 passed\b/.test(summary),
+		"[QK:RPI-ROUNDTRIP-ON-INSTALL] the T2 cells (A→B, reverse dispatch, opt-in absent off, other host refuses, both socket dirs, and the #149 three-route cells: independent, reverse, undeclared sender, cross claim) pass against the installed bridge and entry",
+		vitest.status === 0 && /^Tests\s+9 passed\b/.test(summary),
 		`${summary}\n${vitest.stdout
 			.split("\n")
 			.filter((l) => /×|FAIL|Error/.test(l))

package/scripts/dev-bin.sh

@@ -34,6 +34,14 @@
 #   remove [name]   honest inverse from state (remove only OUR link; REFUSE if it became foreign).
 #                   no name = all managed bins.
 #   verify <name>   require OUR symlink → target and that exact link as the PATH winner.
+#   exclusive       require that NO other root answers to any package.json bin name — not only
+#                   the PATH winner. A winner check alone let a later PATH entry (an old global
+#                   shim) stay selectable by a shell with another PATH order, e.g. non-interactive
+#                   SSH. Read-only: every entry of this PATH plus the global bin dir that `pnpm bin
+#                   -g` / `npm prefix -g` report. Same resolved target = the same install (allowed);
+#                   anything else is another root, never guessed as ours. exit 0 none / 5 another
+#                   root (named, with a conditional removal hint — nothing is removed) / 6 the
+#                   package manifest or a package manager could not be inspected (fail-closed).
 #
 # Overridable for the isolated smoke:
 #   ENTWURF_DEV_BIN_DIR           link location (default: ~/.local/bin — where agy itself lives)
@@ -42,6 +50,7 @@
 #   ENTWURF_AGY_STATUSLINE_TARGET entwurf-agy-statusline target (default: $REPO/scripts/agy-statusline.sh)
 #   ENTWURF_AGY_IMPRINT_TARGET    entwurf-agy-imprint target (default: $REPO/scripts/agy-imprint.sh)
 #   ENTWURF_COPILOT_STATUSLINE_TARGET entwurf-copilot-statusline target (default: $REPO/scripts/copilot-statusline.sh)
+#   ENTWURF_DEV_BIN_PM_TIMEOUT    seconds one package-manager query may take (default 10)
 #   XDG_DATA_HOME                 state root (states under $XDG_DATA_HOME/entwurf/dev-bin/)
 set -euo pipefail
 
@@ -68,6 +77,9 @@ bin_target() {  # $1 = name → prints target path (env-overridable for smoke)
     *) return 1 ;;
   esac
 }
+# Every name bin_target answers for. Kept apart from MANAGED_BINS (what expose links): whether a
+# name is exposed must not change the target exclusive expects for it.
+TARGET_BINS="entwurf entwurf-bridge entwurf-agy-statusline entwurf-agy-imprint entwurf-copilot-statusline"
 state_file_for() { echo "$STATE_DIR/$1.install-state.json"; }
 
 state_link() {  # $1 = state file → recorded linkPath, or empty
@@ -184,6 +196,104 @@ verify_one() {  # $1 = name
   log "[dev-bin verify] $name → $target (PATH winner: $link)"
 }
 
+do_exclusive() {
+  # Our target per package.json bin name: a managed name through bin_target (smoke-overridable),
+  # every other name at its package.json path in this checkout. The manifest is read INSIDE the
+  # verdict step: a read that fails outside it would reach the verdict as zero names and pass.
+  local -a pairs=()
+  local b
+  for b in $TARGET_BINS; do pairs+=("$b=$(bin_target "$b")"); done
+  python3 - "${ENTWURF_DEV_BIN_PM_TIMEOUT:-10}" "$REPO_DIR" "${pairs[@]}" <<'PY'
+import json, os, shutil, signal, subprocess, sys
+
+timeout = float(sys.argv[1])
+manifest = os.path.join(sys.argv[2], "package.json")
+try:
+    with open(manifest) as f:
+        bins = json.load(f)["bin"]
+    if not (isinstance(bins, dict) and "entwurf" in bins
+            and all(isinstance(k, str) and k and isinstance(v, str) and v for k, v in bins.items())):
+        raise ValueError('"bin" is not a non-empty object of name -> path strings naming entwurf')
+except (OSError, ValueError, KeyError, TypeError) as e:
+    print(f"[dev-bin] FAIL: could not inspect the package manifest {manifest} — {type(e).__name__}: {e}."
+          " Not read as 'no other root'.", file=sys.stderr)
+    print("  nothing was removed, no profile edited, no session stopped.", file=sys.stderr)
+    sys.exit(6)  # an unreadable manifest is never "0 names, no other root"
+managed = dict(pair.split("=", 1) for pair in sys.argv[3:])
+ours = {name: os.path.realpath(managed.get(name, os.path.join(sys.argv[2], rel)))
+        for name, rel in bins.items()}
+
+dirs = {}      # realpath(dir) -> (dir as seen, [where it was seen])
+def add(d, where):
+    key = os.path.realpath(d)
+    dirs.setdefault(key, (d, []))[1].append(where)
+
+for d in os.environ.get("PATH", "").split(":"):
+    add(d or os.getcwd(), "PATH")   # an empty POSIX PATH entry means the cwd
+
+def query(argv):
+    exe = shutil.which(argv[0])
+    if exe is None:
+        return "skip", f"{argv[0]} not on PATH — its global bin dir was not checked"
+    try:
+        p = subprocess.Popen([exe] + argv[1:], cwd="/", stdin=subprocess.DEVNULL,
+                             stdout=subprocess.PIPE, stderr=subprocess.PIPE, start_new_session=True)
+    except OSError as e:
+        return "error", f"`{' '.join(argv)}` could not start: {e}"
+    try:
+        out, err = p.communicate(timeout=timeout)
+    except subprocess.TimeoutExpired:
+        os.killpg(p.pid, signal.SIGKILL)
+        p.communicate()
+        return "error", f"`{' '.join(argv)}` did not answer within {timeout:g}s"
+    if p.returncode != 0:
+        tail = err.decode(errors="replace").strip().splitlines()[-1:] or [""]
+        return "error", f"`{' '.join(argv)}` exited {p.returncode}: {tail[0]}"
+    lines = out.decode(errors="replace").strip().splitlines()
+    if len(lines) != 1 or not os.path.isabs(lines[0]):
+        return "error", f"`{' '.join(argv)}` printed {len(lines)} line(s), not one absolute path"
+    return "ok", lines[0]
+
+checked, skipped, errors = ["PATH"], [], []
+for argv, label, to_bin in ((["pnpm", "bin", "-g"], "pnpm global bin", lambda s: s),
+                            (["npm", "prefix", "-g"], "npm global bin", lambda s: os.path.join(s, "bin"))):
+    state, value = query(argv)
+    if state == "ok":
+        add(to_bin(value), label)
+        checked.append(f"{label} {to_bin(value)}")
+    elif state == "skip":
+        skipped.append(value)
+    else:
+        errors.append(value)
+
+others = []
+for _key, (d, where) in dirs.items():
+    for name, target in ours.items():
+        path = os.path.join(d, name)
+        if os.path.lexists(path) and os.path.realpath(path) != target:
+            others.append((path, os.path.realpath(path), where))
+
+for path, resolved, where in others:
+    print(f"[dev-bin] FAIL: another entwurf root is still selectable: {path} -> {resolved}", file=sys.stderr)
+    print(f"  seen via: {', '.join(where)}", file=sys.stderr)
+    hints = [h for w, h in (("pnpm global bin", "pnpm remove -g @junghanacs/entwurf"),
+                            ("npm global bin", "npm uninstall -g @junghanacs/entwurf")) if w in where]
+    for h in hints:
+        print(f"  if a global @junghanacs/entwurf installed it: {h}", file=sys.stderr)
+    print("  " + ("otherwise " if hints else "") + "remove it through whoever owns it.", file=sys.stderr)
+for e in errors:
+    print(f"[dev-bin] FAIL: could not inspect a package manager — {e}. Not read as 'no other root'.", file=sys.stderr)
+if others or errors:
+    print(f"  this checkout: {ours.get('entwurf', '?')}", file=sys.stderr)
+    print("  nothing was removed, no profile edited, no session stopped. Then re-run: ./run.sh setup <project>", file=sys.stderr)
+    sys.exit(5 if others else 6)
+print(f"[dev-bin exclusive] no other root under the {len(ours)} package bin names in: {'; '.join(checked)}")
+for s in skipped:
+    print(f"  not checked: {s}")
+print("  covers only these directories — another shell's PATH or another package manager is not covered.")
+PY
+}
+
 remove_one() {  # $1 = name
   local name="$1" target link sf recorded
   target="$(bin_target "$name")" || fail "unknown managed bin: $name"
@@ -235,5 +345,6 @@ case "${1:-}" in
   expose) shift; do_expose "${1:-}" ;;
   remove) shift; do_remove "${1:-}" ;;
   verify) shift; [ -n "${1:-}" ] || fail "verify requires one managed bin name"; verify_one "$1" ;;
-  *) echo "usage: dev-bin.sh <expose|remove> [bin-name] | verify <bin-name>" >&2; exit 2 ;;
+  exclusive) do_exclusive ;;
+  *) echo "usage: dev-bin.sh <expose|remove> [bin-name] | verify <bin-name> | exclusive" >&2; exit 2 ;;
 esac

package/scripts/lib/chain-terminus-publication.ts

@@ -0,0 +1,58 @@
+/**
+ * The terminus wait of `smoke-entwurf-chain-live`, as one function with its fs seams injectable, so
+ * the oracle that judges a live chain can be driven offline through the exact publication states.
+ *
+ * `enqueueMetaMessage` (pi-extensions/lib/meta-session.ts) publishes in two writes: the `.msg` body
+ * FIRST, then — after the state stamp — `inbox.signal` LAST. A reader can therefore see the body
+ * without the signal for a few milliseconds. The P5 failure on 2026-10-24 is consistent with that by
+ * source and by its preserved mailbox: the old wait stopped at the first body and checked the signal
+ * at once, and the signal file was written about 5 ms after the body. Its interleaving was not traced.
+ * A body without the signal is a publication still in flight, so the wait ends only when both are
+ * there, inside the same deadline. What the smoke asserts afterwards (exactly one body, the signal,
+ * every identity and read-receipt check) is unchanged and still fails on a missing body, a missing
+ * signal or a duplicate.
+ */
+import { existsSync } from "node:fs";
+import fsp from "node:fs/promises";
+import path from "node:path";
+
+export interface TerminusPublicationIo {
+	readdir(dir: string): Promise<string[]>;
+	exists(file: string): boolean;
+	sleep(ms: number): Promise<void>;
+	now(): number;
+}
+
+const realIo: TerminusPublicationIo = {
+	readdir: (dir) => fsp.readdir(dir),
+	exists: (file) => existsSync(file),
+	sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+	now: () => Date.now(),
+};
+
+export interface TerminusPublication {
+	/** Every `.msg` / `.msg.delivered` seen at the last look, so a duplicate stays visible. */
+	msgs: string[];
+	/** Whether `inbox.signal` existed at the last look. */
+	signalled: boolean;
+}
+
+/** Wait until the terminus mailbox holds a body AND its doorbell, or the deadline passes. */
+export async function awaitTerminusPublication(
+	boxDir: string,
+	untilMs: number,
+	pollMs: number,
+	io: TerminusPublicationIo = realIo,
+): Promise<TerminusPublication> {
+	let msgs: string[] = [];
+	let signalled = false;
+	while (io.now() < untilMs) {
+		msgs = (await io.readdir(boxDir).catch(() => [] as string[])).filter(
+			(f) => f.endsWith(".msg") || f.endsWith(".msg.delivered"),
+		);
+		signalled = io.exists(path.join(boxDir, "inbox.signal"));
+		if (msgs.length > 0 && signalled) break;
+		await io.sleep(pollMs);
+	}
+	return { msgs, signalled };
+}