@junghanacs/entwurf 0.41.1 → 0.41.2

package/mcp/entwurf-bridge/dist/scripts/remote-pair-receive.js

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 /**
- * remote-pair-receive — `entwurf remote-pair-receive --pair <absolute file>` (#107 rail 1).
+ * remote-pair-receive — `entwurf remote-pair-receive --pair <absolute file>` (#107 rail 1, #149).
  *
- * The receiving host's entry for one declared remote pair. The sending host runs it over one
+ * The receiving host's entry for its declared remote pairs. The sending host runs it over one
  * SSH call and writes one JSON claim to stdin. This entry reads the operator-named pair
- * declaration once, applies the pair scope check, and hands a matching claim to the existing
- * v2 dispatch. The scope and trust model are in pi-extensions/lib/remote-pair-receive.ts.
+ * declaration once, selects the one route whose two ends are the claim's, and hands a matching
+ * claim to the existing v2 dispatch. The scope and trust model are in pi-extensions/lib/remote-pair-receive.ts.
  *
  * Scope: `--pair` must name THIS host's own opt-in file (`remotePairOptInPath()`), absolute and
- * normalized-equal; any other path — even a valid declaration — is exit 2. That one file is the pair
- * this host accepts and, because it names the sender's host as its route, the declared route back.
+ * normalized-equal; any other path — even a valid declaration — is exit 2. That one file holds the
+ * pairs this host accepts and, because each route names the sender's host, the declared route back.
  * The sender's declaration carries the path only so the argv shape is explicit; it selects nothing.
  *
  * EXIT CONTRACT (stdout carries a JSON receipt line only where named):
@@ -38,7 +38,7 @@ if (args.length !== 2 || args[0] !== "--pair") {
     process.exit(2);
 }
 const pairFile = args[1];
-let decl;
+let decls;
 let claim;
 try {
     // The scope is THIS host's own opt-in, never a file the sender picks: `--pair` must name it
@@ -47,18 +47,18 @@ try {
     if (!path.isAbsolute(pairFile) || path.normalize(pairFile) !== own) {
         throw new Error(`--pair must be this host's opt-in file ${own} (got ${pairFile})`);
     }
-    const route = readRemotePairOptIn(own);
-    if (route === null)
+    const optIn = readRemotePairOptIn(own);
+    if (optIn === null)
         throw new Error(`this host has no remote pair opt-in (${own} is absent)`);
-    decl = { remoteGardenId: route.remoteGardenId, ssh: route.ssh, localGardenId: route.localGardenId };
+    decls = optIn.routes.map((r) => ({ remoteGardenId: r.remoteGardenId, ssh: r.ssh, localGardenId: r.localGardenId }));
     claim = parseRemoteClaim(readFileSync(0, "utf8"));
 }
 catch (err) {
     emit({ kind: "invalid", detail: err instanceof Error ? err.message : String(err) }, 2);
 }
-const receipt = await receiveRemoteClaim(claim, decl, {
+const receipt = await receiveRemoteClaim(claim, decls, {
     dispatch: (params, sender) => runAndRenderEntwurfV2FromSurface(params, { senderProvider: () => sender }),
-    // The scope file IS this host's own opt-in, and it names the sender's host as its route: a
+    // The scope file IS this host's own opt-in, and the matched route names the sender's host: a
     // matching claim always has a declared route back. Declared, not probed.
     replyRoute: "declared",
 });

package/mcp/entwurf-bridge/src/index.ts

@@ -78,7 +78,7 @@ import { resolveMailboxReceiverFacts } from "../../../pi-extensions/lib/entwurf-
 import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provider.ts";
 import { ENTWURF_PEERS_RENDER_LIMIT, renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.ts";
 import { computeSelfAddressability, type MetaDeliveryDomain } from "../../../pi-extensions/lib/entwurf-self-address.ts";
-import { nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contract.ts";
+import { nativePushPaused, nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contract.ts";
 import { resolveMailboxWakeModeCapability } from "../../../pi-extensions/lib/entwurf-v2-decider.ts";
 import { retireCitizen } from "../../../pi-extensions/lib/entwurf-v2-retire.ts";
 import { makeProductionRetireDeps } from "../../../pi-extensions/lib/entwurf-v2-retire-production.ts";
@@ -313,6 +313,7 @@ async function buildMetaSenderEnvelope(
 					metaDeliveryDomain,
 					recordBacked: true,
 					probeAlive: await probeNativeSenderAlive(identity),
+					nativePushPaused: nativePushPaused(identity.backend),
 				}
 			: metaDeliveryDomain === "self-fetch"
 				? (() => {
@@ -488,7 +489,7 @@ server.tool(
 		"mailbox only while deliverable, native-push direct injection only while its adapter probe is alive, " +
 		"or a THIRD RESULT: rejection when neither holds. An inactive self-fetch citizen is mailbox-undeliverable; " +
 		"native-push has NO mailbox: dead → native-push-target-dead; indeterminate → " +
-		"native-push-probe-indeterminate. " +
+		"native-push-probe-indeterminate; agy (paused, #152) → native-push-paused, no probe. " +
 		"DORMANT IS UNREACHABLE: a socket-domain citizen that is not running gets dormant-fire-forget-unsupported " +
 		"— same receiver rule as the mailbox, no active drainer means no delivery. " +
 		"The intent that used to answer there, owned-outcome, resumed it by launching a hidden background child " +
@@ -505,7 +506,8 @@ server.tool(
 				"fire-and-forget = send/reply/hand-off to a LIVE socket target or to any citizen with no " +
 					"socket liveness — the decider picks its rail, and a rail can also REJECT (self-fetch → " +
 					"mailbox when deliverable, else mailbox-undeliverable; native-push → alive: direct injection, " +
-					"dead: native-push-target-dead, indeterminate: native-push-probe-indeterminate); set " +
+					"dead: native-push-target-dead, indeterminate: native-push-probe-indeterminate; a paused " +
+					"backend — agy, #152 — rejects as native-push-paused before any probe); set " +
 					"wants_reply for an answer. This is the ONLY intent: owned-outcome, which resumed a dormant " +
 					"citizen by launching a hidden background child, was withdrawn under the visible-first rule. " +
 					"It is not selectable, not deprecated-but-tolerated; a dormant citizen is currently " +
@@ -532,13 +534,13 @@ server.tool(
 			// Resolved ONCE so the dispatch-moment timestamp is fixed and the control RPC sender
 			// + the mailbox body sender share one envelope. No replyability gate (see above).
 			const sender = await buildSendSenderEnvelope({ requestMeta: extra._meta });
-			// #107: the operator's remote-pair opt-in is read per send. Absent = off and the local
-			// surface below runs exactly as before; a declared target goes over that one route.
+			// #107/#149: the operator's remote-pair opt-in is read per send. Absent = off and the local
+			// surface below runs exactly as before; a declared target goes over its one exact route.
 			const rendered = await runEntwurfV2WithRemoteRoute(
 				{ target, intent, message, mode, wants_reply },
 				{
 					senderProvider: () => sender,
-					route: readRemotePairOptIn(remotePairOptInPath()),
+					optIn: readRemotePairOptIn(remotePairOptInPath()),
 					// The decider's canonical socket dir AND this bridge's ENTWURF_DIR: a trace in either is local.
 					localTrace: makeLocalTraceFact({
 						sessionsDir: defaultMetaSessionsDir(),
@@ -651,7 +653,7 @@ server.tool(
 		"or a REJECT when neither holds: mailbox-undeliverable for a self-fetch citizen whose inbox " +
 		"nobody drains, and on the native-push probe dead → native-push-target-dead vs " +
 		"indeterminate → native-push-probe-indeterminate, kept apart because an unestablished probe " +
-		"is not a departed host. So " +
+		"is not a departed host; an agy target rejects as native-push-paused (#152) without being probed. So " +
 		"`unsupported` does not promise reachability either: a record whose backend has no adapter on " +
 		"this lane resolves to that reject. " +
 		"Note: this is the *active* world and it is facts-only — it creates nothing. Pass an " +
@@ -735,8 +737,9 @@ server.tool(
 		"must be LIVE: it is probed first, and a dead/indeterminate probe is refused (no garden id is " +
 		"minted for a pointer that does not resolve to a real host). Re-registering the same " +
 		"conversation attaches to the SAME garden id and refreshes the cwd. Only 'antigravity' is " +
-		"registerable on this lane. No mailbox receiver marker is written — native-push has no " +
-		"idle-wake watch; the returned garden id is the reply handle.",
+		"registerable on this lane, and antigravity native-push is PAUSED (#152): this verb refuses it by " +
+		"name before any probe and mints no garden id. No mailbox receiver marker is written — native-push " +
+		"has no idle-wake watch; the returned garden id is the reply handle.",
 	{
 		backend: z
 			.enum(["antigravity"])
@@ -787,8 +790,8 @@ server.tool(
 		"herdr workspace, pi and claude-code " +
 		"only; everywhere else it opens in the operator's tmux with all six backends (pi, " +
 		"claude-code, copilot, omp, codex, pi-durable). No fallback: an incomplete herdr context is refused by name, " +
-		"never by a tmux window you cannot see from herdr. The sibling's FIRST action " +
-		"is a callback to you carrying a nonce, whose sender envelope is its garden id — that is how you learn the " +
+		"never by a tmux window you cannot see from herdr. If proceeding, the sibling calls back before its task with a nonce; " +
+		"the sender envelope names its garden id — that is how you learn the " +
 		"address of a thing that did not exist a moment ago. This returns a LAUNCH receipt (the owner's " +
 		"coordinates plus that nonce): it does NOT mean the runtime started, the first turn ran, or " +
 		"the task was delivered. Those coordinates are a VIEW, never an address — a herdr tab/pane id can change under " +

package/native/win32-x64/manifest.json

@@ -3,7 +3,7 @@
 	"platform": "win32",
 	"arch": "x64",
 	"file": "entwurf_win.node",
-	"sha256": "9837893521ec1d033913ca6cd1b705cb6e942e8d5c288948a1ed0ca0e28655e5",
+	"sha256": "0864b2753a8c22831874dd00959febf597616315670130910aa45147aaa61d17",
 	"napiVersion": 8,
 	"builtWith": {
 		"node": "24.18.1",
@@ -12,7 +12,7 @@
 		"windowsTargetPlatformVersion": "10.0.26100.0",
 		"visualStudio": {
 			"displayName": "Visual Studio Enterprise 2026",
-			"installationVersion": "18.10.12224.181"
+			"installationVersion": "18.11.12315.225"
 		}
 	},
 	"source": {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.41.1",
+	"version": "0.41.2",
 	"description": "Visible sibling sessions across independent agent harnesses: launch in Herdr or tmux, retire on request and reopen pi or Claude Code in tmux, and deliver messages by garden id; native bridges and Claude/Cortex ACP adapters.",
 	"license": "MIT",
 	"author": {
@@ -196,10 +196,10 @@
 		"check:full": "bash scripts/check-elapsed.sh check:full check:core check:hermetic check:package",
 		"check:core": "pnpm run check:toolchain && pnpm run check:vitest && pnpm run check:contracts",
 		"check:toolchain": "pnpm lint && pnpm typecheck",
-		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit",
-		"check:contracts": "./run.sh check-demo-reproducibility && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-control-retire && ./run.sh check-pi-retire-request && ./run.sh check-cc-retire-pidfd && ./run.sh check-cc-retire-request && ./run.sh check-retirement-event && ./run.sh check-entwurf-v2-retire && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-win32-preview && ./run.sh check-pack-win32-carrier && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-fresh-call-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-set-model-readback && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-pi-durable-beside && ./run.sh check-pi-durable-carrier && ./run.sh check-pi-durable-native-module",
+		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit && ./run.sh check-chain-terminus-publication",
+		"check:contracts": "./run.sh check-demo-reproducibility && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-control-retire && ./run.sh check-pi-retire-request && ./run.sh check-cc-retire-pidfd && ./run.sh check-cc-retire-request && ./run.sh check-retirement-event && ./run.sh check-entwurf-v2-retire && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-win32-preview && ./run.sh check-pack-win32-carrier && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-fresh-call-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-native-push-paused && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-set-model-readback && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-pi-durable-beside && ./run.sh check-pi-durable-carrier && ./run.sh check-pi-durable-native-module && ./run.sh check-remote-pair-beside",
 		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-pi-launch && ./run.sh check-codex-app-server-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-birth-hook && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-peer-facts && ./run.sh check-herdr-plugin && ./run.sh check-herdr-plugin-profile && ./run.sh check-herdr-plugin-build && ./run.sh check-herdr-runtime-bootstrap && ./run.sh check-herdr-activation && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-typing-call-fence && ./run.sh check-gate-manifests && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex && ./run.sh check-codex-bridge-identity && ./run.sh check-pi-bridge-sender && ./run.sh check-pi-mcp-register && ./run.sh check-pi-mcp-bridge && ./run.sh check-codex-birth-hook && ./run.sh smoke-codex-config-state && ./run.sh smoke-codex-birth && ./run.sh check-herdr-sandbox",
-		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-pack-consumer-roots && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
+		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-pack-argv-matcher && ./run.sh check-pack-consumer-roots && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},
 	"pi": {
 		"extensions": [

package/pi-extensions/lib/entwurf-self-address.ts

@@ -77,6 +77,8 @@ export interface SelfAddressabilityFacts {
 	watchArmed?: boolean;
 	/** meta-session (native-push): an adapter probe found this citizen's live native conversation. */
 	probeAlive?: boolean;
+	/** meta-session (native-push): #152 — this backend's native-push is paused, so no probe ran. */
+	nativePushPaused?: boolean;
 }
 
 export interface SelfAddressabilityResult {
@@ -118,6 +120,17 @@ export function computeSelfAddressability(facts: SelfAddressabilityFacts): SelfA
 			// default fail-closed row).
 			switch (facts.metaDeliveryDomain) {
 				case "native-push": {
+					// #152 policy, decided BEFORE the pure record+probe predicate and kept out of it:
+					// only a record-backed citizen can be "paused" (a record-less one keeps its own
+					// reason), and no probe was run for this answer, so none is reported.
+					if (facts.recordBacked === true && facts.nativePushPaused === true) {
+						return {
+							replyable: false,
+							socketState: "none",
+							reason:
+								"native-push unreachable — native-push for this backend is paused (#152); no probe ran for this answer",
+						};
+					}
 					const push = nativePushDeliverable({ recordBacked: facts.recordBacked, probeAlive: facts.probeAlive });
 					return {
 						replyable: push.deliverable,

package/pi-extensions/lib/entwurf-v2-contract.ts

@@ -134,6 +134,26 @@ export function nativePushSupported(backend: string): backend is NativePushBacke
 	return (NATIVE_PUSH_BACKENDS as readonly string[]).includes(backend);
 }
 
+// ── Paused native-push backends (#152) ─────────────────────────────────────
+// A native-push backend whose SEND is paused by product policy. On the external send path
+// entwurf measured, Antigravity's language server refused the `agentapi` call with
+// `Unauthenticated: missing CSRF token` (agy 1.2.16 in #128; agy 1.4.6 again for #152).
+// Whether a first-party own-tool shell holds a token entwurf could legitimately present is
+// UNMEASURED, not ruled out. So instead of probing a port that refused on that path and
+// reporting it as an inconclusive liveness, the three public entries that would reach the agy LS —
+// v2 dispatch, a sender's own `replyable`, and `entwurf_register_native` — refuse by name
+// BEFORE any probe. This is a fixed constant, not a flag: no env, config or runtime toggle
+// can lift it. The backend stays in NATIVE_PUSH_BACKENDS, so existing agy records, the V3
+// reader and the peers listing are unchanged; only the native-push traffic stops.
+// The one probe that is NOT behind this guard is the fresh-cut quiescence check
+// (scripts/meta-bridge-fresh-cut.ts), which protects an operator-named archive and must keep
+// failing closed rather than read the pause as a departed host.
+export const NATIVE_PUSH_PAUSED_BACKENDS: readonly NativePushBackend[] = ["antigravity"];
+
+export function nativePushPaused(backend: string): boolean {
+	return (NATIVE_PUSH_PAUSED_BACKENDS as readonly string[]).includes(backend);
+}
+
 // NativePushLiveness = the 3-value liveness the native-push adapter probe yields.
 // The SAME three values as SocketLiveness, reused so there is ONE 3-value liveness
 // vocabulary — but these are NOT socket-bound (봉인 2: "주석만 socket-전용 오독 정정"):
@@ -173,6 +193,7 @@ export const ENTWURF_V2_REJECT_REASONS = [
 	"mailbox-undeliverable", // F-mailbox: fire-and-forget to an unsupported citizen whose mailbox is not deliverable (fail-closed; future pi-backend non-drainable mailbox)
 	"native-push-target-dead", // 봉인 1: fire-and-forget to a native-push (agy) target whose adapter probe found NO live conversation. Post-probe; observedLiveness = dead.
 	"native-push-probe-indeterminate", // 봉인 1: fire-and-forget to a native-push target whose adapter probe was inconclusive (agy alive but no port served the conv, or a probe error). Post-probe; observedLiveness = indeterminate. Never coerced to dead.
+	"native-push-paused", // #152: fire-and-forget to a native-push backend whose send is paused by product policy (NATIVE_PUSH_PAUSED_BACKENDS — antigravity). Pre-probe, observedLiveness = null: nothing was probed, so no liveness is claimed — never coerced to dead or indeterminate.
 	"bad-target", // R2: absent/typo garden-id (no existing citizen); fresh creation out of v2 scope
 	"record-less-socket", // #50 C4: a gid-shaped non-symlink control socket exists but NO meta-record claims it. The record is the sole address authority (목표 ②), so a bare socket is not an addressable citizen — it is a diagnostic state, refused for EVERY intent before any lock/probe (pre-probe, observedLiveness=null). NOT `bad-target`: something real answers to this gid, and mislabeling it absent would hide the very state the reject exists to surface.
 	"target-locked", // R5 pre-claim for bucket B F2 per-gid lockfile conflict
@@ -181,12 +202,13 @@ export const ENTWURF_V2_REJECT_REASONS = [
 export type EntwurfV2RejectReason = (typeof ENTWURF_V2_REJECT_REASONS)[number];
 
 // ── Pre-probe reject reasons (？6 — observedLiveness = null) ────────────────
-// These four rejects are decided BEFORE any liveness probe runs, so there is no
+// These five rejects are decided BEFORE any liveness probe runs, so there is no
 // honest 4-value FactLiveness to stamp: `bad-target` (no citizen/backend),
 // `target-locked` (5a lock conflict, before lstat/connect), `target-address-conflict`
 // (address-subject conflict → probing is forbidden), `record-less-socket` (#50 C4:
 // no record ⇒ not a citizen ⇒ no in-domain probe ever runs — the presence hint is
-// a single lstat, not a liveness measurement). `indeterminate` means an
+// a single lstat, not a liveness measurement), `native-push-paused` (#152: the backend's
+// native-push send is paused by policy, so its adapter is never probed). `indeterminate` means an
 // in-domain probe was inconclusive (≠ "not looked yet"); `unsupported` means the
 // backend has no predicate (≠ "pre-probe"). So a pre-probe reject's
 // observedLiveness is `null`, NOT one of the four values. Every OTHER reject —
@@ -203,6 +225,7 @@ export const PRE_PROBE_REJECT_REASONS = [
 	"target-locked",
 	"target-address-conflict",
 	"record-less-socket",
+	"native-push-paused",
 ] as const satisfies readonly EntwurfV2RejectReason[];
 export type PreProbeRejectReason = (typeof PRE_PROBE_REJECT_REASONS)[number];
 

package/pi-extensions/lib/entwurf-v2-decider.ts

@@ -52,6 +52,7 @@ import {
 	isLivenessSupported,
 	makeRejectReceipt,
 	type NativePushBackend,
+	nativePushPaused,
 	nativePushSupported,
 	resolveDispatch,
 	resolveNativePushDispatch,
@@ -306,6 +307,12 @@ export async function decideDispatch(input: DispatchInput, deps: DispatchDecider
 	// branch is LOCK-FREE (봉인 4): the pi in-domain lock closes a socket TOCTOU, but a
 	// volatile probe route has no lock meaning (a duplicate-send idempotency is a D8 future).
 	if (nativePushSupported(identity.backend)) {
+		// #152: a paused native-push backend is refused by name BEFORE its adapter is probed —
+		// on the measured external path that language server refused the call (missing CSRF token),
+		// and a refusal must not be reported as a measured liveness. Pre-probe, observedLiveness null.
+		if (nativePushPaused(identity.backend)) {
+			return reject(makeRejectReceipt("native-push-paused", null));
+		}
 		const probe = await deps.nativePushProbe(identity);
 		const receipt = resolveNativePushDispatch(input.intent, probe.status);
 		if (!receipt.ok) return reject(receipt);

package/pi-extensions/lib/entwurf-v2-surface.ts

@@ -107,6 +107,9 @@ export function actionableRejectHint(reason: string): string | undefined {
 			// Native host up, but nothing served this conversation/thread — inconclusive, not a
 			// hard dead. Backend-neutral for the same reason as the dead cell above.
 			return "the native host (harness process or app-server) is up, but nothing served this conversation/thread, so the probe is INCONCLUSIVE — not a measured death. Retry once it is loaded, or verify the conversation/thread id.";
+		case "native-push-paused":
+			// #152: a policy refusal, not a liveness verdict — this dispatch probed and sent nothing.
+			return "native-push for this backend is paused (#152): its language server refused entwurf's measured external calls for a missing CSRF token, so this dispatch probed and sent nothing. The citizen and its record are kept; reach it from inside its own harness instead.";
 		case "record-less-socket":
 			// #50 C4: name the true cause AND the fix — a bare socket is a diagnostic
 			// state, not an addressable citizen (the record is the address).

package/pi-extensions/lib/fresh-call-composition.ts

@@ -67,7 +67,7 @@ export const FRESH_CALL_CALLBACK_TOOL: Record<FreshCallBackend, string> = {
 	copilot: "entwurf-bridge-entwurf_callback",
 	omp: "mcp__entwurf_bridge_entwurf_callback",
 	// Codex's tool process is the operator app-server, not the pane: the no-arg
-	// verb refuses there by name. First action stays the delivery verb with args.
+	// verb refuses there by name. Its callback stays the delivery verb with args.
 	codex: "mcp__entwurf_bridge__entwurf_v2",
 	// The durable contact registers the bridge verbs as its OWN tools under their bare names, and the
 	// app offers a tool to the model by its registered name (`durable/harness/registry.ts:99`
@@ -381,8 +381,8 @@ export function composeBackendArgs(
  * PLACEMENT SENTENCE. The first line names where the sibling was opened, and only the RAIL knows
  * that — "the operator's tmux session" is true of a `new-window` launch and false of a herdr
  * pane. It is therefore supplied by the caller rather than composed here. Everything BELOW that
- * line is rail-independent and stays the contract: the callback is the first action, the task
- * follows it, and the three prohibitions are measured rather than polite.
+ * line is rail-independent and stays the contract: the callback comes before the task, an optional
+ * read-only check of the caller may come before the callback, and the steering is stated as fact.
  */
 /**
  * The first-turn framing, WITHOUT the task.
@@ -394,8 +394,13 @@ export function composeBackendArgs(
  * the halves separate is what lets the framing stay plain prose on both rails while the operator's
  * task text keeps every byte it was written with.
  *
- * Order is the contract: the callback is the FIRST action and the task follows it, so a sibling
- * that gets stuck in the task has already told the caller who it is.
+ * Order is the contract: the callback comes BEFORE THE TASK, so a sibling that gets stuck in the
+ * task has already told the caller who it is. It is not the literal first tool call. `[GLG 직접,
+ * 2026-10-24]` checking the caller and then calling back is the right order, and the framing used
+ * to say both "FIRST ACTION … call back" and "you can corroborate the caller first" — two
+ * sentences that cannot both be obeyed. What may come before the callback is the one read-only
+ * check offered below (and, where a dialect needs it, loading the tools); reading files, running
+ * commands or starting the task may not.
  *
  * WHAT THIS SAYS AND WHY IT STOPPED SAYING THE REST (#116). Until 2026-09-17 this framing carried
  * three prohibitions, including "Do not inspect environment variables, do not call entwurf_self".
@@ -433,7 +438,7 @@ export function composeFreshCallFraming(params: {
 	const firstAction =
 		params.backend === "codex"
 			? [
-					`FIRST ACTION, before reading files or anything else: call ${birthTool} with ` +
+					`BEFORE THE TASK, and before reading files or running commands: call ${birthTool} with ` +
 						`target=${params.callerGardenId}, intent=fire-and-forget, wants_reply=false, and ` +
 						`message set to exactly ${params.nonce} — that string alone, nothing added.`,
 					`${params.nonce} is a correlation tag this caller minted for this one launch: it names no`,
@@ -443,7 +448,7 @@ export function composeFreshCallFraming(params: {
 					"entwurf_callback is refused on this rail: the tool process is the operator app-server, not this pane.",
 				]
 			: [
-					`FIRST ACTION, before reading files or anything else: call ${birthTool} with no arguments.`,
+					`BEFORE THE TASK, and before reading files or running commands: call ${birthTool} with no arguments.`,
 					"That call is how the caller learns the garden id you were born with. There are no",
 					"parameters: a target or message you type would be a second address axis.",
 					"Your own record does not carry the caller's address, so reporting your identity here does not reach it — that tool call does.",
@@ -453,9 +458,15 @@ export function composeFreshCallFraming(params: {
 		"",
 		...firstAction,
 		"",
-		`You can corroborate the caller first if you want to: ${peersTool} is a read-only listing of`,
-		`this garden's citizens and ${params.callerGardenId} is one of them. That listing is capped, so`,
-		"a caller you do not happen to see in it is not a reason to skip the callback.",
+		// THE CHECK IS THE SIBLING'S, AND SO IS ITS VERDICT. `[GLG 직접, 2026-10-24]` a capped listing that
+		// does not show the caller proves nothing about the caller, but a sibling whose check does not hold
+		// up may say so and hold back. Entwurf decides nothing here — no trust store, no fallback, no
+		// watcher — and the cost of holding back is stated, not hidden: no callback, no address.
+		`You may corroborate the caller before that call: ${peersTool} is a read-only listing of`,
+		`this garden's citizens and ${params.callerGardenId} is one of them. That listing is capped, so not`,
+		"seeing the caller in it does not show the caller is absent. If what you can check is not enough,",
+		"or it conflicts with this message, you may say so here and hold the callback and the task; the",
+		"caller then has no address for you.",
 		...hintBlock,
 		"",
 		// WHERE THE RESULT GOES, said once, as topology. `[GLG 직접, 2026-09-18]` a Sonnet sibling

package/pi-extensions/lib/herdr-fresh-call.ts

@@ -1232,10 +1232,12 @@ export function renderHerdrFreshCall(result: HerdrFreshCallResult): { text: stri
 			`mean the sibling is running, that its first turn ran, or that the task was delivered. The tab and pane ` +
 			`coordinates are a view and can change under the sibling — they are not an address and nothing may be ` +
 			`dispatched to them.\n` +
-			`The sibling's garden id arrives separately — its first action is the zero-argument callback verb, and ` +
+			`The sibling's garden id arrives separately — before its task it calls the zero-argument callback verb ` +
+			`(a read-only look at the caller may come first), and ` +
 			`the sender envelope of THAT message is the address. The nonce above is the correlation tag it carries; ` +
 			`the sibling reads it from its own launch env, never from this receipt. Nothing is polling for it; if it ` +
-			`never comes, the pane is visible and can be read directly.`,
+			`never comes — not started, stuck, or held back after its check; this receipt cannot tell which — the ` +
+			`pane is visible and can be read directly.`,
 		isError: false,
 	};
 }

package/pi-extensions/lib/meta-sender-identity.ts

@@ -47,6 +47,7 @@
  * a backend listed there is one whose hook writes a pid marker, and codex birth writes none.
  */
 
+import { nativePushPaused } from "./entwurf-v2-contract.ts";
 import {
 	defaultMetaSessionsDir,
 	describe,
@@ -229,6 +230,9 @@ export async function probeNativeSenderAlive(
 	identity: Pick<MetaIdentity, "backend" | "nativeSessionId">,
 	deps: { resolveAdapter?: (id: string) => Pick<NativePushAdapter, "probe"> } = {},
 ): Promise<boolean> {
+	// #152: a paused native-push backend cannot receive a reply, so its `replyable` is false by
+	// POLICY — no adapter is resolved or probed. This is not a liveness verdict about the citizen.
+	if (nativePushPaused(identity.backend)) return false;
 	const resolveAdapter = deps.resolveAdapter ?? resolveNativePushAdapter;
 	const probe = await resolveAdapter(identity.backend).probe(identity.nativeSessionId);
 	return probe.status === "alive";

package/pi-extensions/lib/mux-fresh-call.ts

@@ -709,11 +709,13 @@ export function renderFreshCall(result: FreshCallResult): { text: string; isErro
 			`\n` +
 			`This is a LAUNCH receipt: tmux created that window and was asked to start the runtime with the model above. It does ` +
 			`NOT mean the sibling is running, that its first turn ran, or that the task was delivered.\n` +
-			`The sibling's garden id arrives separately — its first action is the zero-argument callback verb ` +
-			`(codex is the one arm that still sends the nonce as arguments), and the sender envelope of THAT ` +
+			`The sibling's garden id arrives separately — before its task it calls the zero-argument callback verb ` +
+			`(codex is the one arm that still sends the nonce as arguments; a read-only look at the caller may come ` +
+			`first), and the sender envelope of THAT ` +
 			`message is the address. The nonce above is the correlation tag it carries; the sibling reads it ` +
-			`from its own launch env, never from this receipt. Nothing is polling for it; if it never comes, ` +
-			`the window is visible and can be read directly.`,
+			`from its own launch env, never from this receipt. Nothing is polling for it; if it never comes — ` +
+			`not started, stuck, or held back after its check; this receipt cannot tell which — the window is visible ` +
+			`and can be read directly.`,
 		isError: false,
 	};
 }

package/pi-extensions/lib/native-push/register.ts

@@ -19,10 +19,12 @@
  * deliverability semantics. `check-native-push-register` asserts this file references no
  * receiver-marker writer. (A dedicated register-provenance slot is a future concern.)
  *
- * LEAF-adjacent + pi-free: imports only the native-push adapter (pi-free) and the meta-session
- * upsert (pi-free), so the harness-neutral MCP bridge can reach it at boot.
+ * LEAF-adjacent + pi-free: imports only the native-push adapter (pi-free), the meta-session
+ * upsert (pi-free) and the pure v2 contract's paused-backend policy, so the harness-neutral MCP
+ * bridge can reach it at boot.
  */
 
+import { nativePushPaused } from "../entwurf-v2-contract.ts";
 import { type MetaCitizenBackend, type UpsertAction, upsertMetaSession } from "../meta-session.ts";
 import { type NativePushAdapter, resolveNativePushAdapter } from "./adapter.ts";
 
@@ -62,6 +64,19 @@ export async function registerNativeConversation(
 	input: RegisterNativeConversationInput,
 	deps: RegisterNativeConversationDeps = {},
 ): Promise<RegisterNativeConversationResult> {
+	// #152: a paused native-push backend is refused by name BEFORE any adapter is resolved or
+	// probed — registration would otherwise reach a language server that refused the measured
+	// external calls (missing CSRF token).
+	// Nothing is probed and no record is written.
+	if (nativePushPaused(input.backend)) {
+		throw new Error(
+			`entwurf_register_native: refusing to register ${input.backend} conversation ${JSON.stringify(
+				input.nativeSessionId,
+			)} — native-push for ${input.backend} is paused (#152: its language server refused ` +
+				"entwurf's measured external calls for a missing CSRF token). Nothing was probed and no garden id was minted; " +
+				"existing records stay readable.",
+		);
+	}
 	const resolveAdapter = deps.resolveAdapter ?? resolveNativePushAdapter;
 	const adapter = resolveAdapter(input.backend);
 	const probe = await adapter.probe(input.nativeSessionId);

package/pi-extensions/lib/omp-fresh-preflight.ts

@@ -20,8 +20,8 @@
  *   callback callable — THE OMP-SPECIFIC ONE. `tools.xdev` defaults to TRUE, which mounts MCP
  *                      tools as `xd://` devices whose schemas never reach the prompt. The tool
  *                      would be configured, the bridge would be running, and the model still
- *                      could not call `mcp__entwurf_bridge_entwurf_v`. Step 9 clause 5 makes the
- *                      callback the FIRST action, so a fresh call onto a default-config host
+ *                      could not call `mcp__entwurf_bridge_entwurf_v`. Step 9 clause 5 puts the
+ *                      callback before the task, so a fresh call onto a default-config host
  *                      opens a window that can never name itself. `[측정]` #87 A-lane: the
  *                      vendor default wrapped the send tool and produced a false delivery report.
  *

package/pi-extensions/lib/pi-durable-fresh-preflight.ts

@@ -15,7 +15,7 @@
  *                 provider spelled out (the bootstrap refuses a model resolved by inference), so
  *                 the model here is `<provider>/<model id>` split at the FIRST `/` — a catalog id
  *                 that itself contains `/` keeps it. A model with no provider part is refused.
- *   first input   the whole framing (callback first, then the task) rides the bootstrap's closed
+ *   first input   the whole framing (callback before the task) rides the bootstrap's closed
  *                 `{v:2,task}` payload, whose decoder caps `task` at 16000 characters. A framed
  *                 task over that cap would open a window whose bootstrap refuses its own argv.
  *

package/pi-extensions/lib/remote-pair-receive.ts

@@ -1,15 +1,16 @@
 /**
- * remote-pair-receive — the RECEIVING half of #107's one declared remote pair (rail 1).
+ * remote-pair-receive — the RECEIVING half of the declared remote pairs (#107 rail 1, #149 routes).
  *
  * The host that owns the target record runs this once per SSH call. It reads one JSON claim
- * from stdin, checks it against the operator-written pair declaration, and hands a matching
+ * from stdin, checks it against the operator-written pair declarations, and hands a matching
  * claim to the existing v2 dispatch. The record, owner and deliverability checks stay the
  * dispatch's own: nothing here writes a mailbox, resolves a rail, or retries.
  *
  * Trust model (GLG, #107 D3 (a)): the boundary is the same operator's SSH account. The pair
- * check is a SCOPE limit, not authentication: a claim whose `from`/`target` is not the declared
- * pair is refused before any mutation. It does not detect that same account sending the
- * declared gid falsely; nothing here claims to.
+ * check is a SCOPE limit, not authentication: a claim whose `from`/`target` is not one declared
+ * pair is refused before any mutation. Both ends are matched in the SAME route (#149), so a sender
+ * declared in one route cannot address the local citizen of another. It does not detect that same
+ * account sending a declared gid falsely; nothing here claims to.
  *
  * Sender: the stdin claim is the only sender input. Ambient carriers (`PI_SESSION_ID`,
  * `PI_AGENT_ID`, sender markers) in the SSH environment are never consulted, so this module
@@ -29,7 +30,7 @@ import type { EntwurfV2SurfaceRendered, SurfaceEntwurfV2Params } from "./entwurf
 import type { MailboxSenderEnvelope } from "./meta-mailbox-body.ts";
 import { requireGardenId } from "./meta-session.ts";
 
-/** One operator-declared pair, as written on the RECEIVING host. */
+/** One operator-declared pair (one route), as written on the RECEIVING host. */
 export interface RemotePairDeclaration {
 	/** The sender's garden id on the other host. */
 	remoteGardenId: string;
@@ -131,24 +132,31 @@ export function parseRemoteClaim(text: string): RemoteClaim {
 	};
 }
 
-/** The scope check. Null = inside the declared pair. */
-export function checkRemotePair(
+/**
+ * The scope check: the one declared pair whose two ends are the claim's `from` and `target`, or a
+ * refusal. The two reasons are the ones every sender already reads (#107), so a sender on another
+ * release still classifies them: an undeclared `from` is a from-mismatch; a declared `from` with a
+ * target that is not ITS declared local (another route's local included) is a target-mismatch.
+ */
+export function selectRemotePair(
 	claim: RemoteClaim,
-	decl: RemotePairDeclaration,
-): { reason: RemotePairRejectReason; detail: string } | null {
-	if (claim.from !== decl.remoteGardenId) {
+	decls: readonly RemotePairDeclaration[],
+): { decl: RemotePairDeclaration } | { reason: RemotePairRejectReason; detail: string } {
+	const fromRoutes = decls.filter((d) => d.remoteGardenId === claim.from);
+	if (fromRoutes.length === 0) {
 		return {
 			reason: "remote-pair-from-mismatch",
-			detail: `from ${claim.from} is not the declared remote ${decl.remoteGardenId}`,
+			detail: `from ${claim.from} is not a declared remote (${decls.map((d) => d.remoteGardenId).join(", ")})`,
 		};
 	}
-	if (claim.target !== decl.localGardenId) {
+	const decl = fromRoutes.find((d) => d.localGardenId === claim.target);
+	if (!decl) {
 		return {
 			reason: "remote-pair-target-mismatch",
-			detail: `target ${claim.target} is not the declared local ${decl.localGardenId}`,
+			detail: `target ${claim.target} is not a declared local for remote ${claim.from} (${fromRoutes.map((d) => d.localGardenId).join(", ")})`,
 		};
 	}
-	return null;
+	return { decl };
 }
 
 export function buildRemoteSenderEnvelope(
@@ -170,12 +178,12 @@ export function buildRemoteSenderEnvelope(
 
 export async function receiveRemoteClaim(
 	claim: RemoteClaim,
-	decl: RemotePairDeclaration,
+	decls: readonly RemotePairDeclaration[],
 	deps: RemoteReceiveDeps,
 ): Promise<RemoteReceiveReceipt> {
-	const mismatch = checkRemotePair(claim, decl);
-	if (mismatch) return { kind: "rejected", ...mismatch };
-	const sender = buildRemoteSenderEnvelope(claim, decl, (deps.now ?? (() => new Date()))(), deps.replyRoute);
+	const picked = selectRemotePair(claim, decls);
+	if (!("decl" in picked)) return { kind: "rejected", ...picked };
+	const sender = buildRemoteSenderEnvelope(claim, picked.decl, (deps.now ?? (() => new Date()))(), deps.replyRoute);
 	const rendered = await deps.dispatch(
 		{ target: claim.target, intent: "fire-and-forget", message: claim.message, wants_reply: claim.wantsReply },
 		sender,