@junghanacs/entwurf 0.41.1 → 0.41.2

package/run.sh

@@ -184,6 +184,7 @@ Usage:
   ./run.sh check-pi-durable-beside    # #129 mutant execution coordinate (VERIFY rule 3): run_vitest over four pi-durable beside tests (adapter, carrier/SDK-set verifier, preflight, owner join) — a pi-durable qualification lane gate argv. Same files check-tests-beside-behavior already runs.
   ./run.sh check-pi-durable-carrier   # #144 mutant execution coordinate (VERIFY rule 3): run_vitest over the carrier test alone (relocation/resolver, owned-source emission and typecheck fence, package file list, task footer, the real bootstrap on the 1.2 SDK, stream transport, skills prompt) — the gate argv of the carrier claims, whose QKs live only in that file. Same file check-tests-beside-behavior already runs.
   ./run.sh check-pi-durable-native-module # #144 mutant execution coordinate (VERIFY rule 3): run_vitest over the bootstrap's native-module file and directory ingress test alone — the gate argv of the ingress claims, whose QKs live only in that file. Same file check-tests-beside-behavior already runs.
+  ./run.sh check-remote-pair-beside   # #149 mutant execution coordinate (VERIFY rule 3): run_vitest over the five remote-pair beside tests (send, receive, roundtrip, transport, mailbox body) — the gate argv of the remote-pair claims. Same files check-tests-beside-behavior already runs.
   ./run.sh check-pi-durable-receive   # #129 L-receive FIRST CELL, CHECKOUT-ONLY. Same input (the bundle must carry the pi-durable-host owner join). The host driver gives the app NO input; a seeded claude-code sender (marker owned by a separate idle child, handed to a gate-owned sending bridge through ENTWURF_META_SENDER_MARKER) enqueues one message, the host's doorbell admits its notice to the ROOT conversation, and the scripted model drains it with entwurf_inbox_read. S withholds response #1 until the ENQUEUE receipt, the .delivered bytes, the signal, the host-owned receiver marker and the notice are captured. Oracles: receiver() admission, native view, raw archive (.delivered.read + lastReadAt), wire (exactly two requests, drain result = view), and after a green reap a forensic read-only SQLite copy (submission row by request id = reported id, root, input, done, placed entry = the notice). V NOT run. Missing inputs → SKIP (97)
   ./run.sh check-copilot-receive-arm  # #82 RAIL 5 gate: the REAL receiver installer + the REAL extension.mjs forked with a stubbed SDK. Arms only after birth, marker owned by the WATCHER pid, self-fetch dispatch answer, doorbell carries the garden id and NOT the body, id-drift/foreign-parent refusals. Hermetic; no Copilot, no model turn
   ./run.sh check-copilot-launch       # #82 RAIL 7 gate: the MANAGED launch `entwurf copilot`, driven through its public address against a FAKE VENDOR on a sandbox PATH. Receiver precondition refusals, EXTENSIONS token + operator token preservation, injected defaults before the `--` terminator, byte-identical argv, the 11 explicit permission/surface policy overrides that suppress `--yolo`, exec (not fork) pid identity, exit passthrough, recursion refusal. Hermetic; no Copilot, no model turn
@@ -221,10 +222,10 @@ Usage:
   ./run.sh check-typing-call-fence    # deterministic gate for the boundary nobody has broken: this product composes ARGUMENTS and LETTERS, never keystrokes. Scans every tracked production source under pi-extensions/ and mcp/ — comments blanked, string literals kept — for tmux send-keys/paste-buffer/load-buffer and herdr's PTY verbs (agent.prompt, agent.send_keys, pane.send_text, pane.input.set). Prose is exempt on purpose: the sentence stating the rule names the very calls it forbids, and a scanner that read prose could be made green by deleting the law. Carries its own oracle — the detector is proven on planted code, proven blind to comments, and the scanned inventory is measured
   ./run.sh check-resume-launch-identity # deterministic gate for resume-launch-identity.ts, the record-authoritative launch-identity leaf preserved through the visible-first cut (spawn-bg and all its callers are gone; this leaf answers "which being is this, and which conversation is theirs"). Temp meta-store fixture: gardenId→record.transcriptPath happy path with header cwd/provider/model; C3 integrity (header id ≠ record.nativeSessionId → refused, never resumed); #52 ADDRESSABLE read (a gid that no longer holds its nativeSessionId alone is refused from EITHER side — the plain targeted read would resume one transcript twice under two locks); cause fidelity per impossible resume incl. the F7 pin (recorded-but-deleted transcript → MISSING, not "no recorded model"); header↔gate SSOT. No spawn/socket/timer
   ./run.sh smoke-entwurf-v2-matrix-live # LIVE sentinel (0.11 Stage 0 step 5d-5, D4-b) — OUT of pnpm check, needs LIVE=1. Drives REAL production runEntwurfV2 deps over REAL OS objects, 4 cells: C1 control-socket (real pi --entwurf-control resident → RPC send → lock acquire→release ×1), C1b record-less socket (#50 C4: live record-less pi → EVERY intent rejected pre-probe record-less-socket, no lock, rendered hint names record authority + fresh-cut), C2 meta-mailbox deliverable (armed self-fetch citizen → real .msg enqueue, lock-free), C3 meta-mailbox guard (no armed receiver → reject, no garbage). Model-in-loop OUT (transport/lock/enqueue gate, GPT Q2); negative/timeout stay deterministic. Model: ENTWURF_LIVE_TARGET=<provider>/<model> (default openai-codex/gpt-5.6-luna). LIVE=1 ./run.sh smoke-entwurf-v2-matrix-live
-  ./run.sh smoke-agy-native-push-live  # 봉인 8 LIVE acceptance for the native-push (agy) rail — OUT of pnpm check, needs LIVE=1 + AGY_CONVERSATION_ID (a live agy conversation). Drives the REAL antigravity adapter + register core + runEntwurfV2 (production deps): doctor-static preflight (dangling→FAIL, the ③ gate), probe route, register create/attach idempotency, fire→native-push delivered, post-send re-probe (D7 partial), bogus-conv→native-push-probe-indeterminate. Meta-store isolated to a temp dir (only the agy round-trip is real; no real-store residue). COST FENCE: open that agy conversation on gemini-3.6-flash (free account) — never a Pro tier; entwurf never selects the agy model and no assertion reads it. LIVE=1 AGY_CONVERSATION_ID=<convId> ./run.sh smoke-agy-native-push-live
+  ./run.sh smoke-agy-native-push-live  # PAUSED (#152): exits 2 with [entwurf:paused] before it reads LIVE or AGY_CONVERSATION_ID — not a PASS and not a SKIP; OUT of pnpm check. Open no agy conversation for it while the pause holds. Its 봉인 8 native-push round trip (real antigravity adapter + register core + runEntwurfV2) runs only after a separate change lifts the pause.
   ./run.sh smoke-codex-native-push-live # on-demand LIVE acceptance for Codex native-push — needs LIVE=1 + CODEX_LIVE_THREAD_ID loaded by a visible TUI attached to the default app-server; probes the real UDS, routes through production runEntwurfV2, queues one exact-token turn without retry, re-probes, and leaves the visible TUI to show the model result
   ./run.sh smoke-codex-fresh-live    # #95 RELEASE MUST: record-backed receipt fixture -> PUBLIC initial Pi fresh/callback in a session S that is NOT the app-server's -> Pi PUBLIC omitted-placement Codex fresh/exact callback, also in S -> Pi-to-Codex addressed native-push v2 -> Codex PUBLIC omitted-placement AND omitted-cwd fresh Pi/exact callback IN S beside its own TUI (lane B claim: the app-server env names another session, so S can only come from the caller's pane title; lane C claim: no cwd was asked for, so the directory can only come from the Codex caller's own record — and the Codex thread's own rollout session_meta.cwd, its pane and its record must all be the requested scratch, not the app-server's repo) -> Codex final v2 evidence. Needs LIVE=1 + ENTWURF_CODEX_APP_SERVER_PID + ENTWURF_CODEX_FRESH_MODEL + ENTWURF_CODEX_FRESH_PI_MODEL, and its ONE stable launch directory answered 'Trust' once in a plain codex -C there: codex records its direct consent per exact directory, so a directory with no answer at all opens a consent screen instead of a first turn. Only THIS gate treats that as a precondition and fails up front as codex-launch-cwd-undecided rather than timing out on a callback — an ordinary entwurf_fresh_call only prints the note and opens the window, because a human can answer the screen. The smoke PRINTS that directory as 'launch-cwd <dir>' and repeats it in the failure as a ready-to-run repair command — do not retype it from memory, and do not write it as \$TMPDIR/... (os.tmpdir() falls back to /tmp when TMPDIR is unset, so that spelling names a different directory in the filesystem root). The PID names the operator-owned app-server, which must sit in a DIFFERENT session from S; the smoke checks/prints all four coordinates, never starts/stops/guesses the app-server/session, never reads screen text, interrupts only its exact still-running Codex turn, and cleans only receipt-named window ids
-  ./run.sh smoke-mux-lifecycle-live  # RELEASE MUST integrated LIVE lifecycle acceptance for mux, through the REAL MCP surface — OUT of pnpm check, needs LIVE=1 and spends model turns (two pi siblings: native + recorded-ACP provider, each resumed once; one Claude Code sibling). tools/call fresh_call -> nonce callback sender envelope -> v2 control send landing in the sibling's own transcript -> resume_call REFUSED while live (window count unchanged) -> stable-handle close (pane gone, socket dead, record kept) -> dormant delivery refused honestly -> public entwurf_resume_call with LAUNCH and OBSERVATION receipts kept apart, same-gid socket alive, zero new citizens, zero lock residue, resumed pane_start_path == RECORD cwd (separate tmux query), transcript byte-identical across the resume -> v2 recall of the pre-close fact. claude-code resume of the still-live sibling refused target-live, no window opened and no lock residue (its dormant same-id resume is deterministic-only, #147 L2). LIVE=1 ./run.sh smoke-mux-lifecycle-live
+  ./run.sh smoke-mux-lifecycle-live  # RELEASE MUST integrated LIVE lifecycle acceptance for mux, through the REAL MCP surface — OUT of pnpm check, needs LIVE=1 and spends model turns (two pi siblings: native + recorded-ACP provider, each resumed once; one Claude Code sibling). tools/call fresh_call (the native pi cell names a caller-distinct seat and tmux is asked where the pane landed, #108) -> nonce callback sender envelope -> v2 control send landing in the sibling's own transcript -> resume_call REFUSED while live (window count unchanged) -> stable-handle close (pane gone, socket dead, record kept) -> dormant delivery refused honestly -> public entwurf_resume_call with LAUNCH and OBSERVATION receipts kept apart, same-gid socket alive, zero new citizens, zero lock residue, resumed pane_start_path == RECORD cwd (separate tmux query), transcript byte-identical across the resume -> v2 recall of the pre-close fact. claude-code resume of the still-live sibling refused target-live, no window opened and no lock residue (its dormant same-id resume is deterministic-only, #147 L2). LIVE=1 ./run.sh smoke-mux-lifecycle-live
   ./run.sh check-meta-facts            # deterministic gate for the meta-facts projection (#65): drives the REAL CLI — full-record join, parse-before-uniqueness, no-winner duplicates, drift/symlink/invalid-UTF-8 defects in-band, deterministic bytes, exit contract 0/2/3, dispatch+emit reachability
   ./run.sh check-herdr-plugin          # deterministic gate for the #116 M2-b herdr plugin (`plugins/herdr/`): STATIC manifest shape for herdr 0.9.0 + the forbidden sections ([[startup]]/[[events]]/[[actions]]/[[link_handlers]]) asserted absent ([[build]] is check-herdr-plugin-build's subject since #116 M3-b3); BEHAVIOURAL drive of the REAL pane entry against a stub `entwurf` and stub HERDR_BIN_PATH that LOG every call — exactly one `herdr integration status` + one `entwurf peer-facts` + one `herdr agent list` per open, in that order (counted, not claimed), through ONE spawn call site; the four blocks each naming their own owner/observation time with no aggregate verdict; the D3=C fallback reading the activation ledger from the path its WRITER owns (XDG state, never the runtime's data root) and only when the phase is `active`, with ENTWURF_BIN and PATH still winning outright; the citizen axis alone skipping by name when no binary is reachable; every broken-evidence state a named red rather than a crash or an empty table, and a selected herdr atom that is `outdated`/`needs repair` as block [1]'s OWN red (`not installed` stays a reported skip); ambiguous never first-wins, diagnostics shown, activity in its own column, and zero writes to the plugin state/config dirs. No herdr binary, no Entwurf install
   ./run.sh check-herdr-runtime-bootstrap # deterministic gate for the #116 M3-b1 runtime leaf (`plugins/herdr/lib/runtime-bootstrap.mjs`): the Entwurf-owned stable active root as a REAL directory (nothing is put on PATH — the scoped wiring above names ABSOLUTE commands under it), ownership decided BEFORE the first mkdir, disk facts from lstat (a dangling symlink is not 'absent' and a link into another tree is not a directory), exact name@version + compiled entry + all three required bins present AND executable + a real `check-bridge`, the plugin-owned artifact lock coherent with the checkout, the owned npm cache and --ignore-scripts, a CERTIFIED journal (non-object/array/scalar/blank-identity/phase-contradicting-digest all refused) as the only ownership proof, all EIGHT active/staging/previous combinations named, the last good runtime never lost (torn swap AND corrupt-active beside a good backup), prior provenance carried across an install that may not finish, a failed candidate leaving the running runtime byte-identical, idempotent same-spec reinstall, a journal believed only while the disk backs it, a preflight-then-mutate inverse taking runtime last, and the refusal to record Herdr's commit as ours. NETWORK ZERO, npm ZERO — it drives a FIXTURE package, so the ACTUAL package proof lives in check-pack-install
@@ -240,6 +241,8 @@ Usage:
   ./run.sh check-entwurf-deliverability # deterministic gate (SE-1/SE-2 slice 2c): conversational-mailbox deliverability predicate — computeMetaReceiverActive (recordBacked ∧ ownerAlive ∧ watchArmed) + mailboxConversationalDeliverable (self-fetch AND active); direct-inject pi refused (SE-1), self-fetch dead/unarmed refused (SE-2); self-address shares the same atom
   ./run.sh check-native-push-adapter # deterministic gate (봉인 3/8): native-push adapter leaf (antigravity) via a FAKE runner — FULL pid scan (not head -1), dead vs indeterminate, VOLATILE route re-discovery (no cache), send argv+ANTIGRAVITY_LS_ADDRESS env, non-zero exit throws, NO adapter-level retry (executor-owned), resolveNativePushAdapter fail-fast
   ./run.sh check-native-push-register # deterministic gate (봉인 5): registerNativeConversation (entwurf_register_native core) via fake adapter + isolated mkdtemp store — live probe→CREATE, re-register→ATTACH (same gid, cwd refreshed, no dup), not-live probe→REFUSE (throws, no record), receiver-marker abstinence (보정① source guard)
+  ./run.sh check-native-push-paused  # #152 mutant execution coordinate: run_vitest over paused.test.ts alone — dispatch, sender replyable and entwurf_register_native refuse a paused backend (antigravity) before any probe. Same file check-tests-beside-behavior already runs.
+  ./run.sh check-chain-terminus-publication  # mutant execution coordinate: run_vitest over test/chain-terminus-publication.test.ts alone — smoke-entwurf-chain-live's terminus wait ends only on a body AND inbox.signal, inside the same deadline.
   ./run.sh check-agy-sender-identity # deterministic gate (#46 sender lane): WHO is calling the bridge — real agy hook as a child process writes an antigravity sender marker keyed by its PARENT pid (never on upsert failure), and resolveTrustedMetaSenderIdentity over isolated stores yields 0→null / 1→identity on EITHER backend / two distinct live identities on one owner pid→THROW (never guess, never downgrade to anonymous). This is what turns an agy send from external-mcp/unknown-host into a replyable garden citizen
   ./run.sh check-package-source-routing # deterministic gate (#29): package-source -> install-root mapping + fail-fast routing (local/git/npm/missing/project/no-source × local+remote, self-root, resume), no backend
   ./run.sh new-session-id             # print one fresh garden id from the generateSessionId SSOT (#50 C2: no launcher injection — the record layer is the consumer; pi mints its own session id)
@@ -338,6 +341,7 @@ Usage:
   ./run.sh check-node-floor-coherence # binds the Node floor (24+, single axis) across engines.node, run.sh setup preflight, meta-bridge install/doctor judgment logic, clean-host docs, the bridge launcher header, and the CI runner node-version — engines.node is the SSOT, everything else is derived; sweeps tracked contract text for an unregistered declaration
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
   ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes, one cell per property: version boundary (a prefix-extended @0.86.0-beta.1 and an off-pin @0.85.1 must leak, @0.86.0 bare or with any measured peer-hash must pass) and closure prefix (an off-pin @earendil-works/chord must leak — it carries no `pi-` prefix); snapshot-safe qualification oracle, also run first inside check-pack-install
+  ./run.sh check-pack-argv-matcher    # pure self-test of check-pack-install's dispatcher-verb leak refusal (the copilot and codex-app-server cells): a front-loaded or trailing leak in ~260 KB is refused where the retired printf | grep -qF shape misses it (teeth control measured each run), clean output passes silently, a failing grep is refused by name, and both cells still return through it; snapshot-safe qualification oracle, also run first inside check-pack-install
   ./run.sh check-pack-consumer-roots  # pure self-test of check-pack-install's consumer sandbox: under a poisoned inherited HOME/XDG/PI_CODING_AGENT_DIR every writable root a consumer subcall sees resolves inside its own consumer home; snapshot-safe qualification oracle, also run first inside check-pack-install
   ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
   ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke + the #116 M3-b1 herdr-plugin RUNTIME VERIFIER run against that actual installed tarball (the focused check-herdr-runtime-bootstrap drives a fixture; THIS is where the real package is proven) with the pinned pi SDK (pins derived from the package.json exact production dependency; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES) + the INSTALLED-PACKAGE branch of the Copilot and OMP birth installers actually RUN (compiled entry selected, no raw .ts, and a real birth edge mints a citizen — the half a required-artifact list can never stand in for) + the INSTALLED #129 durable bootstrap (pi/pi-durable/bootstrap.mjs) imported from node_modules: main/openDurableCitizen exported and PACKAGED_BRIDGE_ENTRY = the installed package's own dist entry — import only, no runtime/TUI/birth/bridge started + the #130 pi-durable CARRIER on actual npm consumers (Entwurf-only / aligned host / isolated global): the installed verifier, a consumer-contained resolution oracle with a same-sandbox neighbour control, every physical SDK edge at the pin, a mixed tree refused as pi-durable-sdk-mismatch though it still imports, and the public `entwurf pi-durable` reaching the app's own explicit-model refusal before any birth, also with one explicit `--native-module` (the synthetic fixture, initialized first; a reserved extension name refused before anything opens) (offline, sandbox HOME)
@@ -1402,6 +1406,26 @@ check_entwurf_v2_native_push() {
   run_vitest pi-extensions/lib/entwurf-v2-native-push.test.ts
 }
 
+check_native_push_paused() {
+  # MUTANT EXECUTION COORDINATE, not a discovery path — paused.test.ts is found by
+  # check-tests-beside-behavior like every other beside-behaviour lane. This case exists
+  # because the AGY-NATIVE-PUSH-PAUSED mutant (#152) names it as gate argv; the narrow file
+  # filter keeps that mutant from re-running every beside-behaviour test. It stays inside
+  # check:contracts for the same reason as check-entwurf-v2-native-push above.
+  section "native-push pause policy (#152, mutant execution coordinate)"
+  run_vitest pi-extensions/lib/native-push/paused.test.ts
+}
+
+check_chain_terminus_publication() {
+  # MUTANT EXECUTION COORDINATE for the CHAIN-TERMINUS-WAITS-FOR-SIGNAL mutant: run_vitest over
+  # test/chain-terminus-publication.test.ts alone — the terminus wait of smoke-entwurf-chain-live
+  # (scripts/lib/chain-terminus-publication.ts) driven offline through the two-write publication
+  # enqueueMetaMessage produces (.msg first, inbox.signal last). It stays inside check:contracts
+  # because a gate a mutant names must be reachable outside qualification.
+  section "chain terminus publication wait (mutant execution coordinate)"
+  run_vitest test/chain-terminus-publication.test.ts
+}
+
 check_entwurf_v2_surface() {
   # Deterministic gate for 0.11 Stage 0 step 5d-3a: the ctx-free surface adapter
   # (entwurf-v2-surface.ts) + the entwurf-control.ts wiring contract. Proves the pure parts:
@@ -1693,6 +1717,14 @@ check_pi_durable_native_module() {
   run_vitest pi-extensions/lib/pi-durable-native-module.test.ts
 }
 
+check_remote_pair_beside() {
+  # #149: the execution coordinate for the declared remote pairs (VERIFY 「Four rules」 rule 3). Not a
+  # discovery path — check-tests-beside-behavior already finds these files. Every remote-pair claim
+  # carries its QK in one of them, and the qualification runner re-invokes a gate argv once per
+  # mutant, so the narrow filter keeps one mutant from re-running every beside test.
+  run_vitest pi-extensions/lib/remote-pair-send.test.ts pi-extensions/lib/remote-pair-receive.test.ts pi-extensions/lib/remote-pair-roundtrip.test.ts pi-extensions/lib/remote-pair-transport.test.ts pi-extensions/lib/meta-mailbox-body.test.ts
+}
+
 smoke_mux_fresh_call_live() {
   # LIVE acceptance for entwurf_fresh_call — OUT of pnpm check, needs LIVE=1, spends two model
   # turns. The one axis no deterministic gate reaches: a real window, a real runtime, a real first
@@ -4215,6 +4247,106 @@ check_pack_pin_matcher() {
   echo "[check-pack-pin-matcher] ok — the pin-leak matcher is version-bounded (lookalikes leak, pinned version passes bare and with either measured peer-hash) and covers the whole @earendil-works closure (chord included)"
 }
 
+# The dispatcher-verb leak refusal of check-pack-install's copilot and codex-app-server cells: the
+# vendor stand-in prints one `ARG<…>` line per argument, and the dispatcher verb among them means it
+# leaked into the vendor's argv. The search it replaces, `printf '%s' "$op_out" | grep -qF …`,
+# refused only when that pipeline exited 0: bash's printf writes a multi-line value a line at a
+# time, `-q` closes the pipe at the first match, and pipefail turned the producer's 141 into a pass
+# (pipefail audit, 2026-10-23: latent, no false green observed in CI). A here-string has no
+# producer to kill, and the verdict reads the search's own rc: 1 (clean) passes, 0 (leaked) and any
+# other rc (the search itself failed) refuse with the cell's diagnostic.
+pack_install_refuse_argv_leak() {
+  local label="$1" out="$2" token="$3" argv_search_rc=0
+  grep -qF -- "$token" <<<"$out" || argv_search_rc=$?
+  case "$argv_search_rc" in
+    1) return 0 ;;
+    0)
+      fail "[check-pack-install] installed 'entwurf $label' leaked the dispatcher verb into the vendor's argv:"
+      echo "$out" | tail -8 | sed 's/^/    /' >&2
+      ;;
+    *) fail "[check-pack-install] installed 'entwurf $label': the dispatcher-verb search itself failed (rc=$argv_search_rc) — refused, never read as no leak" ;;
+  esac
+  return 1
+}
+
+# Self-test of pack_install_refuse_argv_leak — the SAME verdict both cells return through, never a
+# re-typed predicate — on synthetic stand-in output: its pass/refuse result and the diagnostic that
+# names why, one QK per verdict, plus a text check that both cells still return through it.
+# Snapshot-safe like check-pack-pin-matcher, and run first inside check-pack-install. The large
+# fixtures put the leak ahead of ~260 KB, past the default 64 KiB pipe buffer. The teeth control
+# measures, on THIS host, that the retired pipe shape misses it there (grep matched, the pipeline
+# still failed); a fixture that stops biting is a red of its own, not a vacuous green.
+check_pack_argv_matcher() {
+  local cop_leak cop_clean cx_leak cx_clean big_tail big_leak_front big_leak_end big_clean
+  local rc out label fx token missed shim bound_copilot bound_codex red=0 teeth=()
+  cop_leak=$'FLAG=[EXTENSIONS]\nARG<copilot>\nARG<-p>\nARG<hi>\nARG<--model>\nARG<auto>\nARG<--yolo>'
+  cop_clean=$'FLAG=[EXTENSIONS]\nARG<-p>\nARG<hi>\nARG<--model>\nARG<auto>\nARG<--yolo>'
+  cx_leak=$'ARG<codex-app-server>\nARG<app-server>\nARG<--listen>\nARG<unix:///h/.codex/app-server.sock>\nARG<--config>\nARG<probe=1>'
+  cx_clean=$'ARG<app-server>\nARG<--listen>\nARG<unix:///h/.codex/app-server.sock>\nARG<--config>\nARG<probe=1>'
+  big_tail=$(seq 1 24000 | sed 's/^/ARG<x/; s/$/>/')
+  big_leak_front=$'FLAG=[EXTENSIONS]\nARG<copilot>\n'"$big_tail"
+  big_leak_end="$big_tail"$'\nARG<codex-app-server>'
+  big_clean=$'FLAG=[EXTENSIONS]\n'"$big_tail"
+
+  # Teeth control: the defect's own signature — grep matched (its PIPESTATUS is 0) yet the pipeline
+  # failed. A grep error is not teeth, and an exact 141 is not required (an inherited ignored
+  # SIGPIPE still makes the producer fail, and the miss is just as real).
+  { printf '%s' "$big_leak_front" | grep -qF -- 'ARG<copilot>'; teeth=("$?" "${PIPESTATUS[@]}"); } || true
+  if [ "${teeth[0]}" -eq 0 ] || [ "${teeth[2]:-unset}" != 0 ]; then
+    fail "[check-pack-argv-matcher] the planted fixture has no teeth here: the retired printf | grep -qF shape did not miss a leak it matched (pipeline=${teeth[0]} PIPESTATUS=${teeth[*]:1}), so the cells below would prove nothing — enlarge it"
+    return 1
+  fi
+
+  missed=""
+  for fx in "copilot cop_leak ARG<copilot>" "codex-app-server cx_leak ARG<codex-app-server>" "copilot big_leak_front ARG<copilot>" "codex-app-server big_leak_end ARG<codex-app-server>"; do
+    read -r label fx token <<<"$fx"
+    rc=0; out=$(pack_install_refuse_argv_leak "$label" "${!fx}" "$token" 2>&1) || rc=$?
+    { [ "$rc" -eq 1 ] && [[ "$out" == *"leaked the dispatcher verb"* ]]; } || missed+=" $fx(rc=$rc)"
+  done
+  if [ -n "$missed" ]; then
+    fail "[QK:PACK-INSTALL-ARGV-LEAK-CAUGHT] a leaked dispatcher verb must be refused as a leak wherever it sits and however long the output — passed or misnamed:$missed"
+    red=1
+  fi
+
+  missed=""
+  for fx in "copilot cop_clean ARG<copilot>" "codex-app-server cx_clean ARG<codex-app-server>" "copilot big_clean ARG<copilot>"; do
+    read -r label fx token <<<"$fx"
+    rc=0; out=$(pack_install_refuse_argv_leak "$label" "${!fx}" "$token" 2>&1) || rc=$?
+    { [ "$rc" -eq 0 ] && [ -z "$out" ]; } || missed+=" $fx(rc=$rc)"
+  done
+  if [ -n "$missed" ]; then
+    fail "[QK:PACK-INSTALL-ARGV-CLEAN-PASSES] stand-in output without the verb must pass silently, small or large — refused:$missed"
+    red=1
+  fi
+
+  # A search that fails is refused, never read as clean: a `grep` that exits 2 on PATH.
+  shim=$(mktemp -d "${TMPDIR:-/tmp}/entwurf-argv-shim.XXXXXX")
+  printf '#!/bin/sh\n: > "%s/reached"\nexit 2\n' "$shim" > "$shim/grep"
+  chmod +x "$shim/grep"
+  rc=0; out=$(PATH="$shim:$PATH"; pack_install_refuse_argv_leak copilot "$cop_clean" 'ARG<copilot>' 2>&1) || rc=$?
+  if [ ! -e "$shim/reached" ]; then
+    rm -rf "$shim"
+    fail "[check-pack-argv-matcher] the failing grep stand-in was never reached, so the search-error cell would prove nothing"
+    return 1
+  fi
+  rm -rf "$shim"
+  if [ "$rc" -ne 1 ] || [[ "$out" != *"search itself failed (rc=2)"* ]]; then
+    fail "[QK:PACK-INSTALL-ARGV-SEARCH-ERROR-REFUSED] a search that fails (grep rc=2) must refuse the cell and say so, never pass it as clean — got rc=$rc: ${out:-<silent>}"
+    red=1
+  fi
+
+  # Both cells must return through this verdict; a reverted cell would leave the cells above green.
+  bound_copilot=$(grep -cxF "  pack_install_refuse_argv_leak copilot \"\$op_out\" 'ARG<copilot>' || return 1" "$REPO_DIR/run.sh" || true)
+  bound_codex=$(grep -cxF "  pack_install_refuse_argv_leak codex-app-server \"\$op_out\" 'ARG<codex-app-server>' || return 1" "$REPO_DIR/run.sh" || true)
+  if [ "$bound_copilot" != 1 ] || [ "$bound_codex" != 1 ]; then
+    fail "[QK:PACK-INSTALL-ARGV-CELLS-BOUND] the copilot and codex-app-server leak refusals of check-pack-install must each return through pack_install_refuse_argv_leak once (copilot=$bound_copilot codex=$bound_codex)"
+    red=1
+  fi
+
+  [ "$red" -eq 0 ] || return 1
+  echo "[check-pack-argv-matcher] ok — the dispatcher-verb refusal refuses a leak at the front or end of ~260 KB (where the retired pipe shape misses it), passes clean output silently, refuses a failed search by name, and both check-pack-install cells return through it"
+}
+
 # #130 — the pi-durable carrier proved on ACTUAL npm consumers of the candidate tarball.
 # $1 tarball  $2 the gate's npm sandbox  $3 an existing Entwurf-only npm consumer root inside it.
 # Cells: L1s (Entwurf alone, $3), L1 (project-local beside an aligned host pi-coding-agent at the
@@ -4531,6 +4663,7 @@ pack_install_sentinel_untouched() {
 
 _check_pack_install_impl() {
   check_pack_pin_matcher || return 1
+  check_pack_argv_matcher || return 1
   check_pack_consumer_roots || return 1
 
   # Heavy publish gate. Runs the remaining three checks in #13's
@@ -5939,11 +6072,9 @@ JS
       return 1
     fi
   done
-  if printf '%s' "$op_out" | grep -qF 'ARG<copilot>'; then
-    fail "[check-pack-install] installed 'entwurf copilot' leaked the dispatcher verb into the vendor's argv:"
-    echo "$op_out" | tail -8 | sed 's/^/    /' >&2
-    return 1
-  fi
+  # A refusal on a match whose search cannot read a SIGPIPE as "no leak"; the verdict is the
+  # leaf check-pack-argv-matcher drives.
+  pack_install_refuse_argv_leak copilot "$op_out" 'ARG<copilot>' || return 1
   echo "[check-pack-install] installed 'entwurf copilot' reached the vendor with the scan flag and the managed argv"
 
   # #95 — the managed app-server SPELLING, from the INSTALLED package. Same packaging risk as
@@ -5990,11 +6121,7 @@ process.stdout.write(resolveCodexDefaultSocketPath(process.env));
       return 1
     fi
   done
-  if printf '%s' "$op_out" | grep -qF 'ARG<codex-app-server>'; then
-    fail "[check-pack-install] installed 'entwurf codex-app-server' leaked the dispatcher verb into the vendor's argv:"
-    echo "$op_out" | tail -8 | sed 's/^/    /' >&2
-    return 1
-  fi
+  pack_install_refuse_argv_leak codex-app-server "$op_out" 'ARG<codex-app-server>' || return 1
   echo "[check-pack-install] installed 'entwurf codex-app-server' reached the vendor at the INSTALLED resolver's address ($cx_want)"
 
   # The generation verb must reach its verdict from under node_modules. On the
@@ -6641,7 +6768,11 @@ setup_all() {
   else
     bins_rc=0; expose_dev_bin || bins_rc=$?
     if [ "$bins_rc" -eq 0 ]; then
-      setup_result bins PASS "source operator + helper bins exposed and certified (PATH winner: this checkout)"
+      setup_result bins PASS "source operator + helper bins exposed and certified; no other root in this PATH or the npm/pnpm global bin dir (other shells not covered)"
+    elif [ "$bins_rc" -eq 5 ]; then
+      setup_result bins FAIL "another entwurf root is still selectable (named above; nothing removed) — remove it, then re-run setup"
+    elif [ "$bins_rc" -eq 6 ]; then
+      setup_result bins FAIL "the package manifest or a package manager's global bin dir could not be inspected (named above) — refused, not read as clean"
     elif [ "$bins_rc" -eq 3 ]; then
       setup_result bins FAIL "foreign helper bin(s) refused (named above; every unit was attempted) — repair them, then re-run setup"
     else
@@ -7030,7 +7161,13 @@ expose_dev_bin() {
     return 1
   fi
 
-  [ "$rc" -eq 0 ] && return 0
+  # A certified winner is not yet a developer install: a later PATH entry or a package manager's
+  # global bin dir may still hold another root under the same names, which a shell with another
+  # PATH order (non-interactive SSH) selects. exclusive names it (5) or refuses an uninspectable
+  # package manifest or package manager (6); nothing is removed.
+  local ex_rc=0
+  bash "$REPO_DIR/scripts/dev-bin.sh" exclusive || ex_rc=$?
+  [ "$rc" -eq 0 ] && return "$ex_rc"
   if [ "$rc" -eq 3 ]; then
     echo "[setup] dev-bin: foreign helper bin path(s) refused, never clobbered — the refused names are in the summary above." >&2
     echo "[setup]       Every unit was attempted independently; the source operator itself is certified." >&2
@@ -7594,6 +7731,12 @@ case "$cmd" in
   check-entwurf-v2-native-push)
     check_entwurf_v2_native_push
     ;;
+  check-native-push-paused)
+    check_native_push_paused
+    ;;
+  check-chain-terminus-publication)
+    check_chain_terminus_publication
+    ;;
   check-entwurf-control-rpc)
     check_entwurf_control_rpc
     ;;
@@ -7648,6 +7791,9 @@ case "$cmd" in
   check-pi-durable-native-module)
     check_pi_durable_native_module
     ;;
+  check-remote-pair-beside)
+    check_remote_pair_beside
+    ;;
   check-mux-resume-call)
     check_mux_resume_call
     ;;
@@ -7994,12 +8140,14 @@ case "$cmd" in
     (cd "$REPO_DIR" && bash scripts/smoke-pi-provider-state.sh)
     ;;
   smoke-agy-native-push-live)
-    # 봉인 8 LIVE acceptance gate for the native-push (agy) delivery rail. Drives the REAL
-    # antigravity adapter + register core + runEntwurfV2 (production deps) against a live agy
-    # conversation (AGY_CONVERSATION_ID): probe route, register create/attach idempotency,
-    # fire→native-push delivered, bogus-conv probe-indeterminate reject.
-    # Meta-store is isolated to a temp dir (only the agy round-trip is real); honest SKIP when
-    # LIVE!=1. doctor-static preflight FAILs before the agy bridge is wired (③).
+    # PAUSED (#152): the script exits 2 [entwurf:paused] before it reads LIVE or
+    # AGY_CONVERSATION_ID — not a PASS and not a SKIP. The body after that exit is the 봉인 8
+    # LIVE acceptance for the native-push (agy) rail and runs only once a separate change lifts
+    # the pause: REAL antigravity adapter + register core + runEntwurfV2 (production deps)
+    # against a live agy conversation (probe route, register create/attach idempotency,
+    # fire→native-push delivered, bogus-conv probe-indeterminate reject), meta-store isolated
+    # to a temp dir, honest SKIP when LIVE!=1, doctor-static preflight FAIL before the agy
+    # bridge is wired (③).
     run_ts scripts/smoke-agy-native-push-live.ts
     ;;
   smoke-codex-native-push-live)
@@ -8535,8 +8683,8 @@ case "$cmd" in
     run_ts scripts/check-remote-pair-installed.ts "$@"
     ;;
   remote-pair-receive)
-    # #107 rail 1: the receiving host's entry for one declared remote pair. The pair
-    # check runs before the v2 dispatch, so a claim outside the pair mutates nothing;
+    # #107 rail 1 / #149: the receiving host's entry for its declared remote pairs. The pair
+    # check runs before the v2 dispatch, so a claim outside every declared pair mutates nothing;
     # a match reaches the same record/owner/deliverability checks every local send does.
     # Installed, run_ts runs its compiled twin; the sending host's ssh reaches it through the bin.
     shift || true
@@ -8723,6 +8871,9 @@ case "$cmd" in
   check-pack-pin-matcher)
     check_pack_pin_matcher
     ;;
+  check-pack-argv-matcher)
+    check_pack_argv_matcher
+    ;;
   check-pack-win32-carrier)
     check_pack_win32_carrier
     ;;

package/scripts/check-agy-sender-identity.ts

@@ -442,7 +442,7 @@ try {
 	}
 
 	ok(
-		"antigravity is a native-push backend → its replyable comes from the adapter probe",
+		"antigravity stays a native-push backend (its reply rail is native-push; while #152 pauses it, that rail answers replyable:false by policy)",
 		nativePushSupported("antigravity"),
 	);
 	ok(
@@ -455,10 +455,12 @@ try {
 	// probe can only be a broken registry or a probe that could not run at all. Folding that into
 	// replyable:false would tell the receiver a lie about this sender AND bury the defect — the
 	// exact Crash-Don't-Warn shape this lane exists to remove. It must propagate.
+	// The mapping is exercised on codex, the native-push backend that is not paused: antigravity is
+	// paused (#152) and answers false by policy without resolving an adapter (paused.test.ts).
 	{
 		const identity: Pick<MetaIdentity, "backend" | "nativeSessionId"> = {
-			backend: "antigravity",
-			nativeSessionId: "conv-x",
+			backend: "codex",
+			nativeSessionId: "thread-x",
 		};
 		const adapterWith = (probe: NativePushAdapter["probe"]) => ({ resolveAdapter: () => ({ probe }) });
 
@@ -466,7 +468,7 @@ try {
 			"probe alive → replyable true",
 			(await probeNativeSenderAlive(
 				identity,
-				adapterWith(async () => ({ status: "alive", route: { backend: "antigravity", lsAddress: "127.0.0.1:1" } })),
+				adapterWith(async () => ({ status: "alive", route: { backend: "codex", socketPath: "/tmp/gate-codex.sock" } })),
 			)) === true,
 		);
 

package/scripts/check-entwurf-self-address.ts

@@ -112,7 +112,7 @@ function row(facts: SelfAddressabilityFacts): { replyable: boolean; socketState:
 	ok("meta/self-fetch + record but undefined owner/watch → fail-closed NOT replyable", partial.replyable === false);
 }
 
-// meta-session / NATIVE-PUSH rail (antigravity): a SEPARATE axis — recordBacked ∧ probeAlive.
+// meta-session / NATIVE-PUSH rail (Codex; antigravity is paused, #152): a SEPARATE axis — recordBacked ∧ probeAlive.
 // The two rails must not be able to borrow each other's facts (보정①): a mailbox signal
 // deciding an agy reply, or a probe deciding a Claude reply, is a category error.
 {
@@ -124,8 +124,8 @@ function row(facts: SelfAddressabilityFacts): { replyable: boolean; socketState:
 	const reachable = row(push({ recordBacked: true, probeAlive: true }));
 	ok("meta/native-push + record + probe-alive → replyable", reachable.replyable === true);
 
-	// THE ROW THIS RAIL EXISTS FOR: an agy citizen never arms a mailbox watch. Under the
-	// self-fetch atom it would be un-replyable forever; on its own rail it is reachable.
+	// THE ROW THIS RAIL EXISTS FOR: a native-push citizen never arms a mailbox watch. Under
+	// the self-fetch atom it would be un-replyable forever; on its own rail it is reachable.
 	ok(
 		"meta/native-push + record + probe-alive + watch NEVER armed → STILL replyable (no mailbox axis leak)",
 		row(push({ recordBacked: true, probeAlive: true, watchArmed: false })).replyable === true,
@@ -156,6 +156,37 @@ function row(facts: SelfAddressabilityFacts): { replyable: boolean; socketState:
 	);
 }
 
+// #152 policy row: a PAUSED native-push backend is decided BEFORE the pure record+probe
+// predicate. Record-backed + paused → not replyable with a reason naming the pause, even if
+// a probe fact says alive (none ran for this answer). The record axis keeps precedence: a
+// record-less citizen keeps its own reason and is never relabelled as paused.
+{
+	const paused = computeSelfAddressability({
+		origin: "meta-session",
+		metaDeliveryDomain: "native-push",
+		recordBacked: true,
+		probeAlive: true,
+		nativePushPaused: true,
+	});
+	ok(
+		"meta/native-push + record + PAUSED (#152) → NOT replyable, socket none",
+		paused.replyable === false && paused.socketState === "none",
+	);
+	ok("meta/native-push + record + PAUSED (#152) → the reason names the pause", /paused \(#152\)/.test(paused.reason));
+	const recordless = computeSelfAddressability({
+		origin: "meta-session",
+		metaDeliveryDomain: "native-push",
+		recordBacked: false,
+		nativePushPaused: true,
+	});
+	ok(
+		"meta/native-push + NO record + paused → the record-less reason wins (pause never masks it)",
+		recordless.replyable === false &&
+			/no backing meta-record/.test(recordless.reason) &&
+			!/paused/.test(recordless.reason),
+	);
+}
+
 // meta-session / NONE rail: no inbound transport at all. Mailbox facts and a live probe
 // cannot buy replyability — there is nothing to land on. Distinct from the unsupplied
 // (undefined) domain row below, which stays fail-closed for a caller that forgot the axis.

package/scripts/check-entwurf-v2-contract.ts

@@ -430,9 +430,9 @@ ok(
 // cannot enforce it — these semantic fixtures (the SSOT predicate the 5b decider
 // mints against) do.
 eq(
-	"？6: PRE_PROBE_REJECT_REASONS = bad-target/target-locked/target-address-conflict/record-less-socket",
+	"？6: PRE_PROBE_REJECT_REASONS = bad-target/target-locked/target-address-conflict/record-less-socket/native-push-paused",
 	[...PRE_PROBE_REJECT_REASONS],
-	["bad-target", "target-locked", "target-address-conflict", "record-less-socket"],
+	["bad-target", "target-locked", "target-address-conflict", "record-less-socket", "native-push-paused"],
 );
 // the partition is exhaustive + disjoint: every reject reason is pre-probe XOR not.
 for (const r of ENTWURF_V2_REJECT_REASONS) {
@@ -467,6 +467,28 @@ ok(
 	"taxonomy: record-less-socket is NOT a resolver reason (target-resolution stage, not a table cell)",
 	!(RESOLVER_REJECT_REASONS as readonly string[]).includes("record-less-socket"),
 );
+
+// #152: native-push-paused — a native-push backend paused by policy (antigravity: its LS
+// refused entwurf's measured external agentapi calls for a missing CSRF token). The decider refuses it BEFORE
+// any adapter probe, so it is pre-probe (null liveness), never a resolver table cell and
+// never one of the post-probe native-push outcomes it must not impersonate (dead /
+// indeterminate).
+ok(
+	"taxonomy: native-push-paused is in the enum (#152)",
+	(ENTWURF_V2_REJECT_REASONS as readonly string[]).includes("native-push-paused"),
+);
+ok(
+	"？6: native-push-paused is pre-probe (#152 — refused before any adapter probe)",
+	isPreProbeReject("native-push-paused"),
+);
+ok(
+	"taxonomy: native-push-paused is NOT a resolver reason (#152)",
+	!(RESOLVER_REJECT_REASONS as readonly string[]).includes("native-push-paused"),
+);
+ok(
+	"taxonomy: native-push-paused is NOT a post-probe native-push reject (#152 — not dead, not indeterminate)",
+	!(NATIVE_PUSH_REJECT_REASONS as readonly string[]).includes("native-push-paused"),
+);
 ok(
 	"taxonomy: the retired socket-only-no-resume-authority is GONE from the enum (#50 C4)",
 	!(ENTWURF_V2_REJECT_REASONS as readonly string[]).includes("socket-only-no-resume-authority"),