@junghanacs/entwurf 0.41.1 → 0.45.0

package/scripts/check-entwurf-v2-contract.ts

@@ -430,9 +430,9 @@ ok(
 // cannot enforce it — these semantic fixtures (the SSOT predicate the 5b decider
 // mints against) do.
 eq(
-	"？6: PRE_PROBE_REJECT_REASONS = bad-target/target-locked/target-address-conflict/record-less-socket",
+	"？6: PRE_PROBE_REJECT_REASONS = bad-target/target-locked/target-address-conflict/record-less-socket/native-push-paused",
 	[...PRE_PROBE_REJECT_REASONS],
-	["bad-target", "target-locked", "target-address-conflict", "record-less-socket"],
+	["bad-target", "target-locked", "target-address-conflict", "record-less-socket", "native-push-paused"],
 );
 // the partition is exhaustive + disjoint: every reject reason is pre-probe XOR not.
 for (const r of ENTWURF_V2_REJECT_REASONS) {
@@ -467,6 +467,28 @@ ok(
 	"taxonomy: record-less-socket is NOT a resolver reason (target-resolution stage, not a table cell)",
 	!(RESOLVER_REJECT_REASONS as readonly string[]).includes("record-less-socket"),
 );
+
+// #152: native-push-paused — a native-push backend paused by policy (antigravity: its LS
+// refused entwurf's measured external agentapi calls for a missing CSRF token). The decider refuses it BEFORE
+// any adapter probe, so it is pre-probe (null liveness), never a resolver table cell and
+// never one of the post-probe native-push outcomes it must not impersonate (dead /
+// indeterminate).
+ok(
+	"taxonomy: native-push-paused is in the enum (#152)",
+	(ENTWURF_V2_REJECT_REASONS as readonly string[]).includes("native-push-paused"),
+);
+ok(
+	"？6: native-push-paused is pre-probe (#152 — refused before any adapter probe)",
+	isPreProbeReject("native-push-paused"),
+);
+ok(
+	"taxonomy: native-push-paused is NOT a resolver reason (#152)",
+	!(RESOLVER_REJECT_REASONS as readonly string[]).includes("native-push-paused"),
+);
+ok(
+	"taxonomy: native-push-paused is NOT a post-probe native-push reject (#152 — not dead, not indeterminate)",
+	!(NATIVE_PUSH_REJECT_REASONS as readonly string[]).includes("native-push-paused"),
+);
 ok(
 	"taxonomy: the retired socket-only-no-resume-authority is GONE from the enum (#50 C4)",
 	!(ENTWURF_V2_REJECT_REASONS as readonly string[]).includes("socket-only-no-resume-authority"),

package/scripts/check-entwurf-v2-production.ts

@@ -344,45 +344,54 @@ async function main(): Promise<void> {
 		ok("A2: a quarantined target is never lock-acquired", spies.acquire.length === 0);
 	}
 
-	// ── A3: native-push wiring — ONE injected adapter feeds BOTH decider + executor ─
+	// ── A3: antigravity native-push is PAUSED (#152) — the production factory refuses it ─
+	// The agy LS refused entwurf's measured external agentapi calls (missing CSRF token), so the public dispatch
+	// must stop at the decider with the named pre-probe reject: no adapter resolved, nothing
+	// probed or sent, no lock, no mailbox, and no sender envelope asked for. The probe fake is
+	// configured ALIVE on purpose — a regression that reached it would deliver, not hide.
 	{
 		const { deps, spies } = makeSpiedFactory({
 			backend: "antigravity",
 			nativePushProbe: { status: "alive", route: { backend: "antigravity", lsAddress: "127.0.0.1:5599" } },
 		});
 		const result = await runEntwurfV2({ target: GID, intent: "fire-and-forget", message: "hi agy" }, deps);
-		ok("A3: antigravity ff → native-push delivered", result.kind === "executed" && result.transport === "native-push");
-		ok("A3: decider probed the native-push adapter once (decide side)", spies.nativePushProbe.length === 1);
-		ok("A3: executor sent via the native-push adapter once (execute side)", spies.nativePushSend.length === 1);
-		ok("A3: send used the DECIDER-probed route", spies.nativePushSend[0]?.route === "127.0.0.1:5599");
-		ok("A3: send carried the dispatch message", spies.nativePushSend[0]?.content.includes("hi agy") === true);
 		ok(
-			"A3: BOTH hands resolved the SAME adapter (for 'antigravity')",
-			spies.nativePushResolve.length === 2 && spies.nativePushResolve.every((b) => b === "antigravity"),
+			"A3: antigravity ff → rejected native-push-paused (#152), observedLiveness null",
+			result.kind === "rejected" &&
+				result.receipt.reason === "native-push-paused" &&
+				result.receipt.observedLiveness === null,
 		);
-		ok("A3: native-push is LOCK-FREE (no acquire)", spies.acquire.length === 0);
-		ok("A3: native-push did NOT enqueue a mailbox (not the unsupported path)", spies.enqueue.length === 0);
+		ok("A3: paused agy resolved NO native-push adapter (neither hand)", spies.nativePushResolve.length === 0);
+		ok(
+			"A3: paused agy probed and sent nothing",
+			spies.nativePushProbe.length === 0 && spies.nativePushSend.length === 0,
+		);
+		ok("A3: paused agy took no lock and enqueued no mailbox", spies.acquire.length === 0 && spies.enqueue.length === 0);
+		ok("A3: paused agy never asked the sender provider (no execute phase)", spies.senderCalls.length === 0);
 	}
+	// ── A3c: native-push wiring — ONE injected adapter feeds BOTH decider + executor (Codex,
+	// the active native-push backend while agy is paused) ─
 	{
+		const socketPath = "/home/operator/.codex/app-server-control/app-server-control.sock";
 		const { deps, spies } = makeSpiedFactory({
 			backend: "codex",
-			nativePushProbe: {
-				status: "alive",
-				route: { backend: "codex", socketPath: "/home/operator/.codex/app-server-control/app-server-control.sock" },
-			},
+			nativePushProbe: { status: "alive", route: { backend: "codex", socketPath } },
 		});
 		const result = await runEntwurfV2({ target: GID, intent: "fire-and-forget", message: "hi codex" }, deps);
 		ok(
 			"[QK:CODEX-NATIVE-PRODUCTION-WIRING] Codex ff → native-push delivered",
 			result.kind === "executed" && result.transport === "native-push",
 		);
+		ok("A3c: decider probed the native-push adapter once (decide side)", spies.nativePushProbe.length === 1);
+		ok("A3c: executor sent via the native-push adapter once (execute side)", spies.nativePushSend.length === 1);
 		ok(
-			"A3c: both hands resolve the Codex adapter",
-			spies.nativePushResolve.length === 2 && spies.nativePushResolve.every((b) => b === "codex"),
+			"A3c: send used the DECIDER-probed route (the planted Codex UDS)",
+			spies.nativePushSend[0]?.route === socketPath,
 		);
+		ok("A3c: send carried the dispatch message", spies.nativePushSend[0]?.content.includes("hi codex") === true);
 		ok(
-			"A3c: planted Codex UDS reaches the send hand",
-			spies.nativePushSend[0]?.route.endsWith("/app-server-control.sock") === true,
+			"A3c: BOTH hands resolved the SAME adapter (for 'codex')",
+			spies.nativePushResolve.length === 2 && spies.nativePushResolve.every((b) => b === "codex"),
 		);
 		ok(
 			"A3c: Codex native-push remains lock-free and mailbox-free",
@@ -394,16 +403,20 @@ async function main(): Promise<void> {
 	// Codex thread arrived as bare text, so the receiving citizen could not name who called it
 	// and the callback was uncorrelatable. Direct injection has neither the control socket's RPC
 	// framing nor a mailbox file, so the envelope must ride IN the body — the same bytes
-	// `formatMetaMailboxBody` gives the mailbox rail. ONE rail: both native-push backends, no
-	// per-backend branch.
+	// `formatMetaMailboxBody` gives the mailbox rail. ONE rail, no per-backend branch; it is
+	// proven on Codex, the native-push backend public dispatch still reaches while agy is
+	// paused (#152).
 	{
-		const route = { backend: "antigravity", lsAddress: "127.0.0.1:5599" } as const;
+		const route = {
+			backend: "codex",
+			socketPath: "/home/operator/.codex/app-server-control/app-server-control.sock",
+		} as const;
 		const { deps, spies } = makeSpiedFactory({
-			backend: "antigravity",
+			backend: "codex",
 			nativePushProbe: { status: "alive", route },
 		});
 		const { result, executeEvents } = await runInTwoPhases(
-			{ target: GID, intent: "fire-and-forget", message: "hi agy", wantsReply: true },
+			{ target: GID, intent: "fire-and-forget", message: "hi codex", wantsReply: true },
 			deps,
 			spies,
 		);
@@ -417,12 +430,12 @@ async function main(): Promise<void> {
 			result.kind === "executed" && spies.senderCalls.length === 1,
 		);
 		ok(
-			"[QK:NATIVE-PUSH-SENDER-ENVELOPE] agy direct injection carries the mailbox-serialized trusted envelope",
-			spies.nativePushSend[0]?.content === formatMetaMailboxBody(SENDER, "hi agy", true),
+			"[QK:NATIVE-PUSH-SENDER-ENVELOPE] native-push direct injection carries the mailbox-serialized trusted envelope",
+			spies.nativePushSend[0]?.content === formatMetaMailboxBody(SENDER, "hi codex", true),
 		);
 		ok(
 			"A3d: the enveloped body is NOT the raw plan message (an envelope was actually added)",
-			spies.nativePushSend[0]?.content !== "hi agy",
+			spies.nativePushSend[0]?.content !== "hi codex",
 		);
 		ok(
 			"A3d: wants_reply rides the envelope on this rail",
@@ -439,7 +452,7 @@ async function main(): Promise<void> {
 		);
 	}
 	{
-		// Same rail, other backend — codex renders identically. A backend branch would show here.
+		// Same rail, wants_reply=false — the envelope is still rendered, without the reply line.
 		const route = {
 			backend: "codex",
 			socketPath: "/home/operator/.codex/app-server-control/app-server-control.sock",
@@ -447,7 +460,7 @@ async function main(): Promise<void> {
 		const { deps, spies } = makeSpiedFactory({ backend: "codex", nativePushProbe: { status: "alive", route } });
 		const result = await runEntwurfV2({ target: GID, intent: "fire-and-forget", message: "hi codex" }, deps);
 		ok(
-			"A3d: codex direct injection carries the SAME mailbox-serialized envelope (one rail, no backend branch)",
+			"A3d: wants_reply=false direct injection carries the mailbox-serialized envelope for that flag",
 			result.kind === "executed" &&
 				spies.nativePushSend[0]?.content === formatMetaMailboxBody(SENDER, "hi codex", false),
 		);
@@ -503,14 +516,15 @@ async function main(): Promise<void> {
 	}
 
 	{
-		// antigravity + dead probe → reject native-push-target-dead, NO send.
+		// codex + dead probe → reject native-push-target-dead, NO send. (agy never reaches a
+		// probe while paused, #152 — A3.)
 		const { deps, spies } = makeSpiedFactory({
-			backend: "antigravity",
+			backend: "codex",
 			nativePushProbe: { status: "dead", reason: "no host" },
 		});
 		const result = await runEntwurfV2({ target: GID, intent: "fire-and-forget", message: "x" }, deps);
 		ok(
-			"A3b: antigravity ff + dead → rejected native-push-target-dead",
+			"A3b: codex ff + dead → rejected native-push-target-dead",
 			result.kind === "rejected" && result.receipt.reason === "native-push-target-dead",
 		);
 		ok("A3b: no send attempted on a dead target", spies.nativePushSend.length === 0);

package/scripts/check-entwurf-v2-surface.ts

@@ -21,6 +21,12 @@ import assert from "node:assert/strict";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
+import {
+	ENTWURF_DELIVERY_RESULT_CLAUSES,
+	ENTWURF_REJECT_HINTS,
+	ENTWURF_SLOTTED_REJECT_HINTS,
+	ENTWURF_TOOL_GUIDANCE,
+} from "../pi-extensions/lib/agent-guidance.ts";
 import type { EntwurfV2RunResult } from "../pi-extensions/lib/entwurf-v2-runner.ts";
 import {
 	actionableRejectHint,
@@ -28,17 +34,7 @@ import {
 	type SurfaceEntwurfV2Params,
 	toDispatchInput,
 } from "../pi-extensions/lib/entwurf-v2-surface.ts";
-
-/** Cut ONE model-facing string out of a registration block so two descriptions in the same
- * block cannot satisfy an assertion for each other (round-4 masking, 2026-07-27). Returns ""
- * when either marker is missing, which the callers' `length > 120` guard turns into a loud
- * failure rather than a silent pass. */
-function sliceDescription(block: string, startMarker: string, endMarker: string): string {
-	const s = block.indexOf(startMarker);
-	if (s === -1) return "";
-	const e = block.indexOf(endMarker, s + startMarker.length);
-	return e === -1 ? "" : block.slice(s, e);
-}
+import { FRESH_CUT_PRESCRIPTION } from "../pi-extensions/lib/meta-session.ts";
 
 let passed = 0;
 function ok(label: string, cond: boolean): void {
@@ -47,17 +43,6 @@ function ok(label: string, cond: boolean): void {
 	passed++;
 }
 
-/**
- * Collapse a model-facing string's SOURCE form into the text the model actually reads:
- * drop TS string-concat glue between adjacent literals and normalize whitespace.
- */
-function modelText(slice: string): string {
-	return slice
-		.replace(/["']\s*\+\s*["']/g, "")
-		.replace(/\s+/g, " ")
-		.trim();
-}
-
 /**
  * F-2 (2026-07-27): the two model-facing surfaces described the lock, `mode`, and the
  * unsupported-citizen outcome set in ways the code does not support. Measured against
@@ -77,13 +62,11 @@ function modelText(slice: string): string {
  * Applied to BOTH surfaces from one predicate so they cannot drift apart again.
  */
 function assertRailSemantics(tag: string, longDescRaw: string, intentDescRaw: string, modeDescRaw: string): void {
-	// Compare the text the MODEL reads, not the shape the author happened to type. pi-native
-	// wraps inside one template literal; the MCP surface wraps by `+`-concatenating literals.
-	// Without this normalization the same sentence matches on one surface and not the other,
-	// and the assertion silently measures line-wrapping instead of meaning.
-	const longDesc = modelText(longDescRaw);
-	const intentDesc = modelText(intentDescRaw);
-	const modeDesc = modelText(modeDescRaw);
+	// Inputs are decoded product strings, not TS scaffolding. Keep these semantic predicates
+	// separate from the exact, unnormalized pre-extraction byte oracle beside the reader.
+	const longDesc = longDescRaw;
+	const intentDesc = intentDescRaw;
+	const modeDesc = modeDescRaw;
 	ok(
 		`${tag} — long description scopes the per-target lock to the control-socket DOMAIN [QK:V2SURF-MCP-LOCK-DOMAIN]`,
 		/control-socket-DOMAIN\s+dispatch/.test(longDesc) && /lock-free/.test(longDesc),
@@ -155,7 +138,7 @@ function assertRailSemantics(tag: string, longDescRaw: string, intentDescRaw: st
  * DORMANT HONESTY — the model-facing replacement for the retired `V2SURF-MERGED-REJECT` claim,
  * whose subject (two distinct OWNED rejects) left with the `owned-outcome` intent.
  *
- * After the visible-first cut a dormant socket-domain citizen is unreachable by every verb, and
+ * After the visible-first cut a dormant socket-domain citizen rejects delivery by v2, and
  * these four strings are the only place a caller learns that BEFORE spending a dispatch. So each
  * one must, on its own:
  *   - name the reason it will actually get back (`dormant-fire-forget-unsupported`);
@@ -175,7 +158,7 @@ function assertRailSemantics(tag: string, longDescRaw: string, intentDescRaw: st
  * run unlabelled behind it — still real assertions, just not this claim's signature.
  */
 function assertDormantHonesty(tag: string, rawText: string): void {
-	const text = modelText(rawText);
+	const text = rawText;
 	const at = text.indexOf("owned-outcome");
 	ok(
 		`${tag} — names the withdrawn intent owned-outcome and says "withdrawn" beside it (not as an offer) [QK:V2SURF-DORMANT-HONESTY]`,
@@ -192,18 +175,23 @@ function assertDormantHonesty(tag: string, rawText: string): void {
  * PEERS DEAD-ROW HONESTY. `entwurf_peers` is a FACT surface and stays one: this claim must never
  * be satisfiable by adding a per-row action/routing field, which is why it is asserted on the
  * DESCRIPTION and paired with a negative that forbids the row-level fix. What the description owes
- * a caller is that `dead` is a reported fact carrying no invitation — the citizen is dormant and,
- * since the visible-first cut, reachable by no verb at all.
+ * a caller is that `dead` is a reported fact carrying no delivery invitation. A separately
+ * requested, proven-dormant Pi/Claude lifecycle can reopen the same id without submitting a prompt.
  */
 function assertPeersDeadRowHonesty(tag: string, rawBlock: string): void {
-	const text = modelText(rawBlock);
+	const text = rawBlock;
 	ok(
-		`${tag} — entwurf_peers says a dead/dormant row is a REPORTED FACT that grants no action [QK:V2SURF-PEERS-DEAD-ROW]`,
-		/REPORTED FACT/.test(text) && /grants no action/.test(text) && /not an invitation to dispatch/.test(text),
+		`${tag} — entwurf_peers reports dead delivery unavailable, no action grant, and separate explicit-operator promptless resume [QK:V2SURF-PEERS-DEAD-ROW]`,
+		/REPORTED FACT/.test(text) &&
+			/grants no action/.test(text) &&
+			/not an invitation to dispatch/.test(text) &&
+			/no entwurf_v2 delivery is available while it is dormant/.test(text) &&
+			/Only on an explicit operator request, the separate entwurf_resume_call/.test(text) &&
+			/proven-dormant Pi or Claude Code citizen under the same id, submitting no prompt/.test(text),
 	);
 	ok(
-		`${tag} — entwurf_peers calls a dead row currently unreachable by any verb`,
-		/dormant/.test(text) && /unreachable by any verb/.test(text),
+		`${tag} — entwurf_peers does not turn delivery dormancy into a ban on every lifecycle verb`,
+		/dormant/.test(text) && !/unreachable by any verb/.test(text),
 	);
 	// The forbidden repair: teaching the row itself to carry a verb. The facts-only rule is what
 	// keeps this surface from becoming a second dispatch table, so a description that promised a
@@ -214,14 +202,6 @@ function assertPeersDeadRowHonesty(tag: string, rawBlock: string): void {
 	);
 }
 
-/**
- * Containment-disjointness is NOT enough to prove a description slice is tight. Round 5
- * (2026-07-27) shipped a "long description" slice of 4,468 chars that SPANNED the parameter
- * entries because a bare `description:` marker matched the `target` param first — and two
- * over-wide slices can still be mutually non-containing. So pin the ABSENCE of every
- * parameter marker in the long-description slice: if the slice ever swallows the schema
- * again, this fails instead of silently satisfying the schema's own text.
- */
 /**
  * HOST TRUNCATION CAP. Measured 2026-07-30 on both Claude ACP and stock Claude Code: a tool
  * description longer than this is cut mid-sentence and the tail is replaced with `… [truncated]`.
@@ -230,30 +210,12 @@ function assertPeersDeadRowHonesty(tag: string, rawBlock: string): void {
  * to choose an intent. Every other assertion in this file checks that a sentence is PRESENT in
  * source; none of them can see that the host threw half of it away. This one can.
  *
- * Judged on `modelText` (the rendered string), not the source slice: pi-native wraps inside one
- * template literal and the MCP surface `+`-concatenates, so only the normalized text has the
- * length the host actually measures.
+ * Judged on the decoded JSON string, with no source scaffolding or whitespace normalization.
+ * Exact current fields are checked separately against frozen originals plus reviewed literal amendments.
  */
 const HOST_DESCRIPTION_CAP = 2048;
 
-/**
- * The string the HOST measures, recovered from either surface's source scaffolding: drop the
- * `description:` key and the outer template-literal / string-literal fence, and unescape `\"`.
- * Counting the raw slice instead would charge the text for punctuation the model never sees —
- * and the two surfaces carry DIFFERENT punctuation, so the cap would mean two different things.
- */
-function renderedDescription(raw: string): string {
-	const flat = modelText(raw);
-	// Anchor on the description's own first word rather than on scaffolding: the two surfaces put
-	// DIFFERENT preludes in front of it (the MCP slice starts at the tool name), and counting those
-	// would report a number the host never measures — a cap gate that cites the wrong length gets
-	// quoted as if it were the real one.
-	const from = flat.indexOf("CANONICAL");
-	return (from >= 0 ? flat.slice(from) : flat).replace(/[`"],?$/, "").replace(/\\"/g, '"');
-}
-
-function assertDescriptionFitsHostCap(tag: string, longDescRaw: string): void {
-	const rendered = renderedDescription(longDescRaw);
+function assertDescriptionFitsHostCap(tag: string, rendered: string): void {
 	ok(
 		`${tag} — long description fits the host's ${HOST_DESCRIPTION_CAP}-char cap (${rendered.length}) ` +
 			"[QK:V2SURF-DESC-FITS-HOST-CAP]",
@@ -261,12 +223,6 @@ function assertDescriptionFitsHostCap(tag: string, longDescRaw: string): void {
 	);
 }
 
-function assertLongDescExcludesParams(tag: string, longDesc: string, markers: readonly string[]): void {
-	for (const marker of markers) {
-		ok(`${tag} — long description slice excludes the \`${marker}\` parameter marker`, !longDesc.includes(marker));
-	}
-}
-
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const REPO = path.join(HERE, "..");
 const SURFACE_SRC = path.join(REPO, "pi-extensions/lib/entwurf-v2-surface.ts");
@@ -587,9 +543,24 @@ async function main(): Promise<void> {
 				!/DELIVERED|\bdelivered\b/.test(dirtyRefused.text) &&
 				// and every one of them keeps the thing the operator must act on
 				[dirtyBusy, dirtyMailbox, dirtyRefused].every(
-					(r) => r.isError && r.text.includes("DIRTY") && r.text.includes("do NOT retry"),
+					(r) =>
+						r.isError &&
+						r.text.includes("DIRTY") &&
+						r.text.includes("do NOT retry automatically") &&
+						r.text.includes("operator resolve the lock") &&
+						!r.text.includes("would double-deliver"),
 				),
 		);
+		// #154 E1a: the two static clauses of this receipt are authored in root ENTWURF.json; the
+		// syntax around them stays here, so the whole rendered line is compared, not a fragment.
+		const dirtyClause = ENTWURF_DELIVERY_RESULT_CLAUSES["dirty-lock"];
+		ok(
+			"[QK:V2SURF-DELIVERY-RESULT-CLAUSES-FROM-ROOT] the dirty-lock receipt renders the root finalized-rejected and dirty-lock clauses byte for byte inside its code-owned syntax",
+			dirtyBusy.text ===
+				`entwurf_v2 control-socket finalized as queued-steer, and ${dirtyClause}\n  error: release boom` &&
+				dirtyRefused.text ===
+					`entwurf_v2 control-socket finalized as rejected (compacting) — ${ENTWURF_DELIVERY_RESULT_CLAUSES["finalized-rejected"]}, and ${dirtyClause}\n  error: release boom`,
+		);
 
 		// plain execution-failed → error
 		const failed: EntwurfV2RunResult = {
@@ -683,6 +654,25 @@ async function main(): Promise<void> {
 				rls.includes("restart it under the current runtime") &&
 				rls.includes("meta-bridge-fresh-cut"),
 		);
+		// #154 E1b: the text on either side of the fix command is authored in root ENTWURF.json and the
+		// command comes from its owner, so the WHOLE hint is compared against that composition — the
+		// phrase checks above stay, and a hand-kept copy of the text that still carries them dies here.
+		const rlsRoot = ENTWURF_SLOTTED_REJECT_HINTS["record-less-socket"];
+		ok(
+			"[QK:V2SURF-RECORD-LESS-SOCKET-HINT-FROM-ROOT] the record-less-socket hint is exactly the root text before the fix command, the command from its meta-session owner, and the root text after it",
+			rls === `${rlsRoot.beforeFreshCutPrescription}${FRESH_CUT_PRESCRIPTION}${rlsRoot.afterFreshCutPrescription}`,
+		);
+		// #154 C1-B: the five static hints are authored in root ENTWURF.json. This is the WIRING
+		// claim — what the surface returns is the Root value for every declared reason — compared
+		// against the loaded Root, never a fixture, so a Root prose mutant still dies at its own
+		// semantic QK above. The C0 byte oracle lives beside the reader (GUIDANCE-REJECT-HINTS-ORIGINAL).
+		const unwired = Object.entries(ENTWURF_REJECT_HINTS)
+			.filter(([reason, text]) => actionableRejectHint(reason) !== text)
+			.map(([reason]) => reason);
+		ok(
+			`2D: every static reject hint the surface renders is the root ENTWURF.json value [QK:V2SURF-REJECT-HINTS-FROM-ROOT] (unwired: ${JSON.stringify(unwired)})`,
+			Object.keys(ENTWURF_REJECT_HINTS).length === 5 && unwired.length === 0,
+		);
 	}
 
 	// ── 6: RETIRED — parseEntwurfPrefixRootsEnv / ENTWURF_PREFIX_ROOTS ────────
@@ -776,14 +766,10 @@ async function main(): Promise<void> {
 		// Same shipped-rail completeness rule as the pi-native surface (4), and split the SAME
 		// two ways: the long tool description and the `intent` param description must EACH be
 		// true on their own (see the round-4 masking note in block 4).
-		// Same fail-loud rule as block 4: a missing marker would make `slice(0, -1)` return
-		// nearly the whole block and sail past the length guard, so assert the boundary first.
-		const mcpSchemaStart = v2Block.indexOf("\t{");
-		ok("5: MCP — schema boundary marker is present (slice cannot silently widen)", mcpSchemaStart > 0);
-		const mcpLongDesc = v2Block.slice(0, mcpSchemaStart);
-		const mcpIntentDesc = sliceDescription(v2Block, "intent: z", "message: z");
+		const mcpLongDesc = ENTWURF_TOOL_GUIDANCE.entwurf_v2.descriptions.mcp;
+		const mcpIntentDesc = ENTWURF_TOOL_GUIDANCE.entwurf_v2.parameters.intent;
 		ok(
-			"5: MCP — long/intent slices are disjoint (neither can satisfy the other's claim)",
+			"5: MCP — long/intent strings are disjoint (neither can satisfy the other's claim)",
 			mcpLongDesc.length > 0 &&
 				mcpIntentDesc.length > 0 &&
 				!mcpLongDesc.includes(mcpIntentDesc) &&
@@ -799,11 +785,12 @@ async function main(): Promise<void> {
 		}
 		ok("5: MCP — long description denies native-push a mailbox", /NO mailbox/.test(mcpLongDesc));
 		ok(
-			"5: MCP — long description steers live/alive peer → fire-and-forget",
-			/liveness=alive/.test(mcpLongDesc) && /fire-and-forget/.test(mcpLongDesc),
+			"5: MCP — long description says a live socket can receive fire-and-forget, and unsupported is not reachability",
+			/A live socket can receive fire-and-forget/.test(mcpLongDesc) &&
+				/not reachability/.test(mcpLongDesc) &&
+				!/liveness=alive\s*→\s*fire-and-forget/.test(mcpLongDesc),
 		);
-		assertLongDescExcludesParams("5: MCP", mcpLongDesc, ["target: z", "intent: z", "mode: z", "wants_reply: z"]);
-		const mcpModeDesc = sliceDescription(v2Block, "mode: z", "wants_reply: z");
+		const mcpModeDesc = ENTWURF_TOOL_GUIDANCE.entwurf_v2.parameters.mode;
 		assertRailSemantics("5: MCP", mcpLongDesc, mcpIntentDesc, mcpModeDesc);
 		assertDescriptionFitsHostCap("5: MCP", mcpLongDesc);
 
@@ -817,21 +804,20 @@ async function main(): Promise<void> {
 			"5: MCP — entwurf_peers block has a REAL end boundary (next server.tool present)",
 			peersStart !== -1 && peersAfter > peersStart,
 		);
-		const peersBlock = src.slice(peersStart, peersAfter);
-		ok("5: MCP — entwurf_peers block is isolated (non-vacuous)", peersBlock.length > 200);
+		const peersText = ENTWURF_TOOL_GUIDANCE.entwurf_peers.descriptions.mcp;
 		ok(
 			"5: MCP — entwurf_peers names the THIRD answer (a reject), not just the two allow rails",
-			/mailbox-undeliverable/.test(peersBlock) && /native-push-target-dead/.test(peersBlock),
+			/mailbox-undeliverable/.test(peersText) && /native-push-target-dead/.test(peersText),
 		);
 		ok(
 			"5: MCP — entwurf_peers no longer claims `unsupported` does NOT mean unreachable",
-			!/does NOT mean unreachable/.test(peersBlock),
+			!/does NOT mean unreachable/.test(peersText),
 		);
 		// Visible-first cut, operator-surface half: a dormant citizen still gets a row here, and a
 		// caller who reads "it is in the list" as "I can dispatch to it" spends a dispatch to find
 		// out otherwise. The FACT stays a fact — no per-row action field, no routing verb, which is
 		// the rule this surface exists under — so the correction has to live in the description.
-		assertPeersDeadRowHonesty("5: MCP", peersBlock);
+		assertPeersDeadRowHonesty("5: MCP", peersText);
 
 		// F-7: entwurf_inbox_read described itself as draining "your own" inbox while the handler
 		// passes the CALLER-SUPPLIED gardenId straight to readMetaInbox with no comparison against
@@ -845,7 +831,7 @@ async function main(): Promise<void> {
 			inboxStart !== -1 && inboxAfter > inboxStart,
 		);
 		const inboxBlock = src.slice(inboxStart, inboxAfter);
-		const inboxText = modelText(inboxBlock);
+		const inboxText = ENTWURF_TOOL_GUIDANCE.entwurf_inbox_read.descriptions.mcp;
 		ok("5: MCP — entwurf_inbox_read block is isolated (non-vacuous)", inboxText.length > 200);
 		ok(
 			"5: MCP — entwurf_inbox_read states the garden id is CALLER-SUPPLIED and unverified [QK:V2SURF-INBOX-SCOPE-HONESTY]",
@@ -971,20 +957,27 @@ async function main(): Promise<void> {
 	// rail's four boundaries are the ONLY receiver-acceptance values; a mailbox answers with an
 	// ENQUEUE receipt and native-push with an INJECTION, and folding those into the boundary union
 	// would tell a caller that `mailbox-enqueued` is something a receiver observed about its own
-	// queues. Missing either rail is red — the earlier draft listed `mailbox-enqueued` beside the
+	// queues. The socket dispatch may re-resolve to a mailbox leg and report mailbox-enqueued;
+	// that exception must name the leg, not silently invent a fifth receiver queue boundary.
+	// Missing either rail is red — the earlier draft listed `mailbox-enqueued` beside the
 	// four and left native-push out entirely, and nothing noticed.
 	{
-		const outcomeSites = ["mcp/entwurf-bridge/src/index.ts"];
+		const outcomeSites = [
+			{
+				rel: "ENTWURF.json tools.entwurf_v2.descriptions.mcp",
+				text: ENTWURF_TOOL_GUIDANCE.entwurf_v2.descriptions.mcp,
+			},
+		];
 		const missing: string[] = [];
-		for (const rel of outcomeSites) {
-			const text = await fs.readFile(path.join(REPO, rel), "utf8");
+		for (const { rel, text } of outcomeSites) {
 			const at = text.indexOf("reports ONE");
 			const blurb = at < 0 ? "" : text.slice(at, at + 900);
 			if (!/acceptance boundary/i.test(blurb)) missing.push(`${rel}: control receiver acceptance boundary`);
 			for (const b of ["sent", "queued-steer", "queued-follow-up", "accepted-unknown-boundary"]) {
 				if (!blurb.includes(b)) missing.push(`${rel}: boundary ${b}`);
 			}
-			if (!/those four only/i.test(blurb)) missing.push(`${rel}: the four-only scope of the boundary union`);
+			if (!blurb.includes("those four, or `mailbox-enqueued` on a re-resolved mailbox leg"))
+				missing.push(`${rel}: the four receiver boundaries and the explicitly re-resolved mailbox leg`);
 			if (!/mailbox ENQUEUE/i.test(blurb)) missing.push(`${rel}: mailbox enqueue receipt`);
 			if (!/native-push INJECTION/i.test(blurb)) missing.push(`${rel}: native-push injection`);
 			if (!/rejection|rejected/i.test(blurb)) missing.push(`${rel}: rejection`);
@@ -994,7 +987,7 @@ async function main(): Promise<void> {
 			}
 		}
 		ok(
-			`[QK:SEND-OUTCOME-LIST-NAMES-EVERY-RAIL] the tool description names each rail's own result — the control receiver's four acceptance boundaries (and that those four are the whole union), the mailbox ENQUEUE receipt, the native-push INJECTION, a rejection, and accepted-but-lock-dirty — so a caller is never told that one rail's vocabulary describes another's (missing: ${JSON.stringify(missing)})`,
+			`[QK:SEND-OUTCOME-LIST-NAMES-EVERY-RAIL] the tool description names each rail's own result — the control receiver's four acceptance boundaries (or mailbox-enqueued on an explicitly re-resolved mailbox leg), the mailbox ENQUEUE receipt, the native-push INJECTION, a rejection, and accepted-but-lock-dirty — so a caller is never told that one rail's vocabulary describes another's (missing: ${JSON.stringify(missing)})`,
 			missing.length === 0,
 		);
 	}
@@ -1029,7 +1022,10 @@ async function main(): Promise<void> {
 		];
 		const gaps: string[] = [];
 		for (const rel of sites) {
-			const text = await fs.readFile(path.join(REPO, rel), "utf8");
+			const text =
+				rel === "mcp/entwurf-bridge/src/index.ts"
+					? ENTWURF_TOOL_GUIDANCE.entwurf_v2.parameters.mode
+					: await fs.readFile(path.join(REPO, rel), "utf8");
 			for (const axis of axes) if (!axis.holds(text)) gaps.push(`${rel}: ${axis.name}`);
 			if (/steer \((?:interrupt|immediate)|interrupt the current turn|steer = interrupt/i.test(text)) {
 				gaps.push(`${rel}: still claims steer interrupts`);

package/scripts/check-gate-qualification.ts

@@ -3446,6 +3446,7 @@ let manifestCount: number;
 		"acp-stream-hooks": 10,
 		"acp-usage-accounting": 12,
 		"acp-vendor-rejection": 4,
+		"agent-guidance": 14,
 		"agy-permission": 6,
 		"bridge-boot-resume": 5,
 		"bridge-command-boot": 12,
@@ -3453,13 +3454,16 @@ let manifestCount: number;
 		"cc-retire-request": 15,
 		"entwurf-v2-retire": 32,
 		"capability-cache": 3,
+		"capability-bundle-reach": 7,
 		"codex-app-server-launch": 10,
 		"codex-caller-seat": 28,
 		"pi-retire-request": 6,
 		"retirement-event": 16,
 		"control-retire": 9,
-		"control-send-receipt": 19,
-		"codex-native": 87,
+		"control-send-receipt": 20,
+		"codex-native": 95,
+		"native-push-paused": 1,
+		"chain-terminus-publication": 1,
 		"compaction-send-guard": 7,
 		"control-socket-disconnect": 4,
 		"demo-reproducibility": 12,
@@ -3470,7 +3474,7 @@ let manifestCount: number;
 		"pi-bridge-sender": 4,
 		"pi-mcp-bridge": 2,
 		"pi-mcp-register": 3,
-		"pi-durable": 94,
+		"pi-durable": 95,
 		"copilot-receive": 20,
 		"entwurf-peers": 1,
 		"fresh-call-dispatch": 15,
@@ -3491,33 +3495,33 @@ let manifestCount: number;
 		"meta-identity": 9,
 		"meta-retire": 4,
 		"mux-boundary": 16,
-		"mux-fresh-call": 65,
+		"mux-fresh-call": 67,
 		"mux-launcher-fence": 8,
 		"mux-parent-artifact": 3,
-		"pack-install": 5,
+		"pack-install": 9,
 		"pi-package-ownership": 8,
 		"qualification-ledger": 42,
-		"mux-resume-call": 13,
+		"mux-resume-call": 15,
 		"omp-birth": 13,
-		"omp-fresh": 24,
+		"omp-fresh": 25,
 		"omp-receive": 11,
 		"probe-ordering": 1,
 		"release-gate": 21,
 		"remote-pair-display": 3,
 		"remote-pair-installed-audit": 2,
-		"remote-pair-receive": 8,
-		"remote-pair-roundtrip": 5,
-		"remote-pair-send": 12,
+		"remote-pair-receive": 10,
+		"remote-pair-roundtrip": 9,
+		"remote-pair-send": 22,
 		"remote-pair-transport": 4,
 		"retired-sent-surface": 2,
 		"resume-args": 6,
 		"resume-launch-identity": 10,
 		"self-address": 8,
 		"setup-verdict": 14,
-		"source-install": 2,
+		"source-install": 8,
 		"typing-call-fence": 1,
-		"v2-surface": 14,
-		"v2-visible-resume": 40,
+		"v2-surface": 16,
+		"v2-visible-resume": 41,
 		"win32-preview": 19,
 	};
 	const laneTally: Record<string, number> = {};