@junghanacs/entwurf 0.41.1 → 0.45.0

package/scripts/check-mux-resume-call.ts

@@ -36,6 +36,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { ENTWURF_RESUME_LAUNCH_REJECT_HINTS, ENTWURF_TOOL_GUIDANCE } from "../pi-extensions/lib/agent-guidance.ts";
 import { classifyTmuxCwd } from "../pi-extensions/lib/classify-tmux-cwd.ts";
 import type { Placement } from "../pi-extensions/lib/mux-placement.ts";
 import {
@@ -216,6 +217,12 @@ function main(): void {
 			"every reject reason has a hint a caller can act on — a reason without one is a reason they will guess about",
 			reasons.every((r) => typeof RESUME_CALL_REJECT_HINT[r] === "string" && RESUME_CALL_REJECT_HINT[r].length > 0),
 		);
+		ok(
+			"[QK:MUXRESUME-LAUNCH-REJECT-HINTS-FROM-ROOT] every launch-stage resume hint is the root ENTWURF.json text for its own reason, and the table names exactly the verb's reasons",
+			reasons.every((r) => RESUME_CALL_REJECT_HINT[r] === ENTWURF_RESUME_LAUNCH_REJECT_HINTS[r]) &&
+				JSON.stringify(Object.keys(RESUME_CALL_REJECT_HINT).sort()) === JSON.stringify([...reasons].sort()) &&
+				JSON.stringify(Object.keys(ENTWURF_RESUME_LAUNCH_REJECT_HINTS).sort()) === JSON.stringify([...reasons].sort()),
+		);
 		ok(
 			"[QK:MUXRESUME-RUNTIME-TABLE] the runtime is a closed per-backend table, pi → pi and claude-code → claude — never a command a caller supplies",
 			JSON.stringify(RESUME_CALL_RUNTIME) === JSON.stringify({ pi: "pi", "claude-code": "claude" }),
@@ -227,9 +234,19 @@ function main(): void {
 			"[QK:MUXRESUME-NO-IDENTITY] the module never mentions a garden id, a record, a lock or a transcript — it opens a place at a directory and knows nothing about whose citizen it is",
 			!/gardenId|readAddressableMetaIdentity|acquireLock|transcriptPath/.test(SRC),
 		);
+		// Every static form (from / bare / export-from) is parsed and dynamic loading is refused, so a
+		// fourth lane cannot enter through a shape the parser does not see. The one non-mux member is the
+		// node:fs-only guidance reader (#154 C1-D), whose own leaf-ness is GUIDANCE-READER-LEAF-IMPORTS.
+		const resumeImports = [
+			...SRC.matchAll(/^\s*(?:import|export)\s[^;]*?\sfrom\s+["']([^"']+)["']/gm),
+			...SRC.matchAll(/^\s*import\s+["']([^"']+)["']/gm),
+		].map((m) => m[1]);
 		ok(
-			"it imports only the mux lane — no entwurf core, no delivery",
-			!/from "\.\/entwurf-/.test(SRC) && !/meta-session/.test(SRC),
+			"[QK:MUXRESUME-IMPORT-SET] it imports exactly the mux lane plus the guidance reader — no entwurf core, no delivery, no dynamic import",
+			JSON.stringify([...resumeImports].sort()) ===
+				JSON.stringify(["./agent-guidance.ts", "./classify-tmux-cwd.ts", "./mux-launch.ts", "./mux-placement.ts"]) &&
+				!/\bimport\s*\(|\brequire\s*\(/.test(SRC) &&
+				!/meta-session/.test(SRC),
 		);
 		ok(
 			"it uses the SHARED APPEND_FORMAT rather than adding a start-path field: `-P -F` prints its row BEFORE the child chdirs (measured — pane_current_path there still reports the CALLER's cwd), so a path field would be both free-form in a `|`-joined row and racy",
@@ -273,7 +290,7 @@ function main(): void {
 
 		// ── the description contract ────────────────────────────────────────────────
 		// Not prose parity — three claims an operator acts on, plus the host's own cap.
-		const MCP_DESC = (MCP_SURFACE.split('"entwurf_resume_call",')[1] ?? "").split("{")[0];
+		const MCP_DESC = ENTWURF_TOOL_GUIDANCE.entwurf_resume_call.descriptions.mcp;
 		const statesTheContract = (text: string): boolean =>
 			/dormant/i.test(text) && /submits NO prompt/i.test(text) && /observation/i.test(text) && /launch/i.test(text);
 

package/scripts/check-native-push-adapter.ts

@@ -18,6 +18,10 @@
  *   - resolver fail-fast: resolveNativePushAdapter("antigravity") resolves; unknown throws.
  *
  * Pure; no backend, no socket, no real process.
+ *
+ * #152: this is the adapter LEAF only. Public agy delivery, sender replyability and
+ * registration are paused before any adapter is resolved; a green here is not agy
+ * availability and not a live pass.
  */
 
 import assert from "node:assert/strict";

package/scripts/check-native-push-register.ts

@@ -4,17 +4,16 @@
  * agy) and an ISOLATED temp meta-record store (never the real ~/.pi).
  *
  * Proves:
- *   - live probe → CREATE: a fresh live conversation mints a garden citizen whose meta-record
- *     carries the backend / nativeSessionId / caller-stated cwd; the action is "create".
- *   - re-register → ATTACH: the same conversation resolves to the SAME garden id and REFRESHES
- *     the cwd (봉인 5) — it never mints a second id.
- *   - not-live probe → REFUSE: a dead / indeterminate probe THROWS and writes NO record (no
- *     garden id is engraved onto a pointer that does not resolve to a live host).
+ *   - #152 PAUSE: antigravity — the only registerable backend — is refused by name BEFORE any
+ *     adapter is resolved or probed, and NO record is written. While the pause holds, the create /
+ *     attach / refuse-not-live mechanics behind that guard are unreachable, so this gate no longer
+ *     claims them; they return with the pause's lift.
+ *   - the paused-policy check sits BEFORE the probe in the register source.
  *   - RECEIVER-MARKER ABSTINENCE (보정①): the register source references NO receiver-marker
  *     writer — a native-push citizen has no idle-wake watch, so arming one would smuggle
  *     native-push liveness into the mailbox deliverability atom.
  *
- * Deterministic (fake adapter); the only IO is an isolated mkdtemp store (like the meta gates).
+ * Deterministic (trap adapter); the only IO is an isolated mkdtemp store (like the meta gates).
  */
 
 import assert from "node:assert/strict";
@@ -22,8 +21,6 @@ import { mkdtempSync, readdirSync, readFileSync, rmSync } from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
-import { readMetaIdentityByGardenId } from "../pi-extensions/lib/meta-session.ts";
-import type { NativePushAdapter, NativePushProbeResult } from "../pi-extensions/lib/native-push/adapter.ts";
 import { registerNativeConversation } from "../pi-extensions/lib/native-push/register.ts";
 
 let passed = 0;
@@ -35,83 +32,31 @@ function ok(label: string, cond: boolean): void {
 
 const REPO_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
-/** A fake native-push adapter whose probe returns a fixed result and whose send is unused. */
-function fakeAdapter(probe: NativePushProbeResult): NativePushAdapter {
-	return {
-		id: "antigravity",
-		retriable: true,
-		async probe() {
-			return probe;
-		},
-		async send() {
-			throw new Error("register gate: adapter.send must not be called during registration");
-		},
-	};
-}
-
-const ALIVE: NativePushProbeResult = {
-	status: "alive",
-	route: { backend: "antigravity", lsAddress: "127.0.0.1:5599" },
-};
-
 async function main(): Promise<void> {
 	const dir = mkdtempSync(path.join(os.tmpdir(), "entwurf-register-"));
 	try {
-		// ── live probe → CREATE ───────────────────────────────────────────────────
-		const created = await registerNativeConversation(
-			{ backend: "antigravity", nativeSessionId: "conv-abc", cwd: "/work/one" },
-			{ resolveAdapter: () => fakeAdapter(ALIVE), sessionsDir: dir },
-		);
-		ok("create: action = create", created.action === "create");
-		ok("create: gardenId shaped YYYYMMDDTHHMMSS-xxxxxx", /^\d{8}T\d{6}-[0-9a-f]{6}$/.test(created.gardenId));
-		ok("create: backend antigravity", created.backend === "antigravity");
-		ok("create: nativeSessionId echoed", created.nativeSessionId === "conv-abc");
-		ok("create: cwd = caller-stated", created.cwd === "/work/one");
-		// the on-disk record agrees (read back through the authority).
-		const rec = readMetaIdentityByGardenId(created.gardenId, dir);
-		ok("create: record backend antigravity", rec.backend === "antigravity");
-		ok("create: record nativeSessionId bound", rec.nativeSessionId === "conv-abc");
-		ok("create: record cwd recorded", rec.cwd === "/work/one");
-
-		// ── re-register same conversation → ATTACH (same gid, cwd refreshed) ───────
-		const reattached = await registerNativeConversation(
-			{ backend: "antigravity", nativeSessionId: "conv-abc", cwd: "/work/two" },
-			{ resolveAdapter: () => fakeAdapter(ALIVE), sessionsDir: dir },
-		);
-		ok("attach: action = attach", reattached.action === "attach");
-		ok("attach: SAME garden id (no second mint)", reattached.gardenId === created.gardenId);
-		ok(
-			"attach: cwd REFRESHED to the new value",
-			reattached.gardenId === created.gardenId && reattached.cwd === "/work/two",
-		);
-		const rec2 = readMetaIdentityByGardenId(created.gardenId, dir);
-		ok("attach: on-disk cwd refreshed", rec2.cwd === "/work/two");
-		// exactly ONE record file for this conversation (no duplicate mint).
-		const records = readdirSync(dir).filter((f) => f.endsWith(".meta.json"));
-		ok("attach: exactly ONE meta-record (no duplicate garden id)", records.length === 1);
-
-		// ── not-live probe → REFUSE (throw), NO record written ────────────────────
-		for (const probe of [
-			{ status: "dead", reason: "no host" } as const,
-			{ status: "indeterminate", reason: "no port served" } as const,
-		]) {
-			const before = readdirSync(dir).length;
-			let threw = false;
-			try {
-				await registerNativeConversation(
-					{ backend: "antigravity", nativeSessionId: "conv-ghost", cwd: "/work/x" },
-					{ resolveAdapter: () => fakeAdapter(probe), sessionsDir: dir },
-				);
-			} catch (err) {
-				threw = true;
-				ok(
-					`refuse(${probe.status}): error names the non-live probe`,
-					new RegExp(probe.status).test((err as Error).message),
-				);
-			}
-			ok(`refuse(${probe.status}): THROWS (no garden id for a non-live conversation)`, threw);
-			ok(`refuse(${probe.status}): NO record written`, readdirSync(dir).length === before);
+		// ── #152: antigravity is PAUSED → REFUSE by name, no adapter, NO record ──────
+		let resolved = 0;
+		const before = readdirSync(dir).length;
+		let message = "";
+		try {
+			await registerNativeConversation(
+				{ backend: "antigravity", nativeSessionId: "conv-abc", cwd: "/work/one" },
+				{
+					resolveAdapter: () => {
+						resolved++;
+						throw new Error("register gate: no adapter may be resolved for a paused backend");
+					},
+					sessionsDir: dir,
+				},
+			);
+		} catch (err) {
+			message = (err as Error).message;
 		}
+		ok("paused: register THROWS for antigravity", message !== "");
+		ok("paused: the error names the pause (#152)", /paused/.test(message) && /#152/.test(message));
+		ok("paused: no adapter resolved (nothing probed)", resolved === 0);
+		ok("paused: NO record written", readdirSync(dir).length === before);
 	} finally {
 		rmSync(dir, { recursive: true, force: true });
 	}
@@ -127,6 +72,11 @@ async function main(): Promise<void> {
 	// it DOES reuse the upsert authority (봉인 5) and the adapter probe.
 	ok("wiring: register reuses upsertMetaSession", /upsertMetaSession/.test(src));
 	ok("wiring: register probes the adapter before minting", /\.probe\(/.test(src));
+	ok(
+		"wiring: the paused-policy check precedes the adapter probe",
+		src.indexOf("nativePushPaused(input.backend)") > 0 &&
+			src.indexOf("nativePushPaused(input.backend)") < src.indexOf(".probe("),
+	);
 
 	console.log(`\ncheck-native-push-register: ${passed} assertions passed`);
 }

package/scripts/check-remote-pair-installed.ts

@@ -190,8 +190,8 @@ try {
 	);
 	const summary = (vitest.stdout.match(/Tests\s+.*$/m) ?? [""])[0].trim();
 	ok(
-		"[QK:RPI-ROUNDTRIP-ON-INSTALL] the T2 cells (A→B, reverse dispatch, opt-in absent off, other host refuses, both socket dirs) pass against the installed bridge and entry",
-		vitest.status === 0 && /^Tests\s+5 passed\b/.test(summary),
+		"[QK:RPI-ROUNDTRIP-ON-INSTALL] the T2 cells (A→B, reverse dispatch, opt-in absent off, other host refuses, both socket dirs, and the #149 three-route cells: independent, reverse, undeclared sender, cross claim) pass against the installed bridge and entry",
+		vitest.status === 0 && /^Tests\s+9 passed\b/.test(summary),
 		`${summary}\n${vitest.stdout
 			.split("\n")
 			.filter((l) => /×|FAIL|Error/.test(l))

package/scripts/dev-bin.sh

@@ -34,6 +34,14 @@
 #   remove [name]   honest inverse from state (remove only OUR link; REFUSE if it became foreign).
 #                   no name = all managed bins.
 #   verify <name>   require OUR symlink → target and that exact link as the PATH winner.
+#   exclusive       require that NO other root answers to any package.json bin name — not only
+#                   the PATH winner. A winner check alone let a later PATH entry (an old global
+#                   shim) stay selectable by a shell with another PATH order, e.g. non-interactive
+#                   SSH. Read-only: every entry of this PATH plus the global bin dir that `pnpm bin
+#                   -g` / `npm prefix -g` report. Same resolved target = the same install (allowed);
+#                   anything else is another root, never guessed as ours. exit 0 none / 5 another
+#                   root (named, with a conditional removal hint — nothing is removed) / 6 the
+#                   package manifest or a package manager could not be inspected (fail-closed).
 #
 # Overridable for the isolated smoke:
 #   ENTWURF_DEV_BIN_DIR           link location (default: ~/.local/bin — where agy itself lives)
@@ -42,6 +50,7 @@
 #   ENTWURF_AGY_STATUSLINE_TARGET entwurf-agy-statusline target (default: $REPO/scripts/agy-statusline.sh)
 #   ENTWURF_AGY_IMPRINT_TARGET    entwurf-agy-imprint target (default: $REPO/scripts/agy-imprint.sh)
 #   ENTWURF_COPILOT_STATUSLINE_TARGET entwurf-copilot-statusline target (default: $REPO/scripts/copilot-statusline.sh)
+#   ENTWURF_DEV_BIN_PM_TIMEOUT    seconds one package-manager query may take (default 10)
 #   XDG_DATA_HOME                 state root (states under $XDG_DATA_HOME/entwurf/dev-bin/)
 set -euo pipefail
 
@@ -68,6 +77,9 @@ bin_target() {  # $1 = name → prints target path (env-overridable for smoke)
     *) return 1 ;;
   esac
 }
+# Every name bin_target answers for. Kept apart from MANAGED_BINS (what expose links): whether a
+# name is exposed must not change the target exclusive expects for it.
+TARGET_BINS="entwurf entwurf-bridge entwurf-agy-statusline entwurf-agy-imprint entwurf-copilot-statusline"
 state_file_for() { echo "$STATE_DIR/$1.install-state.json"; }
 
 state_link() {  # $1 = state file → recorded linkPath, or empty
@@ -184,6 +196,104 @@ verify_one() {  # $1 = name
   log "[dev-bin verify] $name → $target (PATH winner: $link)"
 }
 
+do_exclusive() {
+  # Our target per package.json bin name: a managed name through bin_target (smoke-overridable),
+  # every other name at its package.json path in this checkout. The manifest is read INSIDE the
+  # verdict step: a read that fails outside it would reach the verdict as zero names and pass.
+  local -a pairs=()
+  local b
+  for b in $TARGET_BINS; do pairs+=("$b=$(bin_target "$b")"); done
+  python3 - "${ENTWURF_DEV_BIN_PM_TIMEOUT:-10}" "$REPO_DIR" "${pairs[@]}" <<'PY'
+import json, os, shutil, signal, subprocess, sys
+
+timeout = float(sys.argv[1])
+manifest = os.path.join(sys.argv[2], "package.json")
+try:
+    with open(manifest) as f:
+        bins = json.load(f)["bin"]
+    if not (isinstance(bins, dict) and "entwurf" in bins
+            and all(isinstance(k, str) and k and isinstance(v, str) and v for k, v in bins.items())):
+        raise ValueError('"bin" is not a non-empty object of name -> path strings naming entwurf')
+except (OSError, ValueError, KeyError, TypeError) as e:
+    print(f"[dev-bin] FAIL: could not inspect the package manifest {manifest} — {type(e).__name__}: {e}."
+          " Not read as 'no other root'.", file=sys.stderr)
+    print("  nothing was removed, no profile edited, no session stopped.", file=sys.stderr)
+    sys.exit(6)  # an unreadable manifest is never "0 names, no other root"
+managed = dict(pair.split("=", 1) for pair in sys.argv[3:])
+ours = {name: os.path.realpath(managed.get(name, os.path.join(sys.argv[2], rel)))
+        for name, rel in bins.items()}
+
+dirs = {}      # realpath(dir) -> (dir as seen, [where it was seen])
+def add(d, where):
+    key = os.path.realpath(d)
+    dirs.setdefault(key, (d, []))[1].append(where)
+
+for d in os.environ.get("PATH", "").split(":"):
+    add(d or os.getcwd(), "PATH")   # an empty POSIX PATH entry means the cwd
+
+def query(argv):
+    exe = shutil.which(argv[0])
+    if exe is None:
+        return "skip", f"{argv[0]} not on PATH — its global bin dir was not checked"
+    try:
+        p = subprocess.Popen([exe] + argv[1:], cwd="/", stdin=subprocess.DEVNULL,
+                             stdout=subprocess.PIPE, stderr=subprocess.PIPE, start_new_session=True)
+    except OSError as e:
+        return "error", f"`{' '.join(argv)}` could not start: {e}"
+    try:
+        out, err = p.communicate(timeout=timeout)
+    except subprocess.TimeoutExpired:
+        os.killpg(p.pid, signal.SIGKILL)
+        p.communicate()
+        return "error", f"`{' '.join(argv)}` did not answer within {timeout:g}s"
+    if p.returncode != 0:
+        tail = err.decode(errors="replace").strip().splitlines()[-1:] or [""]
+        return "error", f"`{' '.join(argv)}` exited {p.returncode}: {tail[0]}"
+    lines = out.decode(errors="replace").strip().splitlines()
+    if len(lines) != 1 or not os.path.isabs(lines[0]):
+        return "error", f"`{' '.join(argv)}` printed {len(lines)} line(s), not one absolute path"
+    return "ok", lines[0]
+
+checked, skipped, errors = ["PATH"], [], []
+for argv, label, to_bin in ((["pnpm", "bin", "-g"], "pnpm global bin", lambda s: s),
+                            (["npm", "prefix", "-g"], "npm global bin", lambda s: os.path.join(s, "bin"))):
+    state, value = query(argv)
+    if state == "ok":
+        add(to_bin(value), label)
+        checked.append(f"{label} {to_bin(value)}")
+    elif state == "skip":
+        skipped.append(value)
+    else:
+        errors.append(value)
+
+others = []
+for _key, (d, where) in dirs.items():
+    for name, target in ours.items():
+        path = os.path.join(d, name)
+        if os.path.lexists(path) and os.path.realpath(path) != target:
+            others.append((path, os.path.realpath(path), where))
+
+for path, resolved, where in others:
+    print(f"[dev-bin] FAIL: another entwurf root is still selectable: {path} -> {resolved}", file=sys.stderr)
+    print(f"  seen via: {', '.join(where)}", file=sys.stderr)
+    hints = [h for w, h in (("pnpm global bin", "pnpm remove -g @junghanacs/entwurf"),
+                            ("npm global bin", "npm uninstall -g @junghanacs/entwurf")) if w in where]
+    for h in hints:
+        print(f"  if a global @junghanacs/entwurf installed it: {h}", file=sys.stderr)
+    print("  " + ("otherwise " if hints else "") + "remove it through whoever owns it.", file=sys.stderr)
+for e in errors:
+    print(f"[dev-bin] FAIL: could not inspect a package manager — {e}. Not read as 'no other root'.", file=sys.stderr)
+if others or errors:
+    print(f"  this checkout: {ours.get('entwurf', '?')}", file=sys.stderr)
+    print("  nothing was removed, no profile edited, no session stopped. Then re-run: ./run.sh setup <project>", file=sys.stderr)
+    sys.exit(5 if others else 6)
+print(f"[dev-bin exclusive] no other root under the {len(ours)} package bin names in: {'; '.join(checked)}")
+for s in skipped:
+    print(f"  not checked: {s}")
+print("  covers only these directories — another shell's PATH or another package manager is not covered.")
+PY
+}
+
 remove_one() {  # $1 = name
   local name="$1" target link sf recorded
   target="$(bin_target "$name")" || fail "unknown managed bin: $name"
@@ -235,5 +345,6 @@ case "${1:-}" in
   expose) shift; do_expose "${1:-}" ;;
   remove) shift; do_remove "${1:-}" ;;
   verify) shift; [ -n "${1:-}" ] || fail "verify requires one managed bin name"; verify_one "$1" ;;
-  *) echo "usage: dev-bin.sh <expose|remove> [bin-name] | verify <bin-name>" >&2; exit 2 ;;
+  exclusive) do_exclusive ;;
+  *) echo "usage: dev-bin.sh <expose|remove> [bin-name] | verify <bin-name> | exclusive" >&2; exit 2 ;;
 esac

package/scripts/lib/chain-terminus-publication.ts

@@ -0,0 +1,58 @@
+/**
+ * The terminus wait of `smoke-entwurf-chain-live`, as one function with its fs seams injectable, so
+ * the oracle that judges a live chain can be driven offline through the exact publication states.
+ *
+ * `enqueueMetaMessage` (pi-extensions/lib/meta-session.ts) publishes in two writes: the `.msg` body
+ * FIRST, then — after the state stamp — `inbox.signal` LAST. A reader can therefore see the body
+ * without the signal for a few milliseconds. The P5 failure on 2026-10-24 is consistent with that by
+ * source and by its preserved mailbox: the old wait stopped at the first body and checked the signal
+ * at once, and the signal file was written about 5 ms after the body. Its interleaving was not traced.
+ * A body without the signal is a publication still in flight, so the wait ends only when both are
+ * there, inside the same deadline. What the smoke asserts afterwards (exactly one body, the signal,
+ * every identity and read-receipt check) is unchanged and still fails on a missing body, a missing
+ * signal or a duplicate.
+ */
+import { existsSync } from "node:fs";
+import fsp from "node:fs/promises";
+import path from "node:path";
+
+export interface TerminusPublicationIo {
+	readdir(dir: string): Promise<string[]>;
+	exists(file: string): boolean;
+	sleep(ms: number): Promise<void>;
+	now(): number;
+}
+
+const realIo: TerminusPublicationIo = {
+	readdir: (dir) => fsp.readdir(dir),
+	exists: (file) => existsSync(file),
+	sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+	now: () => Date.now(),
+};
+
+export interface TerminusPublication {
+	/** Every `.msg` / `.msg.delivered` seen at the last look, so a duplicate stays visible. */
+	msgs: string[];
+	/** Whether `inbox.signal` existed at the last look. */
+	signalled: boolean;
+}
+
+/** Wait until the terminus mailbox holds a body AND its doorbell, or the deadline passes. */
+export async function awaitTerminusPublication(
+	boxDir: string,
+	untilMs: number,
+	pollMs: number,
+	io: TerminusPublicationIo = realIo,
+): Promise<TerminusPublication> {
+	let msgs: string[] = [];
+	let signalled = false;
+	while (io.now() < untilMs) {
+		msgs = (await io.readdir(boxDir).catch(() => [] as string[])).filter(
+			(f) => f.endsWith(".msg") || f.endsWith(".msg.delivered"),
+		);
+		signalled = io.exists(path.join(boxDir, "inbox.signal"));
+		if (msgs.length > 0 && signalled) break;
+		await io.sleep(pollMs);
+	}
+	return { msgs, signalled };
+}

package/scripts/lib/codex-fresh-live-protocol.ts

@@ -70,6 +70,36 @@ export function buildCodexInstruction(input: CodexInstructionInput): string {
 	);
 }
 
+/**
+ * The initial Pi's own fresh-call task: its bootstrap, then a passive wait.
+ *
+ * `[GLG 직접, 2026-10-24]` a fresh sibling may check its caller with the public read-only listing,
+ * then calls back, then works — the same promise the shared framing makes. This task used to say
+ * "Your FIRST tool call must be … callback … and nothing before it" and forbade rechecking
+ * "identity with shell or other tools", which forbade the very check the framing offers. What it
+ * still asks for is narrower and fixture-specific: no shell recheck of what session-info already
+ * says, the zero-argument callback (no target or nonce to copy — the address rides the launch
+ * env), no other tool before it, and no tool used to wait. `[측정 2026-10-24, r3]` a `bash true`
+ * before the callback is still refused by the order audit (`assertBootstrapOrder`).
+ *
+ * THIS ONE LAUNCH TAKES THE OPTION. `[GLG 직접, 2026-10-24]` the shared framing OFFERS the check; the
+ * four impact LIVEs that followed measured it taken zero times, so the positive path had only unit
+ * evidence. This guided task asks the initial Pi to take it — one peers call, its result, then the
+ * callback — and the smoke requires a peers prefix of at least one (`minPeersPrefix`). It is a
+ * fixture's choice of the offered option, not a product rule, and a PASS here is evidence that the
+ * path works end to end, not evidence of any sibling's own judgement.
+ */
+export function buildInitialPiBootstrapTask(initialPiWaitToken: string): string {
+	return (
+		"Session-info already supplies device, time and cwd; do not recheck them with shell. " +
+		"This launch is a guided caller check: first call mcp__entwurf_bridge__entwurf_peers once (read-only, no " +
+		"arguments) to corroborate your caller, and only after its result call mcp__entwurf_bridge__entwurf_callback " +
+		"with no arguments. Use no other tool before the callback. " +
+		`After your required callback receipt, end the turn and wait passively for one addressed message containing ${initialPiWaitToken}. ` +
+		"That message is the only authority to open the Codex sibling. Do not call shell, sleep, terminal, or any tool to wait."
+	);
+}
+
 export interface InitialPiPhaseOneInput {
 	initialPiWaitToken: string;
 	codexWaitToken: string;

package/scripts/lib/codex-fresh-source-receipts.ts

@@ -9,6 +9,11 @@ export interface SourceToolReceipt {
 	text: string;
 	status: SourceToolStatus;
 	isError: boolean;
+	/** Pi only: the transcript row index of this call's assistant message. Rows are appended in
+	 * order, so this is a source fact about WHEN the call was recorded. Codex leaves it unset. */
+	callOrdinal?: number;
+	/** Pi only: the transcript row index of this call's toolResult. Unset while pending and on Codex. */
+	resultOrdinal?: number;
 }
 
 export interface ExpectedSourceToolCall {
@@ -104,6 +109,107 @@ export function assertExactSourceToolCalls(
 	if (remaining.length > 0) throw new Error(`${label}: missing source calls ${JSON.stringify(remaining)}`);
 }
 
+/** The callback a fresh sibling makes before its task, and the one read-only check it may make first. */
+export interface BootstrapOrderExpectation {
+	/** Exact arguments of the read-only `entwurf_peers` check the framing offers before the callback. */
+	peersArguments: Record<string, unknown>;
+	/** The callback role: zero-argument `entwurf_callback`, or Codex's `entwurf_v2` to the caller. */
+	callback: ExpectedSourceToolCall;
+	/** A GUIDED launch that asked for the check requires at least this many peers checks. Absent = 0:
+	 * the check is optional everywhere else, and a fixture's guided task is not a product rule. */
+	minPeersPrefix?: number;
+}
+
+/**
+ * Bootstrap arguments: `entwurf_v2` keeps its schema default (absent `wants_reply` IS false — see
+ * `normalizeSourceArguments`), because Codex's callback IS that verb and a model that omits the key
+ * has obeyed it. Every other verb compared here is byte-exact: `entwurf_callback` is ZERO-argument,
+ * so `{ wants_reply: false }` is a model supplying a parameter the verb does not have, and the peers
+ * check is held to the exact call the framing offers.
+ */
+function bootstrapArgumentsMatch(toolName: string, expected: Record<string, unknown>, actual: Record<string, unknown>) {
+	return toolName === "entwurf_v2" ? sourceArgumentsMatch(expected, actual) : isDeepStrictEqual(expected, actual);
+}
+
+/**
+ * The bootstrap order of one fresh sibling, judged on its source receipts IN CALL ORDER:
+ * zero or more successful exact `entwurf_peers` checks, then exactly one successful exact callback,
+ * then the rest — which is returned for the existing exact-once role audit. `[GLG 직접, 2026-10-24]`
+ * checking the caller and then calling back is the right order; nothing else may come first.
+ *
+ * Refused: any other call before the callback (a `bash true`, a task role), a peers check with other
+ * arguments or that did not succeed, a missing / pending / failed callback, a callback with drifted
+ * arguments, a peers check or a second exact callback AFTER the callback, and — where the source
+ * records it — a callback CALLED before a peers check's RESULT was recorded, or a later call recorded
+ * before the callback's RESULT.
+ *
+ * WHAT THE ORDER PROVES DEPENDS ON THE SOURCE. Pi rows carry `callOrdinal`/`resultOrdinal`, so on Pi
+ * this proves every peers result was recorded before the callback was called, and the callback's
+ * result before every later call. Codex `thread/read` gives item order and a status read at audit
+ * time, nothing more, so on Codex this proves CALL ORDER and completion-at-audit only; that a peers
+ * result preceded the callback call, and that the callback result preceded the next call, are both
+ * UNVERIFIED there.
+ * The peers check is never filtered out by position: it is admitted only as a prefix.
+ *
+ * SCOPE. This is the audit's condition for the short fixture tasks that call it ("use no other tool
+ * before the callback"), not a universal list of what a fresh sibling may do; a sibling whose own
+ * check does not hold up may also hold the callback, which these fixtures then see as no callback.
+ */
+export function assertBootstrapOrder(
+	receipts: readonly SourceToolReceipt[],
+	expected: BootstrapOrderExpectation,
+	label: string,
+): SourceToolReceipt[] {
+	let at = 0;
+	for (; at < receipts.length && receipts[at]?.toolName === "entwurf_peers"; at++) {
+		const check = receipts[at] as SourceToolReceipt;
+		if (!isDeepStrictEqual(check.arguments, expected.peersArguments))
+			throw new Error(
+				`${label}: pre-callback entwurf_peers arguments differ\nexpected=${JSON.stringify(expected.peersArguments)}\nactual=${JSON.stringify(check.arguments)}`,
+			);
+		if (check.status !== "completed" || check.isError)
+			throw new Error(`${label}: pre-callback entwurf_peers ${check.isError ? "failed" : check.status}`);
+	}
+	const callback = receipts[at];
+	if (callback === undefined) throw new Error(`${label}: no callback after ${at} pre-callback check(s)`);
+	const minPeers = expected.minPeersPrefix ?? 0;
+	if (at < minPeers)
+		throw new Error(`${label}: the guided caller check was not made (peers prefix=${at}, required ≥ ${minPeers})`);
+	const role = expected.callback;
+	if (
+		callback.toolName !== role.toolName ||
+		!bootstrapArgumentsMatch(role.toolName, role.arguments, callback.arguments)
+	)
+		throw new Error(
+			`${label}: unexpected pre-callback call ${callback.toolName} ${JSON.stringify(callback.arguments)} — only the read-only entwurf_peers check may precede ${role.toolName} ${JSON.stringify(role.arguments)}`,
+		);
+	if (callback.status !== "completed" || callback.isError)
+		throw new Error(`${label}: the callback ${callback.isError ? "failed" : `remained ${callback.status}`}`);
+	// A check is a check only if its answer was in hand before the callback was made.
+	for (const check of receipts.slice(0, at)) {
+		if (
+			check.resultOrdinal !== undefined &&
+			callback.callOrdinal !== undefined &&
+			!(check.resultOrdinal < callback.callOrdinal)
+		)
+			throw new Error(`${label}: ${callback.toolName} was called before the entwurf_peers result was recorded`);
+	}
+	const rest = receipts.slice(at + 1);
+	for (const later of rest) {
+		if (later.toolName === "entwurf_peers")
+			throw new Error(`${label}: entwurf_peers after the callback — the check is offered only before it`);
+		if (later.toolName === role.toolName && bootstrapArgumentsMatch(role.toolName, role.arguments, later.arguments))
+			throw new Error(`${label}: duplicate callback ${later.toolName}`);
+		if (
+			callback.resultOrdinal !== undefined &&
+			later.callOrdinal !== undefined &&
+			later.callOrdinal < callback.resultOrdinal
+		)
+			throw new Error(`${label}: ${later.toolName} was called before the callback result was recorded`);
+	}
+	return rest;
+}
+
 /** The only production leaf that turns joined source receipts into cleanup window authority. */
 export function sourceCleanupWindows(receipts: readonly SourceToolReceipt[]): string[] {
 	const windows: string[] = [];
@@ -199,9 +305,9 @@ function piSourceVerb(nativeName: string): string {
 /** Join Pi's own toolCall and toolResult rows by native id, retaining pending calls.
  * Native-name equality is checked before translating the exact current Pi dialect. */
 export function piSourceToolReceipts(entries: readonly unknown[]): SourceToolReceipt[] {
-	const calls = new Map<string, { toolName: string; arguments: Record<string, unknown> }>();
-	const results = new Map<string, { toolName: string; text: string; isError: boolean }>();
-	for (const raw of entries) {
+	const calls = new Map<string, { toolName: string; arguments: Record<string, unknown>; callOrdinal: number }>();
+	const results = new Map<string, { toolName: string; text: string; isError: boolean; resultOrdinal: number }>();
+	for (const [ordinal, raw] of entries.entries()) {
 		if (typeof raw !== "object" || raw === null) continue;
 		const entry = raw as { type?: unknown; message?: unknown };
 		if (entry.type !== "message" || typeof entry.message !== "object" || entry.message === null) continue;
@@ -229,6 +335,7 @@ export function piSourceToolReceipts(entries: readonly unknown[]): SourceToolRec
 				calls.set(block.id, {
 					toolName: block.name,
 					arguments: block.arguments as Record<string, unknown>,
+					callOrdinal: ordinal,
 				});
 			}
 		}
@@ -242,6 +349,7 @@ export function piSourceToolReceipts(entries: readonly unknown[]): SourceToolRec
 				toolName: message.toolName,
 				text: textContent(message.content),
 				isError: message.isError,
+				resultOrdinal: ordinal,
 			});
 		}
 	}
@@ -263,6 +371,7 @@ export function piSourceToolReceipts(entries: readonly unknown[]): SourceToolRec
 			text: result.text,
 			status: result.isError ? "failed" : "completed",
 			isError: result.isError,
+			resultOrdinal: result.resultOrdinal,
 		});
 	}
 	return joined;