@junghanacs/entwurf 0.41.1 → 0.45.0

package/scripts/mutants/v2-surface.json

@@ -5,13 +5,12 @@
 		{
 			"claim": "V2SURF-RESUME-HINT-SCOPE",
 			"title": "the dormant capability hint returns to a Pi-only automatic-resume invitation",
-			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\t\t\t\"Only on an explicit operator request, use entwurf_resume_call {target} for Pi or Claude Code; \" +",
-				"\t\t\t\t\"it submits no prompt. This capability hint is not permission to resume automatically.\""
+				"Only on an explicit operator request, use entwurf_resume_call {target} for Pi or Claude Code; it submits no prompt. This capability hint is not permission to resume automatically."
 			],
 			"replace": [
-				"\t\t\t\t\"Reopen the citizen with entwurf_resume_call {target} (pi targets only; it runs no turn), then dispatch again.\""
+				"Reopen the citizen with entwurf_resume_call {target} (pi targets only; it runs no turn), then dispatch again."
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
@@ -21,12 +20,11 @@
 		{
 			"claim": "V2SURF-MCP-LOCK-DOMAIN",
 			"title": "MCP long description reverts to the false \"socket paths take a per-target lock\" claim",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\t\"LOCK: taken for a control-socket-DOMAIN dispatch. The \" +",
-				"\t\t\"mailbox and native-push rails are lock-free — deliverability and the adapter probe guard them. mode \" +"
+				"LOCK: taken for a control-socket-DOMAIN dispatch. The mailbox and native-push rails are lock-free — deliverability and the adapter probe guard them. mode "
 			],
-			"replace": ["\t\t\"LOCK POLICY: socket paths take a per-target lock; the mailbox path does not. mode \" +"],
+			"replace": ["LOCK POLICY: socket paths take a per-target lock; the mailbox path does not. mode "],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-MCP-LOCK-DOMAIN]",
@@ -57,15 +55,9 @@
 		{
 			"claim": "V2SURF-MODE-SCOPE",
 			"title": "the bridge mode param (the one every caller reads, pi included since #125) reverts to \"Delivery mode for a live send\" (false for native-push) (#120 P2: the description was rewritten to stop claiming an interrupt, so the mutation now strips the rail scope from the corrected sentence)",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
-			"find": [
-				"\t\t\t\t\"Injection style for a CONTROL-SOCKET send only: steer (ask the receiver's steering queue) or follow_up (ask its follow-up queue). NEITHER is an interrupt: a busy receiver drains steering after each turn and follow-ups only when its inner loop ends, so a later steer overtakes every earlier follow_up and there is no order between the two. Both queues are volatile process memory — an abort drops what is in them. The receipt names which queue accepted the message (`queued-steer` / `queued-follow-up`); an idle receiver answers `sent`, meaning the turn was TRIGGERED, not that the model has seen the text. \" +",
-				"\t\t\t\t\t\"The mailbox and native-push plans carry no mode, so it has no effect on those rails.\","
-			],
-			"replace": [
-				"\t\t\t\t\"Delivery mode for a live send: steer (ask the steering queue) or follow_up (ask the follow-up queue). \" +",
-				"\t\t\t\t\t\"Both queues are volatile process memory.\","
-			],
+			"subject": "ENTWURF.json",
+			"find": ["Injection style for a CONTROL-SOCKET send only:"],
+			"replace": ["Delivery mode for a live send:"],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-MODE-SCOPE]",
@@ -74,19 +66,11 @@
 		{
 			"claim": "V2SURF-INBOX-SCOPE-HONESTY",
 			"title": "entwurf_inbox_read reverts to the false \"drains your own inbox\" access claim (SCOPE paragraph gone)",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\t\"doorbell is only a wake attempt, not a read. An empty inbox mutates nothing. \" +",
-				"\t\t\"SCOPE — read this literally: the garden id is CALLER-SUPPLIED and is NOT verified against \" +",
-				"\t\t\"your own identity (a host with no garden record of its own can call this too). So passing \" +",
-				"\t\t\"another citizen's garden id drains THEIR mail and stamps THEIR receipt, and they will never \" +",
-				"\t\t\"see those messages. Pass only the id from your own doorbell notice or your own meta-record; \" +",
-				"\t\t\"use entwurf_self if you need to confirm which id that is. \" +"
-			],
-			"replace": [
-				"\t\t\"doorbell is only a wake attempt, not a read. An empty inbox mutates nothing. \" +",
-				"\t\t\"This tool drains your own meta-bridge inbox and stamps the read receipt on your meta-record. \" +"
+				"SCOPE — read this literally: the garden id is CALLER-SUPPLIED and is NOT verified against your own identity"
 			],
+			"replace": ["This tool drains your own meta-bridge inbox and stamps the read receipt on your meta-record"],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-INBOX-SCOPE-HONESTY]",
@@ -95,15 +79,12 @@
 		{
 			"claim": "V2SURF-DORMANT-HONESTY",
 			"title": "MCP long description advertises owned-outcome as a selectable dormant verb again and drops the reason a dormant target actually returns",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\t\"DORMANT IS UNREACHABLE: a socket-domain citizen that is not running gets dormant-fire-forget-unsupported \" +",
-				"\t\t\"— same receiver rule as the mailbox, no active drainer means no delivery. \" +",
-				"\t\t\"The intent that used to answer there, owned-outcome, resumed it by launching a hidden background child \" +",
-				"\t\t\"and was withdrawn under the visible-first rule — re-open the session yourself, then dispatch again. \" +"
+				"A dormant socket rejects this delivery verb as dormant-fire-forget-unsupported. owned-outcome was withdrawn. Only on an explicit operator request, entwurf_resume_call may visibly reopen a proven-dormant Pi or Claude Code citizen under the same id, submitting no prompt; that lifecycle is separate from delivery. "
 			],
 			"replace": [
-				"\t\t\"owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY and is never auto-converted. \" +"
+				"owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY and is never auto-converted. "
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
@@ -113,45 +94,35 @@
 		{
 			"claim": "V2SURF-INDETERMINATE-NO-START",
 			"title": "the indeterminate hint reverts to a socket that \"answered\" and drops the no-start facts — overclaiming a reply that a permission-refused or timed-out probe never got",
-			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\tcase \"indeterminate-no-spawn\":",
-				"\t\t\t// The socket probe did not settle, so liveness is UNKNOWN — an unestablished probe",
-				"\t\t\t// is not a measured death, and dispatching into it could double-deliver. Say",
-				"\t\t\t// \"the PROBE was inconclusive\", never \"the socket answered inconclusively\":",
-				"\t\t\t// `indeterminate` also covers a probe that got no answer at all, was refused by",
-				"\t\t\t// permissions, or timed out, and \"answered\" claims a reply that may never have",
-				"\t\t\t// existed. The wire id is FROZEN and still spells \"-no-spawn\"; it names the rule",
-				"\t\t\t// (never dispatch into an indeterminate target), not a capability that still",
-				"\t\t\t// exists. So the hint's job is to say plainly what did NOT happen: nothing",
-				"\t\t\t// delivered, nothing started.",
-				"\t\t\treturn (",
-				"\t\t\t\t\"the control-socket probe was inconclusive, so the target's liveness is UNKNOWN — this is not a \" +",
-				"\t\t\t\t\"measured death. NOTHING was delivered and NO process was started (the reason id keeps its frozen \" +",
-				"\t\t\t\t\"'-no-spawn' wire spelling from an era when one could be; entwurf_v2 starts nothing on any rail). \" +",
-				"\t\t\t\t\"Re-run entwurf_peers to re-probe; if it stays indeterminate, check for a stale socket file left at \" +",
-				"\t\t\t\t\"that garden id by a session that died without cleaning up.\"",
-				"\t\t\t);"
-			],
-			"replace": [
-				"\t\tcase \"indeterminate-no-spawn\":",
-				"\t\t\treturn \"the target's control socket answered inconclusively; retry.\";"
+				"the control-socket probe was inconclusive, so the target's liveness is UNKNOWN — this is not a measured death. NOTHING was delivered and NO process was started (the reason id keeps its frozen '-no-spawn' wire spelling from an era when one could be; entwurf_v2 starts nothing on any rail). Re-run entwurf_peers to re-probe; if it stays indeterminate, check for a stale socket file left at that garden id by a session that died without cleaning up."
 			],
+			"replace": ["the target's control socket answered inconclusively; retry."],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-INDETERMINATE-NO-START]",
 			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
 		},
+		{
+			"claim": "V2SURF-REJECT-HINTS-FROM-ROOT",
+			"title": "the surface stops returning the Root hint for one declared reason, so a native-push caller loses its next step while the Root text itself still looks perfect",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": ["\t\t\treturn ENTWURF_REJECT_HINTS[\"native-push-probe-indeterminate\"];"],
+			"replace": ["\t\t\treturn undefined;"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2SURF-REJECT-HINTS-FROM-ROOT]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
 		{
 			"claim": "V2SURF-PEERS-DEAD-ROW",
 			"title": "entwurf_peers drops the dead-row sentence, so a dormant citizen is listed with nothing saying it is unreachable",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\t\"row. A `dead` row is a REPORTED FACT and nothing more: that citizen is dormant and is \" +",
-				"\t\t\"currently unreachable by any verb, so listing it grants no action — appearing here is not \" +",
-				"\t\t\"an invitation to dispatch. In particular `unsupported` does NOT mean mailbox: it means this backend has no \" +"
+				"row. A `dead` socket row is a REPORTED FACT: no entwurf_v2 delivery is available while it is dormant. Listing it grants no action and is not an invitation to dispatch. Only on an explicit operator request, the separate entwurf_resume_call may visibly reopen a proven-dormant Pi or Claude Code citizen under the same id, submitting no prompt. In particular"
 			],
-			"replace": ["\t\t\"row. In particular `unsupported` does NOT mean mailbox: it means this backend has no \" +"],
+			"replace": ["row. In particular"],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-PEERS-DEAD-ROW]",
@@ -160,12 +131,12 @@
 		{
 			"claim": "V2SURF-DESC-FITS-HOST-CAP",
 			"title": "the v2 tool description grows back past the host's 2048-char cap — the INTENT contract is silently cut off before the model that must choose an intent ever reads it",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id \" +"
+				"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id "
 			],
 			"replace": [
-				"\t\"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +"
+				"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING "
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
@@ -223,6 +194,21 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:NATIVE-PUSH-RETRY-BYTE-IDENTITY]",
 			"signatureSource": "pi-extensions/lib/entwurf-v2-native-push.test.ts"
+		},
+		{
+			"claim": "V2SURF-RECORD-LESS-SOCKET-HINT-FROM-ROOT",
+			"title": "the record-less-socket hint returns a hand-kept copy of its text, one byte off the Root segments, instead of composing them with the owner's command: every phrase the 2C cell checks still reads, so only the whole-string comparison against Root can see the drift",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": [
+				"\t\t\treturn `${hint.beforeFreshCutPrescription}${FRESH_CUT_PRESCRIPTION}${hint.afterFreshCutPrescription}`;"
+			],
+			"replace": [
+				"\t\t\treturn `a control socket exists at this garden id but NO meta-record claims it — the record is the sole address authority, so a bare socket is not an addressable citizen. If a pre-record-era resident owns that socket, restart it under the current runtime (session_start births its record); if the store predates the current generation, quiesce and archive it with ${FRESH_CUT_PRESCRIPTION}. A stale/forged socket should be  removed.`;"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2SURF-RECORD-LESS-SOCKET-HINT-FROM-ROOT]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
 		}
 	]
 }

package/scripts/mutants/v2-visible-resume.json

@@ -491,6 +491,17 @@
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-CC-MARKER-BINDING-READ]",
 			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-REJECT-HINTS-FROM-ROOT",
+			"title": "one static rejection hint is re-authored as a code literal instead of the root ENTWURF.json text, so the reader stays exact while the rendered rejection no longer carries it",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\"target-locked\": ENTWURF_RESUME_REJECT_HINTS[\"target-locked\"],"],
+			"replace": ["\t\"target-locked\": \"another resume or dispatch holds this citizen's lock\","],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-REJECT-HINTS-FROM-ROOT]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		}
 	]
 }

package/scripts/remote-pair-receive.ts

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
 /**
- * remote-pair-receive — `entwurf remote-pair-receive --pair <absolute file>` (#107 rail 1).
+ * remote-pair-receive — `entwurf remote-pair-receive --pair <absolute file>` (#107 rail 1, #149).
  *
- * The receiving host's entry for one declared remote pair. The sending host runs it over one
+ * The receiving host's entry for its declared remote pairs. The sending host runs it over one
  * SSH call and writes one JSON claim to stdin. This entry reads the operator-named pair
- * declaration once, applies the pair scope check, and hands a matching claim to the existing
- * v2 dispatch. The scope and trust model are in pi-extensions/lib/remote-pair-receive.ts.
+ * declaration once, selects the one route whose two ends are the claim's, and hands a matching
+ * claim to the existing v2 dispatch. The scope and trust model are in pi-extensions/lib/remote-pair-receive.ts.
  *
  * Scope: `--pair` must name THIS host's own opt-in file (`remotePairOptInPath()`), absolute and
- * normalized-equal; any other path — even a valid declaration — is exit 2. That one file is the pair
- * this host accepts and, because it names the sender's host as its route, the declared route back.
+ * normalized-equal; any other path — even a valid declaration — is exit 2. That one file holds the
+ * pairs this host accepts and, because each route names the sender's host, the declared route back.
  * The sender's declaration carries the path only so the argv shape is explicit; it selects nothing.
  *
  * EXIT CONTRACT (stdout carries a JSON receipt line only where named):
@@ -47,7 +47,7 @@ if (args.length !== 2 || args[0] !== "--pair") {
 }
 const pairFile = args[1];
 
-let decl: RemotePairDeclaration;
+let decls: RemotePairDeclaration[];
 let claim: ReturnType<typeof parseRemoteClaim>;
 try {
 	// The scope is THIS host's own opt-in, never a file the sender picks: `--pair` must name it
@@ -56,17 +56,17 @@ try {
 	if (!path.isAbsolute(pairFile) || path.normalize(pairFile) !== own) {
 		throw new Error(`--pair must be this host's opt-in file ${own} (got ${pairFile})`);
 	}
-	const route = readRemotePairOptIn(own);
-	if (route === null) throw new Error(`this host has no remote pair opt-in (${own} is absent)`);
-	decl = { remoteGardenId: route.remoteGardenId, ssh: route.ssh, localGardenId: route.localGardenId };
+	const optIn = readRemotePairOptIn(own);
+	if (optIn === null) throw new Error(`this host has no remote pair opt-in (${own} is absent)`);
+	decls = optIn.routes.map((r) => ({ remoteGardenId: r.remoteGardenId, ssh: r.ssh, localGardenId: r.localGardenId }));
 	claim = parseRemoteClaim(readFileSync(0, "utf8"));
 } catch (err) {
 	emit({ kind: "invalid", detail: err instanceof Error ? err.message : String(err) }, 2);
 }
 
-const receipt = await receiveRemoteClaim(claim, decl, {
+const receipt = await receiveRemoteClaim(claim, decls, {
 	dispatch: (params, sender) => runAndRenderEntwurfV2FromSurface(params, { senderProvider: () => sender }),
-	// The scope file IS this host's own opt-in, and it names the sender's host as its route: a
+	// The scope file IS this host's own opt-in, and the matched route names the sender's host: a
 	// matching claim always has a declared route back. Declared, not probed.
 	replyRoute: "declared",
 });

package/scripts/smoke-agy-install-state.sh

@@ -461,6 +461,126 @@ export ENTWURF_AGY_STATUSLINE_TARGET="$SB/fake-status.sh"
 export ENTWURF_AGY_IMPRINT_TARGET="$SB/fake-aux.sh"
 export ENTWURF_COPILOT_STATUSLINE_TARGET="$SB/fake-aux.sh"
 
+# Hermetic PATH for every dev-bin cell: the host's own entwurf entrypoints (e.g. a real
+# ~/.local/bin/entwurf into some checkout) and its real pnpm/npm global bin dirs must not leak into
+# the exclusivity verdict. Drop every host PATH dir that carries a package bin name, and put fixture
+# package managers first; FAKE_PM_MODE picks their answer. Restored after the dev-bin cells.
+DEVBIN_ORIG_PATH="$PATH"
+PACKAGE_BINS="$(python3 -c 'import json,sys; print(" ".join(json.load(open(sys.argv[1]))["bin"]))' "$REPO_DIR/package.json")"
+HERMETIC_PATH=""
+IFS=':' read -r -a _dirs <<<"$PATH"
+for _d in "${_dirs[@]}"; do
+  [ -n "$_d" ] || continue
+  for _b in $PACKAGE_BINS; do { [ -e "$_d/$_b" ] || [ -L "$_d/$_b" ]; } && continue 2; done
+  HERMETIC_PATH="${HERMETIC_PATH:+$HERMETIC_PATH:}$_d"
+done
+unset _dirs _d _b
+FAKE_PM="$SB/fake-pm"; PM_ROOT="$SB/pm"; mkdir -p "$FAKE_PM"
+for _pm in pnpm npm; do
+  case "$_pm" in pnpm) _q="bin -g"; _a="$PM_ROOT/pnpm-bin" ;; npm) _q="prefix -g"; _a="$PM_ROOT/npm-prefix" ;; esac
+  cat > "$FAKE_PM/$_pm" <<SH
+#!/usr/bin/env bash
+[ "\$*" = "$_q" ] || { echo "fixture $_pm answers only: $_q" >&2; exit 64; }
+case "\${FAKE_PM_MODE:-ok}" in
+  ok) [ "$_pm" = npm ] || case ":\$PATH:" in *":$_a:"*) ;; *) echo "[ERROR] The configured global bin directory \"$_a\" is not in PATH" >&2; exit 1 ;; esac
+      echo "$_a" ;;
+  fail) echo "ERR_FIXTURE_$_pm boom" >&2; exit 1 ;;
+  hang) exec sleep 30 ;;
+esac
+SH
+  chmod +x "$FAKE_PM/$_pm"
+done
+unset _pm _q _a
+mkdir -p "$PM_ROOT/pnpm-bin"   # an existing, empty pnpm global bin dir
+export PATH="$FAKE_PM:$HERMETIC_PATH:$PM_ROOT/pnpm-bin"   # pnpm 11 answers `bin -g` only when that dir is on PATH
+want "dev-bin hermetic PATH: no package bin name resolves, and pnpm/npm are the fixtures" \
+  "! command -v entwurf >/dev/null && [ \"\$(command -v pnpm)\" = '$FAKE_PM/pnpm' ] && [ \"\$(command -v npm)\" = '$FAKE_PM/npm' ]"
+
+# J-X: developer-install exclusivity (dev-bin.sh exclusive). A certified PATH winner alone let an
+# old global shim LATER in PATH stay selectable by a shell with another PATH order (non-interactive
+# SSH picked it). Every cell links by NAME so an operator-set mutant elsewhere cannot reach here.
+bash "$DEVBIN" expose entwurf >/dev/null 2>&1
+bash "$DEVBIN" expose entwurf-bridge >/dev/null 2>&1
+SAME_DIR="$SB/same-root"; mkdir -p "$SAME_DIR"
+ln -s "$SB/fake-entwurf.sh" "$SAME_DIR/entwurf"   # a second link, same target
+ln -s "$DLINK" "$SAME_DIR/entwurf-bridge"         # a chain through our link, same target
+set +e; OUT="$(PATH="$DBIN_DIR:$DBIN_DIR:$SAME_DIR:$PATH" bash "$DEVBIN" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: duplicate PATH entries and links resolving to our target are the same install [QK:SOURCE-SAME-TARGET-PASSES]" \
+  "[ '$RC' -eq 0 ] && printf '%s' \"\$OUT\" | grep -q 'no other root under the 6 package bin names'"
+want "dev-bin exclusive: an existing-but-empty package-manager global bin is checked and clean, and the PASS names its limit" \
+  "printf '%s' \"\$OUT\" | grep -q 'pnpm global bin $PM_ROOT/pnpm-bin' && printf '%s' \"\$OUT\" | grep -q 'another shell.s PATH or another package manager is not covered'"
+TOOLS_ONLY="$SB/tools-only"; mkdir -p "$TOOLS_ONLY"
+for _t in bash python3 dirname env; do ln -s "$(command -v "$_t")" "$TOOLS_ONLY/$_t"; done; unset _t
+set +e; OUT="$(PATH="$TOOLS_ONLY:$DBIN_DIR" bash "$DEVBIN" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: an absent package manager is a named not-checked line, not a failure" \
+  "[ '$RC' -eq 0 ] && printf '%s' \"\$OUT\" | grep -q 'not checked: pnpm not on PATH' && printf '%s' \"\$OUT\" | grep -q 'not checked: npm not on PATH'"
+rm -rf "$SAME_DIR"
+
+OTHER_DIR="$SB/old-global/bin"; mkdir -p "$OTHER_DIR"
+printf '#!/bin/sh\nexec /old/global/entwurf "$@"\n' > "$OTHER_DIR/entwurf"; chmod +x "$OTHER_DIR/entwurf"
+want "dev-bin control: with an old shim LATER in PATH the winner is still ours, so verify alone passes" \
+  "PATH='$DBIN_DIR:$OTHER_DIR':\"\$PATH\" bash '$DEVBIN' verify entwurf >/dev/null 2>&1"
+set +e; OUT="$(PATH="$DBIN_DIR:$OTHER_DIR:$PATH" bash "$DEVBIN" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: an old root LATER in PATH is named and refused, not hidden behind our winner [QK:SOURCE-LATER-ROOT-FAILS]" \
+  "[ '$RC' -eq 5 ] && printf '%s' \"\$OUT\" | grep -qF 'another entwurf root is still selectable: $OTHER_DIR/entwurf'"
+want "dev-bin exclusive: the refusal removes nothing and says so" \
+  "[ \"\$(sed -n 2p '$OTHER_DIR/entwurf')\" = 'exec /old/global/entwurf \"\$@\"' ] && [ -L '$OLINK' ] && printf '%s' \"\$OUT\" | grep -q 'nothing was removed'"
+mkdir -p "$SB/other-checkout/mcp/entwurf-bridge"; printf '#!/bin/sh\n' > "$SB/other-checkout/mcp/entwurf-bridge/start.sh"
+rm -f "$OTHER_DIR/entwurf"; ln -s "$SB/other-checkout/mcp/entwurf-bridge/start.sh" "$OTHER_DIR/entwurf-bridge"
+set +e; OUT="$(PATH="$DBIN_DIR:$OTHER_DIR:$PATH" bash "$DEVBIN" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: a helper name from another checkout is refused like the operator" \
+  "[ '$RC' -eq 5 ] && printf '%s' \"\$OUT\" | grep -qF '$OTHER_DIR/entwurf-bridge -> $SB/other-checkout/mcp/entwurf-bridge/start.sh'"
+rm -rf "$SB/old-global"
+
+mkdir -p "$PM_ROOT/npm-prefix/bin"; printf '#!/bin/sh\n' > "$SB/other-checkout/run.sh"
+ln -s "$SB/other-checkout/run.sh" "$PM_ROOT/npm-prefix/bin/entwurf"   # npm's <prefix>/bin, OFF this PATH
+set +e; OUT="$(PATH="$DBIN_DIR:$PATH" bash "$DEVBIN" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: another root in npm's global bin dir is refused although that dir is not on this PATH [QK:SOURCE-GLOBAL-BIN-OTHER-ROOT]" \
+  "[ '$RC' -eq 5 ] && printf '%s' \"\$OUT\" | grep -qF '$PM_ROOT/npm-prefix/bin/entwurf -> $SB/other-checkout/run.sh' && printf '%s' \"\$OUT\" | grep -qx '  seen via: npm global bin'"
+want "dev-bin exclusive: the removal hint is conditional on the package manager, never asserted" \
+  "printf '%s' \"\$OUT\" | grep -qF 'if a global @junghanacs/entwurf installed it: npm uninstall -g @junghanacs/entwurf' && printf '%s' \"\$OUT\" | grep -q 'otherwise remove it through whoever owns it'"
+rm -rf "$PM_ROOT/npm-prefix"
+
+set +e; OUT="$(FAKE_PM_MODE=fail PATH="$DBIN_DIR:$PATH" bash "$DEVBIN" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: a package manager that cannot answer is refused, not read as clean [QK:SOURCE-GLOBAL-QUERY-REFUSED]" \
+  "[ '$RC' -eq 6 ] && printf '%s' \"\$OUT\" | grep -qF 'could not inspect a package manager — \`pnpm bin -g\` exited 1: ERR_FIXTURE_pnpm boom'"
+set +e; OUT="$(FAKE_PM_MODE=hang ENTWURF_DEV_BIN_PM_TIMEOUT=1 PATH="$DBIN_DIR:$PATH" bash "$DEVBIN" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: a package manager that hangs is bounded and refused" \
+  "[ '$RC' -eq 6 ] && printf '%s' \"\$OUT\" | grep -q 'did not answer within 1s'"
+set +e; OUT="$(PATH="$DBIN_DIR:$FAKE_PM:$HERMETIC_PATH" bash "$DEVBIN" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: pnpm refusing because its global bin dir is off PATH is an inspect failure, not a clean dir" \
+  "[ '$RC' -eq 6 ] && printf '%s' \"\$OUT\" | grep -qF 'is not in PATH'"
+
+# The package manifest is read by the verdict step itself: an unreadable or wrong-shaped one is an
+# inspect failure, never "0 names, no other root". Driven on a copy of THIS dev-bin.sh beside a
+# sandbox package.json, so the repo's own manifest is never touched.
+MANI="$SB/manifest-copy"; mkdir -p "$MANI/scripts"; cp "$DEVBIN" "$MANI/scripts/dev-bin.sh"
+cp "$REPO_DIR/package.json" "$MANI/package.json"
+set +e; OUT="$(PATH="$DBIN_DIR:$PATH" bash "$MANI/scripts/dev-bin.sh" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive control: the copied script with the real manifest checks all 6 names and passes" \
+  "[ '$RC' -eq 0 ] && printf '%s' \"\$OUT\" | grep -q 'no other root under the 6 package bin names'"
+printf 'not json{' > "$MANI/package.json"
+set +e; OUT="$(PATH="$DBIN_DIR:$PATH" bash "$MANI/scripts/dev-bin.sh" exclusive 2>&1)"; RC=$?; set -e
+want "dev-bin exclusive: an unreadable package manifest is refused, never read as zero names [QK:SOURCE-MANIFEST-UNREADABLE-REFUSED]" \
+  "[ '$RC' -eq 6 ] && printf '%s' \"\$OUT\" | grep -qF 'could not inspect the package manifest $MANI/package.json' && ! printf '%s' \"\$OUT\" | grep -q '0 package bin names'"
+for _shape in '{"name":"x"}' '{"bin":"./run.sh"}' '{"bin":{}}' '{"bin":{"entwurf-bridge":"./x"}}'; do
+  printf '%s' "$_shape" > "$MANI/package.json"
+  set +e; OUT="$(PATH="$DBIN_DIR:$PATH" bash "$MANI/scripts/dev-bin.sh" exclusive 2>&1)"; RC=$?; set -e
+  want "dev-bin exclusive: manifest $_shape is refused as uninspectable" \
+    "[ '$RC' -eq 6 ] && printf '%s' \"\$OUT\" | grep -qF 'could not inspect the package manifest'"
+done
+unset _shape; rm -rf "$MANI"
+
+OTHER_DIR="$SB/old-global/bin"; mkdir -p "$OTHER_DIR"
+printf '#!/bin/sh\nexec /old/global/entwurf "$@"\n' > "$OTHER_DIR/entwurf"; chmod +x "$OTHER_DIR/entwurf"
+set +e; OUT="$(PATH="$DBIN_DIR:$OTHER_DIR:$PATH" bash "$REPO_DIR/run.sh" expose-dev-bin 2>&1)"; RC=$?; set -e
+want "source setup's bins step fails when another root is still selectable [QK:SOURCE-EXCLUSIVE-WIRED]" \
+  "[ '$RC' -eq 5 ] && printf '%s' \"\$OUT\" | grep -qF 'another entwurf root is still selectable: $OTHER_DIR/entwurf'"
+rm -rf "$SB/old-global" "$SB/other-checkout" "$TOOLS_ONLY"
+bash "$DEVBIN" remove >/dev/null 2>&1   # the helper links expose-dev-bin just made
+bash "$DEVBIN" remove entwurf >/dev/null 2>&1         # by NAME, like the expose above: the
+bash "$DEVBIN" remove entwurf-bridge >/dev/null 2>&1  # managed list itself may be under test
+
 # J-0: the setup wrapper calls no-arg expose. This is the cross-contract cell the #82 regression
 # lacked: an npm consumer gets `entwurf` from package bin linking, and source setup must expose the
 # same operator command without a second global package install.
@@ -578,6 +698,7 @@ ok "dev-bin migrate: foreign legacy refused (linkPath basename != entwurf-bridge
 rm -f "$LEGACY" "$DLINK" "$DSTATE"
 bash "$DEVBIN" remove >/dev/null 2>&1
 unset ENTWURF_DEV_BIN_DIR ENTWURF_OPERATOR_TARGET ENTWURF_BRIDGE_TARGET ENTWURF_AGY_STATUSLINE_TARGET
+export PATH="$DEVBIN_ORIG_PATH"
 unset ENTWURF_AGY_IMPRINT_TARGET ENTWURF_COPILOT_STATUSLINE_TARGET
 
 # ── K: permission grant — the OTHER half of a usable bridge ───────────────────

package/scripts/smoke-agy-native-push-live.ts

@@ -48,6 +48,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import type { SenderEnvelope } from "../pi-extensions/lib/entwurf-control-rpc.ts";
+import { nativePushPaused } from "../pi-extensions/lib/entwurf-v2-contract.ts";
 import { makeProductionEntwurfV2Deps } from "../pi-extensions/lib/entwurf-v2-production.ts";
 import type { EntwurfV2RunResult } from "../pi-extensions/lib/entwurf-v2-runner.ts";
 import { runEntwurfV2 } from "../pi-extensions/lib/entwurf-v2-runner.ts";
@@ -79,6 +80,18 @@ function smokeSender(gardenId: string, cwd: string): SenderEnvelope {
 }
 
 async function main(): Promise<void> {
+	// #152: agy native-push is PAUSED by product policy, so this positive LIVE acceptance cannot
+	// run — every cell below would drive the paused rail. It exits NON-ZERO by name (neither a PASS
+	// nor the protocol SKIP), and touches no agy process, port or conversation. The pause itself is
+	// proven deterministically beside the behavior (pi-extensions/lib/native-push/paused.test.ts).
+	if (nativePushPaused("antigravity")) {
+		console.error(
+			"[entwurf:paused] smoke-agy-native-push-live — agy native-push is paused (#152: its language " +
+				"server refused entwurf's measured external calls for a missing CSRF token). This LIVE acceptance does not run while " +
+				"the pause holds; it is not a PASS.",
+		);
+		process.exit(2);
+	}
 	if (process.env.LIVE !== "1") {
 		skipLive(
 			"smoke-agy-native-push-live",

package/scripts/smoke-codex-fresh-live.ts

@@ -75,12 +75,14 @@ import {
 } from "../pi-extensions/lib/native-push/codex-ws-client.ts";
 import {
 	buildCodexInstruction,
+	buildInitialPiBootstrapTask,
 	buildInitialPiPhaseOne,
 	buildInitialPiRelay,
 	runCleanupStages,
 	selectReport,
 } from "./lib/codex-fresh-live-protocol.ts";
 import {
+	assertBootstrapOrder,
 	assertExactSourceToolCalls,
 	assertSourceCallScopes,
 	codexCallbackSenders,
@@ -978,11 +980,7 @@ async function run(): Promise<void> {
 		backend: "pi",
 		model: piModel,
 		cwd: scratch,
-		task:
-			"Session-info already supplies device and time. Do not recheck time, cwd, or identity with shell or other tools. " +
-			"Your FIRST tool call must be mcp__entwurf_bridge__entwurf_callback with no arguments, and nothing before it. " +
-			`After your required callback receipt, end the turn and wait passively for one addressed message containing ${initialPiWaitToken}. ` +
-			"That message is the only authority to open the Codex sibling. Do not call shell, sleep, terminal, or any tool to wait.",
+		task: buildInitialPiBootstrapTask(initialPiWaitToken),
 	});
 	receipts["2-initial-pi-launch"] = initialPiLaunch.text;
 	ok(
@@ -1440,25 +1438,33 @@ async function run(): Promise<void> {
 		const observed = await readCodexThread(codexSocketPath, codexThreadId, true);
 		return codexThreadIsTerminal(observed) ? observed : null;
 	});
+	// THE BOOTSTRAP ORDER, THEN THE ROLES — two leaves, composed. `[GLG 직접, 2026-10-24]` a fresh
+	// sibling may check its caller with the read-only listing the framing offers, then calls back,
+	// then works. `assertBootstrapOrder` admits only that prefix (successful exact `entwurf_peers`
+	// checks), requires the exact callback once and successfully, and hands the rest to the
+	// unchanged exact-once role audit — so `bash true` before the callback (the r3 RED) is still
+	// refused, by the order leaf now rather than by a count. On Pi the receipts carry transcript
+	// ordinals, so this also proves every peers RESULT was recorded before the callback was called,
+	// and the callback RESULT before every task call.
+	//
+	// The callback is the ZERO-ARGUMENT eighth verb and `{}` is compared byte-exactly: a target, a
+	// message or a `wants_reply` typed here is a parameter the verb does not have. Nothing is
+	// weakened by the nonce not being in THIS expectation: the correlation is proven earlier and from
+	// the delivered body — `the initial Pi callback carries the exact launch nonce` reads the
+	// fixture's own mailbox, requires exactly one exact match and refuses duplicates, and the two
+	// cells beside it bind that callback's sender envelope to a real pi V3 citizen.
+	const initialPiSources = piSourceToolReceipts(readInitialPiEntries());
+	const initialPiTaskCalls = assertBootstrapOrder(
+		initialPiSources,
+		// The guided task asked this Pi to take the offered check, so a zero-check PASS is not positive evidence.
+		{ peersArguments: {}, callback: { toolName: "entwurf_callback", arguments: {} }, minPeersPrefix: 1 },
+		"initial Pi bootstrap order",
+	);
+	// The verified prefix count: the order leaf admitted exactly these many leading peers checks.
+	const piPeersPrefix = initialPiSources.length - initialPiTaskCalls.length - 1;
 	assertExactSourceToolCalls(
-		piSourceToolReceipts(readInitialPiEntries()),
+		initialPiTaskCalls,
 		[
-			// 0.24.0 moved a pi sibling's first action to the ZERO-ARGUMENT eighth verb, and this
-			// smoke's own launch receipt says so in the same run: "its first action is the
-			// zero-argument callback verb (codex is the one arm that still sends the nonce as
-			// arguments)". The Codex audit below therefore keeps its `entwurf_v2` shape, and only
-			// this one moves. `{}` is matched by deep-strict equality, so it pins the verb's actual
-			// contract — a target or message typed here would be a second address axis and the verb
-			// refuses it by name.
-			//
-			// Nothing is weakened by dropping the nonce from THIS expectation: the correlation is
-			// proven earlier and from the delivered body, which is where a nonce can actually be
-			// corrupted — `the initial Pi callback carries the exact launch nonce` (:970-973) reads
-			// the fixture's own mailbox, requires exactly one exact match and refuses duplicates,
-			// and the two cells beside it bind that callback's sender envelope to a real pi V3
-			// citizen. This audit's job is the different one its name says: exactly these calls,
-			// once each, and nothing else.
-			{ toolName: "entwurf_callback", arguments: {} },
 			{
 				toolName: "entwurf_fresh_call",
 				arguments: {
@@ -1480,10 +1486,18 @@ async function run(): Promise<void> {
 		],
 		"initial Pi final exact-once audit",
 	);
-	assertExactSourceToolCalls(
-		codexSourceToolReceipts(codexThread),
-		[
-			{
+	// Codex: the same composition over the Entwurf MCP calls `thread/read` reports (this smoke's
+	// Codex scope — no vendor-native action taxonomy). Its callback is `entwurf_v2` to the initial Pi
+	// with the nonce, so `wants_reply` keeps its schema default there. `thread/read` gives item order
+	// and a status at audit time only: on Codex this proves CALL ORDER and completion-at-audit; that a
+	// peers result preceded the callback call, and that the callback result preceded the next call,
+	// are both UNVERIFIED.
+	const codexFinalSources = codexSourceToolReceipts(codexThread);
+	const codexTaskCalls = assertBootstrapOrder(
+		codexFinalSources,
+		{
+			peersArguments: {},
+			callback: {
 				toolName: "entwurf_v2",
 				arguments: {
 					target: initialPiGid,
@@ -1492,6 +1506,13 @@ async function run(): Promise<void> {
 					message: codexNonce,
 				},
 			},
+		},
+		"Codex bootstrap order",
+	);
+	const codexPeersPrefix = codexFinalSources.length - codexTaskCalls.length - 1;
+	assertExactSourceToolCalls(
+		codexTaskCalls,
+		[
 			{
 				toolName: "entwurf_fresh_call",
 				arguments: { backend: "pi", model: piModel, task: outboundPiTask },
@@ -1508,7 +1529,9 @@ async function run(): Promise<void> {
 		],
 		"Codex final exact-once audit",
 	);
-	receipts["16-source-final-audit"] = "initial-pi=3/3 completed exact\ncodex=3/3 completed exact";
+	receipts["16-source-final-audit"] =
+		`initial-pi=bootstrap order (peers prefix=${piPeersPrefix} → callback, results-before-next-call by transcript ordinal) + 2/2 task roles exact\n` +
+		`codex=bootstrap order (peers prefix=${codexPeersPrefix} → callback, call order only) + 2/2 task roles exact`;
 }
 
 let failure: unknown = null;

package/scripts/smoke-entwurf-chain-live.ts

@@ -64,6 +64,7 @@ import {
 	writeMetaSenderMarker,
 } from "../pi-extensions/lib/meta-session.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
+import { awaitTerminusPublication } from "./lib/chain-terminus-publication.ts";
 import { skipLive } from "./lib/live-skip.ts";
 
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
@@ -390,14 +391,11 @@ async function main(): Promise<void> {
 
 		// ── the chain runs on its own from here; wait for the terminus ───────────
 		const boxDir = path.join(mailboxDir, gidD);
-		const until = Date.now() + CHAIN_TIMEOUT_MS;
-		let msgs: string[] = [];
-		while (Date.now() < until) {
-			msgs = (await fsp.readdir(boxDir).catch(() => [] as string[])).filter(
-				(f) => f.endsWith(".msg") || f.endsWith(".msg.delivered"),
-			);
-			if (msgs.length > 0) break;
-			await sleep(POLL_MS);
+		// Body AND doorbell, inside the same deadline: enqueue publishes `.msg` first and
+		// `inbox.signal` last, so a body alone is a publication still in flight (P5 2026-10-24).
+		const { msgs, signalled } = await awaitTerminusPublication(boxDir, Date.now() + CHAIN_TIMEOUT_MS, POLL_MS);
+		if (msgs.length > 0 && !signalled) {
+			console.error(`[smoke-entwurf-chain-live] terminus at timeout: ${msgs.length} body file(s) but no inbox.signal`);
 		}
 		if (msgs.length === 0) {
 			let ownerAlive = false;
@@ -423,7 +421,7 @@ async function main(): Promise<void> {
 			console.error(`[smoke-entwurf-chain-live] C stream tail:\n${streamC.slice(-2000)}`);
 		}
 		ok(`the chain reached the mailbox terminus (${msgs.length} .msg)`, msgs.length === 1);
-		ok("the terminus doorbell was poked", existsSync(path.join(boxDir, "inbox.signal")));
+		ok("the terminus doorbell was poked", signalled);
 
 		const body = await fsp.readFile(path.join(boxDir, msgs[0] as string), "utf8");