@junghanacs/entwurf 0.41.1 → 0.45.0

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-self-address.js

@@ -75,6 +75,16 @@ export function computeSelfAddressability(facts) {
             // default fail-closed row).
             switch (facts.metaDeliveryDomain) {
                 case "native-push": {
+                    // #152 policy, decided BEFORE the pure record+probe predicate and kept out of it:
+                    // only a record-backed citizen can be "paused" (a record-less one keeps its own
+                    // reason), and no probe was run for this answer, so none is reported.
+                    if (facts.recordBacked === true && facts.nativePushPaused === true) {
+                        return {
+                            replyable: false,
+                            socketState: "none",
+                            reason: "native-push unreachable — native-push for this backend is paused (#152); no probe ran for this answer",
+                        };
+                    }
                     const push = nativePushDeliverable({ recordBacked: facts.recordBacked, probeAlive: facts.probeAlive });
                     return {
                         replyable: push.deliverable,

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-contract.js

@@ -119,6 +119,24 @@ export const NATIVE_PUSH_BACKENDS = ["antigravity", "codex"];
 export function nativePushSupported(backend) {
     return NATIVE_PUSH_BACKENDS.includes(backend);
 }
+// ── Paused native-push backends (#152) ─────────────────────────────────────
+// A native-push backend whose SEND is paused by product policy. On the external send path
+// entwurf measured, Antigravity's language server refused the `agentapi` call with
+// `Unauthenticated: missing CSRF token` (agy 1.2.16 in #128; agy 1.4.6 again for #152).
+// Whether a first-party own-tool shell holds a token entwurf could legitimately present is
+// UNMEASURED, not ruled out. So instead of probing a port that refused on that path and
+// reporting it as an inconclusive liveness, the three public entries that would reach the agy LS —
+// v2 dispatch, a sender's own `replyable`, and `entwurf_register_native` — refuse by name
+// BEFORE any probe. This is a fixed constant, not a flag: no env, config or runtime toggle
+// can lift it. The backend stays in NATIVE_PUSH_BACKENDS, so existing agy records, the V3
+// reader and the peers listing are unchanged; only the native-push traffic stops.
+// The one probe that is NOT behind this guard is the fresh-cut quiescence check
+// (scripts/meta-bridge-fresh-cut.ts), which protects an operator-named archive and must keep
+// failing closed rather than read the pause as a departed host.
+export const NATIVE_PUSH_PAUSED_BACKENDS = ["antigravity"];
+export function nativePushPaused(backend) {
+    return NATIVE_PUSH_PAUSED_BACKENDS.includes(backend);
+}
 /**
  * Compose the 4-value FACT liveness from a backend and its socket probe.
  * Out-of-domain backend → `unsupported` (NOT dead/indeterminate, R1). An
@@ -148,18 +166,20 @@ export const ENTWURF_V2_REJECT_REASONS = [
     "mailbox-undeliverable", // F-mailbox: fire-and-forget to an unsupported citizen whose mailbox is not deliverable (fail-closed; future pi-backend non-drainable mailbox)
     "native-push-target-dead", // 봉인 1: fire-and-forget to a native-push (agy) target whose adapter probe found NO live conversation. Post-probe; observedLiveness = dead.
     "native-push-probe-indeterminate", // 봉인 1: fire-and-forget to a native-push target whose adapter probe was inconclusive (agy alive but no port served the conv, or a probe error). Post-probe; observedLiveness = indeterminate. Never coerced to dead.
+    "native-push-paused", // #152: fire-and-forget to a native-push backend whose send is paused by product policy (NATIVE_PUSH_PAUSED_BACKENDS — antigravity). Pre-probe, observedLiveness = null: nothing was probed, so no liveness is claimed — never coerced to dead or indeterminate.
     "bad-target", // R2: absent/typo garden-id (no existing citizen); fresh creation out of v2 scope
     "record-less-socket", // #50 C4: a gid-shaped non-symlink control socket exists but NO meta-record claims it. The record is the sole address authority (목표 ②), so a bare socket is not an addressable citizen — it is a diagnostic state, refused for EVERY intent before any lock/probe (pre-probe, observedLiveness=null). NOT `bad-target`: something real answers to this gid, and mislabeling it absent would hide the very state the reject exists to surface.
     "target-locked", // R5 pre-claim for bucket B F2 per-gid lockfile conflict
     "target-address-conflict", // F3: a quarantined citizen (garden-id-socket-conflict / symlinked socket) — the gid resolves to two different receivers (record vs socket), so dispatch refuses to pick. The ONLY in-band honest channel for a dispatch-level identity-split (the listing diagnostic channel is not visible to a v2 caller, who only gets a receipt). Pre-resolver, like bad-target/target-locked — NOT a RESOLVER_REJECT_REASONS member.
 ];
 // ── Pre-probe reject reasons (？6 — observedLiveness = null) ────────────────
-// These four rejects are decided BEFORE any liveness probe runs, so there is no
+// These five rejects are decided BEFORE any liveness probe runs, so there is no
 // honest 4-value FactLiveness to stamp: `bad-target` (no citizen/backend),
 // `target-locked` (5a lock conflict, before lstat/connect), `target-address-conflict`
 // (address-subject conflict → probing is forbidden), `record-less-socket` (#50 C4:
 // no record ⇒ not a citizen ⇒ no in-domain probe ever runs — the presence hint is
-// a single lstat, not a liveness measurement). `indeterminate` means an
+// a single lstat, not a liveness measurement), `native-push-paused` (#152: the backend's
+// native-push send is paused by policy, so its adapter is never probed). `indeterminate` means an
 // in-domain probe was inconclusive (≠ "not looked yet"); `unsupported` means the
 // backend has no predicate (≠ "pre-probe"). So a pre-probe reject's
 // observedLiveness is `null`, NOT one of the four values. Every OTHER reject —
@@ -176,6 +196,7 @@ export const PRE_PROBE_REJECT_REASONS = [
     "target-locked",
     "target-address-conflict",
     "record-less-socket",
+    "native-push-paused",
 ];
 export function isPreProbeReject(reason) {
     return PRE_PROBE_REJECT_REASONS.includes(reason);

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-decider.js

@@ -44,7 +44,7 @@
  * be bypassed.
  */
 import { isOutOfSocketDomainGardenIdConflict } from "./entwurf-facts.js";
-import { isLivenessSupported, makeRejectReceipt, nativePushSupported, resolveDispatch, resolveNativePushDispatch, } from "./entwurf-v2-contract.js";
+import { isLivenessSupported, makeRejectReceipt, nativePushPaused, nativePushSupported, resolveDispatch, resolveNativePushDispatch, } from "./entwurf-v2-contract.js";
 import { defaultMetaMailboxDir, defaultMetaSessionsDir, metaCapabilityFor, } from "./meta-session.js";
 import { isValidSessionId } from "./session-id.js";
 import { controlSocketPath, mapInspectionToLiveness } from "./socket-discovery.js";
@@ -121,6 +121,12 @@ export async function decideDispatch(input, deps) {
     // branch is LOCK-FREE (봉인 4): the pi in-domain lock closes a socket TOCTOU, but a
     // volatile probe route has no lock meaning (a duplicate-send idempotency is a D8 future).
     if (nativePushSupported(identity.backend)) {
+        // #152: a paused native-push backend is refused by name BEFORE its adapter is probed —
+        // on the measured external path that language server refused the call (missing CSRF token),
+        // and a refusal must not be reported as a measured liveness. Pre-probe, observedLiveness null.
+        if (nativePushPaused(identity.backend)) {
+            return reject(makeRejectReceipt("native-push-paused", null));
+        }
         const probe = await deps.nativePushProbe(identity);
         const receipt = resolveNativePushDispatch(input.intent, probe.status);
         if (!receipt.ok)

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-surface.js

@@ -17,6 +17,7 @@
  *     surface never needs to name the `EntwurfV2RunResult` union (it only sees `{text,isError}`).
  */
 import { basename } from "node:path";
+import { ENTWURF_DELIVERY_RESULT_CLAUSES, ENTWURF_REJECT_HINTS, ENTWURF_SLOTTED_REJECT_HINTS, } from "./agent-guidance.js";
 import { makeProductionEntwurfV2Deps } from "./entwurf-v2-production.js";
 import { runEntwurfV2 } from "./entwurf-v2-runner.js";
 import { FRESH_CUT_PRESCRIPTION } from "./meta-session.js";
@@ -36,7 +37,9 @@ export function toDispatchInput(params) {
  * Detour B (B-a) — actionable rendering of an honest reject. The decider is UNCHANGED:
  * a reject stays a reject (Hard Rule 3). This only appends a one-line "what to do instead"
  * to the reject TEXT, so an honest reject stops reading as "delivery impossible". Returns
- * undefined for rejects with no useful next step.
+ * undefined for rejects with no useful next step. Hint English is authored in root ENTWURF.json
+ * (#154); the reason switch stays here, and so do the record-less-socket slot value and its
+ * concatenation (#154 E1b).
  */
 export function actionableRejectHint(reason) {
     switch (reason) {
@@ -45,11 +48,7 @@ export function actionableRejectHint(reason) {
             // state — the citizen exists and is not running — matters more than ever now that
             // there is no verb behind it: a caller that reads "reject" as "wrong id" goes
             // looking in the wrong place.
-            return ("this citizen's record is intact but its session is not running, and delivery has no way to wake it. " +
-                "The resume that used to answer here launched a hidden background child and was withdrawn under the " +
-                "visible-first rule; the visible same-id resume is the separate lifecycle verb entwurf_resume_call. " +
-                "Only on an explicit operator request, use entwurf_resume_call {target} for Pi or Claude Code; " +
-                "it submits no prompt. This capability hint is not permission to resume automatically.");
+            return ENTWURF_REJECT_HINTS["dormant-fire-forget-unsupported"];
         case "indeterminate-no-spawn":
             // The socket probe did not settle, so liveness is UNKNOWN — an unestablished probe
             // is not a measured death, and dispatching into it could double-deliver. Say
@@ -60,28 +59,27 @@ export function actionableRejectHint(reason) {
             // (never dispatch into an indeterminate target), not a capability that still
             // exists. So the hint's job is to say plainly what did NOT happen: nothing
             // delivered, nothing started.
-            return ("the control-socket probe was inconclusive, so the target's liveness is UNKNOWN — this is not a " +
-                "measured death. NOTHING was delivered and NO process was started (the reason id keeps its frozen " +
-                "'-no-spawn' wire spelling from an era when one could be; entwurf_v2 starts nothing on any rail). " +
-                "Re-run entwurf_peers to re-probe; if it stays indeterminate, check for a stale socket file left at " +
-                "that garden id by a session that died without cleaning up.");
+            return ENTWURF_REJECT_HINTS["indeterminate-no-spawn"];
         case "native-push-target-dead":
             // The adapter probe found no live native host serving this conversation/thread. Stays
             // backend-neutral: agy speaks conversations over an LS port, Codex threads over an
             // app-server socket, and this hint is read by callers of both.
-            return "the native-push conversation/thread is not live — no native host (harness process or app-server) answered the probe for it. Re-open that conversation/thread in its own harness, then retry; there is nothing to inject into.";
+            return ENTWURF_REJECT_HINTS["native-push-target-dead"];
         case "native-push-probe-indeterminate":
             // Native host up, but nothing served this conversation/thread — inconclusive, not a
             // hard dead. Backend-neutral for the same reason as the dead cell above.
-            return "the native host (harness process or app-server) is up, but nothing served this conversation/thread, so the probe is INCONCLUSIVE — not a measured death. Retry once it is loaded, or verify the conversation/thread id.";
-        case "record-less-socket":
+            return ENTWURF_REJECT_HINTS["native-push-probe-indeterminate"];
+        case "native-push-paused":
+            // #152: a policy refusal, not a liveness verdict — this dispatch probed and sent nothing.
+            return ENTWURF_REJECT_HINTS["native-push-paused"];
+        case "record-less-socket": {
             // #50 C4: name the true cause AND the fix — a bare socket is a diagnostic
-            // state, not an addressable citizen (the record is the address).
-            return ("a control socket exists at this garden id but NO meta-record claims it — the record is the " +
-                "sole address authority, so a bare socket is not an addressable citizen. If a pre-record-era " +
-                "resident owns that socket, restart it under the current runtime (session_start births its " +
-                `record); if the store predates the current generation, quiesce and archive it with ` +
-                `${FRESH_CUT_PRESCRIPTION}. A stale/forged socket should be removed.`);
+            // state, not an addressable citizen (the record is the address). The text on either
+            // side of the fix command is authored in root ENTWURF.json; the command itself stays
+            // with its owner (meta-session.ts), so the root file never copies it.
+            const hint = ENTWURF_SLOTTED_REJECT_HINTS["record-less-socket"];
+            return `${hint.beforeFreshCutPrescription}${FRESH_CUT_PRESCRIPTION}${hint.afterFreshCutPrescription}`;
+        }
         default:
             return undefined;
     }
@@ -182,13 +180,14 @@ export function renderEntwurfV2Result(result) {
                 // the same acceptance vocabulary the ordinary receipt uses is named here too — a
                 // dirty lock is a reason to be MORE precise about what happened, not less, because
                 // the operator is about to decide by hand whether anything needs re-sending.
+                // The two static clauses are authored in root ENTWURF.json (#154 E1a); this receipt's
+                // syntax, branches and slots stay here.
                 const what = result.finalizedOutcome === "rejected"
-                    ? `rejected${result.finalizedRejectReason ? ` (${result.finalizedRejectReason})` : ""} — the receiver refused it; nothing was accepted`
+                    ? `rejected${result.finalizedRejectReason ? ` (${result.finalizedRejectReason})` : ""} — ${ENTWURF_DELIVERY_RESULT_CLAUSES["finalized-rejected"]}`
                     : `${result.finalizedBoundary ?? "mailbox-enqueued"}${result.finalizedMessagePath ? ` (enqueued ${basename(result.finalizedMessagePath)})` : ""}`;
                 return {
-                    text: `entwurf_v2 ${result.transport} finalized as ${what}, and the lock is DIRTY ` +
-                        `(release failed) — do NOT retry, a re-send would double-deliver. Clear the lock by hand.` +
-                        `\n  error: ${result.error}`,
+                    text: `entwurf_v2 ${result.transport} finalized as ${what}, and ` +
+                        `${ENTWURF_DELIVERY_RESULT_CLAUSES["dirty-lock"]}\n  error: ${result.error}`,
                     isError: true,
                 };
             }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-visible-resume.js

@@ -73,6 +73,7 @@
  * half reads the receiver marker and the record instead.
  */
 import { ACP_MODEL_NOT_CURATED_HINT, AcpModelNotCuratedError } from "./acp/model-ids.js";
+import { ENTWURF_RESUME_REJECT_HINTS } from "./agent-guidance.js";
 import { buildResumePiArgs } from "./entwurf-resume-args.js";
 import { ENTWURF_V2_LOCK_DIR, acquireLock as realAcquireLock, releaseLock as realReleaseLock, } from "./entwurf-v2-lock.js";
 import { classifyMarkerOwner, metaReceiverMarkerPath, parseMetaReceiverMarker, probePidExistence, processStartKey, readStoreRecordFile, } from "./meta-session.js";
@@ -441,19 +442,22 @@ export async function observeSameGidSocket(targetGardenId, socketPath, deps, tim
         await deps.sleep(intervalMs);
     }
 }
+// The static record/liveness hint text is authored in root ENTWURF.json (#154 C1-C); the reasons,
+// this total table and the renderer stay here. acp-model-not-curated keeps the shared ACP constant,
+// and the launch-stage mux hints folded into `detail` stay behind the mux import fence.
 const REJECT_HINT = {
-    "target-invalid": "no citizen has that id; discover targets with entwurf_peers",
-    "target-backend-unsupported": "that citizen's backend has no same-id resume (only pi and Claude Code do) — reach it with entwurf_v2, or open a fresh sibling",
+    "target-invalid": ENTWURF_RESUME_REJECT_HINTS["target-invalid"],
+    "target-backend-unsupported": ENTWURF_RESUME_REJECT_HINTS["target-backend-unsupported"],
     "acp-model-not-curated": ACP_MODEL_NOT_CURATED_HINT,
-    "target-locked": "another resume or dispatch holds this citizen's lock right now",
-    "target-live": "that citizen is already running — this verb only reopens dormant ones",
-    "target-indeterminate": "the citizen could not be proven dormant (an inconclusive socket probe or receiver owner), so nothing was started",
-    "target-receiver-absent": "a Claude Code citizen is proven dormant only by its receiver marker, and it has none — if its window is closed, reopen it yourself",
-    "target-receiver-corrupt": "the citizen's receiver marker cannot be read as a marker, so its owner cannot be judged",
-    "target-receiver-mismatch": "the receiver marker under this garden id names another backend or native session than the record — look at the store before anything reopens",
-    "target-receiver-unbound": "the dead receiver owner is not bound to the record's last arm (none observed, a later attach, or the record moved), so a Claude Code process may still hold the session — if its window is closed, reopen it yourself",
-    "target-address-conflict": "that citizen's control-socket path is corrupt",
-    "launch-refused": "tmux was never asked to open a window",
+    "target-locked": ENTWURF_RESUME_REJECT_HINTS["target-locked"],
+    "target-live": ENTWURF_RESUME_REJECT_HINTS["target-live"],
+    "target-indeterminate": ENTWURF_RESUME_REJECT_HINTS["target-indeterminate"],
+    "target-receiver-absent": ENTWURF_RESUME_REJECT_HINTS["target-receiver-absent"],
+    "target-receiver-corrupt": ENTWURF_RESUME_REJECT_HINTS["target-receiver-corrupt"],
+    "target-receiver-mismatch": ENTWURF_RESUME_REJECT_HINTS["target-receiver-mismatch"],
+    "target-receiver-unbound": ENTWURF_RESUME_REJECT_HINTS["target-receiver-unbound"],
+    "target-address-conflict": ENTWURF_RESUME_REJECT_HINTS["target-address-conflict"],
+    "launch-refused": ENTWURF_RESUME_REJECT_HINTS["launch-refused"],
 };
 /**
  * ONE renderer — the same reason `mux-fresh-call` has one: it keeps the operator-visible answer

package/mcp/entwurf-bridge/dist/pi-extensions/lib/fresh-call-composition.js

@@ -63,7 +63,7 @@ export const FRESH_CALL_CALLBACK_TOOL = {
     copilot: "entwurf-bridge-entwurf_callback",
     omp: "mcp__entwurf_bridge_entwurf_callback",
     // Codex's tool process is the operator app-server, not the pane: the no-arg
-    // verb refuses there by name. First action stays the delivery verb with args.
+    // verb refuses there by name. Its callback stays the delivery verb with args.
     codex: "mcp__entwurf_bridge__entwurf_v2",
     // The durable contact registers the bridge verbs as its OWN tools under their bare names, and the
     // app offers a tool to the model by its registered name (`durable/harness/registry.ts:99`
@@ -348,8 +348,8 @@ export function composeBackendArgs(backend, composition, model, resolveCodexSock
  * PLACEMENT SENTENCE. The first line names where the sibling was opened, and only the RAIL knows
  * that — "the operator's tmux session" is true of a `new-window` launch and false of a herdr
  * pane. It is therefore supplied by the caller rather than composed here. Everything BELOW that
- * line is rail-independent and stays the contract: the callback is the first action, the task
- * follows it, and the three prohibitions are measured rather than polite.
+ * line is rail-independent and stays the contract: the callback comes before the task, an optional
+ * read-only check of the caller may come before the callback, and the steering is stated as fact.
  */
 /**
  * The first-turn framing, WITHOUT the task.
@@ -361,8 +361,13 @@ export function composeBackendArgs(backend, composition, model, resolveCodexSock
  * the halves separate is what lets the framing stay plain prose on both rails while the operator's
  * task text keeps every byte it was written with.
  *
- * Order is the contract: the callback is the FIRST action and the task follows it, so a sibling
- * that gets stuck in the task has already told the caller who it is.
+ * Order is the contract: the callback comes BEFORE THE TASK, so a sibling that gets stuck in the
+ * task has already told the caller who it is. It is not the literal first tool call. `[GLG 직접,
+ * 2026-10-24]` checking the caller and then calling back is the right order, and the framing used
+ * to say both "FIRST ACTION … call back" and "you can corroborate the caller first" — two
+ * sentences that cannot both be obeyed. What may come before the callback is the one read-only
+ * check offered below (and, where a dialect needs it, loading the tools); reading files, running
+ * commands or starting the task may not.
  *
  * WHAT THIS SAYS AND WHY IT STOPPED SAYING THE REST (#116). Until 2026-09-17 this framing carried
  * three prohibitions, including "Do not inspect environment variables, do not call entwurf_self".
@@ -390,7 +395,7 @@ export function composeFreshCallFraming(params) {
     }
     const firstAction = params.backend === "codex"
         ? [
-            `FIRST ACTION, before reading files or anything else: call ${birthTool} with ` +
+            `BEFORE THE TASK, and before reading files or running commands: call ${birthTool} with ` +
                 `target=${params.callerGardenId}, intent=fire-and-forget, wants_reply=false, and ` +
                 `message set to exactly ${params.nonce} — that string alone, nothing added.`,
             `${params.nonce} is a correlation tag this caller minted for this one launch: it names no`,
@@ -400,7 +405,7 @@ export function composeFreshCallFraming(params) {
             "entwurf_callback is refused on this rail: the tool process is the operator app-server, not this pane.",
         ]
         : [
-            `FIRST ACTION, before reading files or anything else: call ${birthTool} with no arguments.`,
+            `BEFORE THE TASK, and before reading files or running commands: call ${birthTool} with no arguments.`,
             "That call is how the caller learns the garden id you were born with. There are no",
             "parameters: a target or message you type would be a second address axis.",
             "Your own record does not carry the caller's address, so reporting your identity here does not reach it — that tool call does.",
@@ -410,9 +415,15 @@ export function composeFreshCallFraming(params) {
         "",
         ...firstAction,
         "",
-        `You can corroborate the caller first if you want to: ${peersTool} is a read-only listing of`,
-        `this garden's citizens and ${params.callerGardenId} is one of them. That listing is capped, so`,
-        "a caller you do not happen to see in it is not a reason to skip the callback.",
+        // THE CHECK IS THE SIBLING'S, AND SO IS ITS VERDICT. `[GLG 직접, 2026-10-24]` a capped listing that
+        // does not show the caller proves nothing about the caller, but a sibling whose check does not hold
+        // up may say so and hold back. Entwurf decides nothing here — no trust store, no fallback, no
+        // watcher — and the cost of holding back is stated, not hidden: no callback, no address.
+        `You may corroborate the caller before that call: ${peersTool} is a read-only listing of`,
+        `this garden's citizens and ${params.callerGardenId} is one of them. That listing is capped, so not`,
+        "seeing the caller in it does not show the caller is absent. If what you can check is not enough,",
+        "or it conflicts with this message, you may say so here and hold the callback and the task; the",
+        "caller then has no address for you.",
         ...hintBlock,
         "",
         // WHERE THE RESULT GOES, said once, as topology. `[GLG 직접, 2026-09-18]` a Sonnet sibling

package/mcp/entwurf-bridge/dist/pi-extensions/lib/herdr-fresh-call.js

@@ -899,10 +899,12 @@ export function renderHerdrFreshCall(result) {
             `mean the sibling is running, that its first turn ran, or that the task was delivered. The tab and pane ` +
             `coordinates are a view and can change under the sibling — they are not an address and nothing may be ` +
             `dispatched to them.\n` +
-            `The sibling's garden id arrives separately — its first action is the zero-argument callback verb, and ` +
+            `The sibling's garden id arrives separately — before its task it calls the zero-argument callback verb ` +
+            `(a read-only look at the caller may come first), and ` +
             `the sender envelope of THAT message is the address. The nonce above is the correlation tag it carries; ` +
             `the sibling reads it from its own launch env, never from this receipt. Nothing is polling for it; if it ` +
-            `never comes, the pane is visible and can be read directly.`,
+            `never comes — not started, stuck, or held back after its check; this receipt cannot tell which — the ` +
+            `pane is visible and can be read directly.`,
         isError: false,
     };
 }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-sender-identity.js

@@ -46,6 +46,7 @@
  * rails never merge — `codex` is deliberately absent from {@link META_SENDER_BACKENDS}, since
  * a backend listed there is one whose hook writes a pid marker, and codex birth writes none.
  */
+import { nativePushPaused } from "./entwurf-v2-contract.js";
 import { defaultMetaSessionsDir, describe, isPlausibleOwnerPid, listAllMetaIdentities, makeStoreRecordReader, metaRecordExistsByGardenId, parentPid, readActiveStoreEntries, readMetaIdentityByGardenId, readMetaSenderMarker, } from "./meta-session.js";
 import { resolveNativePushAdapter } from "./native-push/adapter.js";
 /** Every native backend that mints a garden-id from its own hook and writes a sender marker.
@@ -193,6 +194,10 @@ export function resolveTrustedMetaSenderIdentity(opts = {}) {
  * exactly the Crash-Don't-Warn shape this lane exists to remove. Let them propagate.
  */
 export async function probeNativeSenderAlive(identity, deps = {}) {
+    // #152: a paused native-push backend cannot receive a reply, so its `replyable` is false by
+    // POLICY — no adapter is resolved or probed. This is not a liveness verdict about the citizen.
+    if (nativePushPaused(identity.backend))
+        return false;
     const resolveAdapter = deps.resolveAdapter ?? resolveNativePushAdapter;
     const probe = await resolveAdapter(identity.backend).probe(identity.nativeSessionId);
     return probe.status === "alive";

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-fresh-call.js

@@ -86,6 +86,7 @@
  *     there is no "session created" field because nothing here creates one.
  */
 import { ACP_MODEL_NOT_CURATED_HINT } from "./acp/model-ids.js";
+import { ENTWURF_FRESH_LAUNCH_REJECT_HINTS } from "./agent-guidance.js";
 import { callbackEnvAssignments } from "./callback-env.js";
 import { classifyTmuxCwd } from "./classify-tmux-cwd.js";
 import { CODEX_CALLER_SEAT_HINT, resolveCodexCallerSeat, } from "./codex-caller-seat.js";
@@ -442,7 +443,9 @@ export function freshCall(params, env = process.env, nonce = mintNonce()) {
     };
 }
 /** Why each refusal happened, in the caller's terms. A reason a caller cannot act on is a reason
- * they will guess about. */
+ * they will guess about. The static tmux launch-stage text is authored in root
+ * ENTWURF.json (#154 C1-D) and bound key by key, never spread, so a duplicate or missing reason
+ * still fails typecheck; slot-bearing, ACP and preflight-leaf hints stay code-owned. */
 const REJECT_HINT = {
     // The Copilot capability reasons keep their repair text on the leaf that decides them, so
     // the sentence an operator reads cannot drift away from the predicate that produced it.
@@ -454,28 +457,28 @@ const REJECT_HINT = {
     ...CODEX_CALLER_PREFLIGHT_HINT,
     ...CODEX_CALLER_SEAT_HINT,
     ...FRESH_CALL_PROVIDER_HINT,
-    "no-tmux-context": "this agent is not running inside tmux, so there is no session to open a sibling beside",
-    "anchor-malformed": "TMUX_PANE is not a native pane id",
-    "anchor-unresolved": "tmux resolved no pane for this agent's anchor",
-    "anchor-mismatch": "tmux answered about a different pane than the one asked about",
-    "caller-identity-unavailable": "this surface has no record-backed garden id for the caller, so the sibling would have no address to call back to",
-    "cwd-not-absolute": "the requested cwd is not an absolute path (the value is taken literally — nothing trims or resolves it)",
-    "cwd-format-token": "the requested cwd contains '#', which tmux expands as a format inside -c — it would silently rewrite the path or run a command",
-    "cwd-missing": "the requested cwd does not exist; tmux would not report this, it would open the window in $HOME and look successful",
-    "cwd-not-directory": "the requested cwd exists but is not a directory",
-    "tmux-session-name-invalid": "the requested tmux session name is outside the shape this rail addresses (start with a letter or digit, then letters, digits, '_' or '-') — some other shapes tmux cannot resolve at all ('#' is expanded when the name is stored; '.' and ':' are its own pane/window separators inside a target; a name like '$0' loses to the session id '$0'), and the rest are declined to keep one narrow grammar, so rename the session or open one whose name fits",
-    "tmux-session-missing": "no session with that exact name answers on this agent's tmux server (or that server stopped answering) — nothing was created, so open the session yourself and call again",
-    "model-empty": "model is empty after trimming; fresh calls require an explicit model",
+    "no-tmux-context": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["no-tmux-context"],
+    "anchor-malformed": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["anchor-malformed"],
+    "anchor-unresolved": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["anchor-unresolved"],
+    "anchor-mismatch": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["anchor-mismatch"],
+    "caller-identity-unavailable": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["caller-identity-unavailable"],
+    "cwd-not-absolute": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["cwd-not-absolute"],
+    "cwd-format-token": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["cwd-format-token"],
+    "cwd-missing": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["cwd-missing"],
+    "cwd-not-directory": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["cwd-not-directory"],
+    "tmux-session-name-invalid": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["tmux-session-name-invalid"],
+    "tmux-session-missing": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["tmux-session-missing"],
+    "model-empty": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["model-empty"],
     "model-invalid": `model must be one ${MODEL_MAX_CHARS}-character argv-safe id/alias without whitespace or tmux syntax`,
     "acp-model-not-curated": ACP_MODEL_NOT_CURATED_HINT,
-    "task-empty": "task is empty after trimming",
+    "task-empty": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["task-empty"],
     "task-too-long": `task exceeds ${TASK_MAX_CHARS} characters`,
-    "runtime-unresolved": "the backend's runtime is not installed on PATH",
-    "runtime-not-absolute": "the resolved runtime path is not absolute",
-    "runtime-path-whitespace": "the resolved runtime path contains whitespace, which tmux would re-split",
-    "runtime-missing": "nothing exists at the resolved runtime path",
-    "runtime-not-regular-file": "the resolved runtime path is not a regular file",
-    "runtime-not-executable": "the resolved runtime path is not executable",
+    "runtime-unresolved": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["runtime-unresolved"],
+    "runtime-not-absolute": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["runtime-not-absolute"],
+    "runtime-path-whitespace": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["runtime-path-whitespace"],
+    "runtime-missing": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["runtime-missing"],
+    "runtime-not-regular-file": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["runtime-not-regular-file"],
+    "runtime-not-executable": ENTWURF_FRESH_LAUNCH_REJECT_HINTS["runtime-not-executable"],
 };
 /**
  * ONE renderer, outside the registration. Not a convenience: it keeps the operator-visible answer
@@ -514,11 +517,13 @@ export function renderFreshCall(result) {
             `\n` +
             `This is a LAUNCH receipt: tmux created that window and was asked to start the runtime with the model above. It does ` +
             `NOT mean the sibling is running, that its first turn ran, or that the task was delivered.\n` +
-            `The sibling's garden id arrives separately — its first action is the zero-argument callback verb ` +
-            `(codex is the one arm that still sends the nonce as arguments), and the sender envelope of THAT ` +
+            `The sibling's garden id arrives separately — before its task it calls the zero-argument callback verb ` +
+            `(codex is the one arm that still sends the nonce as arguments; a read-only look at the caller may come ` +
+            `first), and the sender envelope of THAT ` +
             `message is the address. The nonce above is the correlation tag it carries; the sibling reads it ` +
-            `from its own launch env, never from this receipt. Nothing is polling for it; if it never comes, ` +
-            `the window is visible and can be read directly.`,
+            `from its own launch env, never from this receipt. Nothing is polling for it; if it never comes — ` +
+            `not started, stuck, or held back after its check; this receipt cannot tell which — the window is visible ` +
+            `and can be read directly.`,
         isError: false,
     };
 }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/mux-resume-call.js

@@ -48,6 +48,7 @@
  * where the pane actually landed is a separate query against the stable pane id, and it belongs
  * to acceptance, not to the product's launch receipt.
  */
+import { ENTWURF_RESUME_LAUNCH_REJECT_HINTS } from "./agent-guidance.js";
 import { classifyTmuxCwd } from "./classify-tmux-cwd.js";
 import { assertLaunchTarget, LaunchPreconditionError, resolveRuntimeOnPath, SCRUBBED_INHERITED_ENV, } from "./mux-launch.js";
 import { APPEND_FORMAT, assertSelector, assertTmuxOk, inspectPlacement, parseWindowFields, requireSameContext, runTmux, } from "./mux-placement.js";
@@ -136,21 +137,22 @@ export function resumeCall(params, env = process.env) {
     };
 }
 /** Why each refusal happened, in the caller's terms. A reason a caller cannot act on is a reason
- * they will guess about. */
+ * they will guess about. The text is authored in root ENTWURF.json (#154 C1-D); each
+ * key is bound explicitly so the reason union stays exhaustive here. */
 export const RESUME_CALL_REJECT_HINT = {
-    "no-tmux-context": "this agent is not running inside tmux, so there is no session to reopen the citizen in",
-    "anchor-malformed": "TMUX_PANE is not a native pane id",
-    "anchor-unresolved": "tmux resolved no pane for this agent's anchor",
-    "anchor-mismatch": "tmux answered about a different pane than the one asked about",
-    "cwd-not-absolute": "the recorded cwd is not an absolute path",
-    "cwd-format-token": "the recorded cwd contains '#', which tmux expands as a format inside -c — it would silently rewrite the path or run a command",
-    "cwd-missing": "the recorded cwd no longer exists; tmux would not report this, it would open the window in $HOME and look successful",
-    "cwd-not-directory": "the recorded cwd exists but is not a directory",
-    "herdr-resume-unsupported": "this agent runs inside herdr, and same-id resume has only a tmux rail — nothing was opened in any ambient tmux session",
-    "runtime-unresolved": "the citizen's runtime (pi or claude) is not installed on PATH",
-    "runtime-not-absolute": "the resolved runtime path is not absolute",
-    "runtime-path-whitespace": "the resolved runtime path contains whitespace, which tmux would re-split",
-    "runtime-missing": "nothing exists at the resolved runtime path",
-    "runtime-not-regular-file": "the resolved runtime path is not a regular file",
-    "runtime-not-executable": "the resolved runtime path is not executable",
+    "no-tmux-context": ENTWURF_RESUME_LAUNCH_REJECT_HINTS["no-tmux-context"],
+    "anchor-malformed": ENTWURF_RESUME_LAUNCH_REJECT_HINTS["anchor-malformed"],
+    "anchor-unresolved": ENTWURF_RESUME_LAUNCH_REJECT_HINTS["anchor-unresolved"],
+    "anchor-mismatch": ENTWURF_RESUME_LAUNCH_REJECT_HINTS["anchor-mismatch"],
+    "cwd-not-absolute": ENTWURF_RESUME_LAUNCH_REJECT_HINTS["cwd-not-absolute"],
+    "cwd-format-token": ENTWURF_RESUME_LAUNCH_REJECT_HINTS["cwd-format-token"],
+    "cwd-missing": ENTWURF_RESUME_LAUNCH_REJECT_HINTS["cwd-missing"],
+    "cwd-not-directory": ENTWURF_RESUME_LAUNCH_REJECT_HINTS["cwd-not-directory"],
+    "herdr-resume-unsupported": ENTWURF_RESUME_LAUNCH_REJECT_HINTS["herdr-resume-unsupported"],
+    "runtime-unresolved": ENTWURF_RESUME_LAUNCH_REJECT_HINTS["runtime-unresolved"],
+    "runtime-not-absolute": ENTWURF_RESUME_LAUNCH_REJECT_HINTS["runtime-not-absolute"],
+    "runtime-path-whitespace": ENTWURF_RESUME_LAUNCH_REJECT_HINTS["runtime-path-whitespace"],
+    "runtime-missing": ENTWURF_RESUME_LAUNCH_REJECT_HINTS["runtime-missing"],
+    "runtime-not-regular-file": ENTWURF_RESUME_LAUNCH_REJECT_HINTS["runtime-not-regular-file"],
+    "runtime-not-executable": ENTWURF_RESUME_LAUNCH_REJECT_HINTS["runtime-not-executable"],
 };

package/mcp/entwurf-bridge/dist/pi-extensions/lib/native-push/register.js

@@ -19,9 +19,11 @@
  * deliverability semantics. `check-native-push-register` asserts this file references no
  * receiver-marker writer. (A dedicated register-provenance slot is a future concern.)
  *
- * LEAF-adjacent + pi-free: imports only the native-push adapter (pi-free) and the meta-session
- * upsert (pi-free), so the harness-neutral MCP bridge can reach it at boot.
+ * LEAF-adjacent + pi-free: imports only the native-push adapter (pi-free), the meta-session
+ * upsert (pi-free) and the pure v2 contract's paused-backend policy, so the harness-neutral MCP
+ * bridge can reach it at boot.
  */
+import { nativePushPaused } from "../entwurf-v2-contract.js";
 import { upsertMetaSession } from "../meta-session.js";
 import { resolveNativePushAdapter } from "./adapter.js";
 /**
@@ -30,6 +32,15 @@ import { resolveNativePushAdapter } from "./adapter.js";
  * an addressable citizen. On success returns the garden id + the create/attach action.
  */
 export async function registerNativeConversation(input, deps = {}) {
+    // #152: a paused native-push backend is refused by name BEFORE any adapter is resolved or
+    // probed — registration would otherwise reach a language server that refused the measured
+    // external calls (missing CSRF token).
+    // Nothing is probed and no record is written.
+    if (nativePushPaused(input.backend)) {
+        throw new Error(`entwurf_register_native: refusing to register ${input.backend} conversation ${JSON.stringify(input.nativeSessionId)} — native-push for ${input.backend} is paused (#152: its language server refused ` +
+            "entwurf's measured external calls for a missing CSRF token). Nothing was probed and no garden id was minted; " +
+            "existing records stay readable.");
+    }
     const resolveAdapter = deps.resolveAdapter ?? resolveNativePushAdapter;
     const adapter = resolveAdapter(input.backend);
     const probe = await adapter.probe(input.nativeSessionId);

package/mcp/entwurf-bridge/dist/pi-extensions/lib/omp-fresh-preflight.js

@@ -20,8 +20,8 @@
  *   callback callable — THE OMP-SPECIFIC ONE. `tools.xdev` defaults to TRUE, which mounts MCP
  *                      tools as `xd://` devices whose schemas never reach the prompt. The tool
  *                      would be configured, the bridge would be running, and the model still
- *                      could not call `mcp__entwurf_bridge_entwurf_v`. Step 9 clause 5 makes the
- *                      callback the FIRST action, so a fresh call onto a default-config host
+ *                      could not call `mcp__entwurf_bridge_entwurf_v`. Step 9 clause 5 puts the
+ *                      callback before the task, so a fresh call onto a default-config host
  *                      opens a window that can never name itself. `[측정]` #87 A-lane: the
  *                      vendor default wrapped the send tool and produced a false delivery report.
  *

package/mcp/entwurf-bridge/dist/pi-extensions/lib/pi-durable-fresh-preflight.js

@@ -15,7 +15,7 @@
  *                 provider spelled out (the bootstrap refuses a model resolved by inference), so
  *                 the model here is `<provider>/<model id>` split at the FIRST `/` — a catalog id
  *                 that itself contains `/` keeps it. A model with no provider part is refused.
- *   first input   the whole framing (callback first, then the task) rides the bootstrap's closed
+ *   first input   the whole framing (callback before the task) rides the bootstrap's closed
  *                 `{v:2,task}` payload, whose decoder caps `task` at 16000 characters. A framed
  *                 task over that cap would open a window whose bootstrap refuses its own argv.
  *