[max1874]

The native CLI still imported the model client and Inspector, while the model Agent could record a focus steal, continue dispatching, and eventually report DONE. The CLI now has no runtime dependencies, keeps planning/Inspector behind the optional agent extra, and preserves the public Agent API through lazy import. A known focus violation stops Agent input and makes CLI act return focus_violation (exit 3), retaining the real delivery disposition even after native errors.

The existing full-task activation observer can supply Agent.focus_check; it is checked before commands, immediately before input after prediction/value preparation, and afterwards. Unavailable configured evidence also stops. The observer still covers cleanup and is the only basis for full-interval acceptance; one CLI command or endpoint inactivity makes no task-success claim. Calculator now delegates to that same owned-instance acceptance runner instead of retaining another launcher and an invalid “never foreground” endpoint check. Inspector exposes the stop reason and labels DONE as a model claim.

Remove the unoffered native increment/decrement branches, their publication and settle entries, and old acted/missing-disposition inference. Missing, contradictory or malformed action delivery replies reset the bridge and leave the mutation uncertain, without replay. Identity, process binding, AX deadlines, secure fields and dispatch locking remain in place. Choice heads and Jev text generation remain in the optional Agent layer; their decision contract was reviewed and is unchanged rather than replaced by an unmeasured policy.

Runtime evidence (artifacts outside Git at ~/AI/Artifacts/Open Computer Use Contract Cleanup):

• An owned native fixture actually activated on its first AXPress. The original Agent continued to two delivered operations and DONE with took_focus=true. Final Agent stopped at one delivery with blocked. A non-activating normal run reached two and DONE. All owned instances were confirmed closed. Local model stand-in only: this demonstrates runtime control and delivery, not model accuracy.
• The original fixture activation attempt produced no target activation and is excluded from fault-path acceptance.
• Native CLI status ran under Python -S with no site-packages, reading real permissions/lock/frontmost data without loading HTTP/model or Inspector dependencies.
• Final native CLI computed 12 × 34 in a fresh owned Calculator via observed refs under Python -S. Independent reading changed from 0 to exactly 408; complete ready/leased/released/stopped record had zero activation events and cleanup succeeded. No model-accuracy claim.
• Native INCREMENT/DECREMENT requests were refused before dispatch and left the counter at zero. The proxy then removed disposition from a real delivered PRESS reply: Agent blocked with unsafe uncertain delivery, a fresh ping succeeded, and the native counter remained one, proving no replay. Complete event record had zero activations and cleanup succeeded.
• Real Inspector form/API flow showed the uncertain-delivery stop reason and disabled further input; a fresh normal run reached two real operations and Model finished, with the full-run acceptance caveat visible. Both owned windows and the local servers closed. Inspector display evidence alone is not full-run background acceptance.
• Existing CI run 42044785455 passed both contracts (Python unittest and native-source Node guards) and macOS Swift build on exact head 2862c41. No local test/check suites ran; CI workflow/check definitions are unchanged.
• Passive fault logs and relevant crash reports read after runtime verification had no matching entries; this supplements the observed app results, not proof by absence.

No paid model APIs were called. Focus-fault injection was explicitly authorized as a short, disposable-app window; no foreground restoration was added.