Restore polling as the primary Live architecture

Default Codex back to one-shot foreground polling, delegate generation to the existing low-effort agent, and keep the app-server worker available only through an explicit experimental opt-in. Preserve progressive publication and the shared safety and framework optimizations.

Prepared with Codex assistance under maintainer direction.

skill/scripts/live-poll.mjs

@@ -359,8 +359,9 @@ Options:
   --help              Show this help message
 
 Harness note:
-  Default one-shot mode is the portable contract for Claude Code, Cursor, and foreground fallback.
-  Codex uses --stream only for the dedicated worker's narrow foreground control lane.
+  Default one-shot mode is the primary contract, including Codex foreground polling.
+  Claude Code may run it as a background task; Cursor uses a background terminal with exit notification.
+  --stream is retained for explicitly enabled experimental worker control lanes.
   Do not use --stream on Cursor.`);
     process.exit(0);
   }

skill/scripts/live.mjs

@@ -10,7 +10,7 @@
  *
  * After this, the agent's only remaining steps are:
  *   - Open the project's live dev/preview URL in the browser (optional, if browser automation exists)—not `serverPort`; that port is the Impeccable helper for /live.js and /poll
- *   - Enter the poll loop: `node live-poll.mjs`
+ *   - Enter the harness-native poll loop: `node live-poll.mjs`
  *
  * Usage:
  *   node live.mjs                   # Prepare everything, print JSON, exit
@@ -41,7 +41,7 @@ Prepare everything for live variant mode in a single command:
   - Starts (or reuses) the live server in the background
   - Injects the browser script tag
   - Reads PRODUCT.md / DESIGN.md for project context
-  - Starts the dedicated app-server worker by default in Codex
+  - Keeps the experimental Codex app-server worker off unless explicitly enabled
   - In monorepos, choose a child app first; --target <path> is the fallback/manual path
 
 On success, prints a JSON blob with:
@@ -131,8 +131,8 @@ The agent should then:
   const resolvedFiles = resolveFiles(activeCwd, checkResult.config);
   const drift = scanForDrift(activeCwd, resolvedFiles, checkResult.config);
 
-  // Codex-only and default-on in Codex. A failed app-server startup never takes
-  // ownership of the poll queue; the foreground portable path remains active.
+  // Codex-only and explicitly opt-in. The foreground portable path is the
+  // default, and a failed app-server startup never takes ownership of its queue.
   const codexWorker = ensureCodexWorker(activeCwd, checkResult.config);
 
   // 5. Emit everything the agent needs

skill/scripts/live/codex-worker.mjs

@@ -152,9 +152,13 @@ function codexSourceDeltaOutputSchema(phase, requirePlan, expectedVariants) {
 export function resolveCodexWorkerConfig({ env = process.env, liveConfig = {} } = {}) {
   const configured = liveConfig.experimentalCodexWorker || liveConfig.codexWorker || {};
   const envEnabled = parseBoolean(env.IMPECCABLE_LIVE_CODEX_WORKER);
-  // Activation remains process-local. Codex gets the worker by default, while
-  // committed project settings can never switch another harness onto Codex.
-  const enabled = envEnabled == null ? isCodexRuntime(env) : envEnabled;
+  const configuredEnabled = parseBoolean(configured.enabled);
+  // The app-server lane is experimental and opt-in. A committed project
+  // setting can enable it only inside Codex; it can never switch another
+  // harness onto a Codex-specific runtime path.
+  const enabled = envEnabled == null
+    ? isCodexRuntime(env) && configuredEnabled === true
+    : envEnabled;
   const profile = nonEmpty(env.IMPECCABLE_LIVE_CODEX_PROFILE)
     || nonEmpty(configured.profile)
     || 'quality';