@junghanacs/entwurf 0.12.0

package/pi-extensions/lib/entwurf-deliverability.ts

@@ -0,0 +1,123 @@
+/**
+ * entwurf-deliverability — the PURE conversational-mailbox deliverability predicate
+ * (SE-1/SE-2 slice 2c). "If I enqueue a conversational reply to this target's mailbox
+ * right now, will a model actually see it — or will it rot as garbage?"
+ *
+ * Two layers, both pure (facts injected, no IO):
+ *
+ *  - computeMetaReceiverActive(facts): the shared "is this receiver active?" atom —
+ *    recordBacked AND ownerAlive AND watchArmed. This is the SAME conjunction the
+ *    self-addressability predicate uses for its meta branch; both import it so the
+ *    "active receiver" definition has ONE source of truth (concept shared, API split).
+ *
+ *  - mailboxConversationalDeliverable(facts): the enqueue gate. A mailbox enqueue +
+ *    doorbell only delivers for a SELF-FETCH backend (Claude Code / Codex / agy): the
+ *    receiver drains its own inbox on wake. A DIRECT-INJECT backend (pi) has no
+ *    mailbox drain at all — enqueuing for it is the SE-1 false success ("✓ delivered"
+ *    into a void). So deliverable = wakeMode === "self-fetch" AND the receiver is
+ *    active. This is the guard that the v1 fallback, MCP v1, pi-native v1, and the v2
+ *    decider/send-fallback enqueue sites must all pass before writing a .msg (slice 2d).
+ *
+ * The contract is "mailboxConversationalDeliverable", NOT a broad "deliverable": it is
+ * specifically about a conversational reply that needs a live doorbell wake, NOT about
+ * an archival mailbox someone reads later. Naming it narrowly keeps a future archival
+ * path from silently inheriting this gate.
+ */
+
+import type { WakeMode } from "./meta-session.ts";
+
+export interface MetaReceiverActiveFacts {
+	/** The receiver's garden id is backed by a live meta-record (identity exists). */
+	recordBacked?: boolean;
+	/** The receiver's watch owner pid is still the same live process (start-key match). */
+	ownerAlive?: boolean;
+	/** The receiver's idle-wake watch is armed (presence marker from an arm event). */
+	watchArmed?: boolean;
+}
+
+export interface MetaReceiverActiveResult {
+	active: boolean;
+	reason: string;
+}
+
+/**
+ * The shared active-receiver atom. Every axis is required (fail-closed: an undefined
+ * fact is treated as false, never optimistic), and each failure names its own cause so
+ * a terminated-owner is never conflated with a missing record or an unarmed watch.
+ */
+export function computeMetaReceiverActive(facts: MetaReceiverActiveFacts): MetaReceiverActiveResult {
+	if (facts.recordBacked !== true) {
+		return { active: false, reason: "no backing meta-record" };
+	}
+	if (facts.ownerAlive !== true) {
+		return { active: false, reason: "owner not alive (start-key mismatch — session exited or pid reused)" };
+	}
+	if (facts.watchArmed !== true) {
+		return { active: false, reason: "idle-watch not armed — a reply would enqueue with no doorbell wake" };
+	}
+	return { active: true, reason: "record backed, owner alive, watch armed" };
+}
+
+/**
+ * The identity axes a receiver presence marker must agree on to count as THIS target's
+ * live receiver (SE-2 slice 2d-3). A structural shape — both `MetaReceiverMarker` and
+ * `MetaIdentity` carry these fields, so callers pass either without importing the
+ * meta-session types here (keeps this module pure and dependency-light). `backend` is
+ * compared as a string (equality only); the enum is validated by the meta-session reader.
+ */
+export interface ReceiverIdentityFacts {
+	gardenId: string;
+	backend: string;
+	nativeSessionId: string;
+}
+
+/**
+ * Does this presence marker actually belong to the target identity? A marker that is
+ * absent, or whose garden id / backend / native session id has drifted from the record,
+ * is NOT this receiver — fail-closed (a stale/foreign marker must never raise a dead
+ * target to "active"). The single source of truth for "marker ↔ identity match" shared
+ * by the v1 mailbox guard (gatherMailboxDeliverabilityFacts) and the v2 production
+ * `mailboxDeliverabilityFor` seam, so the two paths cannot drift to different meanings.
+ */
+export function receiverMarkerMatchesIdentity(
+	marker: ReceiverIdentityFacts | null | undefined,
+	identity: ReceiverIdentityFacts,
+): boolean {
+	return (
+		!!marker &&
+		marker.gardenId === identity.gardenId &&
+		marker.backend === identity.backend &&
+		marker.nativeSessionId === identity.nativeSessionId
+	);
+}
+
+export interface MailboxDeliverabilityFacts extends MetaReceiverActiveFacts {
+	/** The target backend's wake mode (from the capability registry). */
+	wakeMode?: WakeMode | string;
+}
+
+export interface MailboxDeliverabilityResult {
+	deliverable: boolean;
+	reason: string;
+}
+
+/**
+ * The conversational-mailbox enqueue gate. False (no enqueue) unless the backend is
+ * self-fetch AND the receiver is active. A direct-inject backend (pi) is refused
+ * outright — it has no mailbox drain, so an enqueue would be a silent false success.
+ */
+export function mailboxConversationalDeliverable(facts: MailboxDeliverabilityFacts): MailboxDeliverabilityResult {
+	if (facts.wakeMode !== "self-fetch") {
+		return {
+			deliverable: false,
+			reason: `backend wake mode ${facts.wakeMode ?? "(unset)"} is not self-fetch — a mailbox enqueue would never be drained`,
+		};
+	}
+	const recv = computeMetaReceiverActive(facts);
+	return {
+		deliverable: recv.active,
+		reason: recv.active
+			? `self-fetch receiver active (${recv.reason})`
+			: `self-fetch receiver inactive — ${recv.reason}`,
+	};
+}

package/pi-extensions/lib/entwurf-fact-provider.ts

@@ -0,0 +1,158 @@
+/**
+ * entwurf-fact-provider — the fact-provider's ASSEMBLY layer (0.11 Stage 0 step
+ * 4, slice 4b). Composes the two axes into the listing the MCP `entwurf_peers`
+ * surface (slice 4c) renders. Lives in its own module so nothing imports it back
+ * (one-way: provider → facts / socket-discovery / meta-session) — no import cycle
+ * with `entwurf-facts.ts` (which owns `SocketProbe`/`resolveFactList`).
+ *
+ *   listAllMetaIdentities → pi gid 추출 → scanSocketProbes(piGids)
+ *     → pre-quarantine non-pi/socket conflicts → resolveFactList(clean)
+ *     → { facts, diagnostics }
+ *
+ * Two throw-vs-diagnostics policies, kept distinct (GPT힣 C-원칙):
+ *   - EXPECTED data corruption → diagnostics, listing survives. A meta-record
+ *     parse failure (from listAllMetaIdentities) and a gardenId↔socket address
+ *     collision are external-state problems; one must not blind `entwurf_peers`.
+ *   - IMPOSSIBLE wiring invariant → throw, NOT swallowed. resolveFactList's
+ *     duplicate-identity / unprobed-in-domain throws are assembly BUGS; catching
+ *     them here would hide a code defect. We feed resolveFactList only CLEAN
+ *     inputs (conflicts pre-removed), so its throw stays the last line of defense
+ *     — that is not a re-implementation of the collision rule, it is input
+ *     sanitation that leaves the pure-core invariant intact.
+ *
+ * The non-pi+socket collision quarantines BOTH sides (the PeerFact AND the
+ * socket): gardenId is the universal address and a send path reads the socket
+ * first, so surfacing the record alone (as a clean `unsupported` PeerFact) while
+ * a same-gid socket exists would be half a lie. Both leave the normal output;
+ * one diagnostic carries the fact. (pi + same-gid socket = the normal merge.)
+ */
+
+import { type FactList, isNonPiGardenIdSocketConflict, resolveFactList } from "./entwurf-facts.ts";
+import { isLivenessSupported } from "./entwurf-v2-contract.ts";
+import { listAllMetaIdentities, type MetaBackendV2 } from "./meta-session.ts";
+import { type SocketScanDeps, scanSocketProbes } from "./socket-discovery.ts";
+
+/** A listing-surface problem, surfaced explicitly rather than hidden or thrown.
+ * Kind-tagged so the render layer shows provenance; each carries only verbatim
+ * facts (never a half-parsed identity). The last three are socket-axis hazards
+ * folded from `scanSocketProbes` (slice 4c, Fable 검수): a symlinked socket is a
+ * correlation-authority forgery attempt (P1), a malformed `*.sock` name a visible
+ * drop (P3), a non-ENOENT dir-read failure asymmetric loss of the socket axis
+ * (P2e②). */
+export type EntwurfDiagnostic =
+	| { kind: "meta-record-read-error"; filename: string; message: string }
+	| { kind: "garden-id-socket-conflict"; gardenId: string; backend: MetaBackendV2; message: string }
+	| { kind: "socket-symlink-rejected"; gardenId: string; message: string }
+	| { kind: "malformed-socket-name"; name: string; message: string }
+	| { kind: "socket-dir-read-error"; message: string };
+
+export interface EntwurfFactsResult {
+	facts: FactList;
+	diagnostics: EntwurfDiagnostic[];
+}
+
+export interface EntwurfFactsDeps {
+	/** Meta-store axis: the `.meta.json` entry names + a record reader. */
+	metaEntries: readonly string[];
+	readRecord: (filename: string) => string;
+	/** Socket axis: injected into scanSocketProbes (controlDir/readdir/probe). */
+	socket?: Partial<SocketScanDeps>;
+}
+
+function diagnosticSortKey(d: EntwurfDiagnostic): string {
+	switch (d.kind) {
+		case "meta-record-read-error":
+			return `0:${d.filename}`;
+		case "garden-id-socket-conflict":
+			return `1:${d.gardenId}`;
+		case "socket-symlink-rejected":
+			return `2:${d.gardenId}`;
+		case "malformed-socket-name":
+			return `3:${d.name}`;
+		case "socket-dir-read-error":
+			return "4:";
+	}
+}
+
+/**
+ * Assemble the facts-only listing. Pure over its injected deps (no direct IO) so
+ * the gate drives it without a filesystem; slice 4c supplies the real readdir /
+ * readFile / probe. Live socket probes may carry get_info runtime enrich
+ * (cwd/model/idle); null remains honest and renders as "not enriched".
+ */
+export async function listEntwurfFacts(deps: EntwurfFactsDeps): Promise<EntwurfFactsResult> {
+	const diagnostics: EntwurfDiagnostic[] = [];
+
+	// 1. meta-store axis — expected corruption becomes diagnostics, not a throw.
+	const { identities, errors } = listAllMetaIdentities(deps.metaEntries, deps.readRecord);
+	for (const e of errors) {
+		diagnostics.push({ kind: "meta-record-read-error", filename: e.filename, message: e.message });
+	}
+
+	// 2. socket axis — probe (dir sockets) ∪ (in-domain citizen canonical paths).
+	//    Its three hazards (symlink forgery / malformed name / dir-read error) are
+	//    folded into diagnostics here so the listing survives but never lies.
+	const piGids = identities.filter((i) => isLivenessSupported(i.backend)).map((i) => i.gardenId);
+	const scan = await scanSocketProbes(piGids, deps.socket ?? {});
+	const probes = scan.probes;
+	const socketGids = new Set(probes.map((p) => p.gardenId));
+	const symlinkedGids = new Set(scan.symlinkedGardenIds);
+	for (const gardenId of scan.symlinkedGardenIds) {
+		diagnostics.push({
+			kind: "socket-symlink-rejected",
+			gardenId,
+			message:
+				"control socket is a symlink — never probed (it could redirect to another session's listener and forge " +
+				"an alive liveness for this gardenId); a citizen owning it is treated as dead (dormant), a record-less one dropped.",
+		});
+	}
+	for (const name of scan.malformedNames) {
+		diagnostics.push({
+			kind: "malformed-socket-name",
+			name,
+			message: "control-socket filename is not a garden id — no citizen to correlate to; dropped from the listing.",
+		});
+	}
+	if (scan.dirError !== null) {
+		diagnostics.push({
+			kind: "socket-dir-read-error",
+			message: `control-socket directory unreadable (socket axis incomplete; meta-record citizens still listed): ${scan.dirError}`,
+		});
+	}
+
+	// 3. pre-quarantine non-pi citizens that collide with a control socket. The
+	//    predicate is SHARED with the v2 decider (isNonPiGardenIdSocketConflict) so
+	//    listing and dispatch cannot drift, and it unions socketGids with the
+	//    symlinkedGids: a symlinked socket is never probed (absent from socketGids),
+	//    so the old socketGids-only check let a non-pi citizen with a forged
+	//    (symlinked) socket survive as a clean PeerFact while the legacy send path
+	//    still followed the symlink — the gap this closes.
+	const conflictGids = new Set<string>();
+	for (const id of identities) {
+		if (isNonPiGardenIdSocketConflict(id.backend, id.gardenId, socketGids, symlinkedGids)) {
+			conflictGids.add(id.gardenId);
+			diagnostics.push({
+				kind: "garden-id-socket-conflict",
+				gardenId: id.gardenId,
+				backend: id.backend,
+				message:
+					`non-pi citizen (${id.backend}) shares its gardenId with a control socket (real or symlinked) — address ` +
+					"ambiguity; both the citizen and the socket are quarantined from the listing.",
+			});
+		}
+	}
+
+	// 4. resolveFactList over CLEAN inputs only. Its throws (duplicate identity /
+	//    unprobed in-domain citizen) are impossible wiring invariants — left to
+	//    fire as the last line of defense, never caught here.
+	const cleanIdentities = identities.filter((i) => !conflictGids.has(i.gardenId));
+	const cleanProbes = probes.filter((p) => !conflictGids.has(p.gardenId));
+	const facts: FactList = resolveFactList(cleanIdentities, cleanProbes);
+
+	diagnostics.sort((a, b) => {
+		const ka = diagnosticSortKey(a);
+		const kb = diagnosticSortKey(b);
+		return ka < kb ? -1 : ka > kb ? 1 : 0;
+	});
+	return { facts, diagnostics };
+}

package/pi-extensions/lib/entwurf-facts.ts

@@ -0,0 +1,251 @@
+/**
+ * entwurf-facts — the TS fact-provider's PURE core (0.11 Stage 0 step 4).
+ *
+ * The "brain" reads disk SSOT (meta-record) + a socket probe and emits FACTS,
+ * never verbs. This module holds the single pure composition step:
+ *
+ *     (MetaIdentity, SocketLiveness | null)  →  PeerFact
+ *
+ * What it deliberately does NOT do (동결결정 10 / bucket B boundary):
+ *   - NO verb-routing. A `PeerFact` carries no `resumable`/`sendable`/`transport`
+ *     /`dispatch` field. Whether a target is resumed or sent-to is computed at
+ *     call time by the entwurf_v2 dispatch table from `liveness` — baking that
+ *     decision into the fact layer is exactly what makes `entwurf_peers` lie
+ *     (the reason 동결결정 10 orders contract-lock before this provider).
+ *   - NO IO. readdir of the meta-store and the live socket probe are slice-2
+ *     wiring; this slice locks the fact SHAPE and the R1/R3b liveness invariant
+ *     in code first (gate-first discipline), with both inputs injected.
+ *   - NO transcriptPath. The transcript path is a private on-disk location, not
+ *     a peer-facing fact; `entwurf_peers` exposes identity + cwd-history, not
+ *     filesystem internals. (who-can / dispatch read it via the meta-record
+ *     directly when they genuinely need it — it does not belong in the listing.)
+ *
+ * The 4-value liveness (`alive|dead|indeterminate|unsupported`, R3b) and the
+ * out-of-domain → `unsupported` rule (R1: never coerce an unprobed backend to
+ * `dead`/`indeterminate`) come from entwurf-v2-contract's `factLivenessOf` — the
+ * frozen contract is the single source for that mapping; this module only shapes
+ * the surrounding identity facts around it.
+ */
+
+import { type FactLiveness, factLivenessOf, isLivenessSupported } from "./entwurf-v2-contract.ts";
+import type { MetaBackendV2, MetaIdentity } from "./meta-session.ts";
+import type { SocketLiveness } from "./socket-probe.ts";
+
+/**
+ * Facts-only view of one garden citizen for `entwurf_peers`. Every field except
+ * `liveness` is verbatim identity / cwd-history from the meta-record; `liveness`
+ * is the one COMPUTED fact (4-value, R1/R3b). No verb-routing, no transcript.
+ */
+export interface PeerFact {
+	// — identity + cwd-history facts (verbatim from the meta-record) —
+	gardenId: string;
+	backend: MetaBackendV2;
+	nativeSessionId: string;
+	cwd: string;
+	model: string | null;
+	parentGardenId: string | null;
+	isEntwurf: boolean;
+	createdAt: string;
+	recordUpdatedAt: string;
+	// — the single computed fact: 4-value liveness (R1/R3b). NOT a verb. —
+	liveness: FactLiveness;
+}
+
+/**
+ * Compose a `PeerFact` from a citizen's identity and an optional socket probe.
+ *
+ * `socket` is the 3-value control-socket result for an IN-DOMAIN backend (pi),
+ * or `null` when no probe was taken (out-of-domain backend, or in-domain with no
+ * socket found). `factLivenessOf` resolves the 4-value fact:
+ *   - out-of-domain backend       → `unsupported`   (R1, regardless of `socket`)
+ *   - in-domain, socket present    → that socket value
+ *   - in-domain, socket null        → `indeterminate` (no proof, never `dead`)
+ *
+ * Pure: same inputs → same output, no IO.
+ */
+export function resolvePeerFact(identity: MetaIdentity, socket: SocketLiveness | null): PeerFact {
+	return {
+		gardenId: identity.gardenId,
+		backend: identity.backend,
+		nativeSessionId: identity.nativeSessionId,
+		cwd: identity.cwd,
+		model: identity.model,
+		parentGardenId: identity.parentGardenId,
+		isEntwurf: identity.isEntwurf,
+		createdAt: identity.createdAt,
+		recordUpdatedAt: identity.recordUpdatedAt,
+		liveness: factLivenessOf(identity.backend, socket),
+	};
+}
+
+/**
+ * A non-pi RECORD whose gardenId collides with a control socket — a real (probed)
+ * one OR a symlinked/forged one. The gardenId is the universal address (동결결정3),
+ * so a non-pi citizen sharing it with a socket means a send-path that reaches the
+ * socket first hits a DIFFERENT receiver than the record names — an address split.
+ * Both the citizen and the socket are quarantined from the facts listing.
+ *
+ * The union `socketGids ∪ symlinkedGardenIds` is load-bearing: `socketGids` are
+ * gids with a real probed `*.sock`, but `symlinkedGardenIds` are NEVER probed (P1)
+ * and so are absent from `socketGids`. Looking at `socketGids` alone (the
+ * fact-provider:125 gap this closes) let a non-pi citizen with a *symlinked* socket
+ * survive as a clean PeerFact while the legacy send path still followed the symlink
+ * to a forged receiver. Both axes claim the gid → both must quarantine it.
+ *
+ * SCOPE: this is the RECORD-side, non-pi conflict only — shared by the fact-provider
+ * (listing) and the v2 decider (dispatch) so the two cannot drift (4c "재유도 금지"
+ * 동형; only the observation-bit source is parameterized). A pi citizen whose own
+ * canonical socket is a symlink is NOT this predicate's concern — that is a
+ * target-specific lstat conflict the decider's `inspectTargetControlSocket` raises
+ * as `address-conflict`, kept deliberately separate (GPT 1차 검수 C).
+ */
+export function isNonPiGardenIdSocketConflict(
+	backend: string,
+	gardenId: string,
+	socketGids: ReadonlySet<string>,
+	symlinkedGardenIds: ReadonlySet<string>,
+): boolean {
+	return !isLivenessSupported(backend) && (socketGids.has(gardenId) || symlinkedGardenIds.has(gardenId));
+}
+
+// ── slice 2: meta-store axis ⨯ socket axis → facts-only listing ─────────────
+// (설계 동결 2026-06-11, GPT힣 + Fable 수렴 — NEXT.md "step 4 slice 2 설계 동결")
+
+/**
+ * The SOCKET-axis input to the union: one 3-value probe of a control socket plus
+ * its get_info-derived runtime enrich. Slice-3 wiring fills this by probing the
+ * control-socket dir AND every in-domain citizen's canonical socket path with
+ * `probeSocketLiveness` (3-value, indeterminate preserved). `liveness` is the
+ * 3-value `SocketLiveness` — never `unsupported`, because a probe genuinely ran.
+ * The enrich fields are probe-derived RUNTIME facts (the get_info RPC), labelled
+ * as such — they are NOT meta-record identity and NOT synthetic; a `null` means
+ * the RPC did not surface that field (see `infoError`).
+ */
+export interface SocketProbe {
+	gardenId: string;
+	liveness: SocketLiveness;
+	cwd: string | null;
+	model: string | null;
+	idle: boolean | null;
+	infoError: string | null;
+}
+
+/**
+ * A record-less control-socket probe — a socket path that no meta-record citizen
+ * claims. The canonical case is "socket-only pi": a live pi session that predates
+ * the pi meta-record writer, or one caught in a deploy-lag / crash window. But
+ * `liveness` is the full 3-value `SocketLiveness`, NOT only `alive` — a
+ * dir-present stale socket arrives as `dead` and a load-stalled one as
+ * `indeterminate`; both stay in the listing (hiding a dead socket is GC's job,
+ * not the listing's, and an indeterminate socket-only — "not unlinked, not live"
+ * — is the most worth surfacing). Kept as a DISTINCT fact kind, never folded into
+ * `PeerFact` and never given a 5th liveness value: "this socket has no citizen"
+ * is a statement whose SUBJECT is the socket, not a citizen, so it must not
+ * borrow the citizen-keyed 4-value liveness enum (the sibling of R1 — do not
+ * collapse a different subject). All fields are the socket filename (gardenId =
+ * 동결결정3 correlation authority) + probe-derived runtime facts.
+ */
+export interface SocketOnlyFact {
+	kind: "socket-only";
+	gardenId: string;
+	liveness: SocketLiveness;
+	cwd: string | null;
+	model: string | null;
+	idle: boolean | null;
+	infoError: string | null;
+}
+
+/**
+ * The union output. Two arrays, NOT one discriminated array: the surface layer
+ * (slice 4) may tag a `PeerFact` with `kind:"peer"` when it merges the sections,
+ * but the pure core keeps `PeerFact`'s slice-1 keyset untouched (no `kind` field
+ * baked onto it). `entwurf_peers` reports both sections so the new listing fully
+ * replaces the old live-pi discovery.
+ */
+export interface FactList {
+	peers: PeerFact[];
+	socketOnly: SocketOnlyFact[];
+}
+
+/**
+ * Pure union of the meta-store axis (citizens) and the socket axis (probes) into
+ * a facts-only listing. No IO — slice-3 wiring reads the meta-store and probes
+ * the sockets, then injects both lists.
+ *
+ * Correlation key = `gardenId` (동결결정3; `nativeSessionId` is backend-local, not
+ * a global key). Rules frozen 2026-06-11 (GPT힣 + Fable):
+ *   - in-domain (pi) citizen: liveness = its socket probe (3-value preserved).
+ *     The wiring MUST probe every in-domain citizen's canonical socket path, so a
+ *     citizen ABSENT from `socketProbes` is a wiring-invariant violation → throw.
+ *     We never pass `null` for a pi citizen (resolvePeerFact would map it to
+ *     `indeterminate` and strand a dormant citizen as un-resumable); a dormant
+ *     citizen's absent socket file is probed to `dead` (ENOENT) by the wiring and
+ *     arrives here AS `dead` → dormant → resumable.
+ *   - out-of-domain citizen WITH a control socket at its gardenId → fail-loud
+ *     (address ambiguity; a non-pi citizen must not own a pi control socket).
+ *   - out-of-domain citizen without a socket → `unsupported` (via resolvePeerFact).
+ *   - a probed gardenId with NO citizen → `SocketOnlyFact` (socket-only pi).
+ * A gardenId is never emitted as both a `PeerFact` and a `SocketOnlyFact`; once a
+ * pi meta-record writer ships, a socket-only entry is promoted to a `PeerFact`.
+ */
+export function resolveFactList(identities: MetaIdentity[], socketProbes: SocketProbe[]): FactList {
+	const probeMap = new Map<string, SocketProbe>();
+	for (const probe of socketProbes) {
+		if (probeMap.has(probe.gardenId)) {
+			throw new Error(`resolveFactList: duplicate socket probe for gardenId ${probe.gardenId}`);
+		}
+		probeMap.set(probe.gardenId, probe);
+	}
+
+	const peers: PeerFact[] = [];
+	const consumed = new Set<string>();
+	for (const identity of identities) {
+		const gid = identity.gardenId;
+		if (consumed.has(gid)) {
+			throw new Error(`resolveFactList: duplicate meta-record for gardenId ${gid}`);
+		}
+		let socket: SocketLiveness | null;
+		if (isLivenessSupported(identity.backend)) {
+			const probe = probeMap.get(gid);
+			if (!probe) {
+				throw new Error(
+					`resolveFactList: in-domain citizen ${gid} (${identity.backend}) was not probed — ` +
+						"wiring must probe every in-domain citizen's canonical socket path (absent file → dead, never unprobed)",
+				);
+			}
+			socket = probe.liveness;
+		} else {
+			if (probeMap.has(gid)) {
+				throw new Error(
+					`resolveFactList: out-of-domain citizen ${gid} (${identity.backend}) has a control socket — ` +
+						"address ambiguity (a non-pi citizen must not own a pi control socket)",
+				);
+			}
+			socket = null;
+		}
+		peers.push(resolvePeerFact(identity, socket));
+		consumed.add(gid);
+	}
+
+	const socketOnly: SocketOnlyFact[] = [];
+	for (const probe of socketProbes) {
+		if (consumed.has(probe.gardenId)) continue;
+		socketOnly.push({
+			kind: "socket-only",
+			gardenId: probe.gardenId,
+			liveness: probe.liveness,
+			cwd: probe.cwd,
+			model: probe.model,
+			idle: probe.idle,
+			infoError: probe.infoError,
+		});
+	}
+
+	// Sort by gardenId with a plain `<` compare (not localeCompare) so both fact
+	// surfaces and the socket scan share one locale-independent ordering.
+	const byGardenId = (a: { gardenId: string }, b: { gardenId: string }): number =>
+		a.gardenId < b.gardenId ? -1 : a.gardenId > b.gardenId ? 1 : 0;
+	peers.sort(byGardenId);
+	socketOnly.sort(byGardenId);
+	return { peers, socketOnly };
+}

package/pi-extensions/lib/entwurf-mailbox-guard.ts

@@ -0,0 +1,100 @@
+/**
+ * entwurf-mailbox-guard — the IO orchestration that gates a conversational mailbox
+ * enqueue on the (pure) deliverability predicate (SE-1/SE-2 slice 2d). Kept SEPARATE
+ * from entwurf-deliverability.ts so the predicate stays pure (gate-pinnable) and only
+ * this thin wrapper touches the record store / capability registry / presence marker.
+ *
+ * The contract every conversational-reply enqueue site (MCP entwurf_v2 fallback,
+ * pi-native entwurf_v2 fallback) must use INSTEAD of calling enqueueMetaMessage
+ * directly:
+ *   1. gather facts for the target garden id (record? wakeMode? receiver active?),
+ *   2. ask mailboxConversationalDeliverable,
+ *   3. enqueue ONLY when deliverable; otherwise return a typed non-delivery with a
+ *      reason — no .msg written, no doorbell poked.
+ *
+ * This is the SE-2 "no garbage in a dead/absent receiver's mailbox" guard and the
+ * SE-1 "never enqueue for a backend with no mailbox drain (pi)" guard, in one place.
+ * The low-level enqueueMetaMessage stays a raw primitive — it has no in-band reject;
+ * the refusal happens HERE, before transport, not inside it.
+ */
+
+import {
+	type MailboxDeliverabilityFacts,
+	mailboxConversationalDeliverable,
+	receiverMarkerMatchesIdentity,
+} from "./entwurf-deliverability.ts";
+import {
+	type MetaBackendV2,
+	type MetaCapability,
+	type MetaIdentity,
+	type MetaReceiverMarker,
+	metaCapabilityFor,
+	readMetaIdentityByGardenId,
+	readMetaReceiverMarker,
+} from "./meta-session.ts";
+
+export interface MailboxGuardDeps {
+	/** Read the target's identity (throws when there is no backing record). */
+	readIdentity?: (gardenId: string) => MetaIdentity;
+	/** Read the target's receiver presence marker (null = no live, armed receiver). */
+	readReceiverMarker?: (gardenId: string) => MetaReceiverMarker | null;
+	/** Resolve a backend's capability (wake mode). */
+	capabilityFor?: (backend: MetaBackendV2) => MetaCapability;
+}
+
+/**
+ * Gather the deliverability facts for a target garden id, all via injected (or
+ * production-default) readers. recordBacked/wakeMode come from the record + capability
+ * registry; ownerAlive and watchArmed both derive from the receiver presence marker —
+ * at runtime they move together (a verified marker means a live owner that reached the
+ * watch-arm path; its absence/dead-owner means neither), but the pure predicate keeps
+ * the axes separate so each cause stays nameable. A present marker only counts when it
+ * actually belongs to THIS identity (garden/backend/native id match via the shared
+ * receiverMarkerMatchesIdentity helper) — a drifted/foreign marker is fail-closed to
+ * inactive, the same SSOT the v2 production mailboxDeliverabilityFor seam uses.
+ */
+export function gatherMailboxDeliverabilityFacts(
+	gardenId: string,
+	deps: MailboxGuardDeps = {},
+): MailboxDeliverabilityFacts {
+	const readIdentity = deps.readIdentity ?? ((g: string) => readMetaIdentityByGardenId(g));
+	const readReceiverMarker = deps.readReceiverMarker ?? ((g: string) => readMetaReceiverMarker({ gardenId: g }));
+	const capabilityFor = deps.capabilityFor ?? metaCapabilityFor;
+
+	let recordBacked = false;
+	let wakeMode: string | undefined;
+	let identity: MetaIdentity | null = null;
+	try {
+		identity = readIdentity(gardenId);
+		recordBacked = true;
+		wakeMode = capabilityFor(identity.backend).wakeMode;
+	} catch {
+		recordBacked = false;
+		identity = null;
+	}
+
+	// No record → no identity → never matched (a marker without a record cannot be
+	// verified against one). With a record, the marker must agree on garden/backend/
+	// native id; otherwise it is a stale or foreign marker and the receiver is inactive.
+	const marker = readReceiverMarker(gardenId);
+	const matched = identity !== null && receiverMarkerMatchesIdentity(marker, identity);
+	return { wakeMode, recordBacked, ownerAlive: matched, watchArmed: matched };
+}
+
+export type GuardedMailboxOutcome<T> = { delivered: true; result: T } | { delivered: false; reason: string };
+
+/**
+ * Enqueue a conversational reply to the target's mailbox ONLY when it is deliverable.
+ * When not, returns `{ delivered: false, reason }` and the injected `enqueue` is never
+ * called — the SE-2 guarantee that a refused send mutates nothing.
+ */
+export function guardedMailboxEnqueue<T>(
+	gardenId: string,
+	deps: MailboxGuardDeps,
+	enqueue: () => T,
+): GuardedMailboxOutcome<T> {
+	const facts = gatherMailboxDeliverabilityFacts(gardenId, deps);
+	const verdict = mailboxConversationalDeliverable(facts);
+	if (!verdict.deliverable) return { delivered: false, reason: verdict.reason };
+	return { delivered: true, result: enqueue() };
+}