@junghanacs/entwurf 0.12.8 → 0.12.10

package/scripts/check-agy-sender-identity.ts

@@ -48,6 +48,9 @@ import {
 import {
 	FRESH_CUT_COMMAND,
 	type MetaIdentity,
+	metaRecordExistsByGardenId,
+	processStartKey,
+	readMetaSenderMarker,
 	upsertMetaSession,
 	writeMetaSenderMarker,
 } from "../pi-extensions/lib/meta-session.ts";
@@ -358,6 +361,86 @@ try {
 			trusted?.identity.gardenId === record.record.gardenId,
 		);
 	}
+	// ── #53 A: an init-owned marker names NOBODY, however live init is ─────────
+	// The shape measured on a second Linux host: `meta-senders/claude-code/1.json`,
+	// pid 1, and the REAL start-key for init — so the pid-reuse guard PASSES and
+	// classifyMarkerOwner answers `live` for as long as the host is up. The defect is
+	// one layer up: init owns no Claude session. THIS gate's own writer is one of the
+	// two that could produce the shape before #53 A — the agy imprint asked `> 0`
+	// while the Claude hook already refused `<= 1` — so "only the shell-form hook
+	// could have written it" was never true. After this cut no writer in the tree can.
+	{
+		clearMarkers();
+		const record = upsertMetaSession({
+			input: { backend: "claude-code", nativeSessionId: "sess-init", cwd: REPO_DIR },
+		});
+		const initKey = processStartKey(1);
+		ok("this host CAN read a start key for pid 1 (the residue cells are not vacuous)", initKey !== "");
+		const initDir = path.join(SENDERS_DIR, "claude-code");
+		fs.mkdirSync(initDir, { recursive: true });
+		fs.writeFileSync(
+			path.join(initDir, "1.json"),
+			`${JSON.stringify({
+				backend: "claude-code",
+				gardenId: record.record.gardenId,
+				nativeSessionId: "sess-init",
+				cwd: REPO_DIR,
+				ownerPid: 1,
+				ownerStartKey: initKey,
+				updatedAt: "2026-06-10T16:03:10.000Z",
+			})}\n`,
+		);
+		ok(
+			"an init-owned sender marker reads as null — it grants no identity",
+			readMetaSenderMarker({ backend: "claude-code", ownerPid: 1, sendersDir: SENDERS_DIR }) === null,
+		);
+		ok(
+			"...while its record is present and readable, so the refusal is about the marker's CLAIM",
+			metaRecordExistsByGardenId(record.record.gardenId),
+		);
+		// End to end, with pid 1 supplied as an explicit candidate: the answer is
+		// "nobody" — not an identity, and not a throw either. Stated at the size of the
+		// evidence: the DEFAULT candidate set is only the bridge's parent and grandparent,
+		// so pid 1 enters it just when the native host itself was reparented (a detached
+		// Claude). Reachable, not observed — the affected host's own launch shape
+		// (bridge → claude → bash → wrapper) never had 1 among its candidates, and no
+		// wrong-identity read was measured there. The cut's deadlock is the proven half;
+		// this is the code-path half.
+		let identityThrew: unknown = null;
+		let identityAnswer: unknown = "unset";
+		try {
+			identityAnswer = resolveTrustedMetaSenderIdentity({ ownerPids: [1], sendersDir: SENDERS_DIR });
+		} catch (err) {
+			identityThrew = err;
+		}
+		ok(
+			"resolving with pid 1 as a candidate yields NO identity (and no throw)",
+			identityAnswer === null && identityThrew === null,
+		);
+		let initWriteRejected = false;
+		try {
+			writeMetaSenderMarker({
+				backend: "claude-code",
+				gardenId: record.record.gardenId,
+				nativeSessionId: "sess-init",
+				cwd: REPO_DIR,
+				ownerPid: 1,
+				sendersDir: SENDERS_DIR,
+			});
+		} catch {
+			initWriteRejected = true;
+		}
+		ok("minting an init-owned sender marker THROWS at the write boundary", initWriteRejected);
+		// WIRING: the agy imprint is the SECOND writer, and the one that still asked
+		// `> 0` on its own while the Claude hook already refused `<= 1`. A predicate only
+		// one writer knows is how #53 A drifted in; both must reach the shared one.
+		ok(
+			"the agy imprint routes its owner pid through the shared predicate",
+			/isPlausibleOwnerPid\(ownerPid\)/.test(fs.readFileSync(HOOK, "utf8")),
+		);
+		clearMarkers();
+	}
+
 	ok(
 		"antigravity is a native-push backend → its replyable comes from the adapter probe",
 		nativePushSupported("antigravity"),

package/scripts/check-entwurf-control-rpc.ts

@@ -196,14 +196,14 @@ async function main(): Promise<void> {
 	{
 		const base = {
 			sessionId: "20260613T091000-98363c",
-			agentId: "pi/claude-opus-4-8",
+			agentId: "pi/claude-opus-5",
 			cwd: "/w",
 			timestamp: "2026-06-13T09:10:00.000Z",
 		};
 		ok(
 			"6: minimal envelope → exact block (leading blank line, required fields only)",
 			formatSenderInfoBlock(base) ===
-				`\n\n<sender_info>{"sessionId":"20260613T091000-98363c","agentId":"pi/claude-opus-4-8","cwd":"/w","timestamp":"2026-06-13T09:10:00.000Z"}</sender_info>`,
+				`\n\n<sender_info>{"sessionId":"20260613T091000-98363c","agentId":"pi/claude-opus-5","cwd":"/w","timestamp":"2026-06-13T09:10:00.000Z"}</sender_info>`,
 		);
 		const full = formatSenderInfoBlock({ ...base, origin: "pi-session", replyable: false }, true);
 		ok(

package/scripts/check-entwurf-deliverability.ts

@@ -1,9 +1,10 @@
 /**
  * check-entwurf-deliverability — deterministic gate for the conversational-mailbox
- * deliverability predicate (SE-1/SE-2 slice 2c). This is the predicate the enqueue
- * sites (v1 fallback, MCP v1, pi-native v1, v2 decider/send-fallback) must consult in
- * slice 2d before writing a .msg, so a reply never rots in a dead session's mailbox
- * (SE-2) and is never enqueued for a backend that has no mailbox drain (SE-1, pi).
+ * deliverability predicate (SE-1/SE-2 slice 2c). This is the predicate an enqueue site
+ * must consult in slice 2d before writing a .msg, so a reply never rots in a dead
+ * session's mailbox (SE-2) and is never enqueued for a backend that has no mailbox drain
+ * (SE-1, pi). The SHIPPED sites are the v2 decider and its send-fallback re-resolve; the
+ * v1 fallback / MCP v1 / pi-native v1 sites were removed in the 0.12 cutover.
  *
  * Proves:
  *   - computeMetaReceiverActive: the shared atom — active ⟺ recordBacked ∧ ownerAlive ∧
@@ -124,8 +125,10 @@ ok(
 
 // ── receiverMarkerMatchesIdentity: the marker ↔ identity SSOT (SE-2 2d-3) ───
 // A present marker only raises a receiver to active when it agrees with the record on
-// garden/backend/native id. The v1 mailbox guard AND the v2 production deliverability seam
-// both route through this one helper, so presence-only false-positives are closed in both.
+// garden/backend/native id. The v2 production deliverability seam and the MCP bridge's
+// entwurf_self both route through this one helper, so presence-only false-positives are
+// closed on every shipped path — and there is no second implementation to drift from since
+// entwurf-mailbox-guard.ts (production importers: 0) was deleted 2026-07-27.
 const ID = { gardenId: "20260612T100000-aaaaaa", backend: "claude-code", nativeSessionId: "n-1" };
 ok(
 	"marker matches identity on all three axes → true",

package/scripts/check-entwurf-fact-provider.ts

@@ -8,7 +8,7 @@
  *     into ONE `record-less-socket` diagnostic (#50 C4: a diagnostic subject,
  *     never a listing section) whose message names the cause + fix (fresh-cut),
  *   - corrupt record → meta-record-read-error diagnostic, listing NOT blinded,
- *   - gardenId↔socket collision (non-pi citizen + same-gid socket) → BOTH sides
+ *   - gardenId↔socket collision (out-of-socket-domain citizen + same-gid socket) → BOTH sides
  *     quarantined (gid in neither peers nor socketOnly) + one
  *     garden-id-socket-conflict diagnostic, and listEntwurfFacts does NOT throw
  *     (expected external-state corruption → diagnostics, not a crash),
@@ -63,6 +63,8 @@ interface SocketOpts {
 	extraNames?: string[];
 	/** readdir throws with this code (e.g. "EACCES" / "ENOENT") (P2e②). */
 	readdirErrorCode?: string;
+	/** `.meta.json` entries that are NOT regular files (symlink/dir/special). */
+	irregularMeta?: string[];
 }
 
 function deps(
@@ -72,7 +74,13 @@ function deps(
 ): EntwurfFactsDeps {
 	const symlinkSet = new Set(opts.symlinks ?? []);
 	return {
-		metaEntries: Object.keys(meta),
+		// Kind-carrying entries, like the real bindings: the listing must be able to refuse a
+		// symlinked record without following it. `irregularMeta` names the ones that are not
+		// regular files.
+		metaEntries: Object.keys(meta).map((filename) => ({
+			filename,
+			regularFile: !(opts.irregularMeta ?? []).includes(filename),
+		})),
 		readRecord: (f: string) => {
 			const v = meta[f];
 			if (v === undefined) throw new Error(`ENOENT: ${f}`);
@@ -206,16 +214,16 @@ async function main(): Promise<void> {
 		}
 	}
 
-	// ── non-pi citizen + SYMLINKED socket: the fact-provider:125 gap (closed) ───
-	// A non-pi record sharing its gid with a *symlinked* `*.sock`. The symlink is
+	// ── out-of-socket-domain citizen + symlinked socket (closed gap) ──────────
+	// Such a record shares its gid with a *symlinked* `*.sock`. The symlink is
 	// never probed, so its gid is absent from socketGids — the old socketGids-only
-	// check missed this and the non-pi citizen survived as a clean PeerFact while
+	// check missed this and the out-of-domain citizen survived as a clean PeerFact while
 	// the legacy send path still followed the symlink to a forged receiver. The
-	// shared isNonPiGardenIdSocketConflict predicate unions socketGids with the
+	// shared isOutOfSocketDomainGardenIdConflict predicate unions socketGids with the
 	// symlinked gids, so the citizen is now quarantined (gid in NEITHER peers nor
 	// socketOnly) and the conflict diagnostic is raised — alongside the existing
 	// socket-symlink-rejected one (both are honest: symlink-rejected = "not probed",
-	// conflict = "non-pi address split").
+	// conflict = "out-of-socket-domain address split").
 	{
 		const r = await listEntwurfFacts(
 			deps(
@@ -225,7 +233,7 @@ async function main(): Promise<void> {
 			),
 		);
 		ok(
-			"symlink-collision: non-pi citizen quarantined (NOT in peers)",
+			"symlink-collision: out-of-socket-domain citizen quarantined (NOT in peers)",
 			!r.facts.peers.some((p) => p.gardenId === GID_CONFLICT),
 		);
 		ok(

package/scripts/check-entwurf-facts.ts

@@ -23,7 +23,7 @@
 import assert from "node:assert/strict";
 import {
 	type FactList,
-	isNonPiGardenIdSocketConflict,
+	isOutOfSocketDomainGardenIdConflict,
 	type PeerFact,
 	type RecordLessSocketFact,
 	resolveFactList,
@@ -65,7 +65,7 @@ function identity(backend: MetaCitizenBackend, over: Partial<MetaIdentity> = {})
 		backend,
 		nativeSessionId: "native-abc",
 		cwd: "/home/junghan/repos/gh/entwurf",
-		model: "claude-opus-4-8",
+		model: "claude-opus-5",
 		transcriptPath: "/home/junghan/.claude/projects/x/native-abc.jsonl",
 		createdAt: "2026-06-11T00:38:58.000Z",
 		recordUpdatedAt: "2026-06-11T02:40:00.000Z",
@@ -247,7 +247,7 @@ const GID_SOCKET_ONLY = "20260611T135517-5f0d25";
 	} catch {
 		threw = true;
 	}
-	ok("dedup/authority: non-pi citizen + control socket at same gid → fail-loud", threw);
+	ok("dedup/authority: out-of-socket-domain citizen + same-gid socket → fail-loud", threw);
 }
 
 // ── dedup (동결3): pi citizen + its socket → PeerFact only, never both ────────
@@ -333,11 +333,11 @@ const GID_SOCKET_ONLY = "20260611T135517-5f0d25";
 	);
 }
 
-// ── isNonPiGardenIdSocketConflict: the SHARED record-side conflict predicate ──
+// ── isOutOfSocketDomainGardenIdConflict: shared record-side predicate ──────
 // (fact-provider listing + v2 decider dispatch consume this same fn — 4c 재유도
 // 금지 동형). The union over socketGids ∪ symlinkedGardenIds is the fact-provider:125
 // gap closure: a symlinked socket is never probed, so its gid is absent from
-// socketGids; the predicate must STILL flag a non-pi citizen owning it.
+// socketGids; the predicate must STILL flag an out-of-domain citizen owning it.
 {
 	const G = "20260611T444444-dddddd";
 	const realSockets = new Set([G]);
@@ -345,21 +345,21 @@ const GID_SOCKET_ONLY = "20260611T135517-5f0d25";
 	const empty = new Set<string>();
 	for (const piBackend of IN_DOMAIN) {
 		ok(
-			`conflict-predicate: in-domain (${piBackend}) is NEVER a non-pi conflict (even with a colliding socket)`,
-			!isNonPiGardenIdSocketConflict(piBackend, G, realSockets, symlinked),
+			`conflict-predicate: socket-domain (${piBackend}) is not a record-side conflict`,
+			!isOutOfSocketDomainGardenIdConflict(piBackend, G, realSockets, symlinked),
 		);
 	}
 	ok(
-		"conflict-predicate: non-pi + real socket → conflict",
-		isNonPiGardenIdSocketConflict("claude-code", G, realSockets, empty),
+		"conflict-predicate: out-of-socket-domain + real socket → conflict",
+		isOutOfSocketDomainGardenIdConflict("claude-code", G, realSockets, empty),
 	);
 	ok(
-		"conflict-predicate: non-pi + SYMLINKED socket only → conflict (the :125 gap)",
-		isNonPiGardenIdSocketConflict("claude-code", G, empty, symlinked),
+		"conflict-predicate: out-of-socket-domain + symlinked socket → conflict",
+		isOutOfSocketDomainGardenIdConflict("claude-code", G, empty, symlinked),
 	);
 	ok(
-		"conflict-predicate: non-pi + no socket of either kind → no conflict",
-		!isNonPiGardenIdSocketConflict("claude-code", G, empty, empty),
+		"conflict-predicate: out-of-socket-domain + no socket → no conflict",
+		!isOutOfSocketDomainGardenIdConflict("claude-code", G, empty, empty),
 	);
 }
 

package/scripts/check-entwurf-resume-args.ts

@@ -1,19 +1,20 @@
 /**
  * check-entwurf-resume-args — deterministic gate for the 5c-3b resume-argv SSOT
- * (`buildResumePiArgs`). It pins the load-bearing A1 difference between the legacy one-shot
- * worker and the v2 spawn-bg RESIDENT citizen so the two launch shapes can never drift:
+ * (`buildResumePiArgs`). It pins the RESIDENT citizen launch shape so it cannot drift.
+ * This gate once carried a second `legacy` one-shot variant as a contrast; that launcher
+ * and its enum member were removed 2026-07-27, and the half of A1 that still ships is
+ * asserted directly instead — a resumed citizen stands its control socket up and never
+ * emits the one-shot `--no-extensions`:
  *
- *   1. legacy carries `--no-extensions` and NO `--entwurf-control`.
  *   2. v2-control carries `--entwurf-control` and NO `--no-extensions`.
- *   3. BOTH keep the headless prefix `--mode json -p` and run the prompt as the final
- *      positional (the prompt-as-turn authority is unchanged in v2 — `-p` is NOT dropped).
- *   4. `explicitExtensionArgs` is preserved verbatim, exactly once, in BOTH variants
+ *   3. The headless prefix `--mode json -p` stays and the prompt is the final positional
+ *      (the prompt-as-turn authority is unchanged in v2 — `-p` is NOT dropped).
+ *   4. `explicitExtensionArgs` is preserved verbatim, exactly once
  *      (load-bearing for a recorded `provider=entwurf` resume; #29 footgun).
- *   5. v2-control includes `plan.launchArgs` (`--approve` / empty) as flags BEFORE the
- *      prompt; legacy ignores launchArgs entirely.
- *   6. provider/model identity is laid out identically in both; a null/undefined provider
- *      emits NO `--provider` flag; `--model <m>` and `<prompt>` are the last three tokens.
- *   7. no cross-contamination: the legacy-only and v2-only flags never leak into the other.
+ *   5. `plan.launchArgs` (`--approve` / empty) ride as flags BEFORE the prompt.
+ *   6. a null/undefined provider emits NO `--provider` flag; `--model <m>` and `<prompt>`
+ *      are the last three tokens.
+ *   7. the resident posture is exact: `--entwurf-control` present, `--no-extensions` never.
  *
  * Pure string assembly — no IO, no spawn.
  */
@@ -45,34 +46,6 @@ function valueAfter(args: readonly string[], flag: string): string | undefined {
 }
 
 function main(): void {
-	// ── legacy variant ──────────────────────────────────────────────────────────────
-	{
-		const args = buildResumePiArgs({
-			variant: "legacy",
-			sessionFile: SESSION_FILE,
-			explicitExtensionArgs: EXT,
-			provider: "entwurf",
-			model: "claude-opus-4-8",
-			prompt: "continue the task",
-		});
-		ok("1 legacy has --no-extensions", args.includes("--no-extensions"));
-		ok("1 legacy has NO --entwurf-control", !args.includes("--entwurf-control"));
-		ok("3 legacy headless prefix --mode json -p", args[0] === "--mode" && args[1] === "json" && args[2] === "-p");
-		ok("3 legacy prompt is the final positional", args[args.length - 1] === "continue the task");
-		ok("4 legacy keeps ext args exactly once", args.filter((a) => a === "-e").length === 1);
-		ok("6 legacy provider laid out", valueAfter(args, "--provider") === "entwurf");
-		ok("6 legacy model laid out", valueAfter(args, "--model") === "claude-opus-4-8");
-		ok("6 legacy resumes by exact FILE (--session <abs path>)", valueAfter(args, "--session") === SESSION_FILE);
-		ok("6 legacy carries NO --session-id (the id is pi's own now)", !args.includes("--session-id"));
-		// model + prompt are the last three tokens: --model <m> <prompt>
-		ok(
-			"6 legacy --model <m> <prompt> tail",
-			args[args.length - 3] === "--model" &&
-				args[args.length - 2] === "claude-opus-4-8" &&
-				args[args.length - 1] === "continue the task",
-		);
-	}
-
 	// ── v2-control variant ──────────────────────────────────────────────────────────
 	{
 		const args = buildResumePiArgs({
@@ -80,7 +53,7 @@ function main(): void {
 			sessionFile: SESSION_FILE,
 			explicitExtensionArgs: EXT,
 			provider: "entwurf",
-			model: "claude-opus-4-8",
+			model: "claude-opus-5",
 			prompt: "resume now",
 			launchArgs: ["--approve"],
 		});
@@ -93,7 +66,7 @@ function main(): void {
 		ok("5 v2 includes launchArgs --approve", args.includes("--approve"));
 		ok("5 v2 --approve is before the prompt", args.indexOf("--approve") < args.length - 1);
 		ok("6 v2 provider laid out", valueAfter(args, "--provider") === "entwurf");
-		ok("6 v2 model laid out", valueAfter(args, "--model") === "claude-opus-4-8");
+		ok("6 v2 model laid out", valueAfter(args, "--model") === "claude-opus-5");
 		ok("6 v2 resumes by exact FILE (--session <abs path>)", valueAfter(args, "--session") === SESSION_FILE);
 		ok(
 			"6 v2 carries NO --session-id (a garden id would MINT a session, not resume one)",
@@ -102,25 +75,11 @@ function main(): void {
 		ok(
 			"6 v2 --model <m> <prompt> tail",
 			args[args.length - 3] === "--model" &&
-				args[args.length - 2] === "claude-opus-4-8" &&
+				args[args.length - 2] === "claude-opus-5" &&
 				args[args.length - 1] === "resume now",
 		);
 	}
 
-	// ── 5. legacy IGNORES launchArgs (no --approve leaks in) ──────────────────────────
-	{
-		const args = buildResumePiArgs({
-			variant: "legacy",
-			sessionFile: SESSION_FILE,
-			explicitExtensionArgs: [],
-			provider: null,
-			model: "m",
-			prompt: "p",
-			launchArgs: ["--approve"], // present in input but legacy must ignore it
-		});
-		ok("5 legacy ignores launchArgs (no --approve)", !args.includes("--approve"));
-	}
-
 	// ── 6. null/undefined provider emits NO --provider flag ───────────────────────────
 	for (const provider of [null, undefined] as const) {
 		const args = buildResumePiArgs({
@@ -136,20 +95,23 @@ function main(): void {
 		ok(`6 provider=${provider}: --model <m> <prompt> still tail`, args.slice(-3).join(" ") === "--model m p");
 	}
 
-	// ── 7. no cross-contamination across variants over the same identity ──────────────
+	// ── 7. the resident posture is exact: the one-shot flag never reappears ───────────
+	// The `legacy` variant was removed 2026-07-27, so the old cross-contamination pair is
+	// gone. What must NOT rot is the A1 half that still ships: a resumed citizen stands its
+	// control socket up, which means `--no-extensions` (the one-shot flag that let `pi -p`
+	// exit) can never be emitted here again.
 	{
-		const base = {
+		const v2 = buildResumePiArgs({
 			sessionFile: SESSION_FILE,
 			explicitExtensionArgs: EXT,
 			provider: "entwurf",
 			model: "m",
 			prompt: "p",
 			launchArgs: ["--approve"],
-		} as const;
-		const legacy = buildResumePiArgs({ ...base, variant: "legacy" });
-		const v2 = buildResumePiArgs({ ...base, variant: "v2-control" });
-		ok("7 legacy-only flag absent from v2", !v2.includes("--no-extensions"));
-		ok("7 v2-only flag absent from legacy", !legacy.includes("--entwurf-control") && !legacy.includes("--approve"));
+			variant: "v2-control",
+		});
+		ok("7 resident posture never emits the one-shot --no-extensions", !v2.includes("--no-extensions"));
+		ok("7 resident posture stands the control socket up", v2.includes("--entwurf-control"));
 	}
 
 	console.log(`\ncheck-entwurf-resume-args: ${passed} checks passed`);

package/scripts/check-entwurf-self-address.ts

@@ -7,8 +7,11 @@
  *
  * Proves:
  *   - PURE truth table (computeSelfAddressability, facts injected): pi replyable ⟺
- *     socketAlive; meta replyable ⟺ recordBacked ∧ ownerAlive ∧ watchArmed; external
- *     never replyable. socketState alive/expected/none is its own assertable field.
+ *     socketAlive; external never replyable; and meta replyability splits by RAIL —
+ *     self-fetch ⟺ recordBacked ∧ ownerAlive ∧ watchArmed, native-push ⟺ recordBacked ∧
+ *     probeAlive (a separate axis: an agy citizen never arms a mailbox watch, so the
+ *     self-fetch atom would make it un-replyable forever), and an unsupplied rail is
+ *     fail-closed. socketState alive/expected/none is its own assertable field.
  *   - The two REGRESSION-PROOF rows the lock requires (record-present, not all-absent):
  *       (b) meta record present + owner-dead (start-key mismatch) → false
  *       (c) meta record present + watch-unarmed → false
@@ -147,7 +150,7 @@ function row(facts: SelfAddressabilityFacts): { replyable: boolean; socketState:
 
 	// A native-push citizen must NOT be able to buy replyability with mailbox facts.
 	ok(
-		"meta/native-push + owner-alive + watch-armed but probe-dead → NOT replyable (mailbox facts cannot rescue it)",
+		"meta/native-push + owner-alive + watch-armed but probe-dead → NOT replyable (mailbox facts cannot rescue it) [QK:SELFADDR-RAIL-FACT-LEAK]",
 		row(push({ recordBacked: true, ownerAlive: true, watchArmed: true, probeAlive: false })).replyable === false,
 	);
 }
@@ -223,7 +226,10 @@ const piBody = functionBody("buildStrictPiSenderEnvelope");
 ok("buildStrictPiSenderEnvelope calls computeSelfAddressability", /computeSelfAddressability\s*\(/.test(piBody));
 // Scoped to THIS function body (not a broad grep): the pi-session envelope must NOT
 // hardcode `replyable: true`; it must derive from the predicate result.
-ok("buildStrictPiSenderEnvelope no longer hardcodes `replyable: true`", !/replyable:\s*true/.test(piBody));
+ok(
+	"buildStrictPiSenderEnvelope no longer hardcodes `replyable: true` [QK:SELFADDR-NO-HARDCODED-REPLYABLE]",
+	!/replyable:\s*true/.test(piBody),
+);
 // existsSync alone is too loose — pin that it probes the CANONICAL socket path,
 // not some other file, so the honesty signal cannot drift to a path that does not
 // represent this session's socket.
@@ -246,6 +252,183 @@ ok(
 	/existsSync\s*\(/.test(selfRegion),
 );
 
+// ── SLICE INTEGRITY (before any claim is read off the slice) ─────────────────
+// A source-slice assertion is only as good as its boundaries. `toolRegion` counts
+// parens, so an unbalanced paren inside a string literal would silently widen the
+// slice to a LATER tool and let a neighbour's text satisfy an assertion about this
+// one. Pin both ends explicitly instead of trusting the counter: the slice must
+// contain THIS tool's own error label and must NOT reach the next `server.tool(`.
+ok("entwurf_self slice contains its own handler tail (start boundary real)", /entwurf_self error:/.test(selfRegion));
+ok(
+	"entwurf_self slice stops before the next tool (end boundary real, no silent widen)",
+	!/entwurf_peers/.test(selfRegion) && !/entwurf_inbox_read/.test(selfRegion),
+);
+
+// ── F-1: entwurf_self must render the RAIL, never a universal mailbox ────────
+// The defect: `origin === "meta-session"` unconditionally synthesized
+// `<mailboxDir>/<gardenId>`. `origin` is sender PROVENANCE; the rail is the second
+// axis. A native-push citizen (antigravity) has NO mailbox at all (AGENTS Hard Rule
+// 10, VERIFY "No mailbox/receiver-marker evidence counts on this rail"), so that
+// branch printed a path that will never exist and taught the model mailbox semantics
+// its own rail does not have. Pinned PER RAIL, as one reusable predicate so the same
+// judgement can be driven over negative controls below.
+/** Brace-balanced body of the `if (<guard>) { … }` that follows `guard`, or null. */
+function branchBody(region: string, guard: string): string | null {
+	const at = region.indexOf(guard);
+	if (at < 0) return null;
+	const open = region.indexOf("{", at);
+	if (open < 0) return null;
+	let depth = 0;
+	for (let i = open; i < region.length; i++) {
+		const c = region[i];
+		if (c === "{") depth++;
+		else if (c === "}") {
+			depth--;
+			if (depth === 0) return region.slice(open, i + 1);
+		}
+	}
+	return null;
+}
+
+function metaRailRenderIsHonest(region: string): { honest: boolean; reason: string } {
+	// The mailbox path may be built at most once in the whole render branch…
+	const mailboxCalls = region.split("defaultMetaMailboxDir(").length - 1;
+	if (mailboxCalls !== 1) {
+		return { honest: false, reason: `expected exactly 1 defaultMetaMailboxDir() call, found ${mailboxCalls}` };
+	}
+	// …and that one call must sit INSIDE the self-fetch branch body. Ordering alone is not
+	// containment: an `if (rail === "self-fetch") {}` with an EMPTY body followed by an
+	// unconditional mailbox build satisfies "guard appears before mailbox" while still
+	// synthesizing a mailbox for every rail — the exact defect this predicate exists to
+	// reject. Extract the body by brace-counting and require the call to be in it.
+	const selfFetchBody = branchBody(region, 'rail === "self-fetch"');
+	if (selfFetchBody === null) {
+		return { honest: false, reason: 'no brace-balanced `rail === "self-fetch"` branch body' };
+	}
+	const inBranch = selfFetchBody.split("defaultMetaMailboxDir(").length - 1;
+	if (inBranch !== 1) {
+		return {
+			honest: false,
+			reason: `the self-fetch branch BODY must build the mailbox path exactly once, found ${inBranch} (ordering is not containment)`,
+		};
+	}
+	const pushBody = branchBody(region, 'rail === "native-push"');
+	if (pushBody === null) {
+		return { honest: false, reason: 'no brace-balanced `rail === "native-push"` branch body' };
+	}
+	// The native-push branch must deny an inbox AND keep the direct-inject claim conditional
+	// on the probe: a dead probe has no live conversation to inject into, so an unconditional
+	// "injects a reply into this live conversation" invents the very rail F-1 is about.
+	if (!/no inbox/.test(pushBody)) {
+		return { honest: false, reason: "the native-push branch does not state that there is no inbox" };
+	}
+	if (!/while the adapter probe is alive/.test(pushBody)) {
+		return {
+			honest: false,
+			reason: "the native-push branch states direct injection unconditionally (a dead probe has no live conversation)",
+		};
+	}
+	return {
+		honest: true,
+		reason:
+			"the sole mailbox build is INSIDE the self-fetch branch body; native-push denies an inbox and gates injection on the probe",
+	};
+}
+
+{
+	const verdict = metaRailRenderIsHonest(selfRegion);
+	ok(`entwurf_self renders the meta rail honestly [QK:SELFADDR-RAIL-RENDER] (${verdict.reason})`, verdict.honest);
+	ok(
+		"entwurf_self reads the rail from the builder (not re-derived at the render site)",
+		/self\.metaDeliveryDomain/.test(selfRegion),
+	);
+
+	// NEGATIVE CONTROLS — two KINDS, because a gate that only rejects the exact old
+	// sentence would pass a version where the branch is simply gone (and vice versa).
+	// Driving the same predicate over synthetic sources is what proves this assertion
+	// BLOCKS, not merely that it exists.
+	const retiredUnconditional = [
+		'} else if (sender.origin === "meta-session") {',
+		"\tconst mailboxPath = path.join(defaultMetaMailboxDir(), sender.sessionId);",
+		"\textra.mailboxPath = mailboxPath;",
+		"}",
+	].join("\n");
+	ok(
+		"NEGATIVE 1/3 (exact false sentence): the retired unconditional meta-session mailbox is REJECTED",
+		metaRailRenderIsHonest(retiredUnconditional).honest === false,
+	);
+
+	const selfFetchOnlyNoPushBranch = [
+		"const rail = self.metaDeliveryDomain;",
+		'if (rail === "self-fetch") {',
+		"\tconst mailboxPath = path.join(defaultMetaMailboxDir(), sender.sessionId);",
+		"\textra.mailboxPath = mailboxPath;",
+		"}",
+	].join("\n");
+	ok(
+		"NEGATIVE 2/3 (omission): a self-fetch-guarded render with the native-push branch DELETED is REJECTED",
+		metaRailRenderIsHonest(selfFetchOnlyNoPushBranch).honest === false,
+	);
+
+	// NEGATIVE 3/3 — the form the FIRST version of this predicate wrongly accepted (caught in
+	// cross-review, 2026-07-27): every marker present, guard textually BEFORE the mailbox, yet
+	// the guard's body is empty and the mailbox is built unconditionally. Ordering satisfied,
+	// containment violated. This row is why the predicate brace-counts the branch body.
+	const guardedInNameOnly = [
+		"const rail = self.metaDeliveryDomain;",
+		'if (rail === "self-fetch") { }',
+		"const mailboxPath = path.join(defaultMetaMailboxDir(), sender.sessionId);",
+		"extra.mailboxPath = mailboxPath;",
+		'if (rail === "native-push") {',
+		'\tlines.push("mailbox: none — no inbox; direct-inject only while the adapter probe is alive");',
+		"}",
+	].join("\n");
+	ok(
+		"NEGATIVE 3/3 (ordering-but-not-containment): an EMPTY self-fetch guard followed by an unconditional mailbox build is REJECTED",
+		metaRailRenderIsHonest(guardedInNameOnly).honest === false,
+	);
+}
+
+// ── F-1: the identity-wiring errors must not teach one backend's hook as THE hook ──
+// Both native backends mint a garden id from their OWN hook (Claude Code SessionStart,
+// Antigravity PreInvocation). Naming only SessionStart/Claude sent an agy operator
+// looking for a hook its backend never runs.
+{
+	/** Extract a `class NAME extends Error { ... }` body by brace-counting. */
+	const classBody = (name: string): string => {
+		const sig = `class ${name} extends Error {`;
+		const at = src.indexOf(sig);
+		assert.ok(at >= 0, `${name} present in MCP source`);
+		const open = src.indexOf("{", at);
+		let depth = 0;
+		for (let i = open; i < src.length; i++) {
+			const c = src[i];
+			if (c === "{") depth++;
+			else if (c === "}") {
+				depth--;
+				if (depth === 0) return src.slice(open, i + 1);
+			}
+		}
+		throw new Error(`class ${name} body never closed`);
+	};
+
+	// Anchored per class (not a repo-wide grep) so a mention somewhere else in the file
+	// cannot make either row vacuously green.
+	for (const cls of ["EntwurfEnvelopeWiringError", "EntwurfSenderIdentityError"]) {
+		const body = classBody(cls);
+		ok(
+			`${cls} names BOTH native hooks (SessionStart AND PreInvocation)`,
+			/SessionStart/.test(body) && /PreInvocation/.test(body),
+		);
+		ok(
+			`${cls} no longer presents SessionStart/Claude as THE marker writer`,
+			!/The native SessionStart hook writes that marker/.test(body) &&
+				!/whose SessionStart hook wrote a live/.test(body) &&
+				!/keyed by the\s+Claude Code parent pid/.test(body),
+		);
+	}
+}
+
 // ── SE-2 2e-b: meta-session sender replyability from the receiver presence marker ──
 // Identity stays trusted (record-backed), but `replyable` is now derived from whether
 // THIS session's own receiver inbox can actually wake (slice-2 presence marker), not a