@junghanacs/entwurf 0.12.8 → 0.12.9

package/AGENTS.md

@@ -83,7 +83,7 @@ Warnings make agents blame themselves and flail. Broken tool state must surface
 2. **Dispatch is a function of liveness, not session type.** `entwurf_v2` never asks "is this a resume or a send" up front — it probes the target on its own rail and routes: live pi→control-socket, dormant pi→spawn-bg resume, active self-fetch→meta-mailbox, live native conversation→native-push. State is computed, never stored (a stored liveness bit is a lie).
 3. **A reject is honest, never cosmetic.** When a target cannot receive (dead, drifted identity, wrong state×intent), the decider returns a reject — no `✓ delivered`, no `.msg` written, no signal poke. Silent degraded "delivery" is forbidden.
 4. **MCP injection**: only via explicit `mcpServers` wiring. No ambient `~/.mcp.json` scanning, no automatic retrieval.
-5. **Meta-record authority is the record body, never the filename — and the ACTIVE store is certified as a whole, by one contract.** Identity comes from the `.meta.json` body; no filename is ever parsed for authority. `certifyActiveStore` is the single contract the install doctor and all four identity writers (pi birth, Claude hook, agy imprint, `entwurf_register_native`) share: every `.meta.json` entry is a **regular file** (a symlink is refused, never followed — its bytes live where this store has no ownership), **readable by the live schema**, **named by its own body**, and the **unique holder of its `nativeSessionId`**. Body-is-authority and name-must-agree are not in tension: the body decides *what a record says*, while a record parked under the wrong name is unreachable by garden id and so corrupts the *active store*. Any defect fails the whole write BEFORE it happens, naming the fresh-cut verb — including a defect involving neither of the writer's own ids, because a narrow "is there a record for MY native id" scan is how a store ends up certified by the doctor and written to by the runtime under two different contracts (the weaker one always wins at runtime). **The contract binds both directions, at the granularity each surface can afford:** the store-WIDE scan runs on identity writes and in the doctor, while every TARGETED read (`readMetaIdentityByGardenId`, and so v2 dispatch / `entwurf_self` / sender-marker trust) holds the per-entry half — a non-regular-file record is refused and never followed, and body/filename drift fails loud, both naming the verb. Certifying only on write while the read followed a symlink made the rule true exactly where nobody was addressed. Store-wide *uniqueness* is still not proven per read, so a store that would fail certification can still surface a duplicate `nativeSessionId` to `entwurf_peers` and to dispatch — a known open gap, tracked separately, never described as guarded. A meta-record is nullable-at-birth (`model`/`transcriptPath` null until known). Production reads schemaVersion-3 records only, and the repo carries NO legacy reader or migrator: a record the live schema cannot read fails loud naming the fresh-cut verb (`entwurf meta-bridge-fresh-cut` — archive the whole generation, open an empty one). The active store provides no cross-generation address or resume continuity; sessions flow, and memory lives in the native transcripts and the embedding axes, never in the bridge.
+5. **Meta-record authority is the record body, never the filename — and the ACTIVE store is certified as a whole, by one contract.** Identity comes from the `.meta.json` body; no filename is ever parsed for authority. `certifyActiveStore` is the single contract the install doctor and all four identity writers (pi birth, Claude hook, agy imprint, `entwurf_register_native`) share: every `.meta.json` entry is a **regular file** (a symlink is refused, never followed — its bytes live where this store has no ownership), **readable by the live schema**, **named by its own body**, and the **unique holder of its `nativeSessionId`**. Body-is-authority and name-must-agree are not in tension: the body decides *what a record says*, while a record parked under the wrong name is unreachable by garden id and so corrupts the *active store*. Any defect fails the whole write BEFORE it happens, naming the fresh-cut verb — including a defect involving neither of the writer's own ids, because a narrow "is there a record for MY native id" scan is how a store ends up certified by the doctor and written to by the runtime under two different contracts (the weaker one always wins at runtime). **The contract binds both directions, at the granularity each surface can afford:** the store-WIDE scan runs on identity writes and in the doctor, while the plain TARGETED read (`readMetaIdentityByGardenId`, used by `entwurf_self`, mailbox primitives and sender-marker trust) holds the per-entry half — a non-regular-file record is refused and never followed, and body/filename drift fails loud, both naming the verb. V2 dispatch and pi resume use the stronger `readAddressableMetaIdentity` described next. Certifying only on write while the read followed a symlink made the rule true exactly where nobody was addressed. Store-wide *uniqueness* is checked on the read snapshot wherever it is both affordable and load-bearing (#52, 0.12.9): the **discovery** scan (`listAllMetaIdentities` → `entwurf_peers`) already holds every record, so a duplicated `nativeSessionId` costs nothing to see and neither rival is listed as a citizen — a facts surface may not mint the ownership the certification refuses; and the **dispatch** read (`readAddressableMetaIdentity`, used by v2 `resolveTarget` and the pi resume) fails loud, because that is the moment a record becomes an ADDRESS and a duplicate there injects one live conversation twice or resumes one transcript under two garden-id locks. It is deliberately NOT held on the per-message relay path (mailbox poke, sender-marker trust, `entwurf_self`) — those keep the per-entry half, and a call-relay that re-scans the store per message is a design this repo does not have. A RIVAL is a record that could be ADDRESSED INSTEAD, which is narrower than a file whose bytes carry the same id: a symlinked entry is not a candidate and is NEVER READ (rule 1 — following it to judge it would break the rule while enforcing it), and a drifted or unparseable neighbour is not a candidate because no garden id can reach it; all three stay certification defects and listing diagnostics, they just may not blind a healthy citizen. The inverse is loud: a REGULAR `.meta.json` this process cannot read might BE the duplicate, so it refuses rather than skipping (ENOENT alone is absence — a file that vanished mid-scan is not in the store). Both store-wide read scans take entries WITH THEIR KIND from one shared `readActiveStoreEntries`; the former name-only bindings read each path without first carrying its kind, which is exactly how both `entwurf_peers` surfaces followed a symlinked record the doctor refused. A kind attached to a NAME is still only half the rule, because `lstat`-then-`readFileSync(path)` classifies one entry and reads another — swap the final component in between and the read follows the symlink while every settled-store test stays green. Record bytes therefore come from exactly one reader, `readStoreRecordFile`, shared by the store-wide reader and the targeted read: `O_NOFOLLOW` (a symlink fails the OPEN, before a byte is read), `O_NONBLOCK` (deciding on the fd would otherwise let a fifo block the open forever, a hazard classify-then-open never had), kind decided by `fstat` on THAT file description, and `closeSync` in a `finally`. It does not flatten errno — raced-away (`ENOENT`, skipped), unreadable (`EACCES`, loud) and swapped (`ELOOP`, refused) must stay distinguishable, because the rival scan's raced-away skip is built on that distinction and a wrapper that erased it would turn every concurrent birth into a refused dispatch. **That reader does not replace the `lstat` classification in front of the targeted read: the two layers hold different things, and merging them into "one enforcement point" is a regression, not a cleanup** (caught in cross-review before shipping). The classification decides POLICY on a settled store WITHOUT OPENING anything, which is what lets a socket, a device or a mode-000 directory earn the certification's own sentence — `open` answers `ENXIO`/`EACCES` there, errnos about availability and permission rather than regularity, so an fd-only read starts calling the host unreadable where the doctor calls the entry non-regular, and one store again has two contracts. The fd layer decides the RACE after a regular snapshot, and its errno verdicts collapse back onto the settled sentences through one PURE classifier (`classifyRecordReadFailure`: `ENOENT`→absent; `ELOOP`/`ENXIO`/not-regular-on-fstat→irregular; everything else→unreadable) so a race never teaches a second vocabulary for one state of the world. Those branches are unreachable from any settled store precisely because the classification answers first — so they are pinned with synthetic errnos on the pure function, never by a store on disk. A gate cell that claims to pin a branch nothing can reach is worse than no cell: it passed with the whole mapping deleted (2026-07-26 cross-review). The threat is not only foreign corruption: `upsertMetaSession` certifies and then writes, which is not a transaction, so two concurrent births can mint two garden ids for one native session on a host where nothing was ever corrupted. A meta-record is nullable-at-birth (`model`/`transcriptPath` null until known). Production reads schemaVersion-3 records only, and the repo carries NO legacy reader or migrator: a record the live schema cannot read fails loud naming the fresh-cut verb (`entwurf meta-bridge-fresh-cut` — archive the whole generation, open an empty one). The active store provides no cross-generation address or resume continuity; sessions flow, and memory lives in the native transcripts and the embedding axes, never in the bridge.
 6. **GC reclaims process resources only — never data.** meta-records and transcripts (the denote-id memory layer) are preserved; dormant/stale entries are archived/TTL'd, not deleted.
 7. **This is not a second harness**: no prompt reconstruction, no transcript hydration, no tool result ledger, no harness emulation. Native bridges front only a garden id plus their narrow delivery rail (Claude mailbox or agy native-push); they do not scrape transcripts or run a replacement control daemon.
 8. **Auth boundary is deployment-surface-agnostic**. This repo does not provide, copy, proxy, decrypt, or mediate any backend's credentials. Native-harness sessions read whatever auth state is visible in their own process filesystem; nothing here moves that.
@@ -91,7 +91,7 @@ Warnings make agents blame themselves and flail. Broken tool state must surface
 10. **A green dev clone is not a working package — and a green package on the maintainer's host is not a working consumer.** Node refuses `--experimental-strip-types` below `node_modules`, so any surface an operator can invoke must reach compiled JS when installed. This class has shipped four times (start.sh 0.12.1, store-doctor 0.12.4, plugin hook 0.12.5, agy imprint + three operator commands 0.12.7) because the fence was crossed by hand, per surface, and the source-tree floor cannot see it. There is now exactly one crossing — `run_ts` in `run.sh` — and two gates that hold it: `check-install-surface` (structural) and `check-pack-install` (drives the real tarball, in CI). A new `.ts` entrypoint routes through `run_ts` or it does not ship. Dev-only gates have no compiled twin by design and must be REFUSED under an installed package, never silently skipped — a `.sh` dev gate refuses in its own body, since `scripts/` ships whole and run.sh's dispatch is not the only way in. **`check-pack-install` is still a maintainer-shaped proof**: the checkout is present, every tree is operator-owned, and the install is project-local, so a surface that writes beside the installed package or depends on the repo being nearby is green there and broken for a real consumer. `check-install-container` (#51 C, own required CI job) closes that: one candidate tarball, read-only, into a container that has never seen this repo — non-root `npm install -g`, resolution through the PATH shim, a frozen package root, and a regular-file path+sha256 manifest fence across `install-meta-bridge`; the evidence line records the canonical tarball path + sha256 and the Node image id/repository digest. Default CI packs once into a temp dir; release acceptance passes a caller-preserved tarball through `ENTWURF_CANDIDATE_TGZ` and the gate consumes that exact file without re-packing, so `npm publish <same.tgz> --tag repair` can publish the accepted bytes. The two are not redundant detectors of one defect: the **freeze is a permission-level consumer fact** (the cell actually refuses the write, EACCES, the way a real consumer's host would), while the **manifest fence is the detector** — and it is exactly a regular-file path+sha256 comparison, not a whole-tree guarantee: it reads no permissions, ownership or symlink targets. A freeze at the package root alone is demonstrably insufficient (a write one directory down sails past it and only the fence sees it). Model the consumer's world, never a stricter one: a blanket `chmod -R a-w` freeze produced false reds because `cp -r` propagates modes into the installer's own assembly target, which no `sudo npm i -g` consumer can reach.
 11. **Verification must not rewire the operator's own install.** An offline smoke that writes a live `~/.claude` / `~/.gemini` / `~/.pi` path uninstalls the operator as a side effect of "testing". Swap `HOME` **and every already-exported writable `XDG_*` root** (`XDG_DATA_HOME`: install-state · `XDG_STATE_HOME`: the imprint log · `XDG_CACHE_HOME`: the statusline gid cache): moving HOME alone still writes below the inherited roots. This class struck three times in two days — hard-verify 2026-07-13 (DATA, scratch scripts), `check-pack-install`'s own drives 2026-07-14 (DATA + STATE, inside run.sh), and `smoke-user-scope-citizen` 2026-07-14 (fake `PI_CODING_AGENT_DIR` paired with the real XDG ownership state, so its inverse followed the real `managedSettingsPath` and removed the live MCP key). `check-install-surface` S5 is a static **tripwire** over `scripts/*.sh` source only: it catches a literal live path, one hop of aliasing, (S5b) HOME-without-XDG swaps, and (S5c) a mutating `run.sh` drive left unsandboxed at any root that command writes — the agent dir, `XDG_DATA_HOME`, and, for `install`/`setup`, `HOME` itself, because `ensure_agent_dir_symlinks` hard-codes `$HOME/.pi/agent` and never reads the agent-dir override (so sandboxing `PI_CODING_AGENT_DIR` is not isolation for those commands) — but it cannot see a path assembled across variables, an embedded heredoc, or run.sh itself. **A tripwire keyed to one syntactic form is not a tripwire**: S5c first shipped matching only the inline-env drive, and a review mutation walked the identical leak straight past it by hoisting the same override into an `export` one line up. Match the drive, then demand the isolation — never the other way round. The dynamic complement is `check-pack-install`'s **outer self-fence**, which runs after every success or early-failure path: the operator's real `$XDG_DATA_HOME/entwurf` tree must be byte-identical, and the gate-specific fake agy marker count in the real `$XDG_STATE_HOME/entwurf/agy-imprint.log` must not increase (mutation-checked). Read a green S5 as "no obvious destructive line", never as "verification is sandboxed" — the real guarantee is running the offline floor under a swapped HOME+XDG, which is still open. LIVE gates are the only surfaces that may drive the real host, and they say so in their name.
 12. **A doctor reports runtime truth and ownership truth separately.** Read the target's own semantics before calling a host broken. agy matches `mcp(*)` and `mcp(<server>)` against our tool wherever those rules appear, so an operator's broad `allow` already grants `entwurf_v2` — reporting that host as "NOT granted, agy prompts on every call" was a false red about a working surface. Installers still take the narrowest rule they need; doctors distinguish **we own this** from **someone else's rule is carrying it** from **it is genuinely broken**. Install-state is evidence only when it parses, names its required managed-path field as an absolute path, and that normalized path equals the live target this host reads; corrupt or foreign-target state is a failure even when the live command itself resolves. Ownership beats coverage: an element the state records as ours that has since vanished stays a failure even while an operator's broader rule keeps the surface working (a whole-file settings relink produces exactly this shape). Conversely, broken ownership state does not justify saying a visibly configured runtime command is absent — report both axes honestly and keep the final verdict red.
-13. **A native-hook owner is structural, not a topology guess — and the structure is the exec form.** Shell-form command hooks do not expose one portable process tree: under the same Claude Code version we observed both a direct hook→Claude join and a retained `/bin/bash -c` wrapper, and ordinary tail-exec tests never reproduced the trigger. That form is retired, not patched. The meta-bridge declares the **exec form** — `command` is the shipped `hook-launch.sh`, `args` is the real argv — so no shell exists on the launch path, the launcher `exec`s the payload and preserves the pid, and the hook's parent IS Claude on every host (#51 B2, measured at Claude Code 2.1.217). The hook therefore reads `process.ppid` directly; the `$PPID` carrier, the ancestry walk, and the missing-carrier contract are **gone**, and re-introducing any of them means the manifest stopped feeding the owner. **But `process.ppid` is only the owner when the launcher was actually on the path, so `hook-launch.sh` stamps a non-identity `ENTWURF_META_HOOK_LAUNCH` provenance token and the hook writes NO sender/receiver marker without it.** This is not the retired carrier wearing a new name: the carrier smuggled a *pid* that had to be ancestry-checked, while this token carries no identity at all and answers only "was the authorized launch path taken". It is what keeps the upgrade mismatch fail-closed — an already-open Claude session still holding the OLD cached command reaches the new hook with a shell wrapper as its parent, and without the token that wrapper would be minted as an owner. Deleting it is never a cleanup. **entwurf requires Claude Code `>=2.1.217` and enforces that floor itself, because upstream gives no fail-loud:** an older Claude passes `plugin validate` on the exec manifest (unknown-key passthrough), then at runtime drops `args`, runs `command` alone, and reports the hook as `exit_code: 0, outcome: success` — measured at 2.1.138. `hook-launch.sh` refusing an empty argv is that silence made loud; installer and doctor refuse the version outright; there is no shell-form fallback for older versions. `check-hook-launch-topology` drives the shipped argv for real — including a plugin path containing a space, `$`, a backtick, and `;&` — and `check-claude-floor-coherence` keeps the floor one number derived from `package.json` `entwurf.claudeCodeFloor`. Evidence stays tiered: B/B2 are direct-native observations from actual 2.1.138/2.1.217 sessions on one NixOS host; the Linux artifact-consumer's fake Claude, planted cache, stand-in owner and `/proc` bridge are fixtures that prove package/oracle behavior, never a second native-host acceptance. **The doctor is the release oracle, so its exit 0 must mean every required layer was measured, never that a layer was skipped.** It resolves the ONE artifact Claude loads (`claude plugin list --json`.installPath; an ambiguous multi-version cache is refused, never guessed), classifies the installed *launch form* by name across all three owner hooks — a shell-form or launcher-less exec manifest is refused by name, not reported as unreadable drift — and then requires the live MCP↔marker join. Missing live evidence is `NOT CERTIFIED`, a failure worded distinctly from a broken install. The #51 repair cut has **Linux as its only currently certified axis**: install refuses Darwin because `/proc`-based live bridge discovery cannot certify it yet, doctor stays `NOT CERTIFIED`/nonzero there, and uninstall alone retains Darwin support so legacy state is not stranded. This is an evidence boundary, not a permanent macOS impossibility; future native validation may reopen the lane. `check-meta-doctor-oracle` holds this: a healthy fixture must reach PASS and twenty-one planted defects must each turn it red *naming their own cause*. An oracle with an optional central evidence layer is not an oracle.
+13. **A native-hook owner is structural, not a topology guess — and the structure is the exec form.** Shell-form command hooks do not expose one portable process tree: under the same Claude Code version we observed both a direct hook→Claude join and a retained `/bin/bash -c` wrapper, and ordinary tail-exec tests never reproduced the trigger. That form is retired, not patched. The meta-bridge declares the **exec form** — `command` is the shipped `hook-launch.sh`, `args` is the real argv — so no shell exists on the launch path, the launcher `exec`s the payload and preserves the pid, and the hook's parent IS Claude on every host (#51 B2, measured at Claude Code 2.1.217). The hook therefore reads `process.ppid` directly; the `$PPID` carrier, the ancestry walk, and the missing-carrier contract are **gone**, and re-introducing any of them means the manifest stopped feeding the owner. **But `process.ppid` is only the owner when the launcher was actually on the path, so `hook-launch.sh` stamps a non-identity `ENTWURF_META_HOOK_LAUNCH` provenance token and the hook writes NO sender/receiver marker without it.** **The authorized launch path is necessary, not sufficient: `process.ppid` must also be a pid that CAN own a session, and that question belongs to one shared predicate.** `isPlausibleOwnerPid` (safe integer, `> 1`, in `meta-session.ts` beside `classifyMarkerOwner`) is asked by both writers — the Claude hook and the agy imprint — by the `writeMetaSender/ReceiverMarker` boundary itself, by all three readers (fresh-cut inspect, sender-marker read, receiver-marker read) and by the sender-identity candidate filter. It is deliberately NOT part of `classifyMarkerOwner`, whose pure rule stays correct: asked about pid 1 that rule answers `live`, and honestly so. The layer above is where the claim fails. **That layer is a POLICY bound to the currently certified axis, not a law of processes**: on a Linux desktop/workstation host init is the service manager and every native harness descends from a login session, so `ownerPid <= 1` is always residue — but a container that runs the harness AS pid 1 is a real shape where it would name a genuine owner. Such a host is **unsupported and fails closed**: the writers refuse the marker, so that session keeps its meta-record and never claims reply-addressability. Widening the axis takes new evidence and a new contract, never a quiet loosening of the predicate. Splitting the two is what let the Claude hook refuse `<= 1` while the agy imprint still wrote `> 0` and every reader accepted `> 0`, and a single leftover `ownerPid: 1` marker — observed as a shell-form hook reparented to init before it read its own parent — then blocked that host's `meta-bridge-fresh-cut`: **the one action the refusal prescribes, quiescing the sessions, cannot refute an owner that is init**, and `0.12.8` named that same cut as the only repair for its pre-v3 store (#53 A, measured 2026-07-25). So a marker failing the predicate is **refuted by construction, not proven dead** — legacy (any pre-fix writer that was reparented) or corrupt (a non-integer pid no writer here ever produced), never claimed to have one single origin: the cut clears it as residue and reports it under its own `refuted:` line, never folded into the dead count. A new marker consumer asks the predicate or it reopens this. This is not the retired carrier wearing a new name: the carrier smuggled a *pid* that had to be ancestry-checked, while this token carries no identity at all and answers only "was the authorized launch path taken". It is what keeps the upgrade mismatch fail-closed — an already-open Claude session still holding the OLD cached command reaches the new hook with a shell wrapper as its parent, and without the token that wrapper would be minted as an owner. Deleting it is never a cleanup. **entwurf requires Claude Code `>=2.1.217` and enforces that floor itself, because upstream gives no fail-loud:** an older Claude passes `plugin validate` on the exec manifest (unknown-key passthrough), then at runtime drops `args`, runs `command` alone, and reports the hook as `exit_code: 0, outcome: success` — measured at 2.1.138. `hook-launch.sh` refusing an empty argv is that silence made loud; installer and doctor refuse the version outright; there is no shell-form fallback for older versions. `check-hook-launch-topology` drives the shipped argv for real — including a plugin path containing a space, `$`, a backtick, and `;&` — and `check-claude-floor-coherence` keeps the floor one number derived from `package.json` `entwurf.claudeCodeFloor`. Evidence stays tiered: B/B2 are direct-native observations from actual 2.1.138/2.1.217 sessions on one NixOS host; the Linux artifact-consumer's fake Claude, planted cache, stand-in owner and `/proc` bridge are fixtures that prove package/oracle behavior, never a second native-host acceptance. **The doctor is the release oracle, so its exit 0 must mean every required layer was measured, never that a layer was skipped.** It resolves the ONE artifact Claude loads (`claude plugin list --json`.installPath; an ambiguous multi-version cache is refused, never guessed), classifies the installed *launch form* by name across all three owner hooks — a shell-form or launcher-less exec manifest is refused by name, not reported as unreadable drift — and then requires the live MCP↔marker join. Missing live evidence is `NOT CERTIFIED`, a failure worded distinctly from a broken install. The #51 repair cut has **Linux as its only currently certified axis**: install refuses Darwin because `/proc`-based live bridge discovery cannot certify it yet, doctor stays `NOT CERTIFIED`/nonzero there, and uninstall alone retains Darwin support so legacy state is not stranded. This is an evidence boundary, not a permanent macOS impossibility; future native validation may reopen the lane. `check-meta-doctor-oracle` holds this: a healthy fixture must reach PASS and twenty-one planted defects must each turn it red *naming their own cause*. An oracle with an optional central evidence layer is not an oracle.
 
 ## ACP Plugin Boundary
 
@@ -258,8 +258,8 @@ Code-level invariants pinned at the same time:
 ## Runtime Dependencies
 
 - `@modelcontextprotocol/sdk` and `zod` are the substrate runtime deps. With the Claude-first ACP plugin shipped, the Claude/ACP backend deps are pinned alongside them: `@agentclientprotocol/claude-agent-acp` (`0.61.0`), `@agentclientprotocol/sdk` (`1.3.0`), `@anthropic-ai/sdk` (`0.100.1` — kept: `claude-agent-sdk@0.3.217`'s peer floor is `>=0.93.0`, so 0.100.1 satisfies it and a mechanical rise to the newest SDK is NOT taken). Codex/Gemini ACP packages stay out of scope; Codex is native/probe, agy is the shipped native-push Google lane, and Gemini ACP remains compatibility history rather than a current target.
-- `pi` (`@earendil-works/pi-ai`) on PATH at the pinned range (`>= 0.82.0 < 0.83` — devDep exact `0.82.0` + next-minor ceiling). Mismatches are caught by `check-dep-versions` / `check-pi-runtime-version`. 0.80 moved the standalone root `getModels()` to the deprecated `@earendil-works/pi-ai/compat` entrypoint; the curated Claude surface (`pi-extensions/lib/acp/models.ts`) imports `getModels` from `/compat` — the single subpath allowlisted in `check-pi-import-surface`. NOT a provider-factory subpath such as `providers/anthropic`: although it typechecks, pi's extension loader (jiti alias map in pi-coding-agent `core/extensions/loader.ts`) resolves only FOUR pi-ai specifiers for extensions — the bare root, `/compat`, `/oauth`, and (added in 0.81) `/providers/all` — so any other `providers/*` import resolves to the unresolvable `dist/compat.js/providers/…` and crashes extension load (caught live by `smoke-resident-garden-guard`, not by static typecheck). This `/compat` use is an **extension-loader compatibility shim** chosen by loader constraint, not a preference for a deprecated API — the `<0.83` ceiling guards it.
-  - **The re-evaluation this line demanded has been done (2026-07-24, pi `v0.80.7..v0.82.0` source-diffed + both versions installed and `getModels("anthropic")` compared).** The shim holds: root / `/compat` / `/oauth` are untouched in the alias map, `getModels` is still exported from `/compat` (as `getBuiltinModels`, deprecation text now pointing at `/providers/all`), and the curated anchors are byte-identical across the bump (14 models, `claude-opus-4-8` + `claude-sonnet-5`, same `cost` / `contextWindow` / `maxTokens` / `reasoning`). What 0.81 ADDED — the `/providers/all` alias and native `registerProvider(provider)` registration — is a new surface, not a replacement forced on us; migrating the curated read off deprecated `/compat` onto it is a **separate cut**, deliberately kept out of the version bump. Re-evaluate again at the `<0.83` ceiling.
+- `pi` (`@earendil-works/pi-ai`) on PATH at the pinned range (`>= 0.82.1 < 0.83` — devDep exact `0.82.1` + next-minor ceiling). Mismatches are caught by `check-dep-versions` / `check-pi-runtime-version`. 0.80 moved the standalone root `getModels()` to the deprecated `@earendil-works/pi-ai/compat` entrypoint; the curated Claude surface (`pi-extensions/lib/acp/models.ts`) imports `getModels` from `/compat` — the single subpath allowlisted in `check-pi-import-surface`. NOT a provider-factory subpath such as `providers/anthropic`: although it typechecks, pi's extension loader (jiti alias map in pi-coding-agent `core/extensions/loader.ts`) resolves only FOUR pi-ai specifiers for extensions — the bare root, `/compat`, `/oauth`, and (added in 0.81) `/providers/all` — so any other `providers/*` import resolves to the unresolvable `dist/compat.js/providers/…` and crashes extension load (caught live by `smoke-resident-garden-guard`, not by static typecheck). This `/compat` use is an **extension-loader compatibility shim** chosen by loader constraint, not a preference for a deprecated API — the `<0.83` ceiling guards it.
+  - **The minor-boundary re-evaluation was done 2026-07-24 against pi `v0.80.7..v0.82.0`.** The shim held: root / `/compat` / `/oauth` stayed in the alias map, `getModels` remained a `/compat` re-export of `getBuiltinModels`, and 0.81 added `/providers/all` without forcing migration. **The 2026-07-26 `v0.82.0..v0.82.1` patch was source-diffed and installed again:** loader aliases and `/compat` are unchanged; the builtin Anthropic catalog grows 14→15 only by adding `claude-opus-5`; `claude-sonnet-5` retains identical cost/context/max-token/reasoning metadata. The explicit model cut replaces the curated Opus 4.8 row with Opus 5 (1M context, 128K max output, reasoning enabled) rather than widening the two-model surface. Re-evaluate again at the `<0.83` ceiling.
 
 ## Working Style
 

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.12.9 — 2026-07-26
+
+### Changed
+
+- **The curated ACP surface adopts Claude Opus 5 on pi 0.82.1.** The deliberately narrow two-model surface keeps Sonnet 5 and replaces the Opus 4.8 anchor with Opus 5 (1M context, 128K max output, reasoning enabled). The pi runtime pin, closed peer range, lockfile, install gates, and current-version docs move together; source review of pi 0.82.1 confirmed the extension-loader aliases and `/compat` catalog seam are unchanged.
+- **`meta-bridge-fresh-cut` now reports the transition that actually occurred.** Exit 0 means the cut completed, 1 means nothing moved, 2 is usage, 3 means the cut transition is incomplete, and 4 means the generation was archived and the fresh v3 store opened but residue cleanup is incomplete. The command help, `run.sh` usage, operator docs, and deterministic decision/source-fence cells carry the same contract; exit 4 may proceed to `setup`, while rerunning after a new citizen is born would archive the new generation too.
+
+### Fixed
+
+- **A marker that cannot plausibly own a session no longer blocks the only repair verb or grants identity indefinitely.** The Claude hook, agy imprint, marker write boundary, all sender/receiver readers, fresh-cut inspection, and sender-candidate filtering share one `isPlausibleOwnerPid` policy. On the currently certified Linux desktop/workstation axis, pid 1 is refuted by construction and reported separately from a proven-dead owner; the cut clears that residue instead of waiting forever on init. A container running the harness as pid 1 remains unsupported and fails closed rather than quietly widening the evidence boundary.
+- **`setup` preserves the repository's tracked pi settings across the full install path.** Both writers of `.pi/settings.json` now share one serializer, recognize the portable relative package entry as the same checkout, and leave already-satisfied bytes untouched. The end-to-end gate plants the candidate-index settings in a stand-in checkout, drives the real `run.sh install`, and requires byte and mtime identity, covering both writers and user-scope side effects rather than only a helper.
+- **Duplicate `nativeSessionId` claims are quarantined on discovery and refused wherever a record becomes an address.** `entwurf_peers` lists neither rival while preserving unrelated citizens and naming diagnostics; canonical `entwurf_v2` dispatch checks the store before choosing any transport, and dormant pi resume uses the same addressable read. A regular unreadable rival fails loud because it might be the duplicate, while symlinked, drifted, or unparseable neighbours remain certification/listing defects without being promoted into addressable rivals. The deliberately narrower raw mailbox and marker paths retain the per-entry half of the contract; that boundary and its promotion rule remain tracked in #55.
+- **Record bytes now come from the same opened file description that proves their kind.** `readStoreRecordFile` opens with `O_NOFOLLOW` so a final-component regular-to-symlink swap fails before a byte is read, uses `fstat` on that fd, reads through the fd, and closes in a `finally`. `O_NONBLOCK` prevents the fd-classification repair from introducing a FIFO hang. The preceding `lstat` classification remains a separate policy layer so settled sockets, devices, and mode-000 directories receive the certification contract's non-regular verdict instead of leaking `ENXIO`/`EACCES` as a second vocabulary.
+
+### Verification
+
+- Pre-version landing HEAD `aaab00fbd293300d25c294580bb19bd3a88ad757` passed exact-SHA GitHub Actions run [30186472796](https://github.com/junghan0611/entwurf/actions/runs/30186472796): `check`, `install-surface`, and `artifact-consumer` all success.
+- The prepared tree passed an independent `pnpm check`, then `LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.12.9.8NSzz7` completed all green: **MUST PASS=17 FAIL=0 SKIP=0** and **BEHAVIOR PASS=1 FAIL=0**, EXIT=0. Full log: `/tmp/entwurf-release-gate-0.12.9.8NSzz7/release-gate.log`; per-step artifact paths are preserved inside it. Prepared-HEAD exact-SHA CI and preserved-candidate acceptance remain deliberately deferred to `make`.
+
 ## 0.12.8 — 2026-07-25
 
 ### Changed
@@ -30,7 +49,7 @@ All notable changes to this project will be documented here. Format follows [Kee
 - Pre-version landing HEAD `1345688001ed6629bd0f58996a36134e7b7874bc` passed exact-SHA GitHub Actions run [30150824225](https://github.com/junghan0611/entwurf/actions/runs/30150824225): `check`, `install-surface`, and `artifact-consumer` all success.
 - Published `0.12.8-repair.1` passed installed `doctor-meta-bridge` on maintainer + secondary Linux hosts after a new real Claude session opened with a live MCP child; both runs included physical `entwurf_v2` delivery and live owner join (BASELINE HISTORY).
 - On the stable prepared tree, `LIVE=1 ./run.sh release-gate` is all green — **MUST PASS=17 FAIL=0 SKIP=0** (its first step is the full `pnpm check`; the run includes `smoke-acp-bundled-mcp-live` and `smoke-acp-v2-send-live`) and **BEHAVIOR PASS=1 FAIL=0**, EXIT=0 — at scratch `/tmp/entwurf-release-gate-0.12.8.u9y9IX`, complete log `/tmp/entwurf-release-gate-0.12.8.u9y9IX/release-gate.log`, per-step artifact paths printed inside it. The static gate judges the **candidate index**, so the release-prep bytes were staged before the run, not merely present in the working tree.
-- The prepared-HEAD exact-SHA CI, the preserved candidate and its container acceptance, the tag, the GitHub release, and `latest` publication remain deliberately deferred to `make` / `publish`.
+- Prepared HEAD `e31c28f` passed exact-SHA GitHub Actions run [30152323861](https://github.com/junghan0611/entwurf/actions/runs/30152323861) with `check`, `install-surface`, and `artifact-consumer` all successful. The preserved candidate `junghanacs-entwurf-0.12.8.tgz` (sha256 `7c7e8985823391ec6dfae918e08c4aed1fafd06b7415806b2d591b0cb95891f3`) passed the checkout-invisible container consumer, was tagged as `v0.12.8`, released on GitHub, and published as `latest=0.12.8` while `repair=0.12.8-repair.1` remained unchanged.
 
 ## 0.12.8-repair.1 — 2026-07-22
 

package/DELIVERY.md

@@ -86,7 +86,7 @@ D2 receiver_armed: pass
 D3 addressed_enqueue: pass
 D4 idle_active_wake: pass
 D5 context_injection: pass token=AGY-PARITY-3399
-D6 continuity: pass session_id=<native-id> model=claude-opus-4-8
+D6 continuity: pass session_id=<native-id> model=claude-opus-5
 D7 completion_reply: partial reason="no garden outbox yet"
 D8 robustness: partial reason="loop guard present; crash recovery not tested"
 ```

package/README.md

@@ -159,7 +159,7 @@ because Node refuses to strip `.ts` files under `node_modules`.
 ### Pi adapter / ACP plugin lane
 
 To use the `entwurf` provider inside pi, install a compatible pi binary
-separately (`@earendil-works/pi-coding-agent >=0.82.0 <0.83`). Then point pi at
+separately (`@earendil-works/pi-coding-agent >=0.82.1 <0.83`). Then point pi at
 the npm-installed package or development clone:
 
 ```bash
@@ -261,15 +261,82 @@ Only that accepted file may be published under the explicitly authorized lane:
 > there is nothing to diagnose or branch on.
 >
 > Note the deliberate scope, stated as it actually is. A **store-wide** scan runs on
-> **identity writes** and in the doctor — not on every mailbox poke; a call-relay does
-> not re-scan the whole store per message. What every **targeted read** does hold is
-> the per-entry half of the same contract: `readMetaIdentityByGardenId` refuses a
-> record that is not a regular file (a symlink is never followed, in *either*
-> direction) and one whose body disagrees with its name, naming the verb. What it
-> does **not** do is prove store-wide uniqueness on the read path, so on a store that
-> would fail certification two records can still claim one `nativeSessionId` and
-> `entwurf_peers` will list both as citizens. That is a **known open gap**, not a
-> promise: closing it on the dispatch path is [#52](https://github.com/junghan0611/entwurf/issues/52).
+> **identity writes**, in the doctor, and on the two read surfaces below — not on every
+> mailbox poke; a call-relay does not re-scan the whole store per message. What every
+> **targeted read** holds is the per-entry half of the same contract:
+> `readMetaIdentityByGardenId` refuses a record that is not a regular file (a symlink is
+> never followed, in *either* direction) and one whose body disagrees with its name,
+> naming the verb. That is what the mailbox poke, the sender-marker trust and
+> `entwurf_self` use, and it is all they need.
+>
+> Store-wide **uniqueness** is checked on the read snapshot at the two places where it
+> is both affordable and load-bearing ([#52](https://github.com/junghan0611/entwurf/issues/52),
+> 0.12.9):
+>
+> - **Discovery** — `listAllMetaIdentities`, and so `entwurf_peers`, already reads the
+>   whole store, so the check is free. Two records claiming one `nativeSessionId` are
+>   **not** two citizens: *neither* is listed (the store cannot say which one owns that
+>   session, and a facts surface may not mint an authority the certification refuses),
+>   both become diagnostics naming each other, and every unrelated citizen keeps listing.
+> - **Dispatch** — `readAddressableMetaIdentity`, used by v2 `resolveTarget` and by the
+>   pi resume path. Those are the moments a record stops being data and becomes an
+>   **address**, they happen once per dispatch next to a socket connect and a spawn, and
+>   a duplicate there means direct-injecting one live conversation under two garden ids,
+>   or resuming one transcript twice under two per-garden-id locks. It fails **loud**; a
+>   soft `bad-target` is reserved for a record that is genuinely absent.
+>
+> **A rival is a record that could be addressed instead** — narrower than "a file whose
+> bytes mention the same id". A **symlinked** entry is not a candidate and is *never
+> read* (rule 1 again: following it to see whether it counts would break the rule in the
+> act of enforcing it, and let planted foreign bytes quarantine a healthy citizen); a
+> **drifted** or **unparseable** neighbour is not a candidate either, because no garden
+> id can reach it. All three remain certification defects and the listing reports them as
+> diagnostics — they just may not blind a healthy record. The opposite case is a
+> **regular `.meta.json` this process cannot read**: that one might BE the duplicate, so
+> it fails loud rather than being skipped, because "holds it alone" from a scan that
+> never asked is the same vacuous pass in miniature. (`ENOENT` alone is the exception —
+> a file that vanished mid-scan is not in the store.)
+>
+> Both store-wide read scans take entries **with their kind** from one shared
+> `readActiveStoreEntries`, rather than each binding doing its own name-only `readdir`.
+> That is what makes rule 1 structural: a scan handed bare names has no choice but to
+> read the path, which is how both `entwurf_peers` bindings came to follow a symlinked
+> record while the doctor refused the very same entry.
+>
+> A kind carried alongside a **name** is still only half of it, because a name can stop
+> meaning what it meant. `lstat`-then-`readFileSync(path)` classifies one entry and reads
+> another: replace the final path component with a symlink in between, and the read
+> follows it into foreign bytes while every test on a settled store stays green. So the
+> bytes of a record come from exactly one place — `readStoreRecordFile`, shared by the
+> store-wide reader and by `readMetaIdentityByGardenId` — which opens with `O_NOFOLLOW`
+> (a symlink fails the **open**, before a byte is read), decides the kind by `fstat` on
+> **that file description** rather than on a name, and closes it in a `finally`. It also
+> opens `O_NONBLOCK`, because classify-then-open never had to care that `open(fifo,
+> O_RDONLY)` blocks until a writer appears, and deciding on the fd does. The reader does
+> not flatten errno: callers still separate a record that raced away (`ENOENT`, skipped)
+> from one that cannot be read (`EACCES`, loud) from one that was swapped (`ELOOP`,
+> refused) — and the rival scan's raced-away skip depends on exactly that.
+>
+> That reader does not replace the `lstat` classification in front of the targeted read;
+> the two hold **different** things, and collapsing them into "one enforcement point"
+> was itself a regression (caught in review before shipping). The classification decides
+> POLICY on a settled store **without opening anything**, which is what lets a socket, a
+> device or a mode-000 directory earn the certification's own sentence — an `open` would
+> answer `ENXIO` or `EACCES` there, errnos that say nothing about regularity, and the
+> targeted read would start calling the host unreadable where the doctor calls the entry
+> non-regular. Two contracts for one store is precisely the defect rule 1 exists to
+> prevent. The fd layer decides the RACE: after a regular snapshot, its errno verdicts
+> (`ELOOP`, `ENXIO`, a non-regular `fstat`) collapse back onto the settled sentences
+> through one pure classifier, so a race never teaches the operator a second vocabulary
+> for one state of the world. Because the classification answers first, those branches
+> are unreachable from any settled store — which is why the classifier is pure and pinned
+> with synthetic errnos rather than by a store on disk.
+>
+> This is not only a defence against external corruption. `upsertMetaSession` certifies
+> and then writes, which is **not a transaction**, so two concurrent births — two
+> `SessionStart` hooks, an `entwurf_register_native` racing an agy imprint — can both
+> observe one clean store and mint different garden ids for one native session. A
+> duplicate can therefore appear on a host where nothing was ever corrupted.
 >
 > There is **no migrator and no legacy reader anywhere in this repo** — carrying
 > old records forward would serve a continuity the system deliberately does not
@@ -290,6 +357,23 @@ Only that accepted file may be published under the explicitly authorized lane:
 > entwurf meta-bridge-fresh-cut   # quiesce-checked: archive the old generation, open an empty one
 > ```
 >
+> **Read its exit status, don't just chain it.** The cut answers with a contract
+> ([#54](https://github.com/junghan0611/entwurf/issues/54), `--help` prints it), because
+> "it failed" is not one world-state:
+>
+> | exit | what already moved | what to do |
+> |---|---|---|
+> | `0` | the cut is complete | run `setup` |
+> | `1` | **nothing** — a live/unprovable surface, an occupied archive destination, an unreadable surface | fix the named cause, re-run. **Do not** run `setup`: the store it refused is still there |
+> | `2` | nothing — usage error | fix the command |
+> | `3` | the cut transition is **incomplete** after at least one archive move; the fresh generation is not confirmed open | inspect, or re-run to finish under a new stamp |
+> | `4` | the cut is **complete**; marker/socket residue could not be unlinked | `setup` may run. Prefer repairing the named residue before `setup`; if new citizens have already been born, remove it manually — another fresh-cut would archive their generation too |
+>
+> Only `0` is success — a failed sweep never becomes a pass. `fresh-cut && setup` is
+> still the right chain for the common path; the codes are there so a runbook, CI or an
+> agent can tell a refusal that changed nothing from a cut that already unblocked the
+> install. An exit-4 re-run is safe only before `setup` or any new citizen birth.
+>
 > The refusal is a **preflight, not a lock**: it certifies the store as it stands
 > at that moment. On a host whose pi/Claude settings point straight at a checkout,
 > a `git pull` can put the new code in front of live sessions before you run
@@ -304,6 +388,34 @@ Only that accepted file may be published under the explicitly authorized lane:
 > refuses the cut before anything moves. Cutting needs proof of death, not absence
 > of proof of life.
 >
+> **One marker is cleared without proving death, and it is the exception that keeps
+> this path open.** A marker whose recorded `ownerPid` cannot own anything — `1`
+> (init), `0`, a negative or non-integer — is *refuted by construction*: no writer in
+> this tree can mint one any more, so on a current install it is **legacy or corrupt
+> residue** — a pre-fix writer whose parent had been reparented to init (the retired
+> shell-form Claude hook; the agy imprint, which asked only `> 0` until this repair),
+> or a foreign/damaged marker, the only way a non-integer pid appears at all. The one
+> file actually observed was a shell-form hook reparented to init. Honoring it was not
+> merely wrong, it was a trap: init runs for the whole boot and its start-key does not
+> change while it does, so the owner verdict is `live` and **the very action this
+> refusal prescribes cannot change that** — you quiesce every session, exactly as
+> told, and the cut refuses again. (Deleting the marker removes the claim rather than
+> refuting the verdict; a reboot recomputes the key with no contract either way.)
+> Meanwhile the one repair this page names could not run: on the affected host the cut
+> stayed blocked until the marker file was removed by hand (#53 A, measured on a second
+> Linux host 2026-07-25). Such a marker is now swept as residue and **reported apart
+> from the dead ones** (`refuted:`), because a proof of invalidity is a different
+> finding from a proof of death — and a stronger one.
+>
+> **Scope of that rule.** "A native session is never owned by init" is a property of the
+> axis entwurf certifies — a Linux desktop/workstation host, where init is the service
+> manager and every harness descends from a login session. A container that runs the
+> harness **as pid 1** is a real shape, and there the marker would name a genuine owner.
+> That host is **unsupported and fails closed**: the writers refuse the marker, so the
+> session still gets its meta-record but never claims reply-addressability — a lost
+> capability rather than a false identity. Reopening that lane needs new evidence and a
+> new contract, not a looser predicate.
+>
 > That agy row is not symmetry for its own sake: `entwurf_register_native` writes a
 > record and **no marker at all**, and `entwurf_v2` dispatches to such a citizen
 > straight off the record, so marker absence is the *normal* state of a live,

package/demo/README.md

@@ -113,7 +113,7 @@ The demo launch lines correspond to your shell aliases:
 
 | Alias | Model id | Use as |
 |---|---|---|
-| `piao` | `entwurf/claude-opus-4-8` | `SENDER_MODEL` (precision scenes) |
+| `piao` | `entwurf/claude-opus-5` | `SENDER_MODEL` (precision scenes) |
 | `pias` | `entwurf/claude-sonnet-5` | `SENDER_MODEL` (default) |
 | `piat` | `entwurf/gpt-5.4` | `PEER_MODEL` (default) |
 | `piat5` | `entwurf/gpt-5.5` | either |
@@ -137,7 +137,7 @@ SCENE_DELAY=30 FINAL_PAUSE=10 bash demo.sh
 
 ## Prerequisites
 
-- `pi` on PATH (current floor 0.82.0)
+- `pi` on PATH (current floor 0.82.1)
 - `entwurf` provider configured + auth ready for the selected sender/peer models
 - `asciinema` installed
 - `agg` installed (optional — only for GIF conversion)

package/docs/setup-clean-host.md

@@ -65,7 +65,7 @@ exit 0.
 | Claude Code | **`>=2.1.217`** — the exec-form hook floor; an older Claude drops the hook's `args` silently and still reports success, so there is no fallback lane | `entwurf.claudeCodeFloor` (bound by `check-claude-floor-coherence`) |
 | npm | bundled with Node 24 | public package install path |
 | entwurf | `@junghanacs/entwurf` | neutral npm package; exposes `entwurf`, `entwurf-bridge`, `entwurf-statusline`, `entwurf-agy-statusline`, and `entwurf-agy-imprint` bins |
-| pi binary | **optional**, `@earendil-works/pi-coding-agent >=0.82.0 <0.83` | needed only for the pi adapter / ACP provider / spawn-bg resume lane |
+| pi binary | **optional**, `@earendil-works/pi-coding-agent >=0.82.1 <0.83` | needed only for the pi adapter / ACP provider / spawn-bg resume lane |
 | Antigravity `agy` | **optional**, operator-installed/authenticated native CLI | needed only for the shipped native-push citizen lane; entwurf never moves its auth |
 
 ## Stage 0 — Node 24 via nvm
@@ -155,7 +155,7 @@ If the host will run pi sessions or the Claude ACP provider through pi, install
 a compatible pi binary separately and wire the target project.
 
 ```bash
-npm install -g @earendil-works/pi-coding-agent@0.82.0
+npm install -g @earendil-works/pi-coding-agent@0.82.1
 pi --version
 
 mkdir -p ~/entwurf-smoke
@@ -172,7 +172,7 @@ Drift points:
   `entwurf-bridge`. (The `entwurf-targets.json` link is gone — #50 C3 removed the
   target registry; a leftover operator link is inert.)
 - Older pi versions may silently miss the provider/extension surface. Use the
-  pinned floor (`>=0.82.0 <0.83`) for release verification.
+  pinned floor (`>=0.82.1 <0.83`) for release verification.
 - A host that only uses the external MCP bridge can skip this stage until it
   needs `owned-outcome` spawn-bg resume or pi-native control sockets.
 
@@ -235,6 +235,17 @@ host has nothing to cut and can ignore this paragraph. The refusal is a
 preflight, not a lock: for checkout-backed installs, quiesce sessions before
 pull, then fresh-cut, setup, and reopen.
 
+Read the cut's exit status rather than only chaining it (#54; `--help` prints the
+contract): `0` complete → run `setup`; `1` NOTHING MOVED — a live/unprovable
+surface, an occupied archive destination, an unreadable surface — fix the named
+cause and re-run, and do not run `setup`, because the store it refused is still
+there; `2` usage; `3` CUT TRANSITION INCOMPLETE — at least one archive move
+happened but the fresh generation is not confirmed open — inspect, or re-run to
+finish under a new stamp; `4` the cut is COMPLETE but marker/socket residue could
+not be unlinked — `setup` may run. Prefer fixing the named residue and re-running
+before `setup`; if new citizens have already been born, remove it manually rather
+than fresh-cutting their new generation. Only `0` is success.
+
 Upgrade invariant: every global npm/pnpm package upgrade must be followed by
 `entwurf install-meta-bridge` from that same installed binary and then
 `entwurf doctor-meta-bridge`. Installed statusline/MCP entries use stable bin

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -39,8 +39,7 @@
  *   - surface errors (isError:true); never silent empty results
  *   - no user-specific paths baked in; env-configurable with safe defaults
  */
-import { existsSync, readFileSync } from "node:fs";
-import * as fs from "node:fs/promises";
+import { existsSync } from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import * as process from "node:process";
@@ -55,7 +54,7 @@ import { computeSelfAddressability } from "../../../pi-extensions/lib/entwurf-se
 import { nativePushSupported } from "../../../pi-extensions/lib/entwurf-v2-contract.js";
 import { runAndRenderEntwurfV2FromSurface } from "../../../pi-extensions/lib/entwurf-v2-surface.js";
 import { probeNativeSenderAlive, resolveTrustedMetaSenderIdentity, } from "../../../pi-extensions/lib/meta-sender-identity.js";
-import { defaultMetaMailboxDir, defaultMetaSessionsDir, readMetaInbox, readMetaReceiverMarker, } from "../../../pi-extensions/lib/meta-session.js";
+import { defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaInbox, readMetaReceiverMarker, } from "../../../pi-extensions/lib/meta-session.js";
 import { registerNativeConversation } from "../../../pi-extensions/lib/native-push/register.js";
 const HOME = os.homedir();
 // Directory SOURCE is this adapter's own policy — the bridge honours an explicit
@@ -389,20 +388,15 @@ server.tool("entwurf_peers", "List the entwurf fact surface: garden citizens (fr
     "Note: this is the *active* world. It is NOT a fresh-sibling creation surface; pass an " +
     "existing garden id to entwurf_v2.", {}, async () => {
     try {
-        // Meta-store axis: list `.meta.json` entries (ENOENT = fresh install =
-        // empty; any other readdir failure is a real error, not a silent empty).
+        // Meta-store axis: entries WITH their kind (ENOENT = fresh install = empty; any
+        // other readdir failure is a real error, not a silent empty). The name-only
+        // readdir that used to live here made rule 1 unenforceable on this surface —
+        // `readRecord` would follow a symlinked `.meta.json` to bytes the store does not
+        // own, while the doctor refused that same entry. One store, one contract.
         const sessionsDir = defaultMetaSessionsDir();
-        let metaEntries = [];
-        try {
-            metaEntries = (await fs.readdir(sessionsDir)).filter((n) => n.endsWith(".meta.json"));
-        }
-        catch (err) {
-            if (err?.code !== "ENOENT")
-                throw err;
-        }
         const result = await listEntwurfFacts({
-            metaEntries,
-            readRecord: (filename) => readFileSync(path.join(sessionsDir, filename), "utf8"),
+            metaEntries: readActiveStoreEntries(sessionsDir),
+            readRecord: makeStoreRecordReader(sessionsDir),
             // Socket axis: the same dir dispatch uses (grammar SSOT), scan-internal only.
             socket: { dir: ENTWURF_DIR },
         });

package/mcp/entwurf-bridge/dist/pi-extensions/lib/acp/models.js

@@ -17,14 +17,14 @@
 // Why `/compat` and NOT the 0.80 provider-factory subpath (the pi-ai
 // providers/anthropic subpath): this file is loaded by pi's
 // EXTENSION loader (pi-coding-agent `core/extensions/loader.ts`), whose jiti
-// alias map resolves ONLY three pi-ai specifiers for extensions — the bare root,
-// `/compat`, and `/oauth` — all to `ai/dist/compat.js`. A `providers/*` subpath
-// is NOT in that map: jiti prefix-matches the bare `@earendil-works/pi-ai` alias
-// and appends the remainder, yielding the unresolvable
-// `…/dist/compat.js/providers/anthropic` (verified live: extension load crash,
-// invisible to static typecheck which resolves against node_modules `exports`).
-// So `/compat` is the SINGLE sanctioned extension entrypoint for the old global
-// model-catalog API, and the SINGLE allowlisted exception in
+// alias map resolves FOUR pi-ai specifiers for extensions — the bare root,
+// `/compat`, `/oauth`, and (since pi 0.81) `/providers/all`. Other `providers/*`
+// subpaths are NOT in that map: jiti prefix-matches the bare
+// `@earendil-works/pi-ai` alias and appends the remainder, yielding the
+// unresolvable `…/dist/compat.js/providers/anthropic` (verified live: extension
+// load crash, invisible to static typecheck which resolves against node_modules
+// `exports`). So `/compat` remains the SINGLE sanctioned extension entrypoint
+// this repo uses for the old global model-catalog API, and the SINGLE allowlisted exception in
 // `run.sh check-pi-import-surface`. `getModels` here is compat's deprecated
 // re-export of `getBuiltinModels`. When pi removes compat we migrate to whatever
 // the loader then exposes.
@@ -46,11 +46,11 @@ export const ENTWURF_ACP_NO_AUTH_SENTINEL = "entwurf-no-auth";
 // both axes (protocol smoke + agent interview) — do not extend casually.
 // Exported so the claude backend adapter (backend-adapter.ts) can answer
 // `routeModel` without re-deriving the set from curatedClaudeModels().
-export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-4-8"];
+export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5"];
 /** The anchor model whose absence is a hard registry regression, not a soft skip. */
-export const CURATED_ANCHOR_MODEL_ID = "claude-opus-4-8";
-// Anthropic's registry reports 1M for both Sonnet 5 and Opus 4.8, and the
-// entwurf surface now exposes the full 1M for BOTH. Sonnet 5's 1M window is the
+export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5";
+// Anthropic's registry reports 1M for both Sonnet 5 and Opus 5, and the
+// entwurf surface exposes the full 1M for BOTH. Sonnet 5's 1M window is the
 // whole point of the 0.12.3 bump — it is the compact-free long-context floor the
 // earlier 200K Sonnet cap could not provide. We still clamp to a 1M ceiling so a
 // future registry value can't silently inflate the surface past what we verify.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-fact-provider.js

@@ -28,7 +28,7 @@
  */
 import { isNonPiGardenIdSocketConflict, resolveFactList } from "./entwurf-facts.js";
 import { isLivenessSupported } from "./entwurf-v2-contract.js";
-import { FRESH_CUT_PRESCRIPTION, listAllMetaIdentities } from "./meta-session.js";
+import { FRESH_CUT_PRESCRIPTION, listAllMetaIdentities, } from "./meta-session.js";
 import { scanSocketProbes } from "./socket-discovery.js";
 /** The #50 C4 demotion messages, one per probed liveness so the F8 aggregation
  * groups same-state sockets into one line. Each names the true cause (no record

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-production.js

@@ -21,6 +21,9 @@
  *
  * `resolveTarget` (QB1): a MISSING meta-record is a soft `bad-target` (identity:null); a
  * PRESENT-but-corrupt record fails LOUD (the read throws drift) — never matched by string.
+ * "Corrupt" includes a record that does not hold its `nativeSessionId` alone (#52): the read
+ * here is the ADDRESSABLE one, so the store-wide uniqueness half runs at this boundary and
+ * nowhere cheaper. Absent stays soft; ambiguous never does.
  * `preProbeAddressConflict` (QB2): a single record-side `lstat` (NO connect) of the target's
  * canonical socket path; `indeterminate` (EACCES/unknown) fails loud rather than silently
  * claiming "no conflict". The decider's later `inspectSocket` probe is a SEPARATE step.
@@ -37,7 +40,7 @@ import { executeControlSocketSend, } from "./entwurf-v2-send.js";
 import { resolveDeadControlSendFallback } from "./entwurf-v2-send-fallback.js";
 import { executeSpawnBgResume } from "./entwurf-v2-spawn.js";
 import { makeProductionSpawnBgResumeDeps } from "./entwurf-v2-spawn-production.js";
-import { defaultMetaMailboxDir, defaultMetaSessionsDir, enqueueMetaMessage, metaCapabilityFor, metaRecordExistsByGardenId, readMetaIdentityByGardenId, readMetaReceiverMarker, } from "./meta-session.js";
+import { defaultMetaMailboxDir, defaultMetaSessionsDir, enqueueMetaMessage, metaCapabilityFor, metaRecordExistsByGardenId, readAddressableMetaIdentity, readMetaReceiverMarker, } from "./meta-session.js";
 import { resolveNativePushAdapter as realResolveNativePushAdapter, } from "./native-push/adapter.js";
 import { CONTROL_SOCKET_DIR, controlSocketPath, inspectControlSocketPath, inspectTargetControlSocket, isRecordLessSocketCandidate, } from "./socket-discovery.js";
 import { classifyConnectError, probeSocketLiveness } from "./socket-probe.js";
@@ -97,7 +100,7 @@ export function makeProductionEntwurfV2Deps(opts) {
     const s = opts.seams ?? {};
     const io = {
         metaRecordExists: s.metaRecordExists ?? metaRecordExistsByGardenId,
-        readIdentity: s.readIdentity ?? readMetaIdentityByGardenId,
+        readIdentity: s.readIdentity ?? readAddressableMetaIdentity,
         readReceiverMarker: s.readReceiverMarker ?? ((gid) => readMetaReceiverMarker({ gardenId: gid })),
         inspectPath: s.inspectPath ?? inspectControlSocketPath,
         acquireLock: s.acquireLock ?? realAcquireLock,

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-spawn-production.js

@@ -32,7 +32,7 @@ import * as fs from "node:fs/promises";
 import { getEntwurfExplicitExtensions, mirrorChildStderr, readSessionIdentity } from "./entwurf-core.js";
 import { buildResumePiArgs } from "./entwurf-resume-args.js";
 import { releaseLock } from "./entwurf-v2-lock.js";
-import { readMetaIdentityByGardenId } from "./meta-session.js";
+import { readAddressableMetaIdentity } from "./meta-session.js";
 import { inspectControlSocketPath, mapInspectionToLiveness } from "./socket-discovery.js";
 import { probeSocketLiveness } from "./socket-probe.js";
 /**
@@ -76,13 +76,19 @@ function requireProductionChild(child) {
  * record remembers whose it is — a mismatch means the transcriptPath is stale or
  * foreign, and resuming it would put a turn into a different being's session).
  *
+ * That check is per-record, and per-record is not enough: the v2 lock domain is keyed on
+ * GARDEN ID, so two records sharing one `nativeSessionId` would each pass their own
+ * integrity check and resume the SAME transcript concurrently under two different locks.
+ * Hence {@link readAddressableMetaIdentity} rather than the plain targeted read (#52) —
+ * a resume is exactly the moment a record stops being data and becomes an address.
+ *
  * Everything else is unchanged authority: readSessionIdentity (first model_change) for
  * provider/model/cwd, getEntwurfExplicitExtensions for bridge re-injection (#29 fail-fast).
  * Throws on anything that makes a resume impossible; each throw becomes the watcher's
  * `spawn-start-failed` (no child to watch → release), never a silent no-op.
  */
 export function resolveResumeLaunchIdentity(plan) {
-    const record = readMetaIdentityByGardenId(plan.sessionId);
+    const record = readAddressableMetaIdentity(plan.sessionId);
     if (record.backend !== "pi") {
         throw new Error(`entwurf-v2-spawn-production: ${plan.sessionId} is a ${record.backend} citizen — spawn-bg resume is the pi rail.`);
     }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-sender-identity.js

@@ -16,8 +16,13 @@
  * remains compatibility for an MCP host wrapper; the hook never writes a blind grandparent
  * marker because that may be the long-lived login shell.
  *
- * Two guards make a marker an IDENTITY rather than a hint, and a candidate is only trusted after
- * BOTH pass:
+ * Three guards make a marker an IDENTITY rather than a hint, and a candidate is only trusted
+ * after ALL of them pass:
+ *   0. a PLAUSIBLE owner (isPlausibleOwnerPid, shared with both writers and the generation cut):
+ *      pid <= 1 cannot own a session, and guard 1 cannot catch it — for as long as the host
+ *      is up, init IS still the very process the marker named. This is a rule about the
+ *      marker's CLAIM, not about the owner's state, which is why it is asked first and is
+ *      not opt-out (#53 A).
  *   1. pid + start-key (readMetaSenderMarker): the owner is still the very process that wrote it,
  *      so a dead session's pid, reused by something else, cannot inherit its garden-id.
  *   2. the backing meta-record: the record store is the authority — a marker whose record was
@@ -30,7 +35,7 @@
  * the answer depend on which pid or backend happened to be read first; here lookup order carries
  * no meaning, and two live identities are a refusal rather than a race.
  */
-import { metaRecordExistsByGardenId, parentPid, readMetaIdentityByGardenId, readMetaSenderMarker, } from "./meta-session.js";
+import { isPlausibleOwnerPid, metaRecordExistsByGardenId, parentPid, readMetaIdentityByGardenId, readMetaSenderMarker, } from "./meta-session.js";
 import { resolveNativePushAdapter } from "./native-push/adapter.js";
 /** Every native backend that mints a garden-id from its own hook and writes a sender marker. */
 export const META_SENDER_BACKENDS = ["claude-code", "antigravity"];
@@ -120,7 +125,13 @@ export function resolveTrustedMetaSenderIdentity(opts = {}) {
             markers.push(marker);
     }
     else {
-        const ownerPids = (opts.ownerPids ?? [process.ppid, parentPid(process.ppid) ?? 0]).filter((p) => typeof p === "number" && p > 0);
+        // The candidate filter asks the same question the marker readers ask — CAN this
+        // pid own a session — so it uses the same predicate rather than a second `> 0`
+        // literal. The default set is only the bridge's parent and grandparent, so init
+        // enters it just when the native host itself was reparented (a detached/daemonized
+        // Claude): narrow, but reachable, and a candidate that cannot be an owner has no
+        // business reaching the read at all (#53 A).
+        const ownerPids = (opts.ownerPids ?? [process.ppid, parentPid(process.ppid) ?? 0]).filter(isPlausibleOwnerPid);
         for (const ownerPid of [...new Set(ownerPids)]) {
             for (const backend of META_SENDER_BACKENDS) {
                 const marker = readMetaSenderMarker({ backend, ownerPid, sendersDir: opts.sendersDir });