@junghanacs/entwurf 0.12.8 → 0.12.9

package/mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js

@@ -45,7 +45,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { defaultMetaMailboxDir, defaultMetaSessionsDir, upsertMetaSession, writeMetaReceiverMarker, writeMetaSenderMarker, } from "./lib/meta-session.js";
+import { defaultMetaMailboxDir, defaultMetaSessionsDir, isPlausibleOwnerPid, upsertMetaSession, writeMetaReceiverMarker, writeMetaSenderMarker, } from "./lib/meta-session.js";
 function logLine(level, message) {
     try {
         // dirname(meta-sessions) == the pi agent dir — no extra resolver export needed.
@@ -117,7 +117,12 @@ const META_HOOK_LAUNCH_TOKEN = "hook-launch/v1";
  *    no token means we do not know what our parent is, so we claim nothing.
  * 2. A PLAUSIBLE LIVE PARENT. A reparented orphan (ppid 0/1) is not an owner, and
  *    minting a marker for init would be exactly the "blind ancestor" false-positive
- *    the old ancestry walk existed to prevent.
+ *    the old ancestry walk existed to prevent. The rule is `isPlausibleOwnerPid`,
+ *    shared with the other writer and with every reader: this side already refused
+ *    what all three readers accepted, and one host's leftover `ownerPid: 1` marker
+ *    then blocked its fresh-cut until the file was deleted by hand (#53 A). A
+ *    predicate only one layer knows is how that drift happened, so it is no longer
+ *    written out by hand here.
  *
  * Failing closed costs only reply-addressability, and the doctor sees the ERROR. The
  * opposite — a marker keyed to a transient wrapper — is a lie a sender acts on.
@@ -126,7 +131,7 @@ function resolveMetaHookOwnerPid() {
     if (process.env[META_HOOK_LAUNCH_ENV] !== META_HOOK_LAUNCH_TOKEN)
         return null;
     const ownerPid = process.ppid;
-    if (!Number.isSafeInteger(ownerPid) || ownerPid <= 1)
+    if (!isPlausibleOwnerPid(ownerPid))
         return null;
     return ownerPid;
 }

package/mcp/entwurf-bridge/dist/scripts/agy-imprint.js

@@ -15,7 +15,7 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { parentPid, processStartKey, upsertMetaSession, writeMetaSenderMarker, } from "../pi-extensions/lib/meta-session.js";
+import { isPlausibleOwnerPid, parentPid, processStartKey, upsertMetaSession, writeMetaSenderMarker, } from "../pi-extensions/lib/meta-session.js";
 const NEUTRAL_RESPONSE = '{"injectSteps":[]}';
 function logPath() {
     const root = process.env.XDG_STATE_HOME || path.join(os.homedir(), ".local", "state");
@@ -141,8 +141,16 @@ function imprint(raw) {
         // Written only after the upsert above: the record store is the identity authority, and a
         // marker pointing at a garden-id with no record would be a window of un-backed identity.
         // A failed marker costs reply-addressability, never the session — log and move on.
+        //
+        // The owner rule is `isPlausibleOwnerPid`, the SAME predicate the Claude hook
+        // and every reader hold. This writer used to ask `> 0` on its own, so THIS hook
+        // could mint `meta-senders/antigravity/1.json` through the very reparenting that
+        // stranded a host's fresh-cut (#53 A): agy exits, the imprint is reparented to
+        // init, and `process.ppid` reads 1. Refusing is fail-closed — it costs reply
+        // addressability for that turn and is logged; honoring it would cost the operator
+        // their generation cut, with no in-band way to get it back.
         const ownerPid = process.ppid;
-        if (typeof ownerPid === "number" && ownerPid > 0) {
+        if (isPlausibleOwnerPid(ownerPid)) {
             try {
                 writeMetaSenderMarker({
                     backend: "antigravity",
@@ -157,6 +165,10 @@ function imprint(raw) {
                 logLine(`sender-marker-failed pid=${ownerPid} gardenId=${result.record.gardenId} ${err instanceof Error ? err.message : String(err)}`);
             }
         }
+        else {
+            logLine(`sender-marker-refused pid=${ownerPid} gardenId=${result.record.gardenId} implausible owner pid ` +
+                "(<= 1: this imprint was reparented, so its parent is not the agy process that owns the turn)");
+        }
     }
     catch (err) {
         logLine(`upsert-failed conversationId=${conversationId} ${err instanceof Error ? err.stack || err.message : String(err)}`);

package/mcp/entwurf-bridge/dist/scripts/meta-bridge-fresh-cut.js

@@ -24,7 +24,8 @@
  *   - meta-sessions/  (identity records)  → ARCHIVED  (`<dir>.archive-<ts>`)
  *   - meta-mailbox/   (messages+receipts) → ARCHIVED  (`<dir>.archive-<ts>`)
  *   - meta-senders/, meta-receivers/ markers → CLEARED (disposable process
- *     state; the quiesce gate has already proven every owner pid is gone)
+ *     state; the quiesce gate has already proven every owner pid is gone — or,
+ *     for a refuted marker, that no such owner could ever have existed)
  *   - control sockets (*.sock)            → CLEARED if probed dead (the GC
  *     rule: only a demonstrably dead socket may be unlinked)
  *   - native transcripts, andenken/embedding axes, install ownership state
@@ -50,6 +51,28 @@
  * Only a marker whose named owner demonstrably no longer holds that pid is dead,
  * and only a dead marker/socket is cleared.
  *
+ * ONE class is neither live, uncertain nor dead: a marker whose `ownerPid` cannot
+ * own anything (`<= 1` — init, or a non-pid number). It is REFUTED BY CONSTRUCTION
+ * rather than proven dead: after #53 A no writer in this tree can mint one
+ * (`isPlausibleOwnerPid` at both writers and at the write boundary), so on a current
+ * install it is LEGACY or CORRUPT residue — a pre-fix writer whose parent had been
+ * reparented to init (the retired shell-form Claude hook; the agy imprint, which
+ * asked only `> 0` until this cut), or a foreign/damaged marker, which is the only
+ * way a non-integer pid can appear at all. The one file actually observed was a
+ * shell-form Claude hook reparented to init.
+ *
+ * Reading it as an owner is not merely wrong, it is a trap: init runs for the whole
+ * boot and its start-key does not change while it does, so `classifyMarkerOwner`
+ * answers `live` and THE ACTION THIS REFUSAL PRESCRIBES CANNOT CHANGE THAT — the
+ * operator quiesces every session, exactly as told, and the cut refuses again.
+ * (Deleting the marker removes the claim rather than refuting the verdict, and a
+ * reboot recomputes the key with no contract either way — neither is a remedy this
+ * cut may lean on.) Meanwhile 0.12.8 names this very cut as the one repair for a
+ * pre-v3 store, so the host was stuck until the file was deleted by hand (#53 A,
+ * measured 2026-07-25). Such a marker is therefore clearable residue, swept with the
+ * dead ones but COUNTED AND REPORTED APART from them, because invalidity and death
+ * are different findings.
+ *
  * THE MARKER WALK IS NOT THE WHOLE WORLD. A native-push (agy) citizen is registered
  * with NO marker of any kind and is dispatched straight off its record, so marker
  * absence is its NORMAL deliverable state — a socket+marker scan would call such a host
@@ -69,13 +92,22 @@
  * renames reports exactly what already moved (`archived so far:`) and a re-run
  * finishes the cut with its own stamp.
  * Running on a clean/empty host just opens a fresh generation and says so.
+ *
+ * EXIT CONTRACT (#54) — `FRESH_CUT_EXIT`, defined beside the verb's own name in
+ * meta-session.ts because a runbook and a gate must read the same numbers:
+ * `0` complete · `1` nothing moved · `2` usage · `3` cut transition incomplete ·
+ * `4` cut complete but marker/socket cleanup incomplete. The three failure states
+ * were all hidden behind one `1` before, which is why the documented `fresh-cut && setup` chain stopped
+ * identically on a refusal that changed nothing and on a cut that had already
+ * unblocked the install. Only `0` is success — #54 asked for the states to become
+ * DISTINGUISHABLE, not for a failed sweep to become a pass.
  */
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { CONTROL_SOCKET_SUFFIX, defaultControlSocketDir } from "../pi-extensions/lib/control-socket-path.js";
 import { nativePushSupported } from "../pi-extensions/lib/entwurf-v2-contract.js";
-import { classifyMarkerOwner, defaultMetaMailboxDir, defaultMetaReceiversDir, defaultMetaSendersDir, defaultMetaSessionsDir, parseMetaIdentity, probePidExistence, processStartKey, } from "../pi-extensions/lib/meta-session.js";
+import { classifyMarkerOwner, defaultMetaMailboxDir, defaultMetaReceiversDir, defaultMetaSendersDir, defaultMetaSessionsDir, FRESH_CUT_EXIT, isPlausibleOwnerPid, midCutExit, parseMetaIdentity, probePidExistence, processStartKey, } from "../pi-extensions/lib/meta-session.js";
 import { resolveNativePushAdapter } from "../pi-extensions/lib/native-push/adapter.js";
 import { probeSocketLiveness } from "../pi-extensions/lib/socket-probe.js";
 function usage(code) {
@@ -91,6 +123,20 @@ function usage(code) {
         "store   = ENTWURF_META_SESSIONS_DIR || <PI_CODING_AGENT_DIR|~/.pi/agent>/meta-sessions",
         "mailbox = ENTWURF_META_MAILBOX_DIR  || <PI_CODING_AGENT_DIR|~/.pi/agent>/meta-mailbox",
         "sockets = ENTWURF_DIR               || ~/.pi/entwurf-control",
+        "",
+        "EXIT CONTRACT (#54) — what already moved, not how bad it was:",
+        `  ${FRESH_CUT_EXIT.COMPLETE}  cut complete: generation archived (or none existed), fresh v3 store open,`,
+        "     residue cleared. `&& setup` is correct here.",
+        `  ${FRESH_CUT_EXIT.NO_MOVE}  NOTHING MOVED: a live/unprovable surface, an occupied archive destination,`,
+        "     an unreadable surface, or a first rename that failed. The host is unchanged —",
+        "     fix the named cause and re-run. Do NOT run setup: the store it refused is still there.",
+        `  ${FRESH_CUT_EXIT.USAGE}  usage.`,
+        `  ${FRESH_CUT_EXIT.HALF_CUT}  CUT TRANSITION INCOMPLETE: at least one archive move happened,`,
+        "     but the fresh generation is not confirmed open. Inspect, or re-run to finish under a new stamp.",
+        `  ${FRESH_CUT_EXIT.CLEANUP_INCOMPLETE}  CUT COMPLETE, CLEANUP INCOMPLETE: the generation IS archived and the fresh`,
+        "     generation IS open — install and citizen birth are unblocked, so setup may run —",
+        "     but marker/socket residue survived. Prefer fixing it and re-running BEFORE setup; after new citizen birth,",
+        "     remove the named residue manually instead of archiving the new generation with another cut.",
     ].join("\n"));
     process.exit(code);
 }
@@ -163,16 +209,17 @@ function classifySurfaceDir(dir) {
 function inspectMarkers(dir, label) {
     const violations = [];
     const deadFiles = [];
+    const refutedFiles = [];
     const markerFiles = [];
     const uncertain = (shown, why) => {
         violations.push({ surface: label, detail: `${shown} — ${why}`, kind: "uncertain" });
     };
     const dirState = classifySurfaceDir(dir);
     if (dirState.state === "absent")
-        return { violations, deadFiles };
+        return { violations, deadFiles, refutedFiles };
     if (dirState.state !== "directory") {
         uncertain(dir, `surface could not be inspected (${dirState.detail}): an unreadable surface is not a quiesced one`);
-        return { violations, deadFiles };
+        return { violations, deadFiles, refutedFiles };
     }
     // depth 0 = the marker root, depth 1 = a backend subdir. Nothing deeper is part
     // of any marker layout, so it is inspected by hand rather than swept.
@@ -213,12 +260,28 @@ function inspectMarkers(dir, label) {
             uncertain(shown, `unreadable marker (${err instanceof Error ? err.message : String(err)}): owner unprovable`);
             continue;
         }
-        const ownerPid = typeof raw.ownerPid === "number" && Number.isInteger(raw.ownerPid) && raw.ownerPid > 0 ? raw.ownerPid : null;
-        const ownerStartKey = typeof raw.ownerStartKey === "string" ? raw.ownerStartKey : "";
-        if (ownerPid === null) {
-            uncertain(shown, "no positive-integer `ownerPid`: owner unprovable");
+        // Two different failures, deliberately kept apart. NO numeric `ownerPid` means the
+        // marker never NAMED an owner — unprovable, so it refuses the cut like every other
+        // unreadable marker. A numeric one that cannot own (`<= 1`, non-integer, unsafe)
+        // IS a claim, and it is refuted BY CONSTRUCTION: no writer in this tree can mint it
+        // any more, and on the axis this repo certifies "this session is owned by init" is
+        // false on its face (a container harness running AS pid 1 is a real but UNSUPPORTED
+        // shape — see isPlausibleOwnerPid; it fails closed at the writers). That is a
+        // proof of INVALIDITY — strictly stronger than the proof of death this loop already
+        // acts on — so it is clearable residue, never `live` and never `uncertain`. Without
+        // this row a single reparented-owner marker left quiescence unprovable by the ONE
+        // action the refusal prescribes, and the repair 0.12.8 names could not run until
+        // the file was deleted by hand (#53 A, measured 2026-07-25).
+        if (typeof raw.ownerPid !== "number") {
+            uncertain(shown, "no numeric `ownerPid`: owner unprovable");
+            continue;
+        }
+        if (!isPlausibleOwnerPid(raw.ownerPid)) {
+            refutedFiles.push(file);
             continue;
         }
+        const ownerPid = raw.ownerPid;
+        const ownerStartKey = typeof raw.ownerStartKey === "string" ? raw.ownerStartKey : "";
         if (ownerStartKey === "") {
             uncertain(shown, "no `ownerStartKey`: a bare pid cannot distinguish the owner from a reused pid");
             continue;
@@ -242,7 +305,7 @@ function inspectMarkers(dir, label) {
             deadFiles.push(file);
         }
     }
-    return { violations, deadFiles };
+    return { violations, deadFiles, refutedFiles };
 }
 /**
  * The native-push surface — the ONE live citizen kind that leaves no marker behind.
@@ -266,7 +329,8 @@ function inspectMarkers(dir, label) {
  * record this walk skips, and the claim is deliberately narrow: NOT "that native session
  * has exited", only "these bytes are not an address authority in the live runtime, so
  * they front no current-generation garden surface". Every path that ADDRESSES a citizen
- * goes through the live schema — `readMetaIdentityByGardenId`, the v2 `resolveTarget`,
+ * goes through the live schema — `readAddressableMetaIdentity` (v2 `resolveTarget` and
+ * the pi resume), `readMetaIdentityByGardenId` (the relay reads),
  * the sender-marker trust — and each THROWS on a record this parser refuses, so nothing
  * can dispatch to it. (`entwurf_peers` still LISTS it as a diagnostic; a facts surface
  * reporting what it could not read is not an address.) A record we CAN read is the
@@ -352,12 +416,41 @@ async function inspectNativePushCitizens(storeDir) {
     }
     return violations;
 }
+/**
+ * Remove the files a completed cut is contracted to clear, and report what it could
+ * not. ENOENT is the ONLY tolerated failure — the file raced away, which is the goal
+ * state. Every other errno is a real refusal to delete (EACCES, EPERM under a
+ * sticky-bit parent, EROFS, an immutable attribute, an LSM denial), and a bare
+ * `catch {}` here would launder all of them into "raced away" while the command's own
+ * output still said `cleared:`. That is the Crash-Don't-Warn shape this repo removes,
+ * not a shortcut it tolerates — the caller decides what to do with the failures,
+ * because by this point the archive has already moved and throwing would cost the
+ * operator the story of what DID happen.
+ */
+function clearFiles(files) {
+    const failures = [];
+    let cleared = 0;
+    for (const file of files) {
+        try {
+            fs.unlinkSync(file);
+            cleared += 1;
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                continue; // raced away — already gone is the goal state
+            failures.push({ file, reason: err instanceof Error ? err.message : String(err) });
+        }
+    }
+    return { cleared, failures };
+}
+/** Surfaces this process has already renamed into an archive — see the rename loop. */
+let archivedSoFar = 0;
 async function main() {
     const args = process.argv.slice(2);
     if (args.includes("-h") || args.includes("--help"))
-        usage(0);
+        usage(FRESH_CUT_EXIT.COMPLETE);
     if (args.length > 0)
-        usage(2);
+        usage(FRESH_CUT_EXIT.USAGE);
     const storeDir = defaultMetaSessionsDir();
     const mailboxDir = defaultMetaMailboxDir();
     const sendersDir = defaultMetaSendersDir();
@@ -438,7 +531,7 @@ async function main() {
             "address archived out from under it, and an unprovable owner is not a dead one. " +
             "Quiesce those sessions (close them / let them exit), inspect anything listed UNCERTAIN, " +
             "then re-run the same command. Nothing was moved.");
-        return 1;
+        return FRESH_CUT_EXIT.NO_MOVE;
     }
     // ── the cut: plan the moves, preflight the whole plan, then rename ───────
     const ts = stamp();
@@ -484,9 +577,15 @@ async function main() {
         console.error(`REFUSE: ${collisions.length} archive destination(s) above already exist — this generation's stamp is ` +
             "taken (a cut in the same second, or leftovers from an interrupted one). Nothing was moved: " +
             "wait a second and re-run, or move those directories aside first.");
-        return 1;
+        return FRESH_CUT_EXIT.NO_MOVE;
     }
     const archived = [];
+    // Mirrored to module scope for the ONE reader that cannot see this array: the
+    // top-level rejection handler. Everything from here on can still throw — the
+    // `mkdirSync` that opens the fresh generation, most obviously — and a handler that
+    // answered a flat `1` there would tell a runbook "nothing moved" about a host whose
+    // generation is already in an archive. A single-shot CLI may hold one fact in module
+    // scope when the alternative is an exit status that lies (#54).
     for (const { src, dest } of plan) {
         try {
             fs.renameSync(src, dest);
@@ -510,20 +609,20 @@ async function main() {
                     "not. Fix the cause and re-run the same command — the re-run archives the remainder under its " +
                     "own stamp — or inspect by hand.");
             }
-            return 1;
+            // The prose above already distinguished these two; the STATUS did not, and a
+            // runbook reads the status (#54). `midCutExit` is the SSOT so the words and the
+            // number cannot drift apart.
+            return midCutExit(archived.length);
         }
         archived.push(dest);
+        archivedSoFar = archived.length;
     }
-    let cleared = 0;
-    for (const file of [...senders.deadFiles, ...receivers.deadFiles, ...deadSockets]) {
-        try {
-            fs.unlinkSync(file);
-            cleared += 1;
-        }
-        catch {
-            // raced away — already gone is the goal state
-        }
-    }
+    // Both sweeps go through ONE remover so they cannot drift to different meanings of
+    // "could not remove". Counted APART, because a dead marker is an owner we PROVED
+    // left while a refuted one never named an owner that could exist, and folding the
+    // two would dress a proof of invalidity up as a proof of death.
+    const dead = clearFiles([...senders.deadFiles, ...receivers.deadFiles, ...deadSockets]);
+    const refuted = clearFiles([...senders.refutedFiles, ...receivers.refutedFiles]);
     fs.mkdirSync(storeDir, { recursive: true });
     fs.mkdirSync(mailboxDir, { recursive: true });
     if (archived.length === 0) {
@@ -533,15 +632,42 @@ async function main() {
         for (const dir of archived)
             console.log(`archived: ${dir}`);
     }
-    if (cleared > 0)
-        console.log(`cleared: ${cleared} dead marker/socket file(s) (disposable process state)`);
+    if (dead.cleared > 0)
+        console.log(`cleared: ${dead.cleared} dead marker/socket file(s) (disposable process state)`);
+    if (refuted.cleared > 0) {
+        console.log(`refuted: ${refuted.cleared} legacy/corrupt marker(s) named an owner pid that cannot own a session ` +
+            "(<= 1, or not a pid at all); REFUTED BY CONSTRUCTION, not proven dead, and cleared. The observed " +
+            "case was a hook reparented to init before it read its own parent.");
+    }
     console.log(`fresh generation open: ${storeDir} (empty, v3-only)`);
     console.log("untouched: native transcripts, andenken/embedding memory axes, install state. " +
         "The archive is forensic only — no runtime reads it and there is no restore verb.");
-    return 0;
+    // The generation IS cut by now, so a cleanup failure must not throw away that
+    // story — but it must not be swallowed either: this command's own report claims
+    // the residue was "cleared". Say exactly which files survived and why, keep the
+    // success lines above (this is not a half-cut), and exit nonzero so no caller
+    // reads a partial sweep as a clean one.
+    const cleanupFailures = [...dead.failures, ...refuted.failures];
+    if (cleanupFailures.length > 0) {
+        for (const { file, reason } of cleanupFailures)
+            console.error(`FAIL post-cut cleanup: ${file} — ${reason}`);
+        console.error(`FAIL post-cut cleanup: ${cleanupFailures.length} marker/socket file(s) above could NOT be removed. The ` +
+            "generation was archived and the fresh generation is open — this is not a half-cut, and install/citizen " +
+            "birth are no longer blocked by the store. What survived is disposable process state sitting in the new " +
+            "generation's surfaces, and it will refuse the NEXT cut. Fix the cause (permissions, a read-only mount, " +
+            `an immutable attribute) and re-run the same command BEFORE \`setup\`, or remove those files by hand. EXIT ` +
+            `${FRESH_CUT_EXIT.CLEANUP_INCOMPLETE}: the cut is DONE, so \`setup\` may proceed — but once a new citizen is ` +
+            "born, another fresh-cut would archive that new generation too; repair the named residue manually instead.");
+        return FRESH_CUT_EXIT.CLEANUP_INCOMPLETE;
+    }
+    return FRESH_CUT_EXIT.COMPLETE;
 }
 main().then((code) => process.exit(code), (err) => {
     console.error(err instanceof Error ? (err.stack ?? err.message) : String(err));
     console.error("FAIL: fresh-cut did not complete — the message above names the cause; re-run after fixing it.");
-    process.exit(1);
+    // Not a flat 1: the ONE thing a caller must know from a crash is whether the host
+    // still holds its generation. Every refusal that reaches here from before the first
+    // rename really is a no-op (its own message says so); anything after it is a
+    // an incomplete cut transition and must not be mistaken for a no-op (#54).
+    process.exit(midCutExit(archivedSoFar));
 });

package/mcp/entwurf-bridge/src/index.ts

@@ -40,8 +40,7 @@
  *   - no user-specific paths baked in; env-configurable with safe defaults
  */
 
-import { existsSync, readFileSync } from "node:fs";
-import * as fs from "node:fs/promises";
+import { existsSync } from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import * as process from "node:process";
@@ -63,6 +62,8 @@ import {
 import {
 	defaultMetaMailboxDir,
 	defaultMetaSessionsDir,
+	makeStoreRecordReader,
+	readActiveStoreEntries,
 	readMetaInbox,
 	readMetaReceiverMarker,
 } from "../../../pi-extensions/lib/meta-session.ts";
@@ -441,18 +442,15 @@ server.tool(
 	{},
 	async () => {
 		try {
-			// Meta-store axis: list `.meta.json` entries (ENOENT = fresh install =
-			// empty; any other readdir failure is a real error, not a silent empty).
+			// Meta-store axis: entries WITH their kind (ENOENT = fresh install = empty; any
+			// other readdir failure is a real error, not a silent empty). The name-only
+			// readdir that used to live here made rule 1 unenforceable on this surface —
+			// `readRecord` would follow a symlinked `.meta.json` to bytes the store does not
+			// own, while the doctor refused that same entry. One store, one contract.
 			const sessionsDir = defaultMetaSessionsDir();
-			let metaEntries: string[] = [];
-			try {
-				metaEntries = (await fs.readdir(sessionsDir)).filter((n) => n.endsWith(".meta.json"));
-			} catch (err) {
-				if ((err as NodeJS.ErrnoException)?.code !== "ENOENT") throw err;
-			}
 			const result = await listEntwurfFacts({
-				metaEntries,
-				readRecord: (filename) => readFileSync(path.join(sessionsDir, filename), "utf8"),
+				metaEntries: readActiveStoreEntries(sessionsDir),
+				readRecord: makeStoreRecordReader(sessionsDir),
 				// Socket axis: the same dir dispatch uses (grammar SSOT), scan-internal only.
 				socket: { dir: ENTWURF_DIR },
 			});

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.12.8",
+	"version": "0.12.9",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {
@@ -78,16 +78,16 @@
 		"zod": "^3.25.0 || ^4.0.0"
 	},
 	"peerDependencies": {
-		"@earendil-works/pi-ai": ">=0.82.0 <0.83",
-		"@earendil-works/pi-coding-agent": ">=0.82.0 <0.83",
-		"@earendil-works/pi-tui": ">=0.82.0 <0.83",
+		"@earendil-works/pi-ai": ">=0.82.1 <0.83",
+		"@earendil-works/pi-coding-agent": ">=0.82.1 <0.83",
+		"@earendil-works/pi-tui": ">=0.82.1 <0.83",
 		"typebox": "*"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.4.13",
-		"@earendil-works/pi-ai": "0.82.0",
-		"@earendil-works/pi-coding-agent": "0.82.0",
-		"@earendil-works/pi-tui": "0.82.0",
+		"@earendil-works/pi-ai": "0.82.1",
+		"@earendil-works/pi-coding-agent": "0.82.1",
+		"@earendil-works/pi-tui": "0.82.1",
 		"@types/node": "^24.3.0",
 		"husky": "^9.1.7",
 		"typescript": "^6.0.2"

package/pi-extensions/entwurf-control.ts

@@ -61,7 +61,7 @@
  *    Send-is-throw cleanup; see note above.)
  */
 
-import { existsSync, promises as fs, readFileSync } from "node:fs";
+import { existsSync, promises as fs } from "node:fs";
 import * as net from "node:net";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -525,7 +525,7 @@ const renderSessionMessage: MessageRenderer = (message, { expanded }, theme) =>
 // from the native call site until the schema grows the field.
 interface SentBoxData {
 	to: string; // target sessionId
-	from?: string; // sender agentId, e.g. "entwurf/claude-opus-4-8"
+	from?: string; // sender agentId, e.g. "entwurf/claude-opus-5"
 	cwd?: string; // sender cwd (raw, abbreviateHome applied at render)
 	timestamp?: string; // ISO 8601 UTC; rendered in KST
 	mode?: string; // "steer" | "follow_up" | string passed through
@@ -1396,7 +1396,7 @@ The decider — not this surface — chooses the transport.`,
 
 interface EntwurfFactProviderModule {
 	listEntwurfFacts(params: {
-		metaEntries: readonly string[];
+		metaEntries: readonly { filename: string; regularFile: boolean }[];
 		readRecord: (filename: string) => string;
 		socket: { dir: string };
 	}): Promise<unknown>;
@@ -1408,22 +1408,22 @@ interface EntwurfPeersRenderModule {
 
 interface MetaSessionModule {
 	defaultMetaSessionsDir(): string;
+	readActiveStoreEntries(dir: string): { filename: string; regularFile: boolean }[];
+	makeStoreRecordReader(dir: string): (filename: string) => string;
 }
 
 async function renderEntwurfPeersForSurface(): Promise<{ text: string; payload: unknown }> {
 	const meta = (await import(META_SESSION_MODULE)) as unknown as MetaSessionModule;
 	const sessionsDir = meta.defaultMetaSessionsDir();
-	let metaEntries: string[] = [];
-	try {
-		metaEntries = (await fs.readdir(sessionsDir)).filter((name) => name.endsWith(".meta.json"));
-	} catch (err) {
-		if ((err as NodeJS.ErrnoException)?.code !== "ENOENT") throw err;
-	}
-
+	// Entries carry their KIND. The name-only readdir this used to do left `readRecord`
+	// free to follow a symlinked `.meta.json` into bytes the store does not own — rule 1
+	// held in the doctor and not on the surface operators actually read (pre-existing;
+	// surfaced by the #52 duplicate pass, which would let such a symlink quarantine the
+	// healthy record it shadowed).
 	const provider = (await import(ENTWURF_FACT_PROVIDER_MODULE)) as unknown as EntwurfFactProviderModule;
 	const result = await provider.listEntwurfFacts({
-		metaEntries,
-		readRecord: (filename) => readFileSync(path.join(sessionsDir, filename), "utf8"),
+		metaEntries: meta.readActiveStoreEntries(sessionsDir),
+		readRecord: meta.makeStoreRecordReader(sessionsDir),
 		// Same socket axis as the legacy live-session scan, but merged with the
 		// meta-record rail by listEntwurfFacts so meta-mailbox citizens are discoverable too.
 		socket: { dir: ENTWURF_DIR },

package/pi-extensions/lib/acp/models.ts

@@ -18,14 +18,14 @@
 // Why `/compat` and NOT the 0.80 provider-factory subpath (the pi-ai
 // providers/anthropic subpath): this file is loaded by pi's
 // EXTENSION loader (pi-coding-agent `core/extensions/loader.ts`), whose jiti
-// alias map resolves ONLY three pi-ai specifiers for extensions — the bare root,
-// `/compat`, and `/oauth` — all to `ai/dist/compat.js`. A `providers/*` subpath
-// is NOT in that map: jiti prefix-matches the bare `@earendil-works/pi-ai` alias
-// and appends the remainder, yielding the unresolvable
-// `…/dist/compat.js/providers/anthropic` (verified live: extension load crash,
-// invisible to static typecheck which resolves against node_modules `exports`).
-// So `/compat` is the SINGLE sanctioned extension entrypoint for the old global
-// model-catalog API, and the SINGLE allowlisted exception in
+// alias map resolves FOUR pi-ai specifiers for extensions — the bare root,
+// `/compat`, `/oauth`, and (since pi 0.81) `/providers/all`. Other `providers/*`
+// subpaths are NOT in that map: jiti prefix-matches the bare
+// `@earendil-works/pi-ai` alias and appends the remainder, yielding the
+// unresolvable `…/dist/compat.js/providers/anthropic` (verified live: extension
+// load crash, invisible to static typecheck which resolves against node_modules
+// `exports`). So `/compat` remains the SINGLE sanctioned extension entrypoint
+// this repo uses for the old global model-catalog API, and the SINGLE allowlisted exception in
 // `run.sh check-pi-import-surface`. `getModels` here is compat's deprecated
 // re-export of `getBuiltinModels`. When pi removes compat we migrate to whatever
 // the loader then exposes.
@@ -50,13 +50,13 @@ export const ENTWURF_ACP_NO_AUTH_SENTINEL = "entwurf-no-auth";
 // both axes (protocol smoke + agent interview) — do not extend casually.
 // Exported so the claude backend adapter (backend-adapter.ts) can answer
 // `routeModel` without re-deriving the set from curatedClaudeModels().
-export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-4-8"] as const;
+export const SUPPORTED_ANTHROPIC_MODEL_IDS = ["claude-sonnet-5", "claude-opus-5"] as const;
 
 /** The anchor model whose absence is a hard registry regression, not a soft skip. */
-export const CURATED_ANCHOR_MODEL_ID = "claude-opus-4-8";
+export const CURATED_ANCHOR_MODEL_ID = "claude-opus-5";
 
-// Anthropic's registry reports 1M for both Sonnet 5 and Opus 4.8, and the
-// entwurf surface now exposes the full 1M for BOTH. Sonnet 5's 1M window is the
+// Anthropic's registry reports 1M for both Sonnet 5 and Opus 5, and the
+// entwurf surface exposes the full 1M for BOTH. Sonnet 5's 1M window is the
 // whole point of the 0.12.3 bump — it is the compact-free long-context floor the
 // earlier 200K Sonnet cap could not provide. We still clamp to a 1M ceiling so a
 // future registry value can't silently inflate the surface past what we verify.

package/pi-extensions/lib/entwurf-fact-provider.ts

@@ -29,7 +29,12 @@
 
 import { type FactList, isNonPiGardenIdSocketConflict, resolveFactList } from "./entwurf-facts.ts";
 import { isLivenessSupported } from "./entwurf-v2-contract.ts";
-import { FRESH_CUT_PRESCRIPTION, listAllMetaIdentities, type MetaCitizenBackend } from "./meta-session.ts";
+import {
+	type ActiveStoreEntry,
+	FRESH_CUT_PRESCRIPTION,
+	listAllMetaIdentities,
+	type MetaCitizenBackend,
+} from "./meta-session.ts";
 import { type SocketScanDeps, scanSocketProbes } from "./socket-discovery.ts";
 import type { SocketLiveness } from "./socket-probe.ts";
 
@@ -82,7 +87,9 @@ export interface EntwurfFactsResult {
 
 export interface EntwurfFactsDeps {
 	/** Meta-store axis: the `.meta.json` entry names + a record reader. */
-	metaEntries: readonly string[];
+	/** Store entries WITH their kind (`readActiveStoreEntries`), never bare names: the
+	 * listing must be able to refuse a symlinked record without following it. */
+	metaEntries: readonly ActiveStoreEntry[];
 	readRecord: (filename: string) => string;
 	/** Socket axis: injected into scanSocketProbes (controlDir/readdir/probe). */
 	socket?: Partial<SocketScanDeps>;

package/pi-extensions/lib/entwurf-v2-production.ts

@@ -21,6 +21,9 @@
  *
  * `resolveTarget` (QB1): a MISSING meta-record is a soft `bad-target` (identity:null); a
  * PRESENT-but-corrupt record fails LOUD (the read throws drift) — never matched by string.
+ * "Corrupt" includes a record that does not hold its `nativeSessionId` alone (#52): the read
+ * here is the ADDRESSABLE one, so the store-wide uniqueness half runs at this boundary and
+ * nowhere cheaper. Absent stays soft; ambiguous never does.
  * `preProbeAddressConflict` (QB2): a single record-side `lstat` (NO connect) of the target's
  * canonical socket path; `indeterminate` (EACCES/unknown) fails loud rather than silently
  * claiming "no conflict". The decider's later `inspectSocket` probe is a SEPARATE step.
@@ -84,7 +87,7 @@ import {
 	type MetaReceiverMarker,
 	metaCapabilityFor,
 	metaRecordExistsByGardenId,
-	readMetaIdentityByGardenId,
+	readAddressableMetaIdentity,
 	readMetaReceiverMarker,
 } from "./meta-session.ts";
 import {
@@ -110,6 +113,9 @@ import { classifyConnectError, probeSocketLiveness, type SocketLiveness } from "
  */
 export interface ProductionEntwurfV2Seams {
 	metaRecordExists: (gid: string, sessionsDir: string) => boolean;
+	/** The ADDRESSABLE read (#52): the per-entry contract plus store-wide `nativeSessionId`
+	 * uniqueness. This is a dispatch, so the id it returns is about to become an address —
+	 * a duplicate here would direct-inject one native session under two garden ids. */
 	readIdentity: (gid: string, sessionsDir: string) => MetaIdentity;
 	/** Read the target's receiver presence marker (null = absent / dead owner / corrupt). The
 	 * SE-2 2d-3 active-receiver source; the factory's `mailboxDeliverabilityFor` closure verifies
@@ -222,7 +228,7 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 	const s = opts.seams ?? {};
 	const io: ProductionEntwurfV2Seams = {
 		metaRecordExists: s.metaRecordExists ?? metaRecordExistsByGardenId,
-		readIdentity: s.readIdentity ?? readMetaIdentityByGardenId,
+		readIdentity: s.readIdentity ?? readAddressableMetaIdentity,
 		readReceiverMarker: s.readReceiverMarker ?? ((gid: string) => readMetaReceiverMarker({ gardenId: gid })),
 		inspectPath: s.inspectPath ?? inspectControlSocketPath,
 		acquireLock: s.acquireLock ?? realAcquireLock,