@junghanacs/entwurf 0.12.8 → 0.12.9

package/pi-extensions/lib/entwurf-v2-spawn-production.ts

@@ -35,7 +35,7 @@ import { buildResumePiArgs } from "./entwurf-resume-args.ts";
 import type { LockClaim } from "./entwurf-v2-lock.ts";
 import { releaseLock } from "./entwurf-v2-lock.ts";
 import type { SpawnBgPlan, SpawnBgResumeDeps, SpawnedChild } from "./entwurf-v2-spawn.ts";
-import { readMetaIdentityByGardenId } from "./meta-session.ts";
+import { readAddressableMetaIdentity } from "./meta-session.ts";
 import { inspectControlSocketPath, type LstatLike, mapInspectionToLiveness } from "./socket-discovery.ts";
 import { probeSocketLiveness, type SocketLiveness } from "./socket-probe.ts";
 
@@ -120,13 +120,19 @@ export interface LaunchIdentity {
  * record remembers whose it is — a mismatch means the transcriptPath is stale or
  * foreign, and resuming it would put a turn into a different being's session).
  *
+ * That check is per-record, and per-record is not enough: the v2 lock domain is keyed on
+ * GARDEN ID, so two records sharing one `nativeSessionId` would each pass their own
+ * integrity check and resume the SAME transcript concurrently under two different locks.
+ * Hence {@link readAddressableMetaIdentity} rather than the plain targeted read (#52) —
+ * a resume is exactly the moment a record stops being data and becomes an address.
+ *
  * Everything else is unchanged authority: readSessionIdentity (first model_change) for
  * provider/model/cwd, getEntwurfExplicitExtensions for bridge re-injection (#29 fail-fast).
  * Throws on anything that makes a resume impossible; each throw becomes the watcher's
  * `spawn-start-failed` (no child to watch → release), never a silent no-op.
  */
 export function resolveResumeLaunchIdentity(plan: SpawnBgPlan): LaunchIdentity {
-	const record = readMetaIdentityByGardenId(plan.sessionId);
+	const record = readAddressableMetaIdentity(plan.sessionId);
 	if (record.backend !== "pi") {
 		throw new Error(
 			`entwurf-v2-spawn-production: ${plan.sessionId} is a ${record.backend} citizen — spawn-bg resume is the pi rail.`,

package/pi-extensions/lib/meta-sender-identity.ts

@@ -16,8 +16,13 @@
  * remains compatibility for an MCP host wrapper; the hook never writes a blind grandparent
  * marker because that may be the long-lived login shell.
  *
- * Two guards make a marker an IDENTITY rather than a hint, and a candidate is only trusted after
- * BOTH pass:
+ * Three guards make a marker an IDENTITY rather than a hint, and a candidate is only trusted
+ * after ALL of them pass:
+ *   0. a PLAUSIBLE owner (isPlausibleOwnerPid, shared with both writers and the generation cut):
+ *      pid <= 1 cannot own a session, and guard 1 cannot catch it — for as long as the host
+ *      is up, init IS still the very process the marker named. This is a rule about the
+ *      marker's CLAIM, not about the owner's state, which is why it is asked first and is
+ *      not opt-out (#53 A).
  *   1. pid + start-key (readMetaSenderMarker): the owner is still the very process that wrote it,
  *      so a dead session's pid, reused by something else, cannot inherit its garden-id.
  *   2. the backing meta-record: the record store is the authority — a marker whose record was
@@ -32,6 +37,7 @@
  */
 
 import {
+	isPlausibleOwnerPid,
 	type MetaBackend,
 	type MetaIdentity,
 	type MetaSenderMarker,
@@ -148,9 +154,13 @@ export function resolveTrustedMetaSenderIdentity(opts: ResolveTrustedMetaSenderO
 		const marker = readMetaSenderMarker({ markerPath: opts.markerPath });
 		if (marker) markers.push(marker);
 	} else {
-		const ownerPids = (opts.ownerPids ?? [process.ppid, parentPid(process.ppid) ?? 0]).filter(
-			(p): p is number => typeof p === "number" && p > 0,
-		);
+		// The candidate filter asks the same question the marker readers ask — CAN this
+		// pid own a session — so it uses the same predicate rather than a second `> 0`
+		// literal. The default set is only the bridge's parent and grandparent, so init
+		// enters it just when the native host itself was reparented (a detached/daemonized
+		// Claude): narrow, but reachable, and a candidate that cannot be an owner has no
+		// business reaching the read at all (#53 A).
+		const ownerPids = (opts.ownerPids ?? [process.ppid, parentPid(process.ppid) ?? 0]).filter(isPlausibleOwnerPid);
 		for (const ownerPid of [...new Set(ownerPids)]) {
 			for (const backend of META_SENDER_BACKENDS) {
 				const marker = readMetaSenderMarker({ backend, ownerPid, sendersDir: opts.sendersDir });