@junghanacs/entwurf 0.12.8 → 0.12.9

package/pi-extensions/meta-bridge-hook.ts

@@ -49,6 +49,7 @@ import * as path from "node:path";
 import {
 	defaultMetaMailboxDir,
 	defaultMetaSessionsDir,
+	isPlausibleOwnerPid,
 	type MetaReceiverArmProvenance,
 	upsertMetaSession,
 	writeMetaReceiverMarker,
@@ -140,7 +141,12 @@ const META_HOOK_LAUNCH_TOKEN = "hook-launch/v1";
  *    no token means we do not know what our parent is, so we claim nothing.
  * 2. A PLAUSIBLE LIVE PARENT. A reparented orphan (ppid 0/1) is not an owner, and
  *    minting a marker for init would be exactly the "blind ancestor" false-positive
- *    the old ancestry walk existed to prevent.
+ *    the old ancestry walk existed to prevent. The rule is `isPlausibleOwnerPid`,
+ *    shared with the other writer and with every reader: this side already refused
+ *    what all three readers accepted, and one host's leftover `ownerPid: 1` marker
+ *    then blocked its fresh-cut until the file was deleted by hand (#53 A). A
+ *    predicate only one layer knows is how that drift happened, so it is no longer
+ *    written out by hand here.
  *
  * Failing closed costs only reply-addressability, and the doctor sees the ERROR. The
  * opposite — a marker keyed to a transient wrapper — is a lie a sender acts on.
@@ -148,7 +154,7 @@ const META_HOOK_LAUNCH_TOKEN = "hook-launch/v1";
 function resolveMetaHookOwnerPid(): number | null {
 	if (process.env[META_HOOK_LAUNCH_ENV] !== META_HOOK_LAUNCH_TOKEN) return null;
 	const ownerPid = process.ppid;
-	if (!Number.isSafeInteger(ownerPid) || ownerPid <= 1) return null;
+	if (!isPlausibleOwnerPid(ownerPid)) return null;
 	return ownerPid;
 }
 

package/run.sh

@@ -90,7 +90,7 @@ Usage:
   ./run.sh check-meta-mailbox-state-write # deterministic gate (0.11 Stage 0 step 3D-4 commit2): post-cut receipt is state-only — meta-record file byte-identical across enqueue/read, state carries lastEnqueuedAt/lastReadAt (field isolation), empty inbox no-op on record+state, drift surfaces; no API
   ./run.sh check-meta-receiver-marker # deterministic gate (SE-2): receiver marker round-trip/start-key/provenance, UserPromptSubmit cannot mint presence, reader does not gate on record existence — marker SEMANTICS only; launch topology moved to check-hook-launch-topology
   ./run.sh check-hook-launch-topology # #51 gate 1: shipped hooks.json is exec form through hook-launch.sh, launcher is loud on an empty argv (older Claude's silent args drop), exec preserves the pid so the hook's parent is Claude, and a space/$/backtick plugin path survives as one argv element
-  ./run.sh check-meta-identity-consumers # deterministic gate: V3-only consumer seam — read/scan by body, foreign-generation reads name fresh-cut, the strict upsert refuses an unreadable store before any write, G1 duplicate ambiguity throw, no API
+  ./run.sh check-meta-identity-consumers # deterministic gate: V3-only consumer seam — per-entry targeted read + addressable read snapshot uniqueness, non-regular rivals never read, drift/unparseable rivals unreachable, unreadable regular rivals fail loud; strict upsert refuses an unreadable store before any write, no API
   ./run.sh check-meta-capability-source # deterministic gate (0.11 Stage 0 step 3D-3): capability-source cut-over — mint/parse read wakeMode/deliveryLevel from the registry (metaCapabilityFor, registry-driven via injection), not META_BACKEND_DESCRIPTORS; behaviour-preserving (registry ≡ const); the record.delivery slot 3D-3 preserved was deleted by 3D-4, no API
   ./run.sh check-socket-probe          # deterministic gate (0.11 Stage 0, F3): three-valued control-socket liveness (alive|dead|indeterminate) — GC reclaims dead only, indeterminate survives; pure classify + 2-socket integration, no API
   ./run.sh check-project-trust-handler # deterministic gate (0.11 Stage 0, Trust 2층): project_trust handler — decideProjectTrust matrix (escape=inherited-false+interactive+trust-here→{yes,remember:true}; non-interactive→undecided; never undefined) + adapter single-writer, fake prompt, no UI
@@ -112,7 +112,7 @@ Usage:
   ./run.sh smoke-agy-native-push-live  # 봉인 8 LIVE acceptance for the native-push (agy) rail — OUT of pnpm check, needs LIVE=1 + AGY_CONVERSATION_ID (a live agy conversation). Drives the REAL antigravity adapter + register core + runEntwurfV2 (production deps): doctor-static preflight (dangling→FAIL, the ③ gate), probe route, register create/attach idempotency, fire→native-push delivered, post-send re-probe (D7 partial), owned-outcome→native-push-no-resume-authority, bogus-conv→native-push-probe-indeterminate. Meta-store isolated to a temp dir (only the agy round-trip is real; no real-store residue). LIVE=1 AGY_CONVERSATION_ID=<convId> ./run.sh smoke-agy-native-push-live
   ./run.sh check-entwurf-facts         # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 1+2): PURE PeerFact core + resolveFactList union — R1 out-of-domain→unsupported, R3b pi 4-value, facts-only keyset; union: PeerFact + RecordLessSocketFact by gardenId (#50 C4: record-less socket = diagnostic subject, gid+liveness only), dormant→dead, F3 indeterminate preserved, non-pi+socket fail-loud; pure, no IO
   ./run.sh check-socket-discovery      # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 3): SOCKET-axis scanSocketProbes — probes (dir sockets) ∪ (in-domain citizen canonical paths) 3-valued; dormant citizen no-file → dead (resumable, not unprobed), stall → indeterminate (F3), dir hygiene/dedup/missing-dir + e2e → resolveFactList; readdir/probe injected, no IO
-  ./run.sh check-meta-listing          # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4a): META-STORE axis listAllMetaIdentities — explicit-partial: parse failure / body-filename drift → explicit {filename,message} error (verbatim, no synthetic fields), valid records still listed (corrupt doesn't blind); mode strict throws / collect partial; entries/readRecord injected, no IO
+  ./run.sh check-meta-listing          # deterministic gate: META-STORE facts axis — kind-carrying entries; non-regular records are never read, parse/drift become diagnostics, duplicate nativeSessionId quarantines every rival but not unrelated citizens; strict throws / collect partial; pure injected IO
   ./run.sh check-entwurf-fact-provider # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4b): ASSEMBLY listEntwurfFacts — listAllMetaIdentities→scanSocketProbes→pre-quarantine non-pi/socket conflicts→resolveFactList(clean)→{facts,diagnostics}; C-원칙: expected corruption (parse/collision)→diagnostics (listing survives), impossible invariant (dup/unprobed)→throw; collision quarantines BOTH PeerFact+socket; deps injected, no IO
   ./run.sh check-entwurf-peers-surface # deterministic gate (0.11 Stage 0 step 4, fact-provider slice 4c): MCP entwurf_peers RENDER renderEntwurfPeers (#50 C4) — payload keyset exactly {peers, diagnostics}; FORBIDDEN keys sessions/socketOnly/controlDir/socketPath/count + no .sock in text (socket is transport, never identity); record-less socket = aggregated record-less-socket diagnostic (F8, liveness-keyed message, alive names fresh-cut); NO verb-routing key (JSON deep scan) NOR word (text), diagnostics both surfaces, empty→(none), unsupported shown; WIRING guard: both surfaces call provider+render, getLiveSessions + /entwurf-sessions gone; facts fabricated, no IO
   ./run.sh check-entwurf-self-address # deterministic gate (SE-1/SE-2 slice 1): self-addressability honesty predicate computeSelfAddressability — pi replyable ⟺ live socket; meta ⟺ recordBacked ∧ ownerAlive ∧ watchArmed (regression-proof record-present rows); SOURCE GUARD buildStrictPiSenderEnvelope drops hardcoded replyable:true + existsSync-probes socket, entwurf_self renders alive vs expected. meta watchArmed wired in slice 2 (same release block)
@@ -150,13 +150,13 @@ Usage:
   ./run.sh uninstall-agy-hooks        # honest inverse of install-agy-hooks from install-state
   ./run.sh doctor-agy-hooks           # fail-loud doctor for agy hooks.json imprint wiring
   ./run.sh meta-bridge-prune          # 1.0.0 meta-bridge Phase 4: LISTING-ONLY store hygiene — classify orphan/stale/ambiguous/keep, print manual rm commands, delete NOTHING ([dir] [--ttl-days N])
-  ./run.sh meta-bridge-fresh-cut      # the ONE generation verb (the verb every v3-only rejection names): quiesce-check live sockets/markers/native-push conversations (refusing any surface it cannot inspect), archive meta-sessions/ + meta-mailbox/ to `<dir>.archive-<ts>`, clear dead transport residue, open an empty v3 generation. No migration, no restore — the archive is forensic only
+  ./run.sh meta-bridge-fresh-cut      # the ONE generation verb (the verb every v3-only rejection names): quiesce-check live sockets/markers/native-push conversations (refusing any surface it cannot inspect), archive meta-sessions/ + meta-mailbox/ to `<dir>.archive-<ts>`, clear dead transport residue, open an empty v3 generation. No migration, no restore — the archive is forensic only. EXIT CONTRACT (#54, `--help` prints it): 0 complete / 1 NOTHING MOVED (re-run, do not setup) / 2 usage / 3 cut transition incomplete (inspect) / 4 cut complete but residue cleanup failed (`setup` may run; re-run only before new citizen birth, otherwise remove residue manually)
   ./run.sh meta-bridge-managed-keys   # 0.10.0 meta-bridge: print the SSOT of settings keys entwurf OWNS (consumers read this to stay disjoint — keyset-owner invariant)
   ./run.sh check-keyset-overlap <fragment.json...>  # 0.10.0 meta-bridge: PREVENTIVE keyset guard — fail if a consumer fragment collides with any pi-owned key (cross-repo; not in pnpm check)
   ./run.sh check-dep-versions         # local deterministic check that the pi pin agrees across package.json (devDeps + peer range), run.sh (peer-install pins), and the baseline docs (AGENTS/README/ROADMAP/setup-clean-host/demo)
   ./run.sh check-node-floor-coherence # binds the Node floor (24+, single axis) across engines.node, run.sh setup preflight, meta-bridge install/doctor judgment logic, clean-host docs, the bridge launcher header, and the CI runner node-version — engines.node is the SSOT, everything else is derived; sweeps tracked contract text for an unregistered declaration
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
-  ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm check): seeds host states inline (clean/empty/v3-only/previous-generation/malformed), then drives the real `run.sh install` / `setup` at them — a store the live schema cannot read REFUSES before activation writes (persistent regular-file manifest unchanged), the refusal names fresh-cut in both invocation forms, fresh-cut archives the generation (original bytes intact in the archive) and opens an empty one, the retry PASSES, and a live marker/socket/native-push conversation — or any surface the cut cannot inspect — makes fresh-cut refuse (quiesce gate). No model/network/cost
+  ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm check): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
   ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke with the pinned pi peers (0.82.x) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES)
   ./run.sh check-install-container    # 0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)
   ./run.sh sync-auth                  # copy ~/.pi/agent/auth.json anthropic OAuth credentials to entwurf alias
@@ -501,7 +501,8 @@ register_user_scope_citizen() {
 # exists to hold). Same explicit-global-lifecycle shape as install/uninstall-meta-bridge.
 # Uses the same is_entwurf_source SSOT + --remove, so it never over-deletes a look-alike
 # (entwurf-notes, openclaw-entwurf) and preserves every other package/key. Idempotent:
-# no entwurf entry → no-op.
+# no entwurf entry → no-op. A settings-relative entry naming this repo is preserved and
+# reported rather than deleted — install never writes that form (#53 B).
 remove_user_scope_citizen() {
   local agent_dir="${PI_CODING_AGENT_DIR:-$HOME/.pi/agent}"
   python3 "$REPO_DIR/scripts/register-pi-package.py" "$agent_dir/settings.json" "$REPO_DIR" --remove
@@ -525,7 +526,10 @@ remove_local_package() {
   preflight_pi_settings_shapes "$project_dir/.pi/settings.json" "$(mktemp -u)"
   # packages[] cleanup via the shared SSOT — same is_entwurf_source predicate as
   # install, so remove never over-deletes a look-alike repo (entwurf-notes, …)
-  # that install would never have registered.
+  # that install would never have registered. Same rule, one shape further (#53 B):
+  # register only ever WRITES the absolute path, so a settings-RELATIVE entry naming
+  # this repo (the committed `".."` in <repo>/.pi/settings.json) is source, not
+  # install state — remove leaves it and says so instead of editing tracked bytes.
   python3 "$REPO_DIR/scripts/register-pi-package.py" "$project_dir/.pi/settings.json" "$REPO_DIR" --remove
   # entwurfProvider.mcpServers.entwurf-bridge cleanup (project scope) via the shared SSOT: strip
   # our-managed shapes (the bare stable bin AND the legacy repo start.sh path — a true user
@@ -988,12 +992,12 @@ smoke_entwurf_v2_spawn_live() {
 smoke_acp_socket_citizen_live() {
   # S1 acceptance smoke (ACP plugin on v2) — OUT of pnpm check, needs LIVE=1.
   # Spawns a REAL `pi --entwurf-control` resident on an ACP model
-  # (entwurf/claude-opus-4-8) and proves it is a first-class socket-citizen:
+  # (entwurf/claude-opus-5) and proves it is a first-class socket-citizen:
   # the control socket stands up, get_info answers with the ACP model (model-lock
   # did NOT revert — QM1), idle/cwd are reported, and the fail-loud streamSimple
   # stub never fires (turn-free launch — QM2). No prompt is sent: S1 proves
   # citizenship, never a backend turn (that is S2). Honest skip when LIVE!=1.
-  # Model override: ENTWURF_S1_MODEL (default claude-opus-4-8).
+  # Model override: ENTWURF_S1_MODEL (default claude-opus-5).
   #   LIVE=1 ./run.sh smoke-acp-socket-citizen-live
   run_ts scripts/smoke-acp-socket-citizen-live.ts
 }
@@ -1442,12 +1446,12 @@ assert.equal(peerTui, piAi,
 // floor tracks the devDep pin so a consumer can't install against a pi lacking
 // the public trust exports the bridge imports at the pinned minor, AND an upper
 // bound at the next minor stops a fresh install from silently pulling a future
-// pi (past the declared ceiling — 0.83+ at the current 0.82.0 pin) whose
+// pi (past the declared ceiling — 0.83+ at the current 0.82.1 pin) whose
 // internal export surface has drifted from the one we typecheck against.
 // pi moves its public surface every minor (the 0.79→0.80 getModels→provider-
 // factory churn is exactly this), so an open `>=` floor is exactly how the next
 // installer re-acquires the drift. Expected
-// shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.82.0 <0.83`).
+// shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.82.1 <0.83`).
 const [piMaj, piMin] = piAi.split('.').map(Number);
 assert.equal(piMaj, 0,
   `pi pin major must stay 0 for the next-minor ceiling rule (got ${piAi}); revisit check-dep-versions when pi reaches 1.x`);
@@ -1902,13 +1906,13 @@ check_pi_import_surface() {
   # 0.80 moved the standalone root `getModels()` to the deprecated `/compat`
   # entrypoint. This repo's pi-extensions/** are loaded by pi's EXTENSION loader
   # (pi-coding-agent `core/extensions/loader.ts`), whose jiti alias map resolves
-  # ONLY three pi-ai specifiers for extensions — the bare root, `/compat`, and
-  # `/oauth` — all to `ai/dist/compat.js`. A `providers/*` subpath is NOT in that
+  # FOUR pi-ai specifiers for extensions — the bare root, `/compat`, `/oauth`, and
+  # (since pi 0.81) `/providers/all`. Other `providers/*` subpaths are NOT in that
   # map: jiti prefix-matches the bare `@earendil-works/pi-ai` alias and appends
   # the remainder, producing the unresolvable `…/dist/compat.js/providers/
   # anthropic` (verified live: extension load crash — invisible to static
   # typecheck, which resolves against node_modules `exports`). So `/compat` is the
-  # sanctioned extension entrypoint for the old global model-catalog API
+  # sanctioned extension entrypoint this repo uses for the old global model-catalog API
   # (lib/acp/models.ts: `getModels`), and the ONLY allowlisted exception. The
   # allow-pattern is closing-quote-anchored (`@earendil-works/pi-ai/compat["'\`]`)
   # so it permits ONLY that exact specifier: `/compat-foo`, `/oauth`, every
@@ -2715,7 +2719,7 @@ _check_pack_install_impl() {
   printf '%s\n' '{ "name": "entwurf-install-smoke", "version": "0.0.0", "private": true }' > "$tmp/package.json"
 
   # pi-agent-core is pinned even though we never import it: pi-coding-agent depends
-  # on it by CARET (`^0.82.0`), so with no lockfile in this fresh temp project it
+  # on it by CARET (`^0.82.1`), so with no lockfile in this fresh temp project it
   # floats to whatever pi published last — and that newer core then drags a NESTED
   # pi-ai of its own. Measured 2026-07-21: pinning only the three we import left
   # pi-agent-core@0.80.10 + pi-ai@0.80.10 in the tree while the gate still announced
@@ -2726,10 +2730,10 @@ _check_pack_install_impl() {
   local install_log
   install_log=$(cd "$tmp" && pnpm add \
     "$tgz_path" \
-    "@earendil-works/pi-ai@0.82.0" \
-    "@earendil-works/pi-coding-agent@0.82.0" \
-    "@earendil-works/pi-tui@0.82.0" \
-    "@earendil-works/pi-agent-core@0.82.0" \
+    "@earendil-works/pi-ai@0.82.1" \
+    "@earendil-works/pi-coding-agent@0.82.1" \
+    "@earendil-works/pi-tui@0.82.1" \
+    "@earendil-works/pi-agent-core@0.82.1" \
     "typebox@latest" \
     --ignore-workspace --ignore-scripts 2>&1) || {
     fail "[check-pack-install] pnpm add failed:"
@@ -2739,17 +2743,17 @@ _check_pack_install_impl() {
 
   # A pin is a wish until the resolved tree is read back. Assert it: EVERY
   # @earendil-works pi package present — direct or transitive, top level or nested —
-  # must be the pinned 0.82.0. Anything else means an unpinned caret floated and the
+  # must be the pinned 0.82.1. Anything else means an unpinned caret floated and the
   # rest of this gate would be exercising a runtime nobody verified, while still
-  # printing "pinned pi 0.82.0". Fail loud instead of proving the wrong floor.
+  # printing "pinned pi 0.82.1". Fail loud instead of proving the wrong floor.
   local leaked_pi
-  leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | grep '^@earendil-works+pi-' | grep -v '@0\.82\.0' || true)
+  leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | grep '^@earendil-works+pi-' | grep -v '@0\.82\.1' || true)
   if [ -n "$leaked_pi" ]; then
-    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.82.0):"
+    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.82.1):"
     printf '%s\n' "$leaked_pi" | sed 's/^/    /' >&2
     return 1
   fi
-  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works pi package is 0.82.0"
+  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works pi package is 0.82.1"
 
   # Resolve the installed package.json and confirm pi.extensions
   # arrived intact. If pi.extensions is empty or missing, the
@@ -2834,14 +2838,14 @@ _check_pack_install_impl() {
   # opus anchor (CURATED_ANCHOR_MODEL_ID in lib/acp/models.ts — the model whose
   # absence is a hard registry regression). Checking only one would let half the
   # surface drop silently.
-  for anchor in "claude-sonnet-5" "claude-opus-4-8"; do
+  for anchor in "claude-sonnet-5" "claude-opus-5"; do
     if ! grep -q "$anchor" <<<"$loader_out"; then
       fail "[check-pack-install] pi loader output missing curated Claude model $anchor:"
       echo "$loader_out" | tail -10 | sed 's/^/    /' >&2
       return 1
     fi
   done
-  echo "[check-pack-install] pi loader smoke pass (entwurf registered, claude-sonnet-5 + claude-opus-4-8 anchor)"
+  echo "[check-pack-install] pi loader smoke pass (entwurf registered, claude-sonnet-5 + claude-opus-5 anchor)"
 
   # npm-managed neutral install regression — the README's PRIMARY install path is
   # now `npm install @junghanacs/entwurf` (NOT `pi install npm:...`). This layout
@@ -2922,7 +2926,7 @@ sys.exit(0 if any(isinstance(s,str) and s.endswith('/node_modules/@junghanacs/en
     echo "$foreign_out" | tail -10 | sed 's/^/    /' >&2
     return 1
   }
-  if grep -qi "Unknown option" <<<"$foreign_out" || ! grep -q "claude-opus-4-8" <<<"$foreign_out"; then
+  if grep -qi "Unknown option" <<<"$foreign_out" || ! grep -q "claude-opus-5" <<<"$foreign_out"; then
     fail "[check-pack-install] foreign-cwd --entwurf-control did not load the entwurf extension from user scope:"
     echo "$foreign_out" | tail -10 | sed 's/^/    /' >&2
     return 1

package/scripts/agy-imprint.ts

@@ -17,6 +17,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import {
+	isPlausibleOwnerPid,
 	parentPid,
 	processStartKey,
 	upsertMetaSession,
@@ -165,8 +166,16 @@ function imprint(raw: string): void {
 		// Written only after the upsert above: the record store is the identity authority, and a
 		// marker pointing at a garden-id with no record would be a window of un-backed identity.
 		// A failed marker costs reply-addressability, never the session — log and move on.
+		//
+		// The owner rule is `isPlausibleOwnerPid`, the SAME predicate the Claude hook
+		// and every reader hold. This writer used to ask `> 0` on its own, so THIS hook
+		// could mint `meta-senders/antigravity/1.json` through the very reparenting that
+		// stranded a host's fresh-cut (#53 A): agy exits, the imprint is reparented to
+		// init, and `process.ppid` reads 1. Refusing is fail-closed — it costs reply
+		// addressability for that turn and is logged; honoring it would cost the operator
+		// their generation cut, with no in-band way to get it back.
 		const ownerPid = process.ppid;
-		if (typeof ownerPid === "number" && ownerPid > 0) {
+		if (isPlausibleOwnerPid(ownerPid)) {
 			try {
 				writeMetaSenderMarker({
 					backend: "antigravity",
@@ -181,6 +190,11 @@ function imprint(raw: string): void {
 					`sender-marker-failed pid=${ownerPid} gardenId=${result.record.gardenId} ${err instanceof Error ? err.message : String(err)}`,
 				);
 			}
+		} else {
+			logLine(
+				`sender-marker-refused pid=${ownerPid} gardenId=${result.record.gardenId} implausible owner pid ` +
+					"(<= 1: this imprint was reparented, so its parent is not the agy process that owns the turn)",
+			);
 		}
 	} catch (err) {
 		logLine(

package/scripts/check-acp-session-reuse.ts

@@ -33,7 +33,7 @@ import { pathToFileURL } from "node:url";
 import type { Api, AssistantMessageEvent, Context, Message, Model } from "@earendil-works/pi-ai";
 
 const sonnet = { id: "claude-sonnet-5" } as unknown as Model<Api>;
-const opus = { id: "claude-opus-4-8" } as unknown as Model<Api>;
+const opus = { id: "claude-opus-5" } as unknown as Model<Api>;
 
 type Stream = AsyncIterable<AssistantMessageEvent> & {
 	result: () => Promise<{ stopReason: string; errorMessage?: string }>;

package/scripts/check-acp-session-store.ts

@@ -85,7 +85,7 @@ const baseInput = (): BridgeConfigInput => ({
 	);
 	// Model drift → different signature.
 	assert.notEqual(
-		bridgeConfigSignature({ ...baseInput(), modelId: "claude-opus-4-8" }),
+		bridgeConfigSignature({ ...baseInput(), modelId: "claude-opus-5" }),
 		bridgeConfigSignature(baseInput()),
 		"model drift changes the signature",
 	);
@@ -186,7 +186,7 @@ const baseInput = (): BridgeConfigInput => ({
 	const params = facts({ contextMessageSignatures: ["user:text:a", "assistant:text:b"] });
 	assert.ok(isCompatible(facts(), params), "prefix history + same cfg → compatible");
 	assert.ok(!isCompatible(facts({ cwd: "/other" }), params), "cwd drift → incompatible");
-	assert.ok(!isCompatible(facts({ modelId: "claude-opus-4-8" }), params), "model drift → incompatible");
+	assert.ok(!isCompatible(facts({ modelId: "claude-opus-5" }), params), "model drift → incompatible");
 	assert.ok(!isCompatible(facts({ bridgeConfigSignature: "different" }), params), "signature drift → incompatible");
 	assert.ok(
 		!isCompatible(facts({ contextMessageSignatures: ["user:text:EDITED"] }), params),
@@ -292,7 +292,7 @@ const baseInput = (): BridgeConfigInput => ({
 	assert.throws(
 		() =>
 			decideBootstrap(params("process-scoped"), {
-				existing: { ...aliveCompat, modelId: "claude-opus-4-8" },
+				existing: { ...aliveCompat, modelId: "claude-opus-5" },
 			}),
 		SessionModelLockedError,
 		"live model mismatch throws SessionModelLockedError",

package/scripts/check-agy-sender-identity.ts

@@ -48,6 +48,9 @@ import {
 import {
 	FRESH_CUT_COMMAND,
 	type MetaIdentity,
+	metaRecordExistsByGardenId,
+	processStartKey,
+	readMetaSenderMarker,
 	upsertMetaSession,
 	writeMetaSenderMarker,
 } from "../pi-extensions/lib/meta-session.ts";
@@ -358,6 +361,86 @@ try {
 			trusted?.identity.gardenId === record.record.gardenId,
 		);
 	}
+	// ── #53 A: an init-owned marker names NOBODY, however live init is ─────────
+	// The shape measured on a second Linux host: `meta-senders/claude-code/1.json`,
+	// pid 1, and the REAL start-key for init — so the pid-reuse guard PASSES and
+	// classifyMarkerOwner answers `live` for as long as the host is up. The defect is
+	// one layer up: init owns no Claude session. THIS gate's own writer is one of the
+	// two that could produce the shape before #53 A — the agy imprint asked `> 0`
+	// while the Claude hook already refused `<= 1` — so "only the shell-form hook
+	// could have written it" was never true. After this cut no writer in the tree can.
+	{
+		clearMarkers();
+		const record = upsertMetaSession({
+			input: { backend: "claude-code", nativeSessionId: "sess-init", cwd: REPO_DIR },
+		});
+		const initKey = processStartKey(1);
+		ok("this host CAN read a start key for pid 1 (the residue cells are not vacuous)", initKey !== "");
+		const initDir = path.join(SENDERS_DIR, "claude-code");
+		fs.mkdirSync(initDir, { recursive: true });
+		fs.writeFileSync(
+			path.join(initDir, "1.json"),
+			`${JSON.stringify({
+				backend: "claude-code",
+				gardenId: record.record.gardenId,
+				nativeSessionId: "sess-init",
+				cwd: REPO_DIR,
+				ownerPid: 1,
+				ownerStartKey: initKey,
+				updatedAt: "2026-06-10T16:03:10.000Z",
+			})}\n`,
+		);
+		ok(
+			"an init-owned sender marker reads as null — it grants no identity",
+			readMetaSenderMarker({ backend: "claude-code", ownerPid: 1, sendersDir: SENDERS_DIR }) === null,
+		);
+		ok(
+			"...while its record is present and readable, so the refusal is about the marker's CLAIM",
+			metaRecordExistsByGardenId(record.record.gardenId),
+		);
+		// End to end, with pid 1 supplied as an explicit candidate: the answer is
+		// "nobody" — not an identity, and not a throw either. Stated at the size of the
+		// evidence: the DEFAULT candidate set is only the bridge's parent and grandparent,
+		// so pid 1 enters it just when the native host itself was reparented (a detached
+		// Claude). Reachable, not observed — the affected host's own launch shape
+		// (bridge → claude → bash → wrapper) never had 1 among its candidates, and no
+		// wrong-identity read was measured there. The cut's deadlock is the proven half;
+		// this is the code-path half.
+		let identityThrew: unknown = null;
+		let identityAnswer: unknown = "unset";
+		try {
+			identityAnswer = resolveTrustedMetaSenderIdentity({ ownerPids: [1], sendersDir: SENDERS_DIR });
+		} catch (err) {
+			identityThrew = err;
+		}
+		ok(
+			"resolving with pid 1 as a candidate yields NO identity (and no throw)",
+			identityAnswer === null && identityThrew === null,
+		);
+		let initWriteRejected = false;
+		try {
+			writeMetaSenderMarker({
+				backend: "claude-code",
+				gardenId: record.record.gardenId,
+				nativeSessionId: "sess-init",
+				cwd: REPO_DIR,
+				ownerPid: 1,
+				sendersDir: SENDERS_DIR,
+			});
+		} catch {
+			initWriteRejected = true;
+		}
+		ok("minting an init-owned sender marker THROWS at the write boundary", initWriteRejected);
+		// WIRING: the agy imprint is the SECOND writer, and the one that still asked
+		// `> 0` on its own while the Claude hook already refused `<= 1`. A predicate only
+		// one writer knows is how #53 A drifted in; both must reach the shared one.
+		ok(
+			"the agy imprint routes its owner pid through the shared predicate",
+			/isPlausibleOwnerPid\(ownerPid\)/.test(fs.readFileSync(HOOK, "utf8")),
+		);
+		clearMarkers();
+	}
+
 	ok(
 		"antigravity is a native-push backend → its replyable comes from the adapter probe",
 		nativePushSupported("antigravity"),

package/scripts/check-entwurf-control-rpc.ts

@@ -196,14 +196,14 @@ async function main(): Promise<void> {
 	{
 		const base = {
 			sessionId: "20260613T091000-98363c",
-			agentId: "pi/claude-opus-4-8",
+			agentId: "pi/claude-opus-5",
 			cwd: "/w",
 			timestamp: "2026-06-13T09:10:00.000Z",
 		};
 		ok(
 			"6: minimal envelope → exact block (leading blank line, required fields only)",
 			formatSenderInfoBlock(base) ===
-				`\n\n<sender_info>{"sessionId":"20260613T091000-98363c","agentId":"pi/claude-opus-4-8","cwd":"/w","timestamp":"2026-06-13T09:10:00.000Z"}</sender_info>`,
+				`\n\n<sender_info>{"sessionId":"20260613T091000-98363c","agentId":"pi/claude-opus-5","cwd":"/w","timestamp":"2026-06-13T09:10:00.000Z"}</sender_info>`,
 		);
 		const full = formatSenderInfoBlock({ ...base, origin: "pi-session", replyable: false }, true);
 		ok(

package/scripts/check-entwurf-fact-provider.ts

@@ -63,6 +63,8 @@ interface SocketOpts {
 	extraNames?: string[];
 	/** readdir throws with this code (e.g. "EACCES" / "ENOENT") (P2e②). */
 	readdirErrorCode?: string;
+	/** `.meta.json` entries that are NOT regular files (symlink/dir/special). */
+	irregularMeta?: string[];
 }
 
 function deps(
@@ -72,7 +74,13 @@ function deps(
 ): EntwurfFactsDeps {
 	const symlinkSet = new Set(opts.symlinks ?? []);
 	return {
-		metaEntries: Object.keys(meta),
+		// Kind-carrying entries, like the real bindings: the listing must be able to refuse a
+		// symlinked record without following it. `irregularMeta` names the ones that are not
+		// regular files.
+		metaEntries: Object.keys(meta).map((filename) => ({
+			filename,
+			regularFile: !(opts.irregularMeta ?? []).includes(filename),
+		})),
 		readRecord: (f: string) => {
 			const v = meta[f];
 			if (v === undefined) throw new Error(`ENOENT: ${f}`);

package/scripts/check-entwurf-facts.ts

@@ -65,7 +65,7 @@ function identity(backend: MetaCitizenBackend, over: Partial<MetaIdentity> = {})
 		backend,
 		nativeSessionId: "native-abc",
 		cwd: "/home/junghan/repos/gh/entwurf",
-		model: "claude-opus-4-8",
+		model: "claude-opus-5",
 		transcriptPath: "/home/junghan/.claude/projects/x/native-abc.jsonl",
 		createdAt: "2026-06-11T00:38:58.000Z",
 		recordUpdatedAt: "2026-06-11T02:40:00.000Z",

package/scripts/check-entwurf-mailbox-guard.ts

@@ -59,12 +59,16 @@ const liveIdentity = (): MetaIdentity => ({
 	createdAt: "2026-06-14T01:00:00.000Z",
 	recordUpdatedAt: "2026-06-14T01:00:00.000Z",
 });
+// The owner pid is a plausible one on purpose: these markers are injected straight
+// into the pure predicate, which never reads the field — but a fixture carrying
+// `ownerPid: 1` would model a marker no writer can mint and no reader honors
+// (isPlausibleOwnerPid, #53 A), and fixtures are read as claims about the world.
 const liveMarker = () =>
 	({
 		gardenId: GARDEN,
 		backend: "claude-code",
 		nativeSessionId: "n-a",
-		ownerPid: 1,
+		ownerPid: 4242,
 		ownerStartKey: "x",
 		ownerKind: "claude-code-cli",
 		armProvenance: "session-start",
@@ -77,7 +81,7 @@ const driftMarker = () =>
 		gardenId: GARDEN,
 		backend: "claude-code",
 		nativeSessionId: "n-OTHER",
-		ownerPid: 1,
+		ownerPid: 4242,
 		ownerStartKey: "x",
 		ownerKind: "claude-code-cli",
 		armProvenance: "session-start",

package/scripts/check-entwurf-resume-args.ts

@@ -52,7 +52,7 @@ function main(): void {
 			sessionFile: SESSION_FILE,
 			explicitExtensionArgs: EXT,
 			provider: "entwurf",
-			model: "claude-opus-4-8",
+			model: "claude-opus-5",
 			prompt: "continue the task",
 		});
 		ok("1 legacy has --no-extensions", args.includes("--no-extensions"));
@@ -61,14 +61,14 @@ function main(): void {
 		ok("3 legacy prompt is the final positional", args[args.length - 1] === "continue the task");
 		ok("4 legacy keeps ext args exactly once", args.filter((a) => a === "-e").length === 1);
 		ok("6 legacy provider laid out", valueAfter(args, "--provider") === "entwurf");
-		ok("6 legacy model laid out", valueAfter(args, "--model") === "claude-opus-4-8");
+		ok("6 legacy model laid out", valueAfter(args, "--model") === "claude-opus-5");
 		ok("6 legacy resumes by exact FILE (--session <abs path>)", valueAfter(args, "--session") === SESSION_FILE);
 		ok("6 legacy carries NO --session-id (the id is pi's own now)", !args.includes("--session-id"));
 		// model + prompt are the last three tokens: --model <m> <prompt>
 		ok(
 			"6 legacy --model <m> <prompt> tail",
 			args[args.length - 3] === "--model" &&
-				args[args.length - 2] === "claude-opus-4-8" &&
+				args[args.length - 2] === "claude-opus-5" &&
 				args[args.length - 1] === "continue the task",
 		);
 	}
@@ -80,7 +80,7 @@ function main(): void {
 			sessionFile: SESSION_FILE,
 			explicitExtensionArgs: EXT,
 			provider: "entwurf",
-			model: "claude-opus-4-8",
+			model: "claude-opus-5",
 			prompt: "resume now",
 			launchArgs: ["--approve"],
 		});
@@ -93,7 +93,7 @@ function main(): void {
 		ok("5 v2 includes launchArgs --approve", args.includes("--approve"));
 		ok("5 v2 --approve is before the prompt", args.indexOf("--approve") < args.length - 1);
 		ok("6 v2 provider laid out", valueAfter(args, "--provider") === "entwurf");
-		ok("6 v2 model laid out", valueAfter(args, "--model") === "claude-opus-4-8");
+		ok("6 v2 model laid out", valueAfter(args, "--model") === "claude-opus-5");
 		ok("6 v2 resumes by exact FILE (--session <abs path>)", valueAfter(args, "--session") === SESSION_FILE);
 		ok(
 			"6 v2 carries NO --session-id (a garden id would MINT a session, not resume one)",
@@ -102,7 +102,7 @@ function main(): void {
 		ok(
 			"6 v2 --model <m> <prompt> tail",
 			args[args.length - 3] === "--model" &&
-				args[args.length - 2] === "claude-opus-4-8" &&
+				args[args.length - 2] === "claude-opus-5" &&
 				args[args.length - 1] === "resume now",
 		);
 	}

package/scripts/check-entwurf-session-identity.ts

@@ -103,7 +103,7 @@ try {
 		fileA,
 		sessionLine(idA, "/identity/a") +
 			mc("openai-codex", "gpt-5.5") +
-			msg({ content: "drifted", model: "claude-opus-4-8", provider: "entwurf" }),
+			msg({ content: "drifted", model: "claude-opus-5", provider: "entwurf" }),
 	);
 	const recA = readSessionIdentity(fileA);
 	eq(recA?.provider, "openai-codex", "identity: provider = first model_change (not assistant message)");
@@ -115,7 +115,7 @@ try {
 	const fileB = path.join(idDir, `2026-06-03T22-00-00-000Z_${idB}.jsonl`);
 	fs.writeFileSync(
 		fileB,
-		sessionLine(idB, "/identity/b") + mc("entwurf", "claude-opus-4-8") + mc("openai-codex", "gpt-5.5"),
+		sessionLine(idB, "/identity/b") + mc("entwurf", "claude-opus-5") + mc("openai-codex", "gpt-5.5"),
 	);
 	throws(() => readSessionIdentity(fileB), "identity: later model_change drift → fail-fast");
 
@@ -124,7 +124,7 @@ try {
 	//    judge — identity must resolve from the transcript alone, no throw.
 	const idC = "20260603T220000-3333cc";
 	const fileC = path.join(idDir, `2026-06-03T22-00-00-000Z_${idC}.jsonl`);
-	const mismatchName = `${idC}==entwurf/claude-opus-4-8--x__entwurf`;
+	const mismatchName = `${idC}==entwurf/claude-opus-5--x__entwurf`;
 	fs.writeFileSync(fileC, sessionLine(idC, "/identity/c") + mc("openai-codex", "gpt-5.5") + infoLine(mismatchName));
 	noThrow(() => readSessionIdentity(fileC), "identity: name provider/model disagreement is pi's business — no throw");
 	eq(readSessionIdentity(fileC)?.modelId, "gpt-5.5", "identity: model still resolves from first model_change");
@@ -165,17 +165,18 @@ try {
 	// ---- T-name-blind: the reader takes NO options and never reads the name (#50 C3) ----
 	// The old `requireEntwurf` name-tag authorization (0.9.0 "entwurf 여부 = name tag")
 	// is deleted, not just unused: resume authorization is record existence
-	// (readMetaIdentityByGardenId) + the header-id ↔ record.nativeSessionId integrity
+	// (readAddressableMetaIdentity — the record must also hold its nativeSessionId
+	// alone, #52) + the header-id ↔ record.nativeSessionId integrity
 	// check in resolveResumeLaunchIdentity. A session with no name, a non-canonical
 	// name, or no `entwurf` tag resolves identity exactly like any other pi session.
 	const idG = "20260603T230000-7777aa";
 	const fileG = path.join(idDir, `2026-06-03T23-00-00-000Z_${idG}.jsonl`);
 	fs.writeFileSync(
 		fileG,
-		sessionLine(idG, "/identity/g") + mc("entwurf", "claude-opus-4-8") + infoLine("not a canonical name"),
+		sessionLine(idG, "/identity/g") + mc("entwurf", "claude-opus-5") + infoLine("not a canonical name"),
 	);
 	noThrow(() => readSessionIdentity(fileG), "name-blind: non-canonical name resolves like any pi session");
-	eq(readSessionIdentity(fileG)?.modelId, "claude-opus-4-8", "name-blind: identity from model_change only");
+	eq(readSessionIdentity(fileG)?.modelId, "claude-opus-5", "name-blind: identity from model_change only");
 	eq(readSessionIdentity.length, 1, "name-blind: readSessionIdentity takes exactly one arg (no opts, compiler-pinned)");
 
 	// ========================================================================

package/scripts/check-entwurf-v2-production.ts

@@ -63,13 +63,15 @@ function identity(backend: MetaIdentity["backend"], gardenId = GID): MetaIdentit
 }
 
 /** A receiver presence marker. Matches the record identity (gardenId/backend/nativeSessionId)
- * unless `nativeSessionId` is overridden to simulate an identity-drifted/foreign marker. */
+ * unless `nativeSessionId` is overridden to simulate an identity-drifted/foreign marker.
+ * The owner pid is a plausible one: the predicate never reads it, but a fixture carrying
+ * `ownerPid: 1` would model a marker no writer can mint and no reader honors (#53 A). */
 function receiverMarker(gid: string, backend: string, nativeSessionId = "n"): MetaReceiverMarker {
 	return {
 		gardenId: gid,
 		backend: backend as MetaReceiverMarker["backend"],
 		nativeSessionId,
-		ownerPid: 1,
+		ownerPid: 4242,
 		ownerStartKey: "x",
 		ownerKind: "claude-code-cli",
 		armProvenance: "session-start",

package/scripts/check-entwurf-v2-spawn-production.ts

@@ -59,7 +59,7 @@ const IDENTITY: LaunchIdentity = {
 	cwd: "/home/test/repo",
 	explicitExtensionArgs: ["-e", "/path/to/entwurf/index.ts"],
 	provider: "entwurf",
-	model: "claude-opus-4-8",
+	model: "claude-opus-5",
 };
 
 // True if `p` has NOT settled after a macrotask tick (all pending microtasks drained).
@@ -224,7 +224,7 @@ async function main(): Promise<void> {
 		ok("2 argv carries plan.launchArgs (--approve)", args.includes("--approve"));
 		ok("2 argv carries the ext args", args.includes("-e"));
 		ok("2 argv carries provider", args[args.indexOf("--provider") + 1] === "entwurf");
-		ok("2 argv carries model", args[args.indexOf("--model") + 1] === "claude-opus-4-8");
+		ok("2 argv carries model", args[args.indexOf("--model") + 1] === "claude-opus-5");
 		// #50 C2: argv names the exact transcript FILE, never a garden id. `--session-id`
 		// would CREATE a session at that id when it is missing — post-cut the garden id is
 		// never a pi session id, so the old flag would have minted an empty session and