@junghanacs/entwurf 0.12.9 → 0.12.10

package/scripts/check-entwurf-deliverability.ts

@@ -1,9 +1,10 @@
 /**
  * check-entwurf-deliverability — deterministic gate for the conversational-mailbox
- * deliverability predicate (SE-1/SE-2 slice 2c). This is the predicate the enqueue
- * sites (v1 fallback, MCP v1, pi-native v1, v2 decider/send-fallback) must consult in
- * slice 2d before writing a .msg, so a reply never rots in a dead session's mailbox
- * (SE-2) and is never enqueued for a backend that has no mailbox drain (SE-1, pi).
+ * deliverability predicate (SE-1/SE-2 slice 2c). This is the predicate an enqueue site
+ * must consult in slice 2d before writing a .msg, so a reply never rots in a dead
+ * session's mailbox (SE-2) and is never enqueued for a backend that has no mailbox drain
+ * (SE-1, pi). The SHIPPED sites are the v2 decider and its send-fallback re-resolve; the
+ * v1 fallback / MCP v1 / pi-native v1 sites were removed in the 0.12 cutover.
  *
  * Proves:
  *   - computeMetaReceiverActive: the shared atom — active ⟺ recordBacked ∧ ownerAlive ∧
@@ -124,8 +125,10 @@ ok(
 
 // ── receiverMarkerMatchesIdentity: the marker ↔ identity SSOT (SE-2 2d-3) ───
 // A present marker only raises a receiver to active when it agrees with the record on
-// garden/backend/native id. The v1 mailbox guard AND the v2 production deliverability seam
-// both route through this one helper, so presence-only false-positives are closed in both.
+// garden/backend/native id. The v2 production deliverability seam and the MCP bridge's
+// entwurf_self both route through this one helper, so presence-only false-positives are
+// closed on every shipped path — and there is no second implementation to drift from since
+// entwurf-mailbox-guard.ts (production importers: 0) was deleted 2026-07-27.
 const ID = { gardenId: "20260612T100000-aaaaaa", backend: "claude-code", nativeSessionId: "n-1" };
 ok(
 	"marker matches identity on all three axes → true",

package/scripts/check-entwurf-fact-provider.ts

@@ -8,7 +8,7 @@
  *     into ONE `record-less-socket` diagnostic (#50 C4: a diagnostic subject,
  *     never a listing section) whose message names the cause + fix (fresh-cut),
  *   - corrupt record → meta-record-read-error diagnostic, listing NOT blinded,
- *   - gardenId↔socket collision (non-pi citizen + same-gid socket) → BOTH sides
+ *   - gardenId↔socket collision (out-of-socket-domain citizen + same-gid socket) → BOTH sides
  *     quarantined (gid in neither peers nor socketOnly) + one
  *     garden-id-socket-conflict diagnostic, and listEntwurfFacts does NOT throw
  *     (expected external-state corruption → diagnostics, not a crash),
@@ -214,16 +214,16 @@ async function main(): Promise<void> {
 		}
 	}
 
-	// ── non-pi citizen + SYMLINKED socket: the fact-provider:125 gap (closed) ───
-	// A non-pi record sharing its gid with a *symlinked* `*.sock`. The symlink is
+	// ── out-of-socket-domain citizen + symlinked socket (closed gap) ──────────
+	// Such a record shares its gid with a *symlinked* `*.sock`. The symlink is
 	// never probed, so its gid is absent from socketGids — the old socketGids-only
-	// check missed this and the non-pi citizen survived as a clean PeerFact while
+	// check missed this and the out-of-domain citizen survived as a clean PeerFact while
 	// the legacy send path still followed the symlink to a forged receiver. The
-	// shared isNonPiGardenIdSocketConflict predicate unions socketGids with the
+	// shared isOutOfSocketDomainGardenIdConflict predicate unions socketGids with the
 	// symlinked gids, so the citizen is now quarantined (gid in NEITHER peers nor
 	// socketOnly) and the conflict diagnostic is raised — alongside the existing
 	// socket-symlink-rejected one (both are honest: symlink-rejected = "not probed",
-	// conflict = "non-pi address split").
+	// conflict = "out-of-socket-domain address split").
 	{
 		const r = await listEntwurfFacts(
 			deps(
@@ -233,7 +233,7 @@ async function main(): Promise<void> {
 			),
 		);
 		ok(
-			"symlink-collision: non-pi citizen quarantined (NOT in peers)",
+			"symlink-collision: out-of-socket-domain citizen quarantined (NOT in peers)",
 			!r.facts.peers.some((p) => p.gardenId === GID_CONFLICT),
 		);
 		ok(

package/scripts/check-entwurf-facts.ts

@@ -23,7 +23,7 @@
 import assert from "node:assert/strict";
 import {
 	type FactList,
-	isNonPiGardenIdSocketConflict,
+	isOutOfSocketDomainGardenIdConflict,
 	type PeerFact,
 	type RecordLessSocketFact,
 	resolveFactList,
@@ -247,7 +247,7 @@ const GID_SOCKET_ONLY = "20260611T135517-5f0d25";
 	} catch {
 		threw = true;
 	}
-	ok("dedup/authority: non-pi citizen + control socket at same gid → fail-loud", threw);
+	ok("dedup/authority: out-of-socket-domain citizen + same-gid socket → fail-loud", threw);
 }
 
 // ── dedup (동결3): pi citizen + its socket → PeerFact only, never both ────────
@@ -333,11 +333,11 @@ const GID_SOCKET_ONLY = "20260611T135517-5f0d25";
 	);
 }
 
-// ── isNonPiGardenIdSocketConflict: the SHARED record-side conflict predicate ──
+// ── isOutOfSocketDomainGardenIdConflict: shared record-side predicate ──────
 // (fact-provider listing + v2 decider dispatch consume this same fn — 4c 재유도
 // 금지 동형). The union over socketGids ∪ symlinkedGardenIds is the fact-provider:125
 // gap closure: a symlinked socket is never probed, so its gid is absent from
-// socketGids; the predicate must STILL flag a non-pi citizen owning it.
+// socketGids; the predicate must STILL flag an out-of-domain citizen owning it.
 {
 	const G = "20260611T444444-dddddd";
 	const realSockets = new Set([G]);
@@ -345,21 +345,21 @@ const GID_SOCKET_ONLY = "20260611T135517-5f0d25";
 	const empty = new Set<string>();
 	for (const piBackend of IN_DOMAIN) {
 		ok(
-			`conflict-predicate: in-domain (${piBackend}) is NEVER a non-pi conflict (even with a colliding socket)`,
-			!isNonPiGardenIdSocketConflict(piBackend, G, realSockets, symlinked),
+			`conflict-predicate: socket-domain (${piBackend}) is not a record-side conflict`,
+			!isOutOfSocketDomainGardenIdConflict(piBackend, G, realSockets, symlinked),
 		);
 	}
 	ok(
-		"conflict-predicate: non-pi + real socket → conflict",
-		isNonPiGardenIdSocketConflict("claude-code", G, realSockets, empty),
+		"conflict-predicate: out-of-socket-domain + real socket → conflict",
+		isOutOfSocketDomainGardenIdConflict("claude-code", G, realSockets, empty),
 	);
 	ok(
-		"conflict-predicate: non-pi + SYMLINKED socket only → conflict (the :125 gap)",
-		isNonPiGardenIdSocketConflict("claude-code", G, empty, symlinked),
+		"conflict-predicate: out-of-socket-domain + symlinked socket → conflict",
+		isOutOfSocketDomainGardenIdConflict("claude-code", G, empty, symlinked),
 	);
 	ok(
-		"conflict-predicate: non-pi + no socket of either kind → no conflict",
-		!isNonPiGardenIdSocketConflict("claude-code", G, empty, empty),
+		"conflict-predicate: out-of-socket-domain + no socket → no conflict",
+		!isOutOfSocketDomainGardenIdConflict("claude-code", G, empty, empty),
 	);
 }
 

package/scripts/check-entwurf-resume-args.ts

@@ -1,19 +1,20 @@
 /**
  * check-entwurf-resume-args — deterministic gate for the 5c-3b resume-argv SSOT
- * (`buildResumePiArgs`). It pins the load-bearing A1 difference between the legacy one-shot
- * worker and the v2 spawn-bg RESIDENT citizen so the two launch shapes can never drift:
+ * (`buildResumePiArgs`). It pins the RESIDENT citizen launch shape so it cannot drift.
+ * This gate once carried a second `legacy` one-shot variant as a contrast; that launcher
+ * and its enum member were removed 2026-07-27, and the half of A1 that still ships is
+ * asserted directly instead — a resumed citizen stands its control socket up and never
+ * emits the one-shot `--no-extensions`:
  *
- *   1. legacy carries `--no-extensions` and NO `--entwurf-control`.
  *   2. v2-control carries `--entwurf-control` and NO `--no-extensions`.
- *   3. BOTH keep the headless prefix `--mode json -p` and run the prompt as the final
- *      positional (the prompt-as-turn authority is unchanged in v2 — `-p` is NOT dropped).
- *   4. `explicitExtensionArgs` is preserved verbatim, exactly once, in BOTH variants
+ *   3. The headless prefix `--mode json -p` stays and the prompt is the final positional
+ *      (the prompt-as-turn authority is unchanged in v2 — `-p` is NOT dropped).
+ *   4. `explicitExtensionArgs` is preserved verbatim, exactly once
  *      (load-bearing for a recorded `provider=entwurf` resume; #29 footgun).
- *   5. v2-control includes `plan.launchArgs` (`--approve` / empty) as flags BEFORE the
- *      prompt; legacy ignores launchArgs entirely.
- *   6. provider/model identity is laid out identically in both; a null/undefined provider
- *      emits NO `--provider` flag; `--model <m>` and `<prompt>` are the last three tokens.
- *   7. no cross-contamination: the legacy-only and v2-only flags never leak into the other.
+ *   5. `plan.launchArgs` (`--approve` / empty) ride as flags BEFORE the prompt.
+ *   6. a null/undefined provider emits NO `--provider` flag; `--model <m>` and `<prompt>`
+ *      are the last three tokens.
+ *   7. the resident posture is exact: `--entwurf-control` present, `--no-extensions` never.
  *
  * Pure string assembly — no IO, no spawn.
  */
@@ -45,34 +46,6 @@ function valueAfter(args: readonly string[], flag: string): string | undefined {
 }
 
 function main(): void {
-	// ── legacy variant ──────────────────────────────────────────────────────────────
-	{
-		const args = buildResumePiArgs({
-			variant: "legacy",
-			sessionFile: SESSION_FILE,
-			explicitExtensionArgs: EXT,
-			provider: "entwurf",
-			model: "claude-opus-5",
-			prompt: "continue the task",
-		});
-		ok("1 legacy has --no-extensions", args.includes("--no-extensions"));
-		ok("1 legacy has NO --entwurf-control", !args.includes("--entwurf-control"));
-		ok("3 legacy headless prefix --mode json -p", args[0] === "--mode" && args[1] === "json" && args[2] === "-p");
-		ok("3 legacy prompt is the final positional", args[args.length - 1] === "continue the task");
-		ok("4 legacy keeps ext args exactly once", args.filter((a) => a === "-e").length === 1);
-		ok("6 legacy provider laid out", valueAfter(args, "--provider") === "entwurf");
-		ok("6 legacy model laid out", valueAfter(args, "--model") === "claude-opus-5");
-		ok("6 legacy resumes by exact FILE (--session <abs path>)", valueAfter(args, "--session") === SESSION_FILE);
-		ok("6 legacy carries NO --session-id (the id is pi's own now)", !args.includes("--session-id"));
-		// model + prompt are the last three tokens: --model <m> <prompt>
-		ok(
-			"6 legacy --model <m> <prompt> tail",
-			args[args.length - 3] === "--model" &&
-				args[args.length - 2] === "claude-opus-5" &&
-				args[args.length - 1] === "continue the task",
-		);
-	}
-
 	// ── v2-control variant ──────────────────────────────────────────────────────────
 	{
 		const args = buildResumePiArgs({
@@ -107,20 +80,6 @@ function main(): void {
 		);
 	}
 
-	// ── 5. legacy IGNORES launchArgs (no --approve leaks in) ──────────────────────────
-	{
-		const args = buildResumePiArgs({
-			variant: "legacy",
-			sessionFile: SESSION_FILE,
-			explicitExtensionArgs: [],
-			provider: null,
-			model: "m",
-			prompt: "p",
-			launchArgs: ["--approve"], // present in input but legacy must ignore it
-		});
-		ok("5 legacy ignores launchArgs (no --approve)", !args.includes("--approve"));
-	}
-
 	// ── 6. null/undefined provider emits NO --provider flag ───────────────────────────
 	for (const provider of [null, undefined] as const) {
 		const args = buildResumePiArgs({
@@ -136,20 +95,23 @@ function main(): void {
 		ok(`6 provider=${provider}: --model <m> <prompt> still tail`, args.slice(-3).join(" ") === "--model m p");
 	}
 
-	// ── 7. no cross-contamination across variants over the same identity ──────────────
+	// ── 7. the resident posture is exact: the one-shot flag never reappears ───────────
+	// The `legacy` variant was removed 2026-07-27, so the old cross-contamination pair is
+	// gone. What must NOT rot is the A1 half that still ships: a resumed citizen stands its
+	// control socket up, which means `--no-extensions` (the one-shot flag that let `pi -p`
+	// exit) can never be emitted here again.
 	{
-		const base = {
+		const v2 = buildResumePiArgs({
 			sessionFile: SESSION_FILE,
 			explicitExtensionArgs: EXT,
 			provider: "entwurf",
 			model: "m",
 			prompt: "p",
 			launchArgs: ["--approve"],
-		} as const;
-		const legacy = buildResumePiArgs({ ...base, variant: "legacy" });
-		const v2 = buildResumePiArgs({ ...base, variant: "v2-control" });
-		ok("7 legacy-only flag absent from v2", !v2.includes("--no-extensions"));
-		ok("7 v2-only flag absent from legacy", !legacy.includes("--entwurf-control") && !legacy.includes("--approve"));
+			variant: "v2-control",
+		});
+		ok("7 resident posture never emits the one-shot --no-extensions", !v2.includes("--no-extensions"));
+		ok("7 resident posture stands the control socket up", v2.includes("--entwurf-control"));
 	}
 
 	console.log(`\ncheck-entwurf-resume-args: ${passed} checks passed`);

package/scripts/check-entwurf-self-address.ts

@@ -7,8 +7,11 @@
  *
  * Proves:
  *   - PURE truth table (computeSelfAddressability, facts injected): pi replyable ⟺
- *     socketAlive; meta replyable ⟺ recordBacked ∧ ownerAlive ∧ watchArmed; external
- *     never replyable. socketState alive/expected/none is its own assertable field.
+ *     socketAlive; external never replyable; and meta replyability splits by RAIL —
+ *     self-fetch ⟺ recordBacked ∧ ownerAlive ∧ watchArmed, native-push ⟺ recordBacked ∧
+ *     probeAlive (a separate axis: an agy citizen never arms a mailbox watch, so the
+ *     self-fetch atom would make it un-replyable forever), and an unsupplied rail is
+ *     fail-closed. socketState alive/expected/none is its own assertable field.
  *   - The two REGRESSION-PROOF rows the lock requires (record-present, not all-absent):
  *       (b) meta record present + owner-dead (start-key mismatch) → false
  *       (c) meta record present + watch-unarmed → false
@@ -147,7 +150,7 @@ function row(facts: SelfAddressabilityFacts): { replyable: boolean; socketState:
 
 	// A native-push citizen must NOT be able to buy replyability with mailbox facts.
 	ok(
-		"meta/native-push + owner-alive + watch-armed but probe-dead → NOT replyable (mailbox facts cannot rescue it)",
+		"meta/native-push + owner-alive + watch-armed but probe-dead → NOT replyable (mailbox facts cannot rescue it) [QK:SELFADDR-RAIL-FACT-LEAK]",
 		row(push({ recordBacked: true, ownerAlive: true, watchArmed: true, probeAlive: false })).replyable === false,
 	);
 }
@@ -223,7 +226,10 @@ const piBody = functionBody("buildStrictPiSenderEnvelope");
 ok("buildStrictPiSenderEnvelope calls computeSelfAddressability", /computeSelfAddressability\s*\(/.test(piBody));
 // Scoped to THIS function body (not a broad grep): the pi-session envelope must NOT
 // hardcode `replyable: true`; it must derive from the predicate result.
-ok("buildStrictPiSenderEnvelope no longer hardcodes `replyable: true`", !/replyable:\s*true/.test(piBody));
+ok(
+	"buildStrictPiSenderEnvelope no longer hardcodes `replyable: true` [QK:SELFADDR-NO-HARDCODED-REPLYABLE]",
+	!/replyable:\s*true/.test(piBody),
+);
 // existsSync alone is too loose — pin that it probes the CANONICAL socket path,
 // not some other file, so the honesty signal cannot drift to a path that does not
 // represent this session's socket.
@@ -246,6 +252,183 @@ ok(
 	/existsSync\s*\(/.test(selfRegion),
 );
 
+// ── SLICE INTEGRITY (before any claim is read off the slice) ─────────────────
+// A source-slice assertion is only as good as its boundaries. `toolRegion` counts
+// parens, so an unbalanced paren inside a string literal would silently widen the
+// slice to a LATER tool and let a neighbour's text satisfy an assertion about this
+// one. Pin both ends explicitly instead of trusting the counter: the slice must
+// contain THIS tool's own error label and must NOT reach the next `server.tool(`.
+ok("entwurf_self slice contains its own handler tail (start boundary real)", /entwurf_self error:/.test(selfRegion));
+ok(
+	"entwurf_self slice stops before the next tool (end boundary real, no silent widen)",
+	!/entwurf_peers/.test(selfRegion) && !/entwurf_inbox_read/.test(selfRegion),
+);
+
+// ── F-1: entwurf_self must render the RAIL, never a universal mailbox ────────
+// The defect: `origin === "meta-session"` unconditionally synthesized
+// `<mailboxDir>/<gardenId>`. `origin` is sender PROVENANCE; the rail is the second
+// axis. A native-push citizen (antigravity) has NO mailbox at all (AGENTS Hard Rule
+// 10, VERIFY "No mailbox/receiver-marker evidence counts on this rail"), so that
+// branch printed a path that will never exist and taught the model mailbox semantics
+// its own rail does not have. Pinned PER RAIL, as one reusable predicate so the same
+// judgement can be driven over negative controls below.
+/** Brace-balanced body of the `if (<guard>) { … }` that follows `guard`, or null. */
+function branchBody(region: string, guard: string): string | null {
+	const at = region.indexOf(guard);
+	if (at < 0) return null;
+	const open = region.indexOf("{", at);
+	if (open < 0) return null;
+	let depth = 0;
+	for (let i = open; i < region.length; i++) {
+		const c = region[i];
+		if (c === "{") depth++;
+		else if (c === "}") {
+			depth--;
+			if (depth === 0) return region.slice(open, i + 1);
+		}
+	}
+	return null;
+}
+
+function metaRailRenderIsHonest(region: string): { honest: boolean; reason: string } {
+	// The mailbox path may be built at most once in the whole render branch…
+	const mailboxCalls = region.split("defaultMetaMailboxDir(").length - 1;
+	if (mailboxCalls !== 1) {
+		return { honest: false, reason: `expected exactly 1 defaultMetaMailboxDir() call, found ${mailboxCalls}` };
+	}
+	// …and that one call must sit INSIDE the self-fetch branch body. Ordering alone is not
+	// containment: an `if (rail === "self-fetch") {}` with an EMPTY body followed by an
+	// unconditional mailbox build satisfies "guard appears before mailbox" while still
+	// synthesizing a mailbox for every rail — the exact defect this predicate exists to
+	// reject. Extract the body by brace-counting and require the call to be in it.
+	const selfFetchBody = branchBody(region, 'rail === "self-fetch"');
+	if (selfFetchBody === null) {
+		return { honest: false, reason: 'no brace-balanced `rail === "self-fetch"` branch body' };
+	}
+	const inBranch = selfFetchBody.split("defaultMetaMailboxDir(").length - 1;
+	if (inBranch !== 1) {
+		return {
+			honest: false,
+			reason: `the self-fetch branch BODY must build the mailbox path exactly once, found ${inBranch} (ordering is not containment)`,
+		};
+	}
+	const pushBody = branchBody(region, 'rail === "native-push"');
+	if (pushBody === null) {
+		return { honest: false, reason: 'no brace-balanced `rail === "native-push"` branch body' };
+	}
+	// The native-push branch must deny an inbox AND keep the direct-inject claim conditional
+	// on the probe: a dead probe has no live conversation to inject into, so an unconditional
+	// "injects a reply into this live conversation" invents the very rail F-1 is about.
+	if (!/no inbox/.test(pushBody)) {
+		return { honest: false, reason: "the native-push branch does not state that there is no inbox" };
+	}
+	if (!/while the adapter probe is alive/.test(pushBody)) {
+		return {
+			honest: false,
+			reason: "the native-push branch states direct injection unconditionally (a dead probe has no live conversation)",
+		};
+	}
+	return {
+		honest: true,
+		reason:
+			"the sole mailbox build is INSIDE the self-fetch branch body; native-push denies an inbox and gates injection on the probe",
+	};
+}
+
+{
+	const verdict = metaRailRenderIsHonest(selfRegion);
+	ok(`entwurf_self renders the meta rail honestly [QK:SELFADDR-RAIL-RENDER] (${verdict.reason})`, verdict.honest);
+	ok(
+		"entwurf_self reads the rail from the builder (not re-derived at the render site)",
+		/self\.metaDeliveryDomain/.test(selfRegion),
+	);
+
+	// NEGATIVE CONTROLS — two KINDS, because a gate that only rejects the exact old
+	// sentence would pass a version where the branch is simply gone (and vice versa).
+	// Driving the same predicate over synthetic sources is what proves this assertion
+	// BLOCKS, not merely that it exists.
+	const retiredUnconditional = [
+		'} else if (sender.origin === "meta-session") {',
+		"\tconst mailboxPath = path.join(defaultMetaMailboxDir(), sender.sessionId);",
+		"\textra.mailboxPath = mailboxPath;",
+		"}",
+	].join("\n");
+	ok(
+		"NEGATIVE 1/3 (exact false sentence): the retired unconditional meta-session mailbox is REJECTED",
+		metaRailRenderIsHonest(retiredUnconditional).honest === false,
+	);
+
+	const selfFetchOnlyNoPushBranch = [
+		"const rail = self.metaDeliveryDomain;",
+		'if (rail === "self-fetch") {',
+		"\tconst mailboxPath = path.join(defaultMetaMailboxDir(), sender.sessionId);",
+		"\textra.mailboxPath = mailboxPath;",
+		"}",
+	].join("\n");
+	ok(
+		"NEGATIVE 2/3 (omission): a self-fetch-guarded render with the native-push branch DELETED is REJECTED",
+		metaRailRenderIsHonest(selfFetchOnlyNoPushBranch).honest === false,
+	);
+
+	// NEGATIVE 3/3 — the form the FIRST version of this predicate wrongly accepted (caught in
+	// cross-review, 2026-07-27): every marker present, guard textually BEFORE the mailbox, yet
+	// the guard's body is empty and the mailbox is built unconditionally. Ordering satisfied,
+	// containment violated. This row is why the predicate brace-counts the branch body.
+	const guardedInNameOnly = [
+		"const rail = self.metaDeliveryDomain;",
+		'if (rail === "self-fetch") { }',
+		"const mailboxPath = path.join(defaultMetaMailboxDir(), sender.sessionId);",
+		"extra.mailboxPath = mailboxPath;",
+		'if (rail === "native-push") {',
+		'\tlines.push("mailbox: none — no inbox; direct-inject only while the adapter probe is alive");',
+		"}",
+	].join("\n");
+	ok(
+		"NEGATIVE 3/3 (ordering-but-not-containment): an EMPTY self-fetch guard followed by an unconditional mailbox build is REJECTED",
+		metaRailRenderIsHonest(guardedInNameOnly).honest === false,
+	);
+}
+
+// ── F-1: the identity-wiring errors must not teach one backend's hook as THE hook ──
+// Both native backends mint a garden id from their OWN hook (Claude Code SessionStart,
+// Antigravity PreInvocation). Naming only SessionStart/Claude sent an agy operator
+// looking for a hook its backend never runs.
+{
+	/** Extract a `class NAME extends Error { ... }` body by brace-counting. */
+	const classBody = (name: string): string => {
+		const sig = `class ${name} extends Error {`;
+		const at = src.indexOf(sig);
+		assert.ok(at >= 0, `${name} present in MCP source`);
+		const open = src.indexOf("{", at);
+		let depth = 0;
+		for (let i = open; i < src.length; i++) {
+			const c = src[i];
+			if (c === "{") depth++;
+			else if (c === "}") {
+				depth--;
+				if (depth === 0) return src.slice(open, i + 1);
+			}
+		}
+		throw new Error(`class ${name} body never closed`);
+	};
+
+	// Anchored per class (not a repo-wide grep) so a mention somewhere else in the file
+	// cannot make either row vacuously green.
+	for (const cls of ["EntwurfEnvelopeWiringError", "EntwurfSenderIdentityError"]) {
+		const body = classBody(cls);
+		ok(
+			`${cls} names BOTH native hooks (SessionStart AND PreInvocation)`,
+			/SessionStart/.test(body) && /PreInvocation/.test(body),
+		);
+		ok(
+			`${cls} no longer presents SessionStart/Claude as THE marker writer`,
+			!/The native SessionStart hook writes that marker/.test(body) &&
+				!/whose SessionStart hook wrote a live/.test(body) &&
+				!/keyed by the\s+Claude Code parent pid/.test(body),
+		);
+	}
+}
+
 // ── SE-2 2e-b: meta-session sender replyability from the receiver presence marker ──
 // Identity stays trusted (record-backed), but `replyable` is now derived from whether
 // THIS session's own receiver inbox can actually wake (slice-2 presence marker), not a

package/scripts/check-entwurf-v2-contract.ts

@@ -8,7 +8,7 @@
  * by prose. Pure; no backend, no socket, no API.
  *
  * Proves:
- *   - R1 domain guard: only pi is in the liveness domain; claude-code / codex /
+ *   - R1 domain guard: the control-socket domain currently contains pi; claude-code / codex /
  *     antigravity are `unsupported` — NEVER folded into dead/indeterminate.
  *   - the 6-cell table is exhaustive and every cell is a SINGLE verdict (Q2):
  *     exactly two allow cells (ff+live=send, owned+dormant=resume), four reject.
@@ -92,7 +92,7 @@ function enumValues(schema: unknown): string[] {
 
 const SOCKET_LIVENESSES = ["alive", "dead", "indeterminate"] as const;
 
-// ── R1: backend liveness domain — only pi, others unsupported ──────────────
+// ── R1: control-socket capability domain — currently pi ────────────────────
 eq("domain: pi is supported", isLivenessSupported("pi"), true);
 eq("domain: claude-code unsupported (self-fetch, no socket)", isLivenessSupported("claude-code"), false);
 eq("domain: codex unsupported (no probe surface yet)", isLivenessSupported("codex"), false);

package/scripts/check-entwurf-v2-production.ts

@@ -271,15 +271,15 @@ async function main(): Promise<void> {
 		ok("A: B1 — a pi target does NO pre-lock lstat (inspectPath unused)", spies.inspectPath.length === 0);
 	}
 
-	// ── A2: B1 — a NON-pi target DOES record-side lstat the conflict (pre-lock) ─
+	// ── A2: out-of-socket-domain target checks record-side conflict pre-lock ──
 	{
 		// claude-code (unsupported) + a symlink at the canonical path → record-side conflict →
 		// the decider rejects target-address-conflict BEFORE acquiring (no lock for a quarantined
 		// address). The lstat-only inspectPath ran exactly once; acquire never did.
 		const { deps, spies } = makeSpiedFactory({ backend: "claude-code", inspectKind: "address-conflict" });
 		const decision = await deps.decide({ target: GID, intent: "fire-and-forget", message: "m" });
-		ok("A2: non-pi conflict → reject", decision.kind === "reject");
-		ok("A2: non-pi target lstat'd the conflict exactly once", spies.inspectPath.length === 1);
+		ok("A2: out-of-socket-domain conflict → reject", decision.kind === "reject");
+		ok("A2: out-of-domain target lstat'd the conflict exactly once", spies.inspectPath.length === 1);
 		ok("A2: a quarantined target is never lock-acquired", spies.acquire.length === 0);
 	}
 
@@ -316,7 +316,7 @@ async function main(): Promise<void> {
 		ok("A3b: no send attempted on a dead target", spies.nativePushSend.length === 0);
 	}
 
-	// ── A3: QB2 — a non-pi indeterminate lstat FAILS LOUD (never "no conflict") ─
+	// ── A3: out-of-domain indeterminate lstat fails loud ─────────────────────
 	{
 		const { deps } = makeSpiedFactory({ backend: "claude-code", inspectKind: "indeterminate" });
 		let threw = false;
@@ -325,7 +325,7 @@ async function main(): Promise<void> {
 		} catch {
 			threw = true;
 		}
-		ok("A3: non-pi indeterminate lstat → decide throws (QB2 fail-loud)", threw);
+		ok("A3: out-of-domain indeterminate lstat → decide throws (QB2 fail-loud)", threw);
 	}
 
 	// ── B: control sendOverSocket builds RpcSendCommand + maps + lockDir release ─

package/scripts/check-entwurf-v2-spawn-production.ts

@@ -499,9 +499,13 @@ async function main(): Promise<void> {
 			// missing record → not a garden citizen (readMetaIdentityByGardenId fail-fast).
 			rejects("20260101T000000-facade", "not a garden citizen", "9 recordless gid → not a citizen");
 
-			// non-pi citizen → spawn-bg resume is the pi rail.
+			// A citizen outside the spawn-bg capability domain cannot use that rail.
 			const gidClaude = mintRecord("claude-native-1", null, "claude-code");
-			rejects(gidClaude, "the pi rail", "9 non-pi citizen → refused (pi rail)");
+			rejects(
+				gidClaude,
+				"spawn-bg resume is a host-adapter capability",
+				"9 out-of-domain citizen → refused (spawn-bg rail)",
+			);
 
 			// pi citizen with no recorded transcript (no turn yet) → nothing to resume.
 			const gidNoFile = mintRecord("0199dddd-1111-4222-8333-444455556666", null);