@junghanacs/entwurf 0.17.1 → 0.17.2

package/CHANGELOG.md

@@ -4,6 +4,127 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.17.2 - 2026-09-03
+
+### Added
+
+- **An arriving letter is now visible to the operator, not just to the model (#98).** A sibling's
+  mail landed, was read, and left one line on the receiving screen — `Stop hook feedback` — with no
+  sender, no count, no garden id. Three surfaces changed, each measured in the
+  `scripts/raw-async-delivery/` lab before any product edit:
+  - **The doorbell says what it is.** The shipped `FileChanged` hook declares
+    `rewakeSummary: "entwurf inbox: sibling mail arrived"` and
+    `rewakeMessage: "entwurf mailbox notice:"`. The model no longer wakes to
+    `Stop hook blocking error from command "FileChanged"` — mail arriving was being named an error.
+    Both fields are `@internal` in the vendor and unsanitized, so `check-hook-launch-topology` lints
+    them (declared, no newline, not whitespace-only, length bound, no `[` in the prefix that would
+    double the doorbell's own `[entwurf inbox]`) and `smoke-meta-async-drift` carries both as
+    markers — a silent `@internal` removal is a future this repo cannot measure live.
+  - **The status line carries an unread badge.** `✉N` counts exactly what `entwurf_inbox_read`
+    would hand back (`*.msg` + `*.msg.delivered`, `.read` excluded — the same union as
+    `readMetaInbox`). No badge at zero. **`✉?` when the count could not be TAKEN** (no python3,
+    unusable garden id, unreadable directory): a measurement failure must not look like an empty
+    inbox.
+  - **A send names the file it enqueued.** `entwurf_v2 meta-mailbox → enqueued (2026-…-113443.msg)`.
+    `enqueueMetaMessage` already returned `messagePath`; the mailbox hand was flattening it to
+    `{success:true}`. Deliberately not a read stamp: at enqueue time `lastReadAt` belongs to the
+    PREVIOUS message, and surfacing it would read as "my message was read".
+
+### Fixed
+
+- **A dead-socket send that falls back to the mailbox now names its file too (#98).** A
+  control-socket delivery whose socket was gone re-resolves to the mailbox and writes a `.msg`
+  exactly like the primary rail, but the sender's line said only `fallback-sent` — the one mailbox
+  delivery with no per-message identifier. The receipt is carried through `SendDrive` →
+  `ControlSocketSendResult` → `ExecutedOutcome` → surface. A socket-to-socket retry writes no file
+  and carries none; a `rejected` enqueue carries none; a dep that omits it degrades to the bare
+  outcome rather than printing `undefined`.
+- **entwurf no longer owns the compaction switch (#94).** `autoCompactEnabled` and
+  `env.DISABLE_AUTOCOMPACT` moved from `MANAGED_SETTINGS_SCALARS` to `RETIRED_SETTINGS_SCALARS`,
+  the path `skipDangerousModePermissionPrompt` already walked. Retirement moves **ownership, not
+  state**: `relinquish_retired_scalar()` restores the install-state snapshot only when the current
+  value still equals the last managed one, so retirement alone turns compaction on for nobody —
+  turning it on is a separate operator act, and entwurf writing that value again would undo the
+  return. The doctor now stays green for an operator who turned compaction back on.
+  - **A correction that belongs in the record:** `env.DISABLE_AUTOCOMPACT` was a **no-op** at Claude
+    Code 2.1.259 — the only key that actually suppressed compaction was `autoCompactEnabled`. The
+    conclusion is unchanged; the reason narrows to one key.
+  - The lineage is also corrected. 0.5.0 *did* ship a pi-side compaction guard in real code;
+    `378c682` (v2 subtraction) deleted it and `623a4ea` later cleared the docs that outlived it by
+    seven days. The "zero code backing" in that commit message was a grep result at that moment, not
+    a claim that the guard never existed.
+
+### Changed
+
+- **Three shipped comments stopped repeating two claims this release retired.** `doorbell.sh`,
+  `raw-async-delivery/README.md` and `smoke-meta-async-drift.sh` said that `asyncRewake` ignores
+  `rewakeMessage` and that stdout is dropped. Measured against three vendor binaries (2.1.236 /
+  2.1.258 / 2.1.259), both are false: `rewakeMessage` *replaces* the prefix, and the body is
+  `stderr || stdout`. The marker strings were correct while their stated reasons were dead — a
+  sentinel nobody could act on. The lab README now carries the receipts under
+  `## Inherited facts corrected`, and the watcher documents what it observes rather than which
+  backends it expects.
+- `lastDeliveredAt` is documented as a **reserved slot nobody stamps**, in five comments and four
+  test cells that had been pinning it green as `=== null` while 933 files carried a `.delivered`
+  suffix. The per-message facts are the suffixes (`.msg` → `.delivered` → `.read`); `state.json`
+  holds only the garden's last enqueue/read. Removing the field is a separate migration (its reader
+  is doubly strict and 182 v1 files are on disk), tracked apart from this release.
+
+### Upgrade note
+
+**Run `entwurf setup` once after upgrading — every rail, not just Claude.** Two separate debts:
+
+- The Claude plugin's hook template gained `rewakeSummary` and `rewakeMessage`, so until
+  `install-meta-bridge` runs, `doctor-meta-bridge` reports
+  `installed manifest DIFFERS … Re-run install-meta-bridge`.
+- **This release changed `lib/meta-session.ts`, and four install paths deploy that file** —
+  `install-meta-bridge` (Claude), `install-omp-bridge` and `install-omp-receive` (OMP),
+  `install-copilot-bridge` (Copilot). Every one of them that is installed on the host now carries a
+  STALE writer until it is re-installed, and its own doctor says so by name. Re-installing only the
+  Claude rail leaves the others stale — measured on oracle during this cut, where it blocked
+  `smoke-omp-receive-live` and turned the first `--cut` run red.
+
+`entwurf setup` is presence-driven and re-synthesizes exactly the units this host has, which is why
+it is the upgrade command rather than any single `install-*`. An already-open Claude Code session
+keeps the old manifest until it restarts.
+
+0.17.1 was tagged and released on GitHub but **not published to npm**; it is superseded by this
+version.
+
+### Verification
+
+All of the following ran on oracle (Linux, Claude Code 2.1.259, node 24.18.1, pi 0.84.4, omp 18.0.0).
+
+- **`pnpm run check:full` — exit 0** (432s on the prepared tree; 437s on the pre-version HEAD).
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.17.2b.WW12BK --cut` — `cut: OK`,
+  exit 0.** **MUST PASS=23 FAIL=0 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0 SKIP=0**. Run 20:39→21:26 KST
+  with `env -u CLAUDE_CONFIG_DIR -u PI_SESSION_ID -u PI_AGENT_ID`. Log:
+  `/tmp/entwurf-release-gate-0.17.2b.WW12BK/release-gate.log`. It carried `check:full` (429s) and
+  `check-gate-qualification` (**347/347 KILLED**) as MUST steps.
+- **The first `--cut` attempt was RED, and that is the receipt for the upgrade note above.**
+  `smoke-omp-receive-live` failed with `STALE writer: source=634d5b96ed50 installed=229fef123589`
+  on `~/.omp/agent/extensions/entwurf-receive-omp/lib/meta-session.ts` — MUST PASS=22 FAIL=1,
+  `cut: BLOCKED`. Both OMP extensions on the host still carried the pre-release writer because only
+  the Claude rail had been re-installed. `install-omp-bridge` + `install-omp-receive` moved both to
+  `634d5b96ed50`, `doctor-omp-bridge` and `doctor-omp-receive` went PASS, and the re-run was green.
+  Nothing in the product changed between the two runs.
+- **#94 measured on a live host.** After one `install-meta-bridge`, the install-state ledger no
+  longer carries `autoCompactEnabled` or `env.DISABLE_AUTOCOMPACT`, and `~/.claude/settings.json`
+  was **byte-identical** to its pre-install backup — the return does not rewrite the value it
+  returns. `doctor-meta-bridge` went FAIL→PASS, `smoke-meta-install-state` PASS,
+  `check-meta-doctor-oracle` PASS including the two new cells (`an operator who turned compaction
+  back ON is not drift`, `install-state still owns a retired scalar → FAIL naming its own cause`).
+- **#98 B measured across the whole suffix lifecycle** in an isolated mailbox root: no badge at 0,
+  `✉1` on `.msg`, `✉2` after `.msg.delivered`, unchanged by a `.read` file, back to no badge when
+  all are read, and `✉?` on an unreadable directory.
+- **`smoke-meta-async-drift` ends `pass=12 fail=0 drift=1`, exit 1** — the drift is
+  `codex 0.147.0` outside the `0.144.x` pin and **pre-dates this release**. Both markers this
+  release added (`rewakeMessage`, `rewakeSummary`) are present. The pin bump is deliberately not in
+  this lane.
+- **Exact-SHA CI on the pre-version HEAD `4124e42`** — `check`, `install-surface`,
+  `artifact-consumer` all `success`.
+  Run: https://github.com/junghan0611/entwurf/actions/runs/33742448634
+
 ## 0.17.1 - 2026-09-03
 
 ### Fixed

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-mailbox.js

@@ -36,16 +36,23 @@ import { enqueueMetaMessage } from "./meta-session.js";
  * legacy mailbox path used). `plan.wantsReply` is threaded into the body — v2 carries the
  * caller's intent, a DELIBERATE divergence from the legacy hard-coded `false`. An enqueue
  * throw PROPAGATES; it is never converted to `{success:false}`.
+ *
+ * #98 R — the SEND receipt: `enqueueMetaMessage` already returns the exact `.msg` path it
+ * wrote ("Returns the paths so a sender can show exactly what was queued"), and this body
+ * used to flatten it to `{success:true}`. It now carries that ONE field through. Nothing
+ * else from the enqueue result crosses: no timestamps, and specifically no `lastReadAt` —
+ * see the `RpcSendResult` note. The path is reported verbatim from the enqueue result, not
+ * re-derived from the plan, so it can never disagree with the file that was actually written.
  */
 export function executeMetaMailboxSend(plan, sender, deps) {
     const body = sender ? formatMetaMailboxBody(sender, plan.message, plan.wantsReply) : plan.message;
-    deps.enqueue({
+    const enqueued = deps.enqueue({
         gardenId: plan.targetGardenId,
         body,
         sessionsDir: plan.sessionsDir,
         mailboxDir: plan.mailboxDir,
     });
-    return { success: true };
+    return { success: true, messagePath: enqueued.messagePath };
 }
 /**
  * Build the production `sendViaMailbox(plan, lock)` adapter the 5c-2a send hand consumes.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-runner.js

@@ -49,7 +49,12 @@ export async function executeDispatch(decision, deps) {
                     kind: "executed",
                     receipt,
                     transport,
-                    outcome: { transport: "control-socket", outcome: r.outcome, rejectReason: r.rejectReason },
+                    outcome: {
+                        transport: "control-socket",
+                        outcome: r.outcome,
+                        rejectReason: r.rejectReason,
+                        messagePath: r.messagePath,
+                    },
                 };
             }
             catch (err) {
@@ -80,7 +85,14 @@ export async function executeDispatch(decision, deps) {
                 if (r.success !== true) {
                     throw new Error("entwurf-v2-runner: meta-mailbox send returned success:false (contract violation; a mailbox has no in-band reject).");
                 }
-                return { kind: "executed", receipt, transport, outcome: { transport: "meta-mailbox", success: true } };
+                return {
+                    kind: "executed",
+                    receipt,
+                    transport,
+                    // #98 R: carry the enqueue receipt verbatim. `undefined` stays `undefined` —
+                    // the runner never substitutes a guessed path for a missing one.
+                    outcome: { transport: "meta-mailbox", success: true, messagePath: r.messagePath },
+                };
             }
             catch (err) {
                 return { kind: "execution-failed", receipt, transport, error: errorMessage(err), retrySafe: false };

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-send.js

@@ -58,7 +58,7 @@ export async function executeControlSocketSend(plan, lock, deps) {
         drive = { outcome: "failed", error: err };
     }
     finalizeRelease(policy, deps, held, drive);
-    return { outcome: drive.outcome, rejectReason: drive.rejectReason };
+    return { outcome: drive.outcome, rejectReason: drive.rejectReason, messagePath: drive.messagePath };
 }
 /** Drive the 1차 send and route a connect failure through the F3 split. */
 async function driveSend(plan, lock, deps) {
@@ -122,7 +122,10 @@ async function driveDeadFallback(plan, lock, deps) {
             // hand never reaches for the mailbox on its own; only the resolver routes here.
             try {
                 const r = await deps.sendViaMailbox(rePlan, lock);
-                return { outcome: r.success ? "fallback-sent" : "rejected" };
+                // #98 R: this leg writes a `.msg` exactly like the primary mailbox rail, so it
+                // owes the sender the same per-message receipt. Carried only on success — a
+                // `rejected` enqueue wrote no file to name.
+                return r.success ? { outcome: "fallback-sent", messagePath: r.messagePath } : { outcome: "rejected" };
             }
             catch (err) {
                 return { outcome: "failed", error: err };

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-surface.js

@@ -18,6 +18,7 @@
  *   - `runAndRenderEntwurfV2FromSurface` — assemble production deps + run + render, so the root
  *     surface never needs to name the `EntwurfV2RunResult` union (it only sees `{text,isError}`).
  */
+import { basename } from "node:path";
 import { makeProductionEntwurfV2Deps } from "./entwurf-v2-production.js";
 import { runEntwurfV2 } from "./entwurf-v2-runner.js";
 import { FRESH_CUT_PRESCRIPTION } from "./meta-session.js";
@@ -109,8 +110,13 @@ export function renderEntwurfV2Result(result) {
             if (o.transport === "control-socket") {
                 const delivered = o.outcome === "sent" || o.outcome === "fallback-sent";
                 const reason = o.rejectReason ? ` (reason: ${o.rejectReason})` : "";
+                // #98 R, fallback leg: a dead socket that re-resolved to the mailbox wrote a
+                // `.msg` — name it, exactly as the primary mailbox rail does. Absent on a
+                // socket-to-socket retry (no file) and on every non-mailbox outcome, so the
+                // line degrades to the bare outcome rather than printing "undefined".
+                const enqueued = o.messagePath ? ` (enqueued ${basename(o.messagePath)})` : "";
                 return {
-                    text: `entwurf_v2 control-socket → ${o.outcome}${reason}`,
+                    text: `entwurf_v2 control-socket → ${o.outcome}${reason}${enqueued}`,
                     isError: !delivered,
                 };
             }
@@ -121,8 +127,17 @@ export function renderEntwurfV2Result(result) {
                     isError: false,
                 };
             }
-            // meta-mailbox
-            return { text: "entwurf_v2 meta-mailbox → enqueued", isError: false };
+            // meta-mailbox. #98 R: name the FILE that was enqueued, so the sender's transcript
+            // carries a per-message identifier instead of a bare literal. Only the basename —
+            // the directory is `<meta-mailbox>/<target garden id>/`, which the caller already
+            // typed. Deliberately NOT a read stamp: at enqueue time `lastReadAt` belongs to the
+            // PREVIOUS message, so printing it would claim a read that has not happened.
+            // A dep that omits the receipt falls back to the old literal rather than printing
+            // "undefined" — the delivery still happened.
+            return {
+                text: `entwurf_v2 meta-mailbox → enqueued${o.messagePath ? ` (${basename(o.messagePath)})` : ""}`,
+                isError: false,
+            };
         }
         case "execution-failed": {
             if (result.releaseFailed && result.finalizedOutcome) {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js

@@ -2077,9 +2077,17 @@ export function enqueueMetaMessage(opts) {
  * Drain a garden citizen's mailbox: read every unread message (a fresh `.msg`
  * read before its doorbell, or a doorbell-rung `.msg.delivered`), archive each to
  * `*.read` so a re-read never double-returns, and — only if at least one message
- * was read — stamp `lastReadAt` (NOT `lastDeliveredAt`: the doorbell owns
- * delivery-time, see the stamp-site note below). An empty inbox mutates nothing:
- * reading nothing is not a receipt.
+ * was read — stamp `lastReadAt`. `lastDeliveredAt` stays untouched (see the
+ * stamp-site note below). An empty inbox mutates nothing: reading nothing is not
+ * a receipt.
+ *
+ * WHERE THE PER-MESSAGE TRUTH LIVES (#98 5a, corrected 2026-09-03). The FILE SUFFIX
+ * is the per-message receipt: `.msg` = enqueued, `.msg.delivered` = the doorbell
+ * rang for it, `.msg.delivered.read` = this function handed it to the reader.
+ * `state.json` is NOT that — its three slots are GARDEN-WIDE and overwritten, so
+ * `lastReadAt` says "this citizen last read something at T", never "message X was
+ * read". A sender that quotes `lastReadAt` back as the fate of the letter it just
+ * queued is quoting the PREVIOUS letter's read. That misreading is what opened #98.
  */
 export function readMetaInbox(opts) {
     const now = opts.now ?? new Date();
@@ -2101,10 +2109,18 @@ export function readMetaInbox(opts) {
     if (messages.length === 0) {
         return { gardenId: citizen.gardenId, messages, readAt: null, recordPath: recordFile };
     }
-    // 3D-4 the cut: the read receipt lives SOLELY in the mailbox state store now.
-    // Stamp lastReadAt — the one receipt this layer stamps honestly (it KNOWS the body
-    // reached the reader). lastDeliveredAt is the doorbell's to own; stamping it here
-    // would report read-time as delivery-time, so it is left as the doorbell left it.
+    // 3D-4 the cut: the garden-wide read receipt lives SOLELY in the mailbox state store
+    // now. Stamp lastReadAt — the one slot this layer stamps honestly (it KNOWS a body
+    // reached the reader at this instant). lastDeliveredAt is left alone, and #98 5a
+    // corrects WHY: the old comment said "the doorbell owns it", but the shipped
+    // doorbell.sh (54 lines) writes NOTHING to state.json — measured, zero state writes.
+    // So `lastDeliveredAt` is a RESERVED SLOT nobody stamps, permanently null on all
+    // ~180 on-disk states, while 900+ files carry a `.delivered` suffix. Stamping it
+    // here would still be wrong (it would report read-time as delivery-time), so it
+    // stays null — but do not read "the doorbell will fill it in" into that. The
+    // per-message delivery fact is the `.delivered` SUFFIX. The field is left in place
+    // deliberately: removing it is a migration (the parser rejects unknown keys AND a
+    // bumped schemaVersion, and every stamp re-parses first), tracked as #98 5b.
     // The state stamp returns the updated state, whose lastReadAt IS the D7 read-receipt.
     // Inside the messages.length>0 branch by construction — an empty inbox already
     // early-returned (no .read archive, state untouched), so "read nothing" is no

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.17.1",
+	"version": "0.17.2",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {

package/pi/meta-bridge/entwurf-meta-receive/hooks/hooks.json

@@ -45,7 +45,9 @@
 						"command": "${CLAUDE_PLUGIN_ROOT}/scripts/hook-launch.sh",
 						"args": ["${CLAUDE_PLUGIN_ROOT}/scripts/doorbell.sh"],
 						"asyncRewake": true,
-						"timeout": 20
+						"timeout": 20,
+						"rewakeSummary": "entwurf inbox: sibling mail arrived",
+						"rewakeMessage": "entwurf mailbox notice:"
 					}
 				]
 			}

package/pi/meta-bridge/entwurf-meta-receive/scripts/doorbell.sh

@@ -6,15 +6,20 @@
 # with a doorbell notice. Free: a file write + continuation of an already-running
 # subscription session (no `claude -p` spawn).
 #
-# ADDRESSED by GARDEN ID: the changed path arrives on stdin as `file_path`; its
-# directory IS this session's garden mailbox (<meta-mailbox>/<garden-id>/). So
-# this hook touches ONLY its own mailbox — a sender that pokes one garden id's
-# signal wakes only that session. No node needed here; the dirname is the mailbox.
+# ADDRESSED by GARDEN ID: the changed path arrives on stdin as `file_path` and this
+# hook takes its DIRECTORY as the mailbox to process. No node needed here; the
+# dirname is the mailbox.
 #
-# DOORBELL ONLY: announce "you have mail" + the body path on stderr (the sole
-# asyncRewake payload channel — stdout is dropped). NEVER push imperatives; strong
-# models flag hook-injected commands as prompt injection. The agent self-fetches
-# the body with its own trusted tool, and that inbox-read is the real D7 receipt.
+# Two statements, deliberately kept apart (#98, 2026-09-03 — they used to be one
+# sentence claiming this hook "touches ONLY its own mailbox"):
+#   - PREMISE: under a normal install the only watch this session armed is its own
+#     <garden-id>/inbox.signal, so that is the only file_path that arrives.
+#   - LIMIT: this script does not verify it. It trusts `file_path` and never compares
+#     the dirname against its garden id. Measured — a second FileChanged hook in the
+#     same session made this doorbell process the OTHER mailbox and race it to exit 2,
+#     which is why a second such hook cannot coexist with this one.
+#   Receipt: scripts/raw-async-delivery/README.md, "What the probe session actually
+#   touches". Not a live defect: nothing pokes a signal outside the garden mailbox.
 #
 # RUNTIME DEPS: bash + python3 (the FileChanged stdin JSON is parsed with python3
 # below — robust against escaping, unlike sed/grep). The meta-bridge doctor must

package/pi-extensions/lib/entwurf-v2-mailbox.ts

@@ -50,6 +50,13 @@ export interface MetaMailboxSendDeps {
  * legacy mailbox path used). `plan.wantsReply` is threaded into the body — v2 carries the
  * caller's intent, a DELIBERATE divergence from the legacy hard-coded `false`. An enqueue
  * throw PROPAGATES; it is never converted to `{success:false}`.
+ *
+ * #98 R — the SEND receipt: `enqueueMetaMessage` already returns the exact `.msg` path it
+ * wrote ("Returns the paths so a sender can show exactly what was queued"), and this body
+ * used to flatten it to `{success:true}`. It now carries that ONE field through. Nothing
+ * else from the enqueue result crosses: no timestamps, and specifically no `lastReadAt` —
+ * see the `RpcSendResult` note. The path is reported verbatim from the enqueue result, not
+ * re-derived from the plan, so it can never disagree with the file that was actually written.
  */
 export function executeMetaMailboxSend(
 	plan: MetaMailboxPlan,
@@ -57,13 +64,13 @@ export function executeMetaMailboxSend(
 	deps: MetaMailboxSendDeps,
 ): RpcSendResult {
 	const body = sender ? formatMetaMailboxBody(sender, plan.message, plan.wantsReply) : plan.message;
-	deps.enqueue({
+	const enqueued = deps.enqueue({
 		gardenId: plan.targetGardenId,
 		body,
 		sessionsDir: plan.sessionsDir,
 		mailboxDir: plan.mailboxDir,
 	});
-	return { success: true };
+	return { success: true, messagePath: enqueued.messagePath };
 }
 
 /**

package/pi-extensions/lib/entwurf-v2-runner.ts

@@ -61,12 +61,17 @@ export interface DispatchExecutorDeps {
 }
 
 /** The per-transport success outcome, discriminated by transport so the surface renders
- * each without guessing. `control-socket` carries the optional N3 `rejectReason`;
+ * each without guessing. `control-socket` carries the optional N3 `rejectReason` and,
+ * when a dead-socket re-resolve fell back to the mailbox, that leg's #98 R `messagePath`;
  * `meta-mailbox` is always `success:true` (enqueue has no in-band refuse — a failure is
- * a throw, handled as `execution-failed`). */
+ * a throw, handled as `execution-failed`) and carries the #98 R send receipt: the path of
+ * the `.msg` the enqueue actually wrote. OPTIONAL because a fake/legacy `sendMailbox` dep
+ * may omit it — a missing receipt must degrade the rendered line, never fail the delivery,
+ * and it is the ONLY enqueue-side datum carried (never a read timestamp; see
+ * `RpcSendResult`). */
 export type ExecutedOutcome =
-	| { transport: "control-socket"; outcome: SendFinalOutcome; rejectReason?: string }
-	| { transport: "meta-mailbox"; success: true }
+	| { transport: "control-socket"; outcome: SendFinalOutcome; rejectReason?: string; messagePath?: string }
+	| { transport: "meta-mailbox"; success: true; messagePath?: string }
 	// native-push carries `retried` so the surface can note the 1-shot re-probe retry fired.
 	| { transport: "native-push"; success: true; retried: boolean };
 
@@ -118,7 +123,12 @@ export async function executeDispatch(
 					kind: "executed",
 					receipt,
 					transport,
-					outcome: { transport: "control-socket", outcome: r.outcome, rejectReason: r.rejectReason },
+					outcome: {
+						transport: "control-socket",
+						outcome: r.outcome,
+						rejectReason: r.rejectReason,
+						messagePath: r.messagePath,
+					},
 				};
 			} catch (err) {
 				// N1: a delivered/refused send whose release then threw — lock dirty, do NOT retry.
@@ -150,7 +160,14 @@ export async function executeDispatch(
 						"entwurf-v2-runner: meta-mailbox send returned success:false (contract violation; a mailbox has no in-band reject).",
 					);
 				}
-				return { kind: "executed", receipt, transport, outcome: { transport: "meta-mailbox", success: true } };
+				return {
+					kind: "executed",
+					receipt,
+					transport,
+					// #98 R: carry the enqueue receipt verbatim. `undefined` stays `undefined` —
+					// the runner never substitutes a guessed path for a missing one.
+					outcome: { transport: "meta-mailbox", success: true, messagePath: r.messagePath },
+				};
 			} catch (err) {
 				return { kind: "execution-failed", receipt, transport, error: errorMessage(err), retrySafe: false };
 			}

package/pi-extensions/lib/entwurf-v2-send.ts

@@ -52,10 +52,20 @@ export type MetaMailboxPlan = Extract<ExecutionPlan, { transport: "meta-mailbox"
 export type SendFinalOutcome = "sent" | "fallback-sent" | "rejected" | "failed";
 
 /** What a single RPC / mailbox enqueue reports. `success:false` is an in-band reject
- * (the receiver answered and refused) — distinct from a thrown connect error. */
+ * (the receiver answered and refused) — distinct from a thrown connect error.
+ *
+ * `messagePath` is the SEND-side receipt (#98 R) and is OPTIONAL because only the
+ * mailbox rail has one: an enqueue writes a file, so there is a per-message artifact
+ * to name. A control-socket RPC hands the body to a live receiver and produces no
+ * file, so it leaves this undefined rather than inventing one. It carries the ENQUEUED
+ * path and NOTHING about reading: `lastReadAt` at enqueue time is the PREVIOUS
+ * message's read stamp, so surfacing it here would read as "my message was read" —
+ * the exact misreading #98 opened on. The per-message read receipt is the `.read`
+ * suffix on this very file, never a state.json slot. */
 export interface RpcSendResult {
 	success: boolean;
 	error?: string;
+	messagePath?: string;
 }
 
 /** The same-lock one-shot re-resolve result (5c-2b implements the resolver; 5c-2a
@@ -98,6 +108,14 @@ export interface ControlSocketSendResult {
 	 * 5d runner carries this verbatim so the surface can tell "in-band refusal" from
 	 * "no live route" — the N3 carry-over the hand boundary used to drop. */
 	rejectReason?: string;
+	/** #98 R, fallback leg: the `.msg` a dead-socket re-resolve enqueued. Present ONLY
+	 * when the fallback actually routed to the mailbox and the enqueue succeeded — a
+	 * control-socket retry hands the body to a live receiver and writes no file, so it
+	 * leaves this undefined rather than inventing one. Same rule as `RpcSendResult`: the
+	 * ENQUEUED path and nothing about reading. Without it a `fallback-sent` is the one
+	 * mailbox delivery whose sender gets no per-message identifier — the same letter the
+	 * primary mailbox rail names. */
+	messagePath?: string;
 }
 
 // A drive step's verdict: the terminal outcome, plus the original error to RETHROW on
@@ -107,6 +125,8 @@ interface SendDrive {
 	outcome: SendFinalOutcome;
 	error?: unknown;
 	rejectReason?: string;
+	/** #98 R receipt from the mailbox fallback leg (see `ControlSocketSendResult`). */
+	messagePath?: string;
 }
 
 /**
@@ -139,7 +159,7 @@ export async function executeControlSocketSend(
 		drive = { outcome: "failed", error: err };
 	}
 	finalizeRelease(policy, deps, held, drive);
-	return { outcome: drive.outcome, rejectReason: drive.rejectReason };
+	return { outcome: drive.outcome, rejectReason: drive.rejectReason, messagePath: drive.messagePath };
 }
 
 /** Drive the 1차 send and route a connect failure through the F3 split. */
@@ -208,7 +228,10 @@ async function driveDeadFallback(
 			// hand never reaches for the mailbox on its own; only the resolver routes here.
 			try {
 				const r = await deps.sendViaMailbox(rePlan, lock);
-				return { outcome: r.success ? "fallback-sent" : "rejected" };
+				// #98 R: this leg writes a `.msg` exactly like the primary mailbox rail, so it
+				// owes the sender the same per-message receipt. Carried only on success — a
+				// `rejected` enqueue wrote no file to name.
+				return r.success ? { outcome: "fallback-sent", messagePath: r.messagePath } : { outcome: "rejected" };
 			} catch (err) {
 				return { outcome: "failed", error: err };
 			}

package/pi-extensions/lib/entwurf-v2-surface.ts

@@ -19,6 +19,7 @@
  *     surface never needs to name the `EntwurfV2RunResult` union (it only sees `{text,isError}`).
  */
 
+import { basename } from "node:path";
 import type { SenderEnvelope } from "./entwurf-control-rpc.ts";
 import type { DispatchInput, EntwurfV2Mode } from "./entwurf-v2-decider.ts";
 import { makeProductionEntwurfV2Deps, type ProductionEntwurfV2Opts } from "./entwurf-v2-production.ts";
@@ -144,8 +145,13 @@ export function renderEntwurfV2Result(result: EntwurfV2RunResult): EntwurfV2Surf
 			if (o.transport === "control-socket") {
 				const delivered = o.outcome === "sent" || o.outcome === "fallback-sent";
 				const reason = o.rejectReason ? ` (reason: ${o.rejectReason})` : "";
+				// #98 R, fallback leg: a dead socket that re-resolved to the mailbox wrote a
+				// `.msg` — name it, exactly as the primary mailbox rail does. Absent on a
+				// socket-to-socket retry (no file) and on every non-mailbox outcome, so the
+				// line degrades to the bare outcome rather than printing "undefined".
+				const enqueued = o.messagePath ? ` (enqueued ${basename(o.messagePath)})` : "";
 				return {
-					text: `entwurf_v2 control-socket → ${o.outcome}${reason}`,
+					text: `entwurf_v2 control-socket → ${o.outcome}${reason}${enqueued}`,
 					isError: !delivered,
 				};
 			}
@@ -156,8 +162,17 @@ export function renderEntwurfV2Result(result: EntwurfV2RunResult): EntwurfV2Surf
 					isError: false,
 				};
 			}
-			// meta-mailbox
-			return { text: "entwurf_v2 meta-mailbox → enqueued", isError: false };
+			// meta-mailbox. #98 R: name the FILE that was enqueued, so the sender's transcript
+			// carries a per-message identifier instead of a bare literal. Only the basename —
+			// the directory is `<meta-mailbox>/<target garden id>/`, which the caller already
+			// typed. Deliberately NOT a read stamp: at enqueue time `lastReadAt` belongs to the
+			// PREVIOUS message, so printing it would claim a read that has not happened.
+			// A dep that omits the receipt falls back to the old literal rather than printing
+			// "undefined" — the delivery still happened.
+			return {
+				text: `entwurf_v2 meta-mailbox → enqueued${o.messagePath ? ` (${basename(o.messagePath)})` : ""}`,
+				isError: false,
+			};
 		}
 		case "execution-failed": {
 			if (result.releaseFailed && result.finalizedOutcome) {

package/pi-extensions/lib/meta-session.ts

@@ -2532,9 +2532,17 @@ export interface ReadMetaInboxResult {
  * Drain a garden citizen's mailbox: read every unread message (a fresh `.msg`
  * read before its doorbell, or a doorbell-rung `.msg.delivered`), archive each to
  * `*.read` so a re-read never double-returns, and — only if at least one message
- * was read — stamp `lastReadAt` (NOT `lastDeliveredAt`: the doorbell owns
- * delivery-time, see the stamp-site note below). An empty inbox mutates nothing:
- * reading nothing is not a receipt.
+ * was read — stamp `lastReadAt`. `lastDeliveredAt` stays untouched (see the
+ * stamp-site note below). An empty inbox mutates nothing: reading nothing is not
+ * a receipt.
+ *
+ * WHERE THE PER-MESSAGE TRUTH LIVES (#98 5a, corrected 2026-09-03). The FILE SUFFIX
+ * is the per-message receipt: `.msg` = enqueued, `.msg.delivered` = the doorbell
+ * rang for it, `.msg.delivered.read` = this function handed it to the reader.
+ * `state.json` is NOT that — its three slots are GARDEN-WIDE and overwritten, so
+ * `lastReadAt` says "this citizen last read something at T", never "message X was
+ * read". A sender that quotes `lastReadAt` back as the fate of the letter it just
+ * queued is quoting the PREVIOUS letter's read. That misreading is what opened #98.
  */
 export function readMetaInbox(opts: ReadMetaInboxOptions): ReadMetaInboxResult {
 	const now = opts.now ?? new Date();
@@ -2560,10 +2568,18 @@ export function readMetaInbox(opts: ReadMetaInboxOptions): ReadMetaInboxResult {
 		return { gardenId: citizen.gardenId, messages, readAt: null, recordPath: recordFile };
 	}
 
-	// 3D-4 the cut: the read receipt lives SOLELY in the mailbox state store now.
-	// Stamp lastReadAt — the one receipt this layer stamps honestly (it KNOWS the body
-	// reached the reader). lastDeliveredAt is the doorbell's to own; stamping it here
-	// would report read-time as delivery-time, so it is left as the doorbell left it.
+	// 3D-4 the cut: the garden-wide read receipt lives SOLELY in the mailbox state store
+	// now. Stamp lastReadAt — the one slot this layer stamps honestly (it KNOWS a body
+	// reached the reader at this instant). lastDeliveredAt is left alone, and #98 5a
+	// corrects WHY: the old comment said "the doorbell owns it", but the shipped
+	// doorbell.sh (54 lines) writes NOTHING to state.json — measured, zero state writes.
+	// So `lastDeliveredAt` is a RESERVED SLOT nobody stamps, permanently null on all
+	// ~180 on-disk states, while 900+ files carry a `.delivered` suffix. Stamping it
+	// here would still be wrong (it would report read-time as delivery-time), so it
+	// stays null — but do not read "the doorbell will fill it in" into that. The
+	// per-message delivery fact is the `.delivered` SUFFIX. The field is left in place
+	// deliberately: removing it is a migration (the parser rejects unknown keys AND a
+	// bumped schemaVersion, and every stamp re-parses first), tracked as #98 5b.
 	// The state stamp returns the updated state, whose lastReadAt IS the D7 read-receipt.
 	// Inside the messages.length>0 branch by construction — an empty inbox already
 	// early-returned (no .read archive, state untouched), so "read nothing" is no
@@ -2603,6 +2619,15 @@ export const MAILBOX_RECEIPT_SCHEMA_VERSION = 1 as const;
  * The per-citizen mailbox receipt state. Holds exactly the three delivery
  * timestamps that move out of `record.delivery` (wakeMode/deliveryLevel are
  * capability, deliberately absent). Body is SSOT; the on-disk path is derived.
+ *
+ * SCOPE (#98 5a): these are GARDEN-WIDE "last activity" slots, single-valued and
+ * overwritten — NOT per-message receipts. Per message, the receipt is the file
+ * suffix in the same directory (`.msg` → `.msg.delivered` → `.msg.delivered.read`).
+ * `lastEnqueuedAt`/`lastReadAt` are stamped by `enqueueMetaMessage`/`readMetaInbox`.
+ * `lastDeliveredAt` is stamped by NOBODY: the doorbell does not write state.json, so
+ * it is a reserved slot that is null everywhere. Kept rather than removed because the
+ * parser is doubly strict (exact schemaVersion + no unknown keys) and every stamp
+ * re-parses, so dropping it is a migration over the existing on-disk v1 files (#98 5b).
  */
 export interface MailboxReceiptState {
 	schemaVersion: typeof MAILBOX_RECEIPT_SCHEMA_VERSION;