@junghanacs/entwurf 0.17.1 → 0.18.0

package/AGENTS.md

@@ -90,7 +90,7 @@ A `--entwurf-control` pi session is a citizen for the same reason a native bridg
 
 - **control-socket domain (currently `pi`)**: socket liveness, per-target lock, live send, and a dormant cell that rejects.
 - **No relaunch transport exists inside delivery.** `spawn-bg` — a detached, window-less resume child — was removed under the visible-first rule, not deprecated behind a reject, and `entwurf_v2` still starts no process: a dormant socket-domain citizen is refused as `dormant-fire-forget-unsupported`. Reopening one is the separate lifecycle verb `entwurf_resume_call`, which is pi-only (`target-not-pi` otherwise), returns a LAUNCH receipt and an OBSERVATION receipt that are never merged, releases its per-gid lock on every path, and on an unobserved socket leaves the visible window open rather than retrying. No watcher, no retry, no supervisor. Do not re-route it through `entwurf_v2` and do not describe a spawn domain that does not exist.
-- **self-fetch domain (Claude Code, Copilot CLI)**: active receiver + mailbox deliverability; no resume authority. The two arm that receiver through different vendor surfaces — a Claude hook that emits watchPaths, a Copilot first-party extension that holds the watch in a forked child — and the marker records which, because the pid a reader verifies differs.
+- **self-fetch domain (Claude Code, Copilot CLI)**: active receiver + mailbox deliverability; no resume authority. The two arm that receiver through different vendor surfaces — a Claude hook that emits watchPaths, a Copilot first-party extension that holds the watch in a forked child — and the marker records which, because the pid a reader verifies differs. A live marker is not by itself an armed doorbell: where the watch owner IS the process the sender marker is keyed to (`ownerKind: claude-code-cli`), that owner may switch sessions in place, so deliverability also requires its sender marker to still name the same garden. That join is `ownerKind`-scoped by construction — a Copilot watch lives in a forked child with its own pid, so the join does not exist there and must never be applied to it (#101).
 - **native-push domain (currently Antigravity)**: adapter probe + direct injection; no mailbox and no resume authority.
 - `origin: "pi-session" | "meta-session" | "external-mcp"` records sender provenance. It is not the citizen identity schema and not a hierarchy.
 - `entwurf_peers` reports record citizens and liveness facts only. It never embeds routing verbs or socket addresses for peers.
@@ -172,6 +172,7 @@ implement → affected focused gates → independent review → one amendment bu
 | `pi-extensions/lib/entwurf-v2-*.ts` | v2 contract, decider, transports, runner, production wiring; visible resume keeps launch injected |
 | `pi-extensions/lib/mux-*.ts` | same-tmux placement plus narrow fresh-call and visible-resume launch compositions |
 | `pi-extensions/lib/entwurf-fact*.ts` | record citizens + transport-specific liveness facts |
+| `pi-extensions/lib/entwurf-peer-observe.ts` | the IO half of the observed peer facts (receiver / transcript) |
 | `pi-extensions/lib/native-push/` | native-push adapter/probe/register leaf |
 | `pi-extensions/acp-provider.ts` | `entwurf` provider registration |
 | `pi-extensions/lib/acp/` | ACP adapter rail, config/overlay, augment, turn loop, event mapping |

package/CHANGELOG.md

@@ -4,6 +4,254 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.18.0 - 2026-09-04
+
+### Fixed
+
+- **A Claude window that changes which session it serves no longer leaves an armed receiver behind
+  (#101).** One process serves one garden at a time but can change which: open a bare `claude` and
+  then `/resume` or `/clear` inside it, and a second `SessionStart` arrives under the same pid,
+  seconds later, naming a different session. The garden it stopped serving kept a receiver marker
+  naming a LIVE owner, so dispatch read an armed doorbell nobody held — a sibling's message was
+  reported as sent and then sat unread in that mailbox for over 50 minutes (oracle, 2026-09-04; that
+  unread letter is what opened the issue).
+  - **Deliverability now asks about *now*, not *ever*.** `watchArmed` was a copy of the identity
+    match; it is a measurement — the receiver owner's own sender marker
+    (`meta-senders/<backend>/<pid>.json`) must still name the same garden. Both consumers, the v2
+    production seam and `entwurf_self`, go through one shared composition, so a citizen's
+    self-report and dispatch cannot disagree.
+  - **The hook retires what it stopped serving** — the marker only, never the record (a record is a
+    citizen's identity, not sweepable state), only a marker its own pid owns, and only on an
+    arm-capable event. `UserPromptSubmit` cannot emit `watchPaths`, so retiring on a keystroke would
+    disarm the session the operator is sitting in with no way to re-arm. The vendor's `source` is
+    logged on every line and branched on nowhere: the switch is settled by what is on disk.
+  - **The join is scoped by the marker's `ownerKind`, not by backend** — today that is
+    `claude-code-cli`. A Copilot watch lives in a forked extension child with its own pid while its
+    sender marker carries the CLI's `process.ppid`, so applying the same check there would make
+    every Copilot citizen permanently `mailbox-undeliverable`. That is a scope decision with a
+    measured reason, not an omission.
+
+### Added
+
+- **A rejected delivery now names which receiver axis failed (#101).** A bare `mailbox-undeliverable`
+  sent one sibling hunting for a live session it had read as dead. The rejection now says whether
+  the doorbell is not armed, the owner is not alive, or there is no record.
+- **`entwurf_peers` separates a live citizen from a phantom (#101).** Every claude-code row reads
+  `liveness=unsupported`, so two rows were byte-identical whether or not anyone was home. Each row
+  now carries two observed facts — `receiver=` (doorbell state) and `transcript=` (whether a
+  conversation was ever written):
+
+  ```text
+  - 20260904T072015-e09b66  liveness=unsupported  receiver=active    transcript=exists
+  - 20260904T093135-ac7a1a  liveness=unsupported  receiver=inactive  transcript=absent
+  ```
+
+- **`check-meta-hook-session-switch` (28 assertions) and the first mutant lane the Claude hook has
+  ever had (#101).** The gate drives the shipped launcher twice under one fake owner pid and
+  requires that exactly one of the two gardens is deliverable — and that it is the one the operator
+  is sitting in. `scripts/mutants/meta-hook-session-switch.json` carries **17 claims**, 1:1 with the
+  gate's `[QK:…]` labels, each re-planting the defect this lane closed and requiring the gate to go
+  red at its claimed signature. Three of those six new mutants exist because cross-review found two
+  QK labels with no mutant behind them and three real weakenings walking straight through: the
+  join's `ownerKind` scope, the sender marker's start-key guard, and its backend equality.
+
+### Changed
+
+- **One inherited sentence about the resume picker is retired, and it was retired by measurement
+  (#101).** The diagnosis said the picker fires `SessionStart` twice — a placeholder id, then the
+  picked one. Six LIVE cells on this host (Claude Code 2.1.260, hook log verbatim in
+  `scripts/raw-claude-session-switch/README.md`) show it fires **once**, carrying the real id,
+  whether the id comes from the picker or from argv. The two-`SessionStart` shape is a bare `claude`
+  followed by an in-session `/resume` or `/clear` — which is exactly what the field case did, four
+  seconds before its second envelope. The repair is unaffected (either way one pid stops serving one
+  garden), so only the prose moved, in four places. Compaction, manual and automatic, re-fires
+  `SessionStart` for the **same** native id and retires nothing; the same-garden rule already
+  covered it.
+- **A `UserPromptSubmit` envelope is trusted for the receiver join, on a measured footing.** The
+  cross-review threat model ("a stale or out-of-order UPS") was withdrawn rather than defended: it
+  claimed the sender pointer is untrustworthy for the join while the same pointer stays authoritative
+  for sender identity — two incompatible readings of one file. Across the raw lab's four pids, every
+  `UserPromptSubmit` named the native id its own pid's preceding `SessionStart` had established,
+  **8 of 8**. The arm-capable restriction stays on its own footing.
+- **Three LIVE smokes stopped depending on a fixture the new join reads as retired.** Five smokes
+  seeded a receiver marker with no sender marker beside it — three of them release MUSTs — so each
+  would have failed on its own fixture rather than on the rail it exists to prove. They now seed
+  both and sandbox the senders root, the shape `smoke-mux-lifecycle-live` and `smoke-omp-fresh-live`
+  already had. `smoke-entwurf-chain-live` additionally gives its terminus an owner **outside hop 1's
+  ancestry**: seeding it under the smoke's own pid put two garden citizens on one host process and
+  the bridge refused the hop outright with `ambiguous sender identity`.
+
+### Upgrade note
+
+**Run `entwurf setup` once after upgrading — every rail, not just Claude.** This release changes
+`pi-extensions/lib/meta-session.ts` and the Claude hook, and **four install paths deploy that
+file** — `install-meta-bridge` (Claude), `install-omp-bridge` and `install-omp-receive` (OMP),
+`install-copilot-bridge` (Copilot). Every one of them present on the host now carries a STALE
+writer until it is re-installed, and its own doctor says so by name. Re-installing only the Claude
+rail leaves the others stale, and that does not surface until a LIVE gate turns red — measured in
+the 0.17.2 cut, where it blocked `smoke-omp-receive-live` and made the first `--cut` run BLOCKED.
+
+`entwurf setup` is presence-driven and re-synthesizes exactly the units this host has, which is why
+it is the upgrade command rather than any single `install-*`. An already-open Claude Code session
+keeps the old manifest until it restarts — and, for this release specifically, an already-open
+session also keeps the old hook, which is the code that retires a switched-away receiver.
+
+### Verification
+
+All of the following ran on oracle (Linux, Claude Code 2.1.260, node 24.18.1, pi 0.84.4, omp 18.0.0).
+
+- **`pnpm run check:full` — exit 0**, 440s on the prepared tree and 446s inside the release gate.
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.18.0c.xZlKjZ --cut` — `cut: OK`,
+  exit 0.** **MUST PASS=23 FAIL=0 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0 SKIP=0**. Run 18:57→19:48 KST
+  on `faee8f6`, with `env -u CLAUDE_CONFIG_DIR -u PI_SESSION_ID -u PI_AGENT_ID`. Log:
+  `/tmp/entwurf-release-gate-0.18.0c.xZlKjZ/release-gate.log`. It carried `check:full` and
+  `check-gate-qualification` (**364/364 KILLED**, up from 347 — the 17 new claims are this lane's
+  `MHSS-*`) as MUST steps.
+- **This lane's own gate: `check-meta-hook-session-switch` — 28 assertions passed**, and all 17
+  `MHSS-*` mutants killed at their claimed signatures inside that qualification run.
+- **The three LIVE smokes whose fixtures this lane changed are green**, including
+  `smoke-entwurf-chain-live` — **24 assertions**, four citizens across three harnesses, and its new
+  pre-flight cell `fixture: the terminus is a deliverable citizen at the moment the chain starts`
+  passed before the chain ran.
+- **One unattributed `smoke-entwurf-chain-live` failure is on the record and is NOT closed.** During
+  the lane (2026-09-04 16:58 KST) one run rejected at hop 3 with `mailbox-undeliverable (observed
+  liveness: unsupported)`; the runs before and after it passed and it has not reproduced. A
+  start-key race and an early idle-owner exit were excluded by measurement; a memory-pressure
+  hypothesis is neither confirmed nor refuted (no OOM or kill entries in the host journal for that
+  window). The instrument that will split the next occurrence shipped in this release — the fixture
+  pre-flight assertion above, plus a `terminus fixture at timeout:` line naming owner liveness and
+  both receiver facts.
+- **The first `--cut` attempt of this cut was BLOCKED, and the cause was operator error, not the
+  product.** `check-gate-qualification` aborted with `origin HEAD changed during qualification`
+  because a commit was created while the gate was running. Every other MUST step in that run passed
+  (`MUST PASS=22 FAIL=1 SKIP=0`). The run above is the re-measurement on a frozen HEAD. One LIVE
+  gate run before that was killed by the host harness's low-memory watchdog rather than by any
+  assertion, and was re-run under tmux.
+- **Exact-SHA CI on the pre-version HEAD `e56eee0`** — `check`, `install-surface`,
+  `artifact-consumer` all `success`.
+  Run: https://github.com/junghan0611/entwurf/actions/runs/33853363923
+
+## 0.17.2 - 2026-09-03
+
+### Added
+
+- **An arriving letter is now visible to the operator, not just to the model (#98).** A sibling's
+  mail landed, was read, and left one line on the receiving screen — `Stop hook feedback` — with no
+  sender, no count, no garden id. Three surfaces changed, each measured in the
+  `scripts/raw-async-delivery/` lab before any product edit:
+  - **The doorbell says what it is.** The shipped `FileChanged` hook declares
+    `rewakeSummary: "entwurf inbox: sibling mail arrived"` and
+    `rewakeMessage: "entwurf mailbox notice:"`. The model no longer wakes to
+    `Stop hook blocking error from command "FileChanged"` — mail arriving was being named an error.
+    Both fields are `@internal` in the vendor and unsanitized, so `check-hook-launch-topology` lints
+    them (declared, no newline, not whitespace-only, length bound, no `[` in the prefix that would
+    double the doorbell's own `[entwurf inbox]`) and `smoke-meta-async-drift` carries both as
+    markers — a silent `@internal` removal is a future this repo cannot measure live.
+  - **The status line carries an unread badge.** `✉N` counts exactly what `entwurf_inbox_read`
+    would hand back (`*.msg` + `*.msg.delivered`, `.read` excluded — the same union as
+    `readMetaInbox`). No badge at zero. **`✉?` when the count could not be TAKEN** (no python3,
+    unusable garden id, unreadable directory): a measurement failure must not look like an empty
+    inbox.
+  - **A send names the file it enqueued.** `entwurf_v2 meta-mailbox → enqueued (2026-…-113443.msg)`.
+    `enqueueMetaMessage` already returned `messagePath`; the mailbox hand was flattening it to
+    `{success:true}`. Deliberately not a read stamp: at enqueue time `lastReadAt` belongs to the
+    PREVIOUS message, and surfacing it would read as "my message was read".
+
+### Fixed
+
+- **A dead-socket send that falls back to the mailbox now names its file too (#98).** A
+  control-socket delivery whose socket was gone re-resolves to the mailbox and writes a `.msg`
+  exactly like the primary rail, but the sender's line said only `fallback-sent` — the one mailbox
+  delivery with no per-message identifier. The receipt is carried through `SendDrive` →
+  `ControlSocketSendResult` → `ExecutedOutcome` → surface. A socket-to-socket retry writes no file
+  and carries none; a `rejected` enqueue carries none; a dep that omits it degrades to the bare
+  outcome rather than printing `undefined`.
+- **entwurf no longer owns the compaction switch (#94).** `autoCompactEnabled` and
+  `env.DISABLE_AUTOCOMPACT` moved from `MANAGED_SETTINGS_SCALARS` to `RETIRED_SETTINGS_SCALARS`,
+  the path `skipDangerousModePermissionPrompt` already walked. Retirement moves **ownership, not
+  state**: `relinquish_retired_scalar()` restores the install-state snapshot only when the current
+  value still equals the last managed one, so retirement alone turns compaction on for nobody —
+  turning it on is a separate operator act, and entwurf writing that value again would undo the
+  return. The doctor now stays green for an operator who turned compaction back on.
+  - **A correction that belongs in the record:** `env.DISABLE_AUTOCOMPACT` was a **no-op** at Claude
+    Code 2.1.259 — the only key that actually suppressed compaction was `autoCompactEnabled`. The
+    conclusion is unchanged; the reason narrows to one key.
+  - The lineage is also corrected. 0.5.0 *did* ship a pi-side compaction guard in real code;
+    `378c682` (v2 subtraction) deleted it and `623a4ea` later cleared the docs that outlived it by
+    seven days. The "zero code backing" in that commit message was a grep result at that moment, not
+    a claim that the guard never existed.
+
+### Changed
+
+- **Three shipped comments stopped repeating two claims this release retired.** `doorbell.sh`,
+  `raw-async-delivery/README.md` and `smoke-meta-async-drift.sh` said that `asyncRewake` ignores
+  `rewakeMessage` and that stdout is dropped. Measured against three vendor binaries (2.1.236 /
+  2.1.258 / 2.1.259), both are false: `rewakeMessage` *replaces* the prefix, and the body is
+  `stderr || stdout`. The marker strings were correct while their stated reasons were dead — a
+  sentinel nobody could act on. The lab README now carries the receipts under
+  `## Inherited facts corrected`, and the watcher documents what it observes rather than which
+  backends it expects.
+- `lastDeliveredAt` is documented as a **reserved slot nobody stamps**, in five comments and four
+  test cells that had been pinning it green as `=== null` while 933 files carried a `.delivered`
+  suffix. The per-message facts are the suffixes (`.msg` → `.delivered` → `.read`); `state.json`
+  holds only the garden's last enqueue/read. Removing the field is a separate migration (its reader
+  is doubly strict and 182 v1 files are on disk), tracked apart from this release.
+
+### Upgrade note
+
+**Run `entwurf setup` once after upgrading — every rail, not just Claude.** Two separate debts:
+
+- The Claude plugin's hook template gained `rewakeSummary` and `rewakeMessage`, so until
+  `install-meta-bridge` runs, `doctor-meta-bridge` reports
+  `installed manifest DIFFERS … Re-run install-meta-bridge`.
+- **This release changed `lib/meta-session.ts`, and four install paths deploy that file** —
+  `install-meta-bridge` (Claude), `install-omp-bridge` and `install-omp-receive` (OMP),
+  `install-copilot-bridge` (Copilot). Every one of them that is installed on the host now carries a
+  STALE writer until it is re-installed, and its own doctor says so by name. Re-installing only the
+  Claude rail leaves the others stale — measured on oracle during this cut, where it blocked
+  `smoke-omp-receive-live` and turned the first `--cut` run red.
+
+`entwurf setup` is presence-driven and re-synthesizes exactly the units this host has, which is why
+it is the upgrade command rather than any single `install-*`. An already-open Claude Code session
+keeps the old manifest until it restarts.
+
+0.17.1 was tagged and released on GitHub but **not published to npm**; it is superseded by this
+version.
+
+### Verification
+
+All of the following ran on oracle (Linux, Claude Code 2.1.259, node 24.18.1, pi 0.84.4, omp 18.0.0).
+
+- **`pnpm run check:full` — exit 0** (432s on the prepared tree; 437s on the pre-version HEAD).
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.17.2b.WW12BK --cut` — `cut: OK`,
+  exit 0.** **MUST PASS=23 FAIL=0 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0 SKIP=0**. Run 20:39→21:26 KST
+  with `env -u CLAUDE_CONFIG_DIR -u PI_SESSION_ID -u PI_AGENT_ID`. Log:
+  `/tmp/entwurf-release-gate-0.17.2b.WW12BK/release-gate.log`. It carried `check:full` (429s) and
+  `check-gate-qualification` (**347/347 KILLED**) as MUST steps.
+- **The first `--cut` attempt was RED, and that is the receipt for the upgrade note above.**
+  `smoke-omp-receive-live` failed with `STALE writer: source=634d5b96ed50 installed=229fef123589`
+  on `~/.omp/agent/extensions/entwurf-receive-omp/lib/meta-session.ts` — MUST PASS=22 FAIL=1,
+  `cut: BLOCKED`. Both OMP extensions on the host still carried the pre-release writer because only
+  the Claude rail had been re-installed. `install-omp-bridge` + `install-omp-receive` moved both to
+  `634d5b96ed50`, `doctor-omp-bridge` and `doctor-omp-receive` went PASS, and the re-run was green.
+  Nothing in the product changed between the two runs.
+- **#94 measured on a live host.** After one `install-meta-bridge`, the install-state ledger no
+  longer carries `autoCompactEnabled` or `env.DISABLE_AUTOCOMPACT`, and `~/.claude/settings.json`
+  was **byte-identical** to its pre-install backup — the return does not rewrite the value it
+  returns. `doctor-meta-bridge` went FAIL→PASS, `smoke-meta-install-state` PASS,
+  `check-meta-doctor-oracle` PASS including the two new cells (`an operator who turned compaction
+  back ON is not drift`, `install-state still owns a retired scalar → FAIL naming its own cause`).
+- **#98 B measured across the whole suffix lifecycle** in an isolated mailbox root: no badge at 0,
+  `✉1` on `.msg`, `✉2` after `.msg.delivered`, unchanged by a `.read` file, back to no badge when
+  all are read, and `✉?` on an unreadable directory.
+- **`smoke-meta-async-drift` ends `pass=12 fail=0 drift=1`, exit 1** — the drift is
+  `codex 0.147.0` outside the `0.144.x` pin and **pre-dates this release**. Both markers this
+  release added (`rewakeMessage`, `rewakeSummary`) are present. The pin bump is deliberately not in
+  this lane.
+- **Exact-SHA CI on the pre-version HEAD `4124e42`** — `check`, `install-surface`,
+  `artifact-consumer` all `success`.
+  Run: https://github.com/junghan0611/entwurf/actions/runs/33742448634
+
 ## 0.17.1 - 2026-09-03
 
 ### Fixed

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -64,7 +64,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { controlSocketPathIn, defaultControlSocketDir } from "../../../pi-extensions/lib/control-socket-path.js";
-import { receiverMarkerMatchesIdentity } from "../../../pi-extensions/lib/entwurf-deliverability.js";
+import { resolveMailboxReceiverFacts } from "../../../pi-extensions/lib/entwurf-deliverability.js";
 import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provider.js";
 import { renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.js";
 import { computeSelfAddressability } from "../../../pi-extensions/lib/entwurf-self-address.js";
@@ -73,7 +73,7 @@ import { resolveMailboxWakeModeCapability } from "../../../pi-extensions/lib/ent
 import { runAndRenderEntwurfV2FromSurface } from "../../../pi-extensions/lib/entwurf-v2-surface.js";
 import { makeVisibleResumeDeps, renderVisibleResume, visibleResume, } from "../../../pi-extensions/lib/entwurf-v2-visible-resume.js";
 import { probeNativeSenderAlive, resolveTrustedMetaSenderIdentity, } from "../../../pi-extensions/lib/meta-sender-identity.js";
-import { applyOmpBridgeChildRootPolicy, defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaInbox, readMetaReceiverMarker, } from "../../../pi-extensions/lib/meta-session.js";
+import { applyOmpBridgeChildRootPolicy, defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaInbox, readMetaReceiverMarker, readMetaSenderMarker, requireBackend, } from "../../../pi-extensions/lib/meta-session.js";
 import { freshCall, renderFreshCall } from "../../../pi-extensions/lib/mux-fresh-call.js";
 import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.js";
 import { registerNativeConversation } from "../../../pi-extensions/lib/native-push/register.js";
@@ -223,9 +223,12 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
     //     admits another self-fetch citizen.
     //   none        ← neither. omp today: no mailbox drain, no native-push adapter. Rendering
     //     this as self-fetch printed a mailboxPath nothing drains.
-    //   self-fetch (claude-code/copilot): can this citizen's own inbox wake? → the receiver
-    //     presence marker (readMetaReceiverMarker folds a dead/reused owner to null, so a match
-    //     means a live, ARMED receiver — the sender marker proves identity, never an armed watch).
+    //   self-fetch (claude-code/copilot): can this citizen's own inbox wake? → the SHARED
+    //     receiver composition `resolveMailboxReceiverFacts`, the same one the v2 dispatch seam
+    //     uses, so a citizen's self-reported replyability can never disagree with what dispatch
+    //     decides about it. It reads the presence marker (a dead/reused owner already folds to
+    //     null) AND, where the watch owner is the sender-marker process, the #101 join that says
+    //     the owner is still serving THIS garden rather than one it switched away from.
     //   native-push (antigravity): there is no inbox and no watch. A reply is injected into a
     //     live app-server conversation, so only an adapter probe can answer. Composing the
     //     receiver atom here would demand `watchArmed` from a backend that never arms one, and
@@ -248,14 +251,16 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
         }
         : metaDeliveryDomain === "self-fetch"
             ? (() => {
-                const receiver = readMetaReceiverMarker({ gardenId: identity.gardenId });
-                const active = receiverMarkerMatchesIdentity(receiver, identity);
+                const receiver = resolveMailboxReceiverFacts(identity, {
+                    readReceiverMarker: (gardenId) => readMetaReceiverMarker({ gardenId }),
+                    readSenderMarker: (backend, ownerPid) => readMetaSenderMarker({ backend: requireBackend(backend), ownerPid }),
+                });
                 return {
                     origin: "meta-session",
                     metaDeliveryDomain,
                     recordBacked: true,
-                    ownerAlive: active,
-                    watchArmed: active,
+                    ownerAlive: receiver.ownerAlive,
+                    watchArmed: receiver.watchArmed,
                 };
             })()
             : {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-deliverability.js

@@ -72,6 +72,82 @@ export function receiverMarkerMatchesIdentity(marker, identity) {
         marker.backend === identity.backend &&
         marker.nativeSessionId === identity.nativeSessionId);
 }
+// ── the watch-owner ↔ sender-marker join (#101 결함 B) ──────────────────────
+// A receiver marker proves "a LIVE process once armed a watch for this garden".
+// It does NOT prove "that process is serving this garden RIGHT NOW". One native
+// process can hold markers for several gardens and drain exactly one of them:
+// Claude Code's session switch (an in-session `/resume` or `/clear`) fires a second
+// SessionStart inside the SAME pid under a NEW native session id, so the first
+// garden's marker keeps naming a live owner forever while the doorbell it advertises
+// is gone. Measured on oracle 2026-09-04 (#101): one pid held both markers, a
+// 09:33 enqueue to the retired garden sat unread as a bare `.msg` for ≥50 minutes —
+// the "enqueue into a void" this module's header exists to refuse.
+//
+// The join that decides it is already on disk: the SENDER marker is keyed by owner
+// pid and rewritten with the CURRENT garden on every arm/prompt, so
+// `meta-senders/<backend>/<ownerPid>.json.gardenId` is the answer to "which garden
+// does this process serve now?". A receiver marker naming a different garden than
+// its own owner's sender marker is a retired watch.
+//
+// SCOPE IS NOT UNIVERSAL, AND THE MARKER SAYS SO. The join only exists where the
+// watch owner IS the process the sender marker is keyed to. That is true for the
+// Claude hook (one `ownerPid` variable writes both markers —
+// `meta-bridge-hook.ts` sender + receiver arm) and false BY CONSTRUCTION for
+// Copilot, whose watch lives in a forked first-party extension child
+// (`extension.mjs` writes `ownerPid: process.pid`) while its sender marker is keyed
+// to the CLI parent (`meta-bridge-hook-copilot.ts` uses `process.ppid`). Applying
+// the join there would make every Copilot citizen permanently undeliverable — a
+// regression on a shipped lane, not a fix. `ownerKind` is recorded on the marker for
+// exactly this reason ("the marker records which, because the pid a reader verifies
+// differs" — AGENTS.md, self-fetch domain), so it is the axis, not `backend`.
+//
+// `omp-host` is a CANDIDATE, deliberately not admitted here: OMP already retires the
+// previous garden in-process on its `/new` edge (the unarm the claude hook lacked),
+// so the cell this join closes has a different owner there. Admitting it needs its
+// own measurement, not this file's optimism.
+export const SENDER_JOINED_RECEIVER_OWNER_KINDS = ["claude-code-cli"];
+/** Does this watch owner share its pid with the backend's sender marker? */
+export function receiverOwnerKindJoinsSender(ownerKind) {
+    return SENDER_JOINED_RECEIVER_OWNER_KINDS.includes(ownerKind);
+}
+/**
+ * Is the watch owner still serving THIS garden? Fail-closed inside the join's scope:
+ * an absent/unreadable sender marker, or one naming another garden or backend, means
+ * the watch is retired. Outside the scope (an ownerKind whose watch owner is not the
+ * sender-marker process) the join does not apply and the marker's own live-owner guard
+ * is the whole rule — returning true here is NOT optimism, it is "this axis says
+ * nothing", and the caller has already required the marker to match the identity.
+ */
+export function receiverOwnerServesGarden(marker, senderMarker) {
+    if (!receiverOwnerKindJoinsSender(marker.ownerKind))
+        return true;
+    return !!senderMarker && senderMarker.gardenId === marker.gardenId && senderMarker.backend === marker.backend;
+}
+/**
+ * THE single composition of the two mailbox receiver facts, over injected readers.
+ * Both production consumers — the v2 `mailboxDeliverabilityFor` seam and the MCP
+ * bridge's `entwurf_self` — call THIS, so a direct send, a re-resolved fallback send
+ * and a citizen's own replyability can never drift to different verdicts.
+ *
+ *   ownerAlive  — a live-owner marker that names THIS identity (the reader already ran
+ *                 the plausibility + start-key guards; this adds the identity match).
+ *   watchArmed  — that owner is still serving this garden (the join above). It is a
+ *                 MEASUREMENT, never a copy of ownerAlive: copying it is what let a
+ *                 retired watch read as an armed doorbell (#101 결함 B).
+ *
+ * `recordBacked` is NOT decided here — it stays the caller's explicit fact, so an
+ * absent record and a dead owner stay distinguishable in the reason string.
+ */
+export function resolveMailboxReceiverFacts(identity, readers) {
+    const marker = readers.readReceiverMarker(identity.gardenId);
+    const ownerAlive = receiverMarkerMatchesIdentity(marker, identity);
+    if (!ownerAlive || !marker)
+        return { ownerAlive: false, watchArmed: false };
+    const senderMarker = receiverOwnerKindJoinsSender(marker.ownerKind)
+        ? readers.readSenderMarker(marker.backend, marker.ownerPid)
+        : null;
+    return { ownerAlive, watchArmed: receiverOwnerServesGarden(marker, senderMarker) };
+}
 /**
  * The conversational-mailbox enqueue gate. False (no enqueue) unless the backend is
  * self-fetch AND the receiver is active. A direct-inject backend (pi / codex /

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-fact-provider.js

@@ -26,7 +26,8 @@
  * a same-gid socket exists would be half a lie. Both leave the normal output;
  * one diagnostic carries the fact. (pi + same-gid socket = the normal merge.)
  */
-import { isOutOfSocketDomainGardenIdConflict, resolveFactList } from "./entwurf-facts.js";
+import { isOutOfSocketDomainGardenIdConflict, resolveFactList, } from "./entwurf-facts.js";
+import { observePeerFacts } from "./entwurf-peer-observe.js";
 import { isLivenessSupported } from "./entwurf-v2-contract.js";
 import { FRESH_CUT_PRESCRIPTION, listAllMetaIdentities, } from "./meta-session.js";
 import { scanSocketProbes } from "./socket-discovery.js";
@@ -65,10 +66,12 @@ function diagnosticSortKey(d) {
     }
 }
 /**
- * Assemble the facts-only listing. Pure over its injected deps (no direct IO) so
- * the gate drives it without a filesystem; slice 4c supplies the real readdir /
- * readFile / probe. Probes are gid + liveness only (#50 C4 — the per-socket
- * get_info enrich left with the socket-only quasi-citizen listing).
+ * Assemble the facts-only listing. Driven entirely through injected deps, so the gate
+ * runs it without a filesystem; slice 4c supplies the real readdir / readFile / probe.
+ * The one dep with a REAL default is `observe` (#101) — see its comment: a per-citizen
+ * measurement both wiring sites must make identically is safer as one default than as two
+ * call-site arguments. Probes are gid + liveness only (#50 C4 — the per-socket get_info
+ * enrich left with the socket-only quasi-citizen listing).
  */
 export async function listEntwurfFacts(deps) {
     const diagnostics = [];
@@ -129,7 +132,7 @@ export async function listEntwurfFacts(deps) {
     //    fire as the last line of defense, never caught here.
     const cleanIdentities = identities.filter((i) => !conflictGids.has(i.gardenId));
     const cleanProbes = probes.filter((p) => !conflictGids.has(p.gardenId));
-    const facts = resolveFactList(cleanIdentities, cleanProbes);
+    const facts = resolveFactList(cleanIdentities, cleanProbes, deps.observe ?? observePeerFacts);
     // 5. #50 C4 demotion: a record-less socket is a diagnostic, not a listing
     //    section. One diagnostic per socket (subjects aggregate at render, F8);
     //    the message is liveness-keyed so same-state sockets group into one line.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-facts.js

@@ -19,6 +19,9 @@
  *     a peer-facing fact; `entwurf_peers` exposes identity + cwd-history, not
  *     filesystem internals. (who-can / dispatch read it via the meta-record
  *     directly when they genuinely need it — it does not belong in the listing.)
+ *     Whether that transcript EXISTS is a different thing and is carried (#101):
+ *     the path stays private, the fact that a citizen has never written a turn
+ *     does not.
  *
  * The 4-value liveness (`alive|dead|indeterminate|unsupported`, R3b) and the
  * out-of-domain → `unsupported` rule (R1: never coerce an unprobed backend to
@@ -27,6 +30,9 @@
  * the surrounding identity facts around it.
  */
 import { factLivenessOf, isLivenessSupported } from "./entwurf-v2-contract.js";
+/** What a caller that measured nothing must say. Explicit and greppable — a row that
+ * silently defaulted to `none`/`absent` would be a fabricated fact. */
+export const UNOBSERVED_PEER = { receiver: "unobserved", transcript: "unobserved" };
 /**
  * Compose a `PeerFact` from a citizen's identity and an optional socket probe.
  *
@@ -39,7 +45,7 @@ import { factLivenessOf, isLivenessSupported } from "./entwurf-v2-contract.js";
  *
  * Pure: same inputs → same output, no IO.
  */
-export function resolvePeerFact(identity, socket) {
+export function resolvePeerFact(identity, socket, observations = UNOBSERVED_PEER) {
     return {
         gardenId: identity.gardenId,
         backend: identity.backend,
@@ -49,6 +55,8 @@ export function resolvePeerFact(identity, socket) {
         createdAt: identity.createdAt,
         recordUpdatedAt: identity.recordUpdatedAt,
         liveness: factLivenessOf(identity.backend, socket),
+        receiver: observations.receiver,
+        transcript: observations.transcript,
     };
 }
 /**
@@ -98,7 +106,7 @@ export function isOutOfSocketDomainGardenIdConflict(backend, gardenId, socketGid
  * A gardenId is never emitted as both a `PeerFact` and a `RecordLessSocketFact`;
  * a record-less socket becomes a `PeerFact` the moment a record claims the gid.
  */
-export function resolveFactList(identities, socketProbes) {
+export function resolveFactList(identities, socketProbes, observe = () => UNOBSERVED_PEER) {
     const probeMap = new Map();
     for (const probe of socketProbes) {
         if (probeMap.has(probe.gardenId)) {
@@ -129,7 +137,7 @@ export function resolveFactList(identities, socketProbes) {
             }
             socket = null;
         }
-        peers.push(resolvePeerFact(identity, socket));
+        peers.push(resolvePeerFact(identity, socket, observe(identity)));
         consumed.add(gid);
     }
     const recordLessSockets = [];

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-peer-observe.js

@@ -0,0 +1,66 @@
+/**
+ * entwurf-peer-observe — the IO half of the two OBSERVED peer facts (#101).
+ *
+ * `entwurf_peers` used to answer a claude-code citizen with `liveness=unsupported` and
+ * nothing else, because the control-socket probe genuinely does not apply to a self-fetch
+ * backend. Two same-cwd rows — one a live conversation, one an abandoned startup session
+ * whose transcript was never written — were therefore byte-identical in the listing, and
+ * a caller picking "the newest record in this cwd" (the natural heuristic, and the one the
+ * surface encourages) picked the phantom as often as the real one. Both halves of the
+ * distinction were already on disk; nothing read them.
+ *
+ * FACTS, NOT VERBS. `receiver` and `transcript` say what was found, never what to do
+ * about it: no `sendable`, no `deliverable`, no transport. The listing stays a listing —
+ * dispatch still computes routing at call time from the same underlying markers.
+ *
+ * ONE MEASUREMENT, TWO WORDS. `receiver` is derived from the SAME
+ * `resolveMailboxReceiverFacts` composition the v2 dispatch seam and `entwurf_self` use.
+ * The surfaces are allowed to phrase it differently — a listing wants an enum, a reject
+ * wants a sentence — but they may not disagree, so the enum is a projection of that atom
+ * rather than a second opinion about the same markers.
+ */
+import * as fs from "node:fs";
+import { resolveMailboxReceiverFacts } from "./entwurf-deliverability.js";
+import { metaCapabilityFor, metaReceiverMarkerPath, readMetaReceiverMarker, readMetaSenderMarker, requireBackend, } from "./meta-session.js";
+/**
+ * The mailbox receiver axis for one citizen.
+ *
+ * `n/a` is not a failure: a backend with no mailbox (pi's control socket, antigravity's
+ * native push) has no receiver marker to be right or wrong about, and printing `none`
+ * there would invent a missing thing. The `inactive` / `none` split is what a reader
+ * needs to tell "a watch was armed and is no longer valid" from "no watch was ever
+ * armed here", so it is taken from the marker FILE's existence rather than from the
+ * reader's null — the reader folds absent, corrupt and dead-owner into one null.
+ */
+function observeReceiver(identity) {
+    if (metaCapabilityFor(identity.backend).wakeMode !== "self-fetch")
+        return "n/a";
+    const facts = resolveMailboxReceiverFacts(identity, {
+        readReceiverMarker: (gardenId) => readMetaReceiverMarker({ gardenId }),
+        readSenderMarker: (backend, ownerPid) => readMetaSenderMarker({ backend: requireBackend(backend), ownerPid }),
+    });
+    if (facts.ownerAlive && facts.watchArmed)
+        return "active";
+    return fs.existsSync(metaReceiverMarkerPath(identity.gardenId)) ? "inactive" : "none";
+}
+/**
+ * Does the recorded transcript exist? A record is minted at SessionStart, but a harness
+ * that writes its transcript lazily (Claude Code writes on the first turn) leaves a
+ * citizen with no conversation behind it until someone actually says something. The PATH
+ * stays private — only its existence crosses to the listing.
+ */
+function observeTranscript(identity) {
+    try {
+        // A record with no recorded transcript path has nothing to stat — that is the same
+        // observable state as a path that is not there, and neither is an `exists` claim.
+        return identity.transcriptPath && fs.existsSync(identity.transcriptPath) ? "exists" : "absent";
+    }
+    catch {
+        // A transcript we cannot stat is not a transcript we can claim exists.
+        return "absent";
+    }
+}
+/** The production observer: both axes, measured for one citizen. */
+export function observePeerFacts(identity) {
+    return { receiver: observeReceiver(identity), transcript: observeTranscript(identity) };
+}

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-peers-render.js

@@ -22,9 +22,18 @@
  *     socketPath rows — the pre-record socket-scan worldview) is gone with the
  *     `controlDir` it exposed. Socket paths are dispatch-internal transport.
  */
+// `receiver` and `transcript` are OBSERVED facts, not routing (#101): they say what was
+// found on disk for this citizen, and a caller still asks entwurf_v2 what may be done
+// about it. They earn a column because for every claude-code row `liveness` reads
+// `unsupported` — the socket probe does not apply — so two rows in one cwd, a live
+// conversation and an abandoned startup session whose transcript was never written, used to
+// be indistinguishable here. `receiver=active|inactive|none|n/a` is a projection of the
+// same measurement dispatch uses; `transcript=exists|absent` is the record's transcript,
+// existence only, never the path.
 function renderPeerLine(p) {
     const model = p.model ?? "(unknown)";
-    return `- ${p.gardenId}  backend=${p.backend}  liveness=${p.liveness}  cwd=${p.cwd}  model=${model}`;
+    return (`- ${p.gardenId}  backend=${p.backend}  liveness=${p.liveness}  receiver=${p.receiver}  ` +
+        `transcript=${p.transcript}  cwd=${p.cwd}  model=${model}`);
 }
 function renderDiagnosticLine(d) {
     switch (d.kind) {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-decider.js

@@ -151,8 +151,14 @@ export async function decideDispatch(input, deps) {
         // fail-closed (SE-2 2d-3). resolveDispatch then routes intent × deliverable.
         const deliverability = await deps.mailboxDeliverabilityFor(identity);
         const receipt = resolveDispatch(input.intent, "unsupported", deliverability.deliverable);
-        if (!receipt.ok)
-            return reject(receipt);
+        // The predicate's reason travels with the reject (#101 갭 C). It is attached only when
+        // undeliverability is what produced the reject — an intent-shaped refusal on a
+        // DELIVERABLE target must not be dressed up as a receiver problem.
+        if (!receipt.ok) {
+            return deliverability.deliverable
+                ? reject(receipt)
+                : reject(receipt, { kind: "mailbox-undeliverable", reason: deliverability.reason });
+        }
         // the only allow cell here is fire-and-forget → meta-mailbox send.
         const plan = {
             transport: "meta-mailbox",