@junghanacs/entwurf 0.17.1 → 0.18.0

package/scripts/smoke-entwurf-chain-live.ts

@@ -54,7 +54,15 @@ import fsp from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { readMetaInbox, upsertMetaSession, writeMetaReceiverMarker } from "../pi-extensions/lib/meta-session.ts";
+import { resolveMailboxReceiverFacts } from "../pi-extensions/lib/entwurf-deliverability.ts";
+import {
+	readMetaInbox,
+	readMetaReceiverMarker,
+	readMetaSenderMarker,
+	upsertMetaSession,
+	writeMetaReceiverMarker,
+	writeMetaSenderMarker,
+} from "../pi-extensions/lib/meta-session.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
 import { skipLive } from "./lib/live-skip.ts";
 
@@ -155,11 +163,13 @@ async function main(): Promise<void> {
 	const sessionsDir = path.join(world, "sessions");
 	const mailboxDir = path.join(world, "mailbox");
 	const receiversDir = path.join(world, "receivers");
-	for (const d of [sessionsDir, mailboxDir, receiversDir]) await fsp.mkdir(d, { recursive: true });
+	const sendersDir = path.join(world, "senders");
+	for (const d of [sessionsDir, mailboxDir, receiversDir, sendersDir]) await fsp.mkdir(d, { recursive: true });
 	const worldEnv = {
 		ENTWURF_META_SESSIONS_DIR: sessionsDir,
 		ENTWURF_META_MAILBOX_DIR: mailboxDir,
 		ENTWURF_META_RECEIVERS_DIR: receiversDir,
+		ENTWURF_META_SENDERS_DIR: sendersDir,
 	};
 	// The MCP bridge prefers PI_SESSION_ID+PI_AGENT_ID over a meta-sender marker when both
 	// are present. A runner that is itself a pi --entwurf-control session (release-gate,
@@ -183,20 +193,46 @@ async function main(): Promise<void> {
 		dir: sessionsDir,
 	});
 	const gidD = terminus.record.gardenId;
-	writeMetaReceiverMarker({
-		gardenId: gidD,
-		backend: "claude-code",
-		nativeSessionId: terminus.record.nativeSessionId,
-		ownerPid: process.pid,
-		armProvenance: "session-start",
-		receiversDir,
-	});
-	console.error(`[smoke-entwurf-chain-live] D:      ${gidD} (mailbox terminus)`);
-
 	const children: ChildProcess[] = [];
+	let terminusOwner: ChildProcess | null = null;
 	let streamB = "";
 	let streamC = "";
 	try {
+		// The receiver marker alone is no longer the whole fixture (#101): a `claude-code-cli` watch
+		// owner is deliverable only while ITS OWN sender marker still names the garden it is armed
+		// for — that join is what refuses a session which switched away in place. A receiver marker
+		// with no sender marker beside it models a state the product now treats as retired, so this
+		// smoke would fail on its own fixture instead of on the rail it exists to prove.
+		//
+		// THE OWNER IS A SPAWNED IDLE PROCESS, NOT THIS ONE, and that is specific to this smoke:
+		// hop 1 is a native `claude` child of THIS process, and the bridge resolves a sender's
+		// identity through its ancestry. A terminus marker under this pid therefore puts TWO garden
+		// citizens on one host process, which the bridge refuses outright as ambiguous sender
+		// identity — measured on oracle 2026-09-04, where hop 1 came back "refused: ambiguous sender
+		// identity (…-f34713, …-912b42)" and the chain never started. The sibling smokes keep
+		// `process.pid` because their children are pi/ACP sessions carrying their own identity, or
+		// tmux siblings that are not descendants at all.
+		terminusOwner = spawn(process.execPath, ["-e", "setTimeout(() => {}, 900000)"], { stdio: "ignore" });
+		const terminusOwnerPid = terminusOwner.pid;
+		if (typeof terminusOwnerPid !== "number") throw new Error("could not spawn the terminus owner process");
+		writeMetaReceiverMarker({
+			gardenId: gidD,
+			backend: "claude-code",
+			nativeSessionId: terminus.record.nativeSessionId,
+			ownerPid: terminusOwnerPid,
+			armProvenance: "session-start",
+			receiversDir,
+		});
+		writeMetaSenderMarker({
+			backend: "claude-code",
+			gardenId: gidD,
+			nativeSessionId: terminus.record.nativeSessionId,
+			cwd: world,
+			ownerPid: terminusOwnerPid,
+			sendersDir,
+		});
+		console.error(`[smoke-entwurf-chain-live] D:      ${gidD} (mailbox terminus)`);
+
 		// ── C: the ACP Claude Sonnet citizen (spawned first so B can be told its id) ──
 		const known = new Set((await readRecords(sessionsDir)).map((r) => r.gardenId));
 		const c = spawn(
@@ -283,6 +319,21 @@ async function main(): Promise<void> {
 		ok("A is distinct from every other citizen", !new Set([gidB, gidC, gidD]).has(gidA as string));
 		console.error(`[smoke-entwurf-chain-live] A:      ${gidA} (native Claude Code)`);
 
+		// ── the fixture must still be a deliverable citizen when the chain arrives ──
+		// The terminus is only reachable while its owner is alive AND that owner's sender marker
+		// still names it (#101). Both are fixture state this smoke owns, and both can decay while
+		// three model turns run. Asserting it here separates "the chain did not arrive" from "the
+		// target stopped being addressable", which cost a LIVE run to tell apart once.
+		const terminusFacts = resolveMailboxReceiverFacts(terminus.record, {
+			readReceiverMarker: (gardenId: string) => readMetaReceiverMarker({ gardenId, receiversDir }),
+			readSenderMarker: (backend: string, pid: number) =>
+				readMetaSenderMarker({ backend: backend as "claude-code", ownerPid: pid, sendersDir }),
+		});
+		ok(
+			"fixture: the terminus is a deliverable citizen at the moment the chain starts",
+			terminusFacts.ownerAlive && terminusFacts.watchArmed,
+		);
+
 		// ── the chain runs on its own from here; wait for the terminus ───────────
 		const boxDir = path.join(mailboxDir, gidD);
 		const until = Date.now() + CHAIN_TIMEOUT_MS;
@@ -295,7 +346,25 @@ async function main(): Promise<void> {
 			await sleep(POLL_MS);
 		}
 		if (msgs.length === 0) {
-			console.error(`[smoke-entwurf-chain-live] A turn output:\n${claudeOut.slice(0, 1500)}`);
+			let ownerAlive = false;
+			try {
+				process.kill(terminusOwnerPid, 0);
+				ownerAlive = true;
+			} catch {}
+			const facts = resolveMailboxReceiverFacts(terminus.record, {
+				readReceiverMarker: (gardenId: string) => readMetaReceiverMarker({ gardenId, receiversDir }),
+				readSenderMarker: (backend: string, pid: number) =>
+					readMetaSenderMarker({ backend: backend as "claude-code", ownerPid: pid, sendersDir }),
+			});
+			console.error(
+				`[smoke-entwurf-chain-live] terminus fixture at timeout: ownerPid=${terminusOwnerPid} alive=${ownerAlive} ` +
+					`ownerAlive=${facts.ownerAlive} watchArmed=${facts.watchArmed}`,
+			);
+			// The FULL turn, not a 1500-char head: that slice cut the JSON before its `result`
+			// field, so the one line that says what A actually did — the tool outcome it was told
+			// to echo back — was the first thing this diagnostic dropped. A failure that hides its
+			// own cause costs another LIVE run to re-learn.
+			console.error(`[smoke-entwurf-chain-live] A turn output:\n${claudeOut}`);
 			console.error(`[smoke-entwurf-chain-live] B stream tail:\n${streamB.slice(-2000)}`);
 			console.error(`[smoke-entwurf-chain-live] C stream tail:\n${streamC.slice(-2000)}`);
 		}
@@ -350,6 +419,9 @@ async function main(): Promise<void> {
 		console.error(`[smoke-entwurf-chain-live] chain: ${gidA} → ${gidB} → ${gidC} → ${gidD}`);
 	} finally {
 		for (const ch of children) await terminateChild(ch).catch(() => undefined);
+		try {
+			terminusOwner?.kill("SIGTERM");
+		} catch {}
 	}
 
 	console.log(

package/scripts/smoke-entwurf-v2-matrix-live.ts

@@ -62,6 +62,7 @@ import {
 	metaRecordExistsByGardenId,
 	upsertMetaSession,
 	writeMetaReceiverMarker,
+	writeMetaSenderMarker,
 } from "../pi-extensions/lib/meta-session.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
 import { skipLive } from "./lib/live-skip.ts";
@@ -187,10 +188,15 @@ async function main(): Promise<void> {
 	const mailboxDir = path.join(tmp, "mailbox");
 	const lockDir = path.join(tmp, "locks");
 	const receiversDir = path.join(tmp, "receivers");
-	for (const d of [sessionsDir, mailboxDir, lockDir, receiversDir]) await fsp.mkdir(d, { recursive: true });
+	const sendersDir = path.join(tmp, "senders");
+	for (const d of [sessionsDir, mailboxDir, lockDir, receiversDir, sendersDir]) await fsp.mkdir(d, { recursive: true });
 	// The receiver marker is read through defaultMetaReceiversDir() (env-overridable); point it
 	// (and the store/mailbox defaults, belt-and-suspenders to the opts dirs) at the temp world.
+	// The SENDER dir joins that list for #101: deliverability now also reads the receiver owner's
+	// sender marker, and leaving this one pointed at the operator's real root would have the
+	// fixture judged against markers this smoke never wrote.
 	process.env.ENTWURF_META_RECEIVERS_DIR = receiversDir;
+	process.env.ENTWURF_META_SENDERS_DIR = sendersDir;
 	process.env.ENTWURF_META_SESSIONS_DIR = sessionsDir;
 	process.env.ENTWURF_META_MAILBOX_DIR = mailboxDir;
 
@@ -341,6 +347,14 @@ async function main(): Promise<void> {
 			const gid = minted.record.gardenId;
 			artifacts["C2.gid"] = gid;
 			// armed = a presence marker owned by THIS (live) process → deliverable.
+			//
+			// The receiver marker alone is no longer the whole fixture (#101): a `claude-code-cli`
+			// watch owner is deliverable only while ITS OWN sender marker still names the garden it
+			// is armed for — that join is what refuses a session which switched away in place. A
+			// receiver marker with no sender marker beside it models a state the product now treats
+			// as retired, so this smoke would fail on its own fixture instead of on the rail it
+			// exists to prove. Same shape as smoke-mux-lifecycle-live / smoke-omp-fresh-live, which
+			// already seeded both.
 			writeMetaReceiverMarker({
 				gardenId: gid,
 				backend: "claude-code",
@@ -349,6 +363,14 @@ async function main(): Promise<void> {
 				armProvenance: "session-start",
 				receiversDir,
 			});
+			writeMetaSenderMarker({
+				backend: "claude-code",
+				gardenId: gid,
+				nativeSessionId: minted.record.nativeSessionId,
+				cwd: tmp,
+				ownerPid: process.pid,
+				sendersDir,
+			});
 
 			const result: EntwurfV2RunResult = await runEntwurfV2(
 				{ target: gid, intent: "fire-and-forget", message: "matrix-live C2 meta-mailbox probe" },

package/scripts/smoke-meta-async-drift.sh

@@ -6,13 +6,24 @@
 #
 # WHY THIS EXISTS
 #   The whole Claude async-delivery path rides on UNDOCUMENTED Claude Code behavior:
-#   `asyncRewake` force-prepends `Stop hook feedback:` and ignores `rewakeMessage`;
-#   the payload channel is stderr-only; `watchPaths` can arm from only 3 hook events
-#   (SessionStart / CwdChanged / FileChanged). Half the Gotchas in
-#   scripts/raw-async-delivery/README.md are reverse-engineered. Claude ships ~weekly.
-#   So the path can break SILENTLY on any upgrade. This gate makes it SCREAM instead —
-#   direct lineage of the 0.8.x fail-fast tool-surface gates ("don't let a surface
-#   break quietly, make the gate cry out").
+#   `asyncRewake` names the operator row and the model prefix from `rewakeSummary` /
+#   `rewakeMessage` (both read from a local plugin's hooks.json, both @internal, and
+#   the product doorbell now DEPENDS on both); the doorbell writes its notice on
+#   stderr; `watchPaths` can arm from only 3 hook events (SessionStart / CwdChanged /
+#   FileChanged). Half the Gotchas in scripts/raw-async-delivery/README.md are
+#   reverse-engineered. Claude ships ~weekly. So the path can break SILENTLY on any
+#   upgrade. This gate makes it SCREAM instead — direct lineage of the 0.8.x fail-fast
+#   tool-surface gates ("don't let a surface break quietly, make the gate cry out").
+#
+#   THIS PARAGRAPH USED TO BE WRONG, AND THAT IS THE POINT (#98, corrected
+#   2026-09-03). It said `asyncRewake` "force-prepends `Stop hook feedback:` and
+#   ignores `rewakeMessage`", and that the payload channel was "stderr-only". Both are
+#   FALSE — measured on 2.1.236/2.1.258/2.1.259: `rewakeMessage` REPLACES the model
+#   prefix, `rewakeSummary` REPLACES the operator row, and the model body is
+#   `stderr || stdout`. The marker strings below stayed green the whole time, because
+#   a marker pins a STRING and cannot see the sentence next to it rot. Nobody tried
+#   the two fields for months on the strength of this header. Receipts:
+#   scripts/raw-async-delivery/README.md "Inherited facts corrected".
 #
 # TWO TIERS (mirrors smoke-compaction-policy: deterministic default + LIVE=1 add-on)
 #   DETERMINISTIC (default; free, offline, CI/pre-commit safe):
@@ -70,7 +81,19 @@ MARKERS=(
   flushPendingAsyncRewakeHooks    # engine turn-boundary flush (edge-bound delivery)
   CLAUDE_CODE_STOP_HOOK_BLOCK_CAP # native re-wake cap
   FileChanged                     # idle-wake event
-  rewakeMessage                   # the field asyncRewake IGNORES (doorbell-only proof)
+  # rewakeMessage/rewakeSummary — CORRECTED 2026-09-03 (#98 Phase 1). The comment here used
+  # to read "the field asyncRewake IGNORES (doorbell-only proof)". That was FALSE, and it is
+  # the reason nobody tried the field for months: measured on 2.1.236/2.1.258/2.1.259, BOTH
+  # are read from a local plugin's hooks.json with no first-party gate. `rewakeMessage`
+  # REPLACES the model-facing `Stop hook blocking error from command "…":` prefix;
+  # `rewakeSummary` REPLACES the operator-visible row (default `Stop hook feedback`). Only
+  # the stdout-JSON form of rewakeSummary is first-party gated. The marker string was right
+  # while the reason next to it was dead — which is why these two are pinned HERE: the
+  # product doorbell now DEPENDS on both (pi/meta-bridge/.../hooks/hooks.json), the fields
+  # are @internal, and if either disappears the surface silently reverts to
+  # `Stop hook feedback` + "blocking error" with no other gate to notice.
+  rewakeMessage                   # model-facing prefix replacement (product depends on it)
+  rewakeSummary                   # operator-facing row replacement (product depends on it)
   hookSpecificOutput              # the watchPaths emit envelope
   CwdChanged                      # the 2nd of the 3 watch-arming events
 )

package/scripts/smoke-meta-install-state.sh

@@ -317,6 +317,69 @@ def structural_cells():
         assert (broken, settings) == before
 
 cell("", "retired/managed sets stay disjoint and a corrupt key ledger fails closed", structural_cells)
+
+def compaction_cells():
+    # #94 — the two compaction keys join the retired set. They exercise two axes
+    # the skipDangerous cells above never touch: a NESTED path and a STRING
+    # scalar. Both matter, because relinquish compares `type(value) is
+    # type(last_managed_value)` and walks the path through get_nested.
+    for name, path, last in [
+        ("autoCompactEnabled", ["autoCompactEnabled"], False),
+        ("env.DISABLE_AUTOCOMPACT", ["env", "DISABLE_AUTOCOMPACT"], "1"),
+    ]:
+        def build(current=MISSING, old=MISSING):
+            settings = {}
+            if current is not MISSING:
+                node = settings
+                for key in path[:-1]:
+                    node = node.setdefault(key, {})
+                node[path[-1]] = current
+            keys = {} if old is MISSING else {name: copy.deepcopy(old)}
+            return {"files": {"settings": {"keys": keys}}}, settings
+
+        def led(existed, value):
+            return {"kind": "scalar", "path": path, "original": {"existed": existed, "value": value}}
+
+        def call(current=MISSING, old=MISSING):
+            state, settings = build(current, old)
+            m.relinquish_retired_scalar(state, settings, name, path, last)
+            return state, settings
+
+        # (a) still carrying what entwurf last managed, with provenance -> the
+        #     pre-entwurf snapshot is restored, and the entry is consumed.
+        state, settings = call(last, led(True, last))
+        assert m.get_nested(settings, path) == (True, last), (name, settings)
+        assert name not in state["files"]["settings"]["keys"], name
+        # (a') the same, where the operator had NOTHING before entwurf: restoring
+        #      the snapshot must DELETE the key rather than leave our value.
+        state, settings = call(last, led(False, None))
+        assert m.get_nested(settings, path)[0] is False, (name, settings)
+        # (b) the operator has since changed it -> already theirs, untouched.
+        other = True if last is False else "0"
+        state, settings = call(other, led(True, last))
+        assert m.get_nested(settings, path) == (True, other), (name, settings)
+        assert name not in state["files"]["settings"]["keys"], name
+        # (c) no ledger entry at all (fresh install) -> untouched, and a fresh
+        #     install never creates one because the key is not managed any more.
+        for current in [last, other, MISSING]:
+            state, settings = call(current)
+            expected = (False, None) if current is MISSING else (True, current)
+            assert m.get_nested(settings, path) == expected, (name, current, settings)
+        # Type strictness, where a lookalike EXISTS. For the bool axis that is `0`
+        # (`0 == False` is True while `type(0) is not bool`) — NOT `1`, which is
+        # simply unequal to False and would pass the cell without the type guard
+        # ever being consulted. The string axis has no lookalike at all: no
+        # non-str value equals `"1"`, so equality alone already refuses and there
+        # is nothing for a type check to add. Asserted only where it can fail.
+        if last is False:
+            state, settings = call(0, led(True, last))
+            assert m.get_nested(settings, path) == (True, 0), (name, settings)
+
+cell(
+    "",
+    "#94 compaction keys relinquish across nested/string axes: restore, delete, operator-changed, fresh, type-strict",
+    compaction_cells,
+)
 sys.exit(failed)
 PY
 then ok "#71 retirement leaf: provenance, bool strictness, malformed refusal, one-shot convergence"
@@ -339,10 +402,12 @@ assert stat.S_IMODE(os.stat(path).st_mode) == 0o600
 s=json.load(open(path))
 assert s['files']['settings']['keys']['enabledPlugins.entwurf-meta-receive@meta-bridge-local']['original']['value'] is False
 assert s['files']['settings']['keys']['cleanupPeriodDays']['original']['value'] == 30
-assert s['files']['settings']['keys']['env.DISABLE_AUTOCOMPACT']['original']['value'] == '0'
 assert s['files']['settings']['keys']['statusLine']['original']['value']['command'] == '/old/user/statusline.sh'
 assert s['files']['settings']['keys']['promptSuggestionEnabled']['original']['value'] is True
-assert s['files']['settings']['keys']['autoCompactEnabled']['original']['existed'] is False
+# #94 case (c) — a FRESH install never captures a retired key, so entwurf holds no
+# ownership evidence for compaction and uninstall can never restore a suppression.
+assert 'autoCompactEnabled' not in s['files']['settings']['keys']
+assert 'env.DISABLE_AUTOCOMPACT' not in s['files']['settings']['keys']
 assert 'skipDangerousModePermissionPrompt' not in s['files']['settings']['keys']
 assert s['files']['claudeRoot']['keys']['mcpServers.entwurf-bridge']['original']['value']['command'] == 'old'
 PY
@@ -360,6 +425,21 @@ state['files']['settings']['keys']['skipDangerousModePermissionPrompt']={
   'kind':'scalar', 'path':['skipDangerousModePermissionPrompt'],
   'original':{'existed':True, 'value':False}
 }
+# #94 — the same upgrade shape for the two compaction keys, planted at DRIVE level
+# so apply() itself is the subject, not the leaf. Two branches that the unit cells
+# cannot reach through the real ledger: a NESTED path whose original must come
+# back, and a key whose original never existed and must therefore be DELETED
+# rather than left carrying entwurf's value.
+settings['autoCompactEnabled']=False
+state['files']['settings']['keys']['autoCompactEnabled']={
+  'kind':'scalar', 'path':['autoCompactEnabled'],
+  'original':{'existed':False, 'value':None}
+}
+settings.setdefault('env',{})['DISABLE_AUTOCOMPACT']='1'
+state['files']['settings']['keys']['env.DISABLE_AUTOCOMPACT']={
+  'kind':'scalar', 'path':['env','DISABLE_AUTOCOMPACT'],
+  'original':{'existed':True, 'value':'0'}
+}
 json.dump(settings, open(sp,'w'), indent=2); open(sp,'a').write('\n')
 json.dump(state, open(stp,'w'), indent=2); open(stp,'a').write('\n')
 PY
@@ -373,14 +453,26 @@ assert settings['enabledPlugins']['entwurf-meta-receive@meta-bridge-local'] is T
 assert settings['enabledPlugins']['keep@user'] is True
 assert settings['extraKnownMarketplaces']['meta-bridge-local']['source']['path'] == os.environ['ASM']
 assert settings['cleanupPeriodDays'] == 365
-assert settings['env']['DISABLE_AUTOCOMPACT'] == '1'
+# #94 - retired: apply neither writes nor rewrites it. The fixture's operator
+# value ('0') survives untouched, and the scalar is never introduced at all.
+assert settings['env']['DISABLE_AUTOCOMPACT'] == '0'
+assert 'autoCompactEnabled' not in settings
 assert settings['env']['KEEP_ME'] == 'yes'
 assert settings['statusLine']['command'] == os.environ['REPO'] + '/scripts/meta-bridge-statusline.sh'
-for key in ['promptSuggestionEnabled','awaySummaryEnabled','autoMemoryEnabled','verbose','autoCompactEnabled','showTurnDuration','terminalProgressBarEnabled','useAutoModeDuringPlan','enableWorkflows','workflowKeywordTriggerEnabled']:
+for key in ['promptSuggestionEnabled','awaySummaryEnabled','autoMemoryEnabled','verbose','showTurnDuration','terminalProgressBarEnabled','useAutoModeDuringPlan','enableWorkflows','workflowKeywordTriggerEnabled']:
     assert settings[key] is False, key
 assert settings['skipDangerousModePermissionPrompt'] is False
+# #94 drive-level relinquishment, both branches:
+#   nested path  -> the operator's pre-entwurf '0' is back, and the env map that
+#                   carries it survives with the neighbour key untouched.
+#   absent original -> the key is REMOVED, not left holding entwurf's False.
+assert settings['env']['DISABLE_AUTOCOMPACT'] == '0'
+assert settings['env']['KEEP_ME'] == 'yes'
+assert 'autoCompactEnabled' not in settings
 state=json.load(open(cfg + '/entwurf.install-state.json'))
 assert 'skipDangerousModePermissionPrompt' not in state['files']['settings']['keys']
+assert 'autoCompactEnabled' not in state['files']['settings']['keys']
+assert 'env.DISABLE_AUTOCOMPACT' not in state['files']['settings']['keys']
 for item in ['Bash','Read','Write','Edit','Grep','Glob','WebFetch','WebSearch','Skill','mcp__entwurf-bridge__*']:
     assert item in settings['permissions']['allow'], item
 assert settings['permissions']['allow'].count('Read') == 1
@@ -455,7 +547,6 @@ import json, os
 s=json.load(open(os.environ['CLAUDE_CONFIG_DIR'] + '/entwurf.install-state.json'))
 assert s['files']['settings']['keys']['enabledPlugins.entwurf-meta-receive@meta-bridge-local']['original']['value'] is False
 assert s['files']['settings']['keys']['cleanupPeriodDays']['original']['value'] == 30
-assert s['files']['settings']['keys']['env.DISABLE_AUTOCOMPACT']['original']['value'] == '0'
 assert s['files']['settings']['keys']['statusLine']['original']['value']['command'] == '/old/user/statusline.sh'
 assert s['files']['settings']['keys']['promptSuggestionEnabled']['original']['value'] is True
 PY
@@ -479,13 +570,18 @@ root=json.load(open(os.environ['HOME'] + '/.claude.json'))
 assert settings['cleanupPeriodDays'] == 30
 assert settings['enabledPlugins']['entwurf-meta-receive@meta-bridge-local'] is False
 assert 'meta-bridge-local' not in settings.get('extraKnownMarketplaces', {})
+# #94 - still the operator's '0'. NOT restored by uninstall (we never owned it):
+# never written in the first place.
 assert settings['env']['DISABLE_AUTOCOMPACT'] == '0'
 assert settings['env']['KEEP_ME'] == 'yes'
 assert settings['statusLine']['command'] == '/old/user/statusline.sh'
 assert settings['promptSuggestionEnabled'] is True
 assert settings['skipDangerousModePermissionPrompt'] is False
 assert settings['showTurnDuration'] is True
-for key in ['awaySummaryEnabled','autoMemoryEnabled','verbose','autoCompactEnabled','terminalProgressBarEnabled','useAutoModeDuringPlan','enableWorkflows','workflowKeywordTriggerEnabled']:
+# One list, one meaning: these are the keys UNINSTALL removed. `autoCompactEnabled`
+# is not among them post-#94 — that entwurf never introduced it is a different
+# claim, pinned on the post-install assertion above.
+for key in ['awaySummaryEnabled','autoMemoryEnabled','verbose','terminalProgressBarEnabled','useAutoModeDuringPlan','enableWorkflows','workflowKeywordTriggerEnabled']:
     assert key not in settings, key
 allow=settings['permissions']['allow']
 deny=settings['permissions']['deny']
@@ -667,7 +763,8 @@ s=json.load(open(os.environ['CLAUDE_CONFIG_DIR'] + '/entwurf.install-state.json'
 assert s['files']['settings']['keys']['enabledPlugins.entwurf-meta-receive@meta-bridge-local']['original']['existed'] is False
 assert s['files']['settings']['keys']['extraKnownMarketplaces.meta-bridge-local']['original']['existed'] is False
 assert s['files']['claudeRoot']['keys']['mcpServers.entwurf-bridge']['original']['existed'] is False
-assert s['files']['settings']['keys']['env.DISABLE_AUTOCOMPACT']['original']['existed'] is True
+# #94 - retired: prepare captures no ownership evidence for it any more.
+assert 'env.DISABLE_AUTOCOMPACT' not in s['files']['settings']['keys']
 PY
 then ok "legacy exact plugin/marketplace/MCP migrate as pi-owned absent, policy keys remain user-owned"; else bad "legacy migration state check failed"; fi
 py uninstall >/dev/null
@@ -706,18 +803,80 @@ valid_record "20260606T000001-bbbbbb" "native-b" > "$STORE/20260606T000001-bbbbb
 STATUS_INPUT_MATCH='{"session_id":"native-a","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-sonnet-5"},"context_window":{"context_window_size":200000,"used_percentage":2,"current_usage":{"input_tokens":10}}}'
 STATUS_INPUT_MISS='{"session_id":"native-missing","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-opus-5"}}'
 STATUS_INPUT_READY='{"workspace":{"current_dir":"/tmp"},"model":{"id":"claude-haiku-4-5"}}'
-STATUS_OUT_MATCH="$(printf '%s' "$STATUS_INPUT_MATCH" | ENTWURF_META_SESSIONS_DIR="$STORE" "$REPO/scripts/meta-bridge-statusline.sh")"
+# Pin the mailbox root on EVERY statusline render below, not just the badge cells: the
+# #98 B badge reads it, so an unpinned call would let the operator's real ~/.pi mailbox
+# decide whether these rows carry an envelope.
+MBX="$TMP/mbx"; mkdir -p "$MBX/20260606T000000-aaaaaa"
+STATUS_OUT_MATCH="$(printf '%s' "$STATUS_INPUT_MATCH" | ENTWURF_META_SESSIONS_DIR="$STORE" ENTWURF_META_MAILBOX_DIR="$MBX" "$REPO/scripts/meta-bridge-statusline.sh")"
 if [ "$(printf '%s\n' "$STATUS_OUT_MATCH" | wc -l | tr -d ' ')" = "2" ]; then ok "statusline renders exactly two rows"; else bad "statusline should render two rows: $STATUS_OUT_MATCH"; fi
 if printf '%s\n' "$STATUS_OUT_MATCH" | sed -n '1p' | grep -q 'tmp' && printf '%s\n' "$STATUS_OUT_MATCH" | sed -n '2p' | grep -q '🪛 20260606T000000-aaaaaa cc | s'; then ok "statusline keeps row-1 work context and maps native session_id to row-2 garden-id"; else bad "statusline did not show expected two-row content for native-a: $STATUS_OUT_MATCH"; fi
-STATUS_OUT_MISS="$(printf '%s' "$STATUS_INPUT_MISS" | ENTWURF_META_SESSIONS_DIR="$STORE" "$REPO/scripts/meta-bridge-statusline.sh")"
+STATUS_OUT_MISS="$(printf '%s' "$STATUS_INPUT_MISS" | ENTWURF_META_SESSIONS_DIR="$STORE" ENTWURF_META_MAILBOX_DIR="$MBX" "$REPO/scripts/meta-bridge-statusline.sh")"
 if printf '%s' "$STATUS_OUT_MISS" | grep -q '🪛 ? cc'; then ok "statusline no-record fallback is ?"; else bad "statusline no-record fallback wrong: $STATUS_OUT_MISS"; fi
-STATUS_OUT_READY="$(printf '%s' "$STATUS_INPUT_READY" | ENTWURF_META_SESSIONS_DIR="$STORE" "$REPO/scripts/meta-bridge-statusline.sh")"
+STATUS_OUT_READY="$(printf '%s' "$STATUS_INPUT_READY" | ENTWURF_META_SESSIONS_DIR="$STORE" ENTWURF_META_MAILBOX_DIR="$MBX" "$REPO/scripts/meta-bridge-statusline.sh")"
 if printf '%s' "$STATUS_OUT_READY" | grep -q '🪛 ready cc'; then ok "statusline no-session_id fallback is ready"; else bad "statusline ready fallback wrong: $STATUS_OUT_READY"; fi
 cp "$STORE/20260606T000000-aaaaaa.meta.json" "$STORE/20260606T000003-dddddd.meta.json"
-STATUS_OUT_DUP="$(printf '%s' "$STATUS_INPUT_MATCH" | ENTWURF_META_SESSIONS_DIR="$STORE" "$REPO/scripts/meta-bridge-statusline.sh")"
+STATUS_OUT_DUP="$(printf '%s' "$STATUS_INPUT_MATCH" | ENTWURF_META_SESSIONS_DIR="$STORE" ENTWURF_META_MAILBOX_DIR="$MBX" "$REPO/scripts/meta-bridge-statusline.sh")"
 if printf '%s' "$STATUS_OUT_DUP" | grep -q '🪛 ! cc'; then ok "statusline duplicate nativeSessionId fallback is !"; else bad "statusline duplicate fallback wrong: $STATUS_OUT_DUP"; fi
 rm "$STORE/20260606T000003-dddddd.meta.json"
 
+# --- #98 B: the unread badge -------------------------------------------------
+# Three states that must LOOK different: N letters, none, and "could not count".
+# The last one is the whole reason the badge exists — an unread letter that the
+# operator never saw is exactly the failure #98 opened on, and a statusline that
+# renders a confident 0 when its read failed reproduces it one layer down.
+badge_line() { printf '%s' "$1" | ENTWURF_META_SESSIONS_DIR="$STORE" ENTWURF_META_MAILBOX_DIR="$MBX" "$REPO/scripts/meta-bridge-statusline.sh" | sed -n '2p'; }
+
+# empty mailbox -> NO badge. Silence is the quiet common case; the badge is for mail.
+B_EMPTY="$(badge_line "$STATUS_INPUT_MATCH")"
+if ! printf '%s' "$B_EMPTY" | grep -q '✉'; then ok "badge: empty mailbox draws no envelope"; else bad "badge: empty mailbox drew one: $B_EMPTY"; fi
+
+# The counted set is EXACTLY readMetaInbox's unread union: *.msg + *.msg.delivered.
+# The three decoys below must all be excluded: a .read (already drained — a badge that
+# counted it would never clear), the signal file, and state.json.
+: > "$MBX/20260606T000000-aaaaaa/one.msg"
+: > "$MBX/20260606T000000-aaaaaa/two.msg.delivered"
+: > "$MBX/20260606T000000-aaaaaa/three.msg.delivered.read"
+: > "$MBX/20260606T000000-aaaaaa/inbox.signal"
+: > "$MBX/20260606T000000-aaaaaa/state.json"
+B_TWO="$(badge_line "$STATUS_INPUT_MATCH")"
+if printf '%s' "$B_TWO" | grep -q '✉2'; then ok "badge: .msg + .msg.delivered counted, .read/signal/state excluded (✉2)"; else bad "badge: expected ✉2, got: $B_TWO"; fi
+
+# The drain clears it on the NEXT render — the property acceptance criterion 4 names.
+mv "$MBX/20260606T000000-aaaaaa/one.msg" "$MBX/20260606T000000-aaaaaa/one.msg.read"
+mv "$MBX/20260606T000000-aaaaaa/two.msg.delivered" "$MBX/20260606T000000-aaaaaa/two.msg.delivered.read"
+B_DRAINED="$(badge_line "$STATUS_INPUT_MATCH")"
+if ! printf '%s' "$B_DRAINED" | grep -q '✉'; then ok "badge: clears after the read archives both bodies to .read"; else bad "badge: stayed after drain: $B_DRAINED"; fi
+
+# Could-not-count #1: no garden id resolved, so there is no mailbox to look in. The
+# statusline must NOT quietly claim zero for a session it could not place.
+B_NOGARDEN="$(badge_line "$STATUS_INPUT_MISS")"
+if printf '%s' "$B_NOGARDEN" | grep -q '✉?'; then ok "badge: unresolved garden id renders ✉? (never a false zero)"; else bad "badge: unresolved garden id should be ✉?, got: $B_NOGARDEN"; fi
+
+# Could-not-count #2: the mailbox dir exists but cannot be read. Same rule.
+chmod 000 "$MBX/20260606T000000-aaaaaa"
+B_UNREADABLE="$(badge_line "$STATUS_INPUT_MATCH")"
+chmod 755 "$MBX/20260606T000000-aaaaaa"
+if printf '%s' "$B_UNREADABLE" | grep -q '✉?'; then ok "badge: unreadable mailbox renders ✉? (measurement failure, not zero)"; else bad "badge: unreadable mailbox should be ✉?, got: $B_UNREADABLE"; fi
+
+# Could-not-count #3: no python3 at all. That degrade path predates the badge and used
+# to print a bare `🪛 ? cc`; without the ✉? it would read as "counted, none".
+# The stand-in PATH carries `cat` and nothing else: the script reads its stdin with `cat`
+# BEFORE it tests for python3, so a truly empty PATH would kill it under `set -e` and the
+# cell would pass for the wrong reason.
+mkdir -p "$TMP/emptybin"
+ln -sf "$(command -v cat)" "$TMP/emptybin/cat"
+if [ -n "$(command -v python3 2>/dev/null)" ] && PATH="$TMP/emptybin" command -v python3 >/dev/null 2>&1; then bad "no-python3 fixture is not actually python3-less"; else ok "no-python3 fixture really hides python3"; fi
+# `$BASH` (an absolute path) rather than the name `bash`, so the interpreter is reachable
+# without putting a second binary on the stand-in PATH the fixture is trying to empty.
+B_NOPY="$(printf '%s' "$STATUS_INPUT_MATCH" | PATH="$TMP/emptybin" ENTWURF_META_SESSIONS_DIR="$STORE" ENTWURF_META_MAILBOX_DIR="$MBX" "$BASH" "$REPO/scripts/meta-bridge-statusline.sh" | sed -n '2p')"
+if printf '%s' "$B_NOPY" | grep -q '✉?'; then ok "badge: python3-less degrade line still says ✉? (not a silent zero)"; else bad "badge: python3-less degrade should carry ✉?, got: $B_NOPY"; fi
+
+# A garden id that never renders a real mailbox: the pre-record "ready" state. Nothing
+# has been addressed to this session yet, so an empty badge is TRUE, not a guess.
+B_READY="$(badge_line "$STATUS_INPUT_READY")"
+if ! printf '%s' "$B_READY" | grep -q '✉'; then ok "badge: pre-record 'ready' draws no envelope (nothing addressed yet)"; else bad "badge: ready state drew an envelope: $B_READY"; fi
+rm -rf "$MBX"
+
 if node --experimental-strip-types "$STORE_DOCTOR" "$STORE" >/dev/null; then ok "store doctor accepts valid records"; else bad "store doctor rejected valid records"; fi
 cp "$STORE/20260606T000000-aaaaaa.meta.json" "$STORE/20260606T000002-cccccc.meta.json"
 if node --experimental-strip-types "$STORE_DOCTOR" "$STORE" >/dev/null 2>&1; then bad "store doctor missed body/filename drift + duplicate"; else ok "store doctor fails on body/filename drift and duplicate nativeSessionId"; fi

package/scripts/smoke-meta-keyset-guard.sh

@@ -31,7 +31,10 @@ d=json.load(sys.stdin)
 s=d['settings']
 assert 'statusLine' in s['map-entry'], 'statusLine missing from SSOT map-entry'
 assert 'permissions.allow' in s['array-items'] and 'permissions.deny' in s['array-items'], 'permissions missing'
-assert 'verbose' in s['scalar'] and 'autoCompactEnabled' in s['scalar'], 'scalar policy missing'
+assert 'verbose' in s['scalar'] and 'awaySummaryEnabled' in s['scalar'], 'scalar policy missing'
+# #94: the compaction keys are RETIRED, so managed-keys must NOT claim them.
+assert 'autoCompactEnabled' not in s['scalar'], 'retired compaction scalar still claimed as managed'
+assert 'env.DISABLE_AUTOCOMPACT' not in s['scalar'], 'retired compaction env scalar still claimed as managed'
 assert any(k.startswith('enabledPlugins.') for k in s['map-entry']), 'plugin ref missing'
 assert d['claudeRoot']['map-entry'] == ['mcpServers.entwurf-bridge'], 'MCP key missing'
 " && ok "managed-keys SSOT is valid JSON with the expected owned keys" \

package/scripts/smoke-mux-fresh-call-live.ts

@@ -194,7 +194,10 @@ async function main(): Promise<void> {
 		const callerGid = caller.record.gardenId;
 		// A record proves identity; only an ARMED receiver marker makes the mailbox deliverable —
 		// without it the callbacks would be refused as mailbox-undeliverable and this smoke would
-		// measure nothing.
+		// measure nothing. Since #101 the marker is half of that: a `claude-code-cli` watch owner
+		// is deliverable only while ITS OWN sender marker still names the garden it is armed for,
+		// which is what refuses a session that switched away in place. Both, or the fixture models
+		// a retired watch — the same shape smoke-mux-lifecycle-live already seeds.
 		meta.writeMetaReceiverMarker({
 			gardenId: callerGid,
 			backend: "claude-code",
@@ -202,9 +205,16 @@ async function main(): Promise<void> {
 			ownerPid: process.pid,
 			armProvenance: "session-start",
 		});
+		const callerSenderMarker = meta.writeMetaSenderMarker({
+			backend: "claude-code",
+			gardenId: callerGid,
+			nativeSessionId,
+			cwd: scratch,
+			ownerPid: process.pid,
+		});
 		ok(
-			"fixture: the caller citizen was minted INSIDE the fixture store and its mailbox is armed",
-			Boolean(callerGid) && caller.path.startsWith(root),
+			"fixture: the caller citizen was minted INSIDE the fixture store, with an armed mailbox and a sender marker",
+			Boolean(callerGid) && caller.path.startsWith(root) && callerSenderMarker.startsWith(root),
 		);
 
 		// ── One private tmux server per backend ──────────────────────────────────