@junghanacs/entwurf 0.17.1 → 0.18.0

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-mailbox.js

@@ -36,16 +36,23 @@ import { enqueueMetaMessage } from "./meta-session.js";
  * legacy mailbox path used). `plan.wantsReply` is threaded into the body — v2 carries the
  * caller's intent, a DELIBERATE divergence from the legacy hard-coded `false`. An enqueue
  * throw PROPAGATES; it is never converted to `{success:false}`.
+ *
+ * #98 R — the SEND receipt: `enqueueMetaMessage` already returns the exact `.msg` path it
+ * wrote ("Returns the paths so a sender can show exactly what was queued"), and this body
+ * used to flatten it to `{success:true}`. It now carries that ONE field through. Nothing
+ * else from the enqueue result crosses: no timestamps, and specifically no `lastReadAt` —
+ * see the `RpcSendResult` note. The path is reported verbatim from the enqueue result, not
+ * re-derived from the plan, so it can never disagree with the file that was actually written.
  */
 export function executeMetaMailboxSend(plan, sender, deps) {
     const body = sender ? formatMetaMailboxBody(sender, plan.message, plan.wantsReply) : plan.message;
-    deps.enqueue({
+    const enqueued = deps.enqueue({
         gardenId: plan.targetGardenId,
         body,
         sessionsDir: plan.sessionsDir,
         mailboxDir: plan.mailboxDir,
     });
-    return { success: true };
+    return { success: true, messagePath: enqueued.messagePath };
 }
 /**
  * Build the production `sendViaMailbox(plan, lock)` adapter the 5c-2a send hand consumes.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-production.js

@@ -29,7 +29,7 @@
  * claiming "no conflict". The decider's later `inspectSocket` probe is a SEPARATE step.
  */
 import { sendRpcCommand as realSendRpc, } from "./entwurf-control-rpc.js";
-import { mailboxConversationalDeliverable, receiverMarkerMatchesIdentity, } from "./entwurf-deliverability.js";
+import { mailboxConversationalDeliverable, resolveMailboxReceiverFacts, } from "./entwurf-deliverability.js";
 import { isOutOfSocketDomainGardenIdConflict } from "./entwurf-facts.js";
 import { isLivenessSupported } from "./entwurf-v2-contract.js";
 import { decideDispatch, } from "./entwurf-v2-decider.js";
@@ -38,7 +38,7 @@ import { makeProductionSendViaMailbox } from "./entwurf-v2-mailbox.js";
 import { makeNativePushSend } from "./entwurf-v2-native-push.js";
 import { executeControlSocketSend, } from "./entwurf-v2-send.js";
 import { resolveDeadControlSendFallback } from "./entwurf-v2-send-fallback.js";
-import { defaultMetaMailboxDir, defaultMetaSessionsDir, enqueueMetaMessage, metaCapabilityFor, metaRecordExistsByGardenId, readAddressableMetaIdentity, readMetaReceiverMarker, } from "./meta-session.js";
+import { defaultMetaMailboxDir, defaultMetaSessionsDir, enqueueMetaMessage, metaCapabilityFor, metaRecordExistsByGardenId, readAddressableMetaIdentity, readMetaReceiverMarker, readMetaSenderMarker, requireBackend, } from "./meta-session.js";
 import { resolveNativePushAdapter as realResolveNativePushAdapter, } from "./native-push/adapter.js";
 import { CONTROL_SOCKET_DIR, controlSocketPath, inspectControlSocketPath, inspectTargetControlSocket, isRecordLessSocketCandidate, } from "./socket-discovery.js";
 import { classifyConnectError, probeSocketLiveness } from "./socket-probe.js";
@@ -77,6 +77,8 @@ export function makeProductionEntwurfV2Deps(opts) {
         metaRecordExists: s.metaRecordExists ?? metaRecordExistsByGardenId,
         readIdentity: s.readIdentity ?? readAddressableMetaIdentity,
         readReceiverMarker: s.readReceiverMarker ?? ((gid) => readMetaReceiverMarker({ gardenId: gid })),
+        readSenderMarker: s.readSenderMarker ??
+            ((backend, ownerPid) => readMetaSenderMarker({ backend: requireBackend(backend), ownerPid })),
         inspectPath: s.inspectPath ?? inspectControlSocketPath,
         acquireLock: s.acquireLock ?? realAcquireLock,
         releaseLock: s.releaseLock ?? realReleaseLock,
@@ -98,22 +100,32 @@ export function makeProductionEntwurfV2Deps(opts) {
         enqueue: io.enqueue,
     });
     // ── ONE deliverability seam (SE-2 2d-3): wake-mode capability AND a live active-
-    // receiver (a presence marker that matches THIS identity). The SAME closure is injected
-    // into the decider AND the dead-fallback, so a direct send and a re-resolved fallback
-    // send can never drift to different deliverability verdicts. recordBacked is true by
-    // construction — resolveTarget already proved the record exists before any unsupported-
-    // backend mailbox route, and the closure is only consulted on that route. A null /
-    // dead-owner / identity-mismatched marker is fail-closed to inactive (SE-2): a reply to a
-    // terminated self-fetch citizen is rejected, not enqueued as mailbox garbage. ──────────
+    // receiver. The SAME closure is injected into the decider AND the dead-fallback, so a
+    // direct send and a re-resolved fallback send can never drift to different deliverability
+    // verdicts. recordBacked is true by construction — resolveTarget already proved the record
+    // exists before any unsupported-backend mailbox route, and the closure is only consulted on
+    // that route. A null / dead-owner / identity-mismatched marker is fail-closed to inactive
+    // (SE-2): a reply to a terminated self-fetch citizen is rejected, not enqueued as mailbox
+    // garbage.
+    //
+    // The two receiver facts come from the SHARED composition (#101 결함 B), never from one
+    // value copied into both slots. `ownerAlive` is the marker↔identity match on a live owner;
+    // `watchArmed` is the separate measurement that this owner is STILL serving this garden.
+    // They were the same expression until a Claude session switch inside one pid left a retired
+    // garden's marker reading as an armed doorbell and a real message rotted unread in its
+    // mailbox. `entwurf_self` calls the same composition, so a citizen's own replyability can
+    // never disagree with what dispatch decided about it. ──────────
     const mailboxDeliverabilityFor = (identity) => {
         const wakeMode = metaCapabilityFor(identity.backend).wakeMode;
-        const marker = io.readReceiverMarker(identity.gardenId);
-        const matched = receiverMarkerMatchesIdentity(marker, identity);
+        const { ownerAlive, watchArmed } = resolveMailboxReceiverFacts(identity, {
+            readReceiverMarker: io.readReceiverMarker,
+            readSenderMarker: io.readSenderMarker,
+        });
         return mailboxConversationalDeliverable({
             wakeMode,
             recordBacked: true,
-            ownerAlive: matched,
-            watchArmed: matched,
+            ownerAlive,
+            watchArmed,
         });
     };
     // ── target resolution (QB1 + QB2) ─────────────────────────────────────────

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-runner.js

@@ -49,7 +49,12 @@ export async function executeDispatch(decision, deps) {
                     kind: "executed",
                     receipt,
                     transport,
-                    outcome: { transport: "control-socket", outcome: r.outcome, rejectReason: r.rejectReason },
+                    outcome: {
+                        transport: "control-socket",
+                        outcome: r.outcome,
+                        rejectReason: r.rejectReason,
+                        messagePath: r.messagePath,
+                    },
                 };
             }
             catch (err) {
@@ -80,7 +85,14 @@ export async function executeDispatch(decision, deps) {
                 if (r.success !== true) {
                     throw new Error("entwurf-v2-runner: meta-mailbox send returned success:false (contract violation; a mailbox has no in-band reject).");
                 }
-                return { kind: "executed", receipt, transport, outcome: { transport: "meta-mailbox", success: true } };
+                return {
+                    kind: "executed",
+                    receipt,
+                    transport,
+                    // #98 R: carry the enqueue receipt verbatim. `undefined` stays `undefined` —
+                    // the runner never substitutes a guessed path for a missing one.
+                    outcome: { transport: "meta-mailbox", success: true, messagePath: r.messagePath },
+                };
             }
             catch (err) {
                 return { kind: "execution-failed", receipt, transport, error: errorMessage(err), retrySafe: false };

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-send.js

@@ -58,7 +58,7 @@ export async function executeControlSocketSend(plan, lock, deps) {
         drive = { outcome: "failed", error: err };
     }
     finalizeRelease(policy, deps, held, drive);
-    return { outcome: drive.outcome, rejectReason: drive.rejectReason };
+    return { outcome: drive.outcome, rejectReason: drive.rejectReason, messagePath: drive.messagePath };
 }
 /** Drive the 1차 send and route a connect failure through the F3 split. */
 async function driveSend(plan, lock, deps) {
@@ -122,7 +122,10 @@ async function driveDeadFallback(plan, lock, deps) {
             // hand never reaches for the mailbox on its own; only the resolver routes here.
             try {
                 const r = await deps.sendViaMailbox(rePlan, lock);
-                return { outcome: r.success ? "fallback-sent" : "rejected" };
+                // #98 R: this leg writes a `.msg` exactly like the primary mailbox rail, so it
+                // owes the sender the same per-message receipt. Carried only on success — a
+                // `rejected` enqueue wrote no file to name.
+                return r.success ? { outcome: "fallback-sent", messagePath: r.messagePath } : { outcome: "rejected" };
             }
             catch (err) {
                 return { outcome: "failed", error: err };

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-surface.js

@@ -18,6 +18,7 @@
  *   - `runAndRenderEntwurfV2FromSurface` — assemble production deps + run + render, so the root
  *     surface never needs to name the `EntwurfV2RunResult` union (it only sees `{text,isError}`).
  */
+import { basename } from "node:path";
 import { makeProductionEntwurfV2Deps } from "./entwurf-v2-production.js";
 import { runEntwurfV2 } from "./entwurf-v2-runner.js";
 import { FRESH_CUT_PRESCRIPTION } from "./meta-session.js";
@@ -102,6 +103,12 @@ export function renderEntwurfV2Result(result) {
                         `\n  ${c.detail}` +
                         (c.holder ? `\n  holder: pid ${c.holder.pid} on ${c.holder.hostname} since ${c.holder.createdAt}` : "");
             }
+            // #101 갭 C: name WHICH receiver axis failed. "mailbox-undeliverable" alone sent a
+            // caller looking for a dead session when the session was alive and had simply
+            // switched to another garden — the predicate knew that and the surface threw it away.
+            if (result.diagnostic?.kind === "mailbox-undeliverable") {
+                text += `\n  mailbox-undeliverable: ${result.diagnostic.reason}`;
+            }
             return { text, isError: true };
         }
         case "executed": {
@@ -109,8 +116,13 @@ export function renderEntwurfV2Result(result) {
             if (o.transport === "control-socket") {
                 const delivered = o.outcome === "sent" || o.outcome === "fallback-sent";
                 const reason = o.rejectReason ? ` (reason: ${o.rejectReason})` : "";
+                // #98 R, fallback leg: a dead socket that re-resolved to the mailbox wrote a
+                // `.msg` — name it, exactly as the primary mailbox rail does. Absent on a
+                // socket-to-socket retry (no file) and on every non-mailbox outcome, so the
+                // line degrades to the bare outcome rather than printing "undefined".
+                const enqueued = o.messagePath ? ` (enqueued ${basename(o.messagePath)})` : "";
                 return {
-                    text: `entwurf_v2 control-socket → ${o.outcome}${reason}`,
+                    text: `entwurf_v2 control-socket → ${o.outcome}${reason}${enqueued}`,
                     isError: !delivered,
                 };
             }
@@ -121,8 +133,17 @@ export function renderEntwurfV2Result(result) {
                     isError: false,
                 };
             }
-            // meta-mailbox
-            return { text: "entwurf_v2 meta-mailbox → enqueued", isError: false };
+            // meta-mailbox. #98 R: name the FILE that was enqueued, so the sender's transcript
+            // carries a per-message identifier instead of a bare literal. Only the basename —
+            // the directory is `<meta-mailbox>/<target garden id>/`, which the caller already
+            // typed. Deliberately NOT a read stamp: at enqueue time `lastReadAt` belongs to the
+            // PREVIOUS message, so printing it would claim a read that has not happened.
+            // A dep that omits the receipt falls back to the old literal rather than printing
+            // "undefined" — the delivery still happened.
+            return {
+                text: `entwurf_v2 meta-mailbox → enqueued${o.messagePath ? ` (${basename(o.messagePath)})` : ""}`,
+                isError: false,
+            };
         }
         case "execution-failed": {
             if (result.releaseFailed && result.finalizedOutcome) {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js

@@ -1661,6 +1661,44 @@ export function readMetaReceiverMarker(opts) {
         return null;
     }
 }
+/**
+ * Retire a receiver presence marker THIS owner pid wrote (#101 결함 A).
+ *
+ * A native process that switches sessions in place — an in-session `/resume` or `/clear`
+ * fires a second SessionStart inside the same pid under a new native session id — leaves
+ * the previous garden's marker behind, naming a live owner whose watch is gone. Measured
+ * on oracle 2026-09-04: one pid (143742) held two gardens' markers four seconds apart, and
+ * mail sent to the retired one sat unread.
+ *
+ * ONLY THE MARKER. The meta-record stays: records are identity, and deleting one
+ * outside `meta-bridge-fresh-cut` would fight store certification (Hard Rule 7/8).
+ * A retired citizen keeps its record, its transcript and its listing — it loses only
+ * the claim that a doorbell is armed for it, which is exactly the claim that stopped
+ * being true.
+ *
+ * Fail-closed the other way too: the marker is read back first and removed ONLY when its
+ * `ownerPid` field equals the one passed here — pid equality, which is what a caller can
+ * actually check; it does not prove the same PROCESS wrote it (a reused pid compares equal),
+ * and the reader-side start-key guard is where that finer distinction lives. It is enough for
+ * the rule this serves: a hook never retires a watch some other pid is holding. Returns whether a marker was actually removed. Never throws — a retirement
+ * that cannot happen is a log line, not a broken session start.
+ */
+export function removeMetaReceiverMarker(opts) {
+    try {
+        const receiversDir = opts.receiversDir ?? defaultMetaReceiversDir();
+        const file = metaReceiverMarkerPath(opts.gardenId, receiversDir);
+        // verifyOwner:false — the point is the OWNERSHIP field, not the owner's liveness;
+        // a marker whose owner already died is still this pid's to clean up when it names it.
+        const marker = readMetaReceiverMarker({ markerPath: file, verifyOwner: false });
+        if (!marker || marker.ownerPid !== opts.ownerPid)
+            return false;
+        fs.unlinkSync(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Idempotent fs upsert (writes v3 identity). CERTIFY the whole active store, then
  * decide create-vs-attach on record EXISTENCE and write atomically as v3. On
@@ -2077,9 +2115,17 @@ export function enqueueMetaMessage(opts) {
  * Drain a garden citizen's mailbox: read every unread message (a fresh `.msg`
  * read before its doorbell, or a doorbell-rung `.msg.delivered`), archive each to
  * `*.read` so a re-read never double-returns, and — only if at least one message
- * was read — stamp `lastReadAt` (NOT `lastDeliveredAt`: the doorbell owns
- * delivery-time, see the stamp-site note below). An empty inbox mutates nothing:
- * reading nothing is not a receipt.
+ * was read — stamp `lastReadAt`. `lastDeliveredAt` stays untouched (see the
+ * stamp-site note below). An empty inbox mutates nothing: reading nothing is not
+ * a receipt.
+ *
+ * WHERE THE PER-MESSAGE TRUTH LIVES (#98 5a, corrected 2026-09-03). The FILE SUFFIX
+ * is the per-message receipt: `.msg` = enqueued, `.msg.delivered` = the doorbell
+ * rang for it, `.msg.delivered.read` = this function handed it to the reader.
+ * `state.json` is NOT that — its three slots are GARDEN-WIDE and overwritten, so
+ * `lastReadAt` says "this citizen last read something at T", never "message X was
+ * read". A sender that quotes `lastReadAt` back as the fate of the letter it just
+ * queued is quoting the PREVIOUS letter's read. That misreading is what opened #98.
  */
 export function readMetaInbox(opts) {
     const now = opts.now ?? new Date();
@@ -2101,10 +2147,18 @@ export function readMetaInbox(opts) {
     if (messages.length === 0) {
         return { gardenId: citizen.gardenId, messages, readAt: null, recordPath: recordFile };
     }
-    // 3D-4 the cut: the read receipt lives SOLELY in the mailbox state store now.
-    // Stamp lastReadAt — the one receipt this layer stamps honestly (it KNOWS the body
-    // reached the reader). lastDeliveredAt is the doorbell's to own; stamping it here
-    // would report read-time as delivery-time, so it is left as the doorbell left it.
+    // 3D-4 the cut: the garden-wide read receipt lives SOLELY in the mailbox state store
+    // now. Stamp lastReadAt — the one slot this layer stamps honestly (it KNOWS a body
+    // reached the reader at this instant). lastDeliveredAt is left alone, and #98 5a
+    // corrects WHY: the old comment said "the doorbell owns it", but the shipped
+    // doorbell.sh (54 lines) writes NOTHING to state.json — measured, zero state writes.
+    // So `lastDeliveredAt` is a RESERVED SLOT nobody stamps, permanently null on all
+    // ~180 on-disk states, while 900+ files carry a `.delivered` suffix. Stamping it
+    // here would still be wrong (it would report read-time as delivery-time), so it
+    // stays null — but do not read "the doorbell will fill it in" into that. The
+    // per-message delivery fact is the `.delivered` SUFFIX. The field is left in place
+    // deliberately: removing it is a migration (the parser rejects unknown keys AND a
+    // bumped schemaVersion, and every stamp re-parses first), tracked as #98 5b.
     // The state stamp returns the updated state, whose lastReadAt IS the D7 read-receipt.
     // Inside the messages.length>0 branch by construction — an empty inbox already
     // early-returned (no .read archive, state untouched), so "read nothing" is no

package/mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js

@@ -28,6 +28,20 @@
  * a UserPromptSubmit fire does a degraded RECORD backfill (upsert) but cannot
  * re-arm the idle watch — the record's address is restored, the wake is not.
  *
+ * SESSION SWITCH (#101). One Claude process serves one session at a time, but it can
+ * change which. Measured on oracle 2026-09-04 (raw lab S1-S6, Claude Code 2.1.260): a bare
+ * `claude` mints a NEW session (`source=startup`), and an in-session `/resume` or `/clear`
+ * then fires a SECOND SessionStart under the SAME pid for a DIFFERENT native id
+ * (`source=resume` / `source=clear`). The first garden is left behind — in the #101 field
+ * case its transcript was never written at all — while its receiver marker still names a
+ * LIVE owner, so a sender reads an armed doorbell nobody holds. This hook therefore reads
+ * the sender marker BEFORE overwriting it and retires the previous garden's receiver marker
+ * (marker only — records are identity and are never deleted here; and only a marker this
+ * pid owns). Compaction (`source=compact`) re-fires SessionStart for the SAME native id, so
+ * the same rule retires nothing there — measured, not assumed. The envelope's `source` is
+ * logged beside all of it and decides nothing: the switch is settled by what is on disk,
+ * which holds on every host and vendor version.
+ *
  * LAUNCH: never invoked directly by Claude. `hooks.json` declares the EXEC form
  * (`command` = `<plugin-root>/scripts/hook-launch.sh`, `args` = [node, this file]),
  * and the launcher `exec`s that argv — so this process inherits the launcher's pid
@@ -45,7 +59,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { defaultMetaMailboxDir, defaultMetaSessionsDir, isPlausibleOwnerPid, upsertMetaSession, writeMetaReceiverMarker, writeMetaSenderMarker, } from "./lib/meta-session.js";
+import { defaultMetaMailboxDir, defaultMetaSessionsDir, isPlausibleOwnerPid, readMetaSenderMarker, removeMetaReceiverMarker, upsertMetaSession, writeMetaReceiverMarker, writeMetaSenderMarker, } from "./lib/meta-session.js";
 function logLine(level, message) {
     try {
         // dirname(meta-sessions) == the pi agent dir — no extra resolver export needed.
@@ -168,6 +182,13 @@ function main() {
             ? env.model_id
             : undefined;
     const eventName = typeof env.hook_event_name === "string" ? env.hook_event_name : "SessionStart";
+    // `source` (startup | resume | clear | compact) is Claude's own word for WHY this
+    // SessionStart fired. It is logged on every line below and decides nothing: a session
+    // switch is settled by what is on disk (the sender marker's garden), which is true on
+    // every host and every vendor version. Logging it is how this host finally gets a
+    // receipt for the envelope order the #101 diagnosis could only read from vendor docs —
+    // and the raw lab (scripts/raw-claude-session-switch) reads these lines, not a guess.
+    const source = typeof env.source === "string" && env.source.length > 0 ? env.source : "(unset)";
     if (!sessionId || !transcriptPath) {
         // A degraded envelope: cannot mint an honest reference record. Log + no-op
         // rather than write a half-record or guess a transcript path. LEVEL depends
@@ -185,7 +206,7 @@ function main() {
             input: { backend: "claude-code", nativeSessionId: sessionId, transcriptPath, cwd, model },
         });
         gardenId = result.record.gardenId;
-        logLine("INFO", `${result.action} record ${path.basename(result.path)} (event=${eventName}, native=${sessionId})`);
+        logLine("INFO", `${result.action} record ${path.basename(result.path)} (event=${eventName}, source=${source}, native=${sessionId})`);
     }
     catch (err) {
         // Best-effort: a broken record store must surface via the doctor, not by
@@ -210,9 +231,48 @@ function main() {
     // an env var. Missing launcher provenance or an implausible parent yields no marker.
     const ownerPid = resolveMetaHookOwnerPid();
     if (ownerPid !== null) {
+        // SESSION SWITCH RETIREMENT (#101 결함 A). One Claude process serves ONE session at a
+        // time, but it can switch which: an in-session `/resume` or `/clear` fires a second
+        // SessionStart under the same pid for a different native id, leaving the session the
+        // process started with behind (measured on oracle, meta-bridge-hook.log 2026-09-04
+        // 13:13:04 `source=startup` → 13:13:37 `source=resume`; the field case at 09:31:35 →
+        // 09:31:39 is the same shape). Whatever it was serving before is no longer being
+        // drained, so the marker advertising its doorbell has to go.
+        //
+        // The evidence is the sender marker as it stands RIGHT NOW — pid → the garden this
+        // process serves — which is why this reads it BEFORE the write below overwrites it with
+        // the new garden. No vendor field is consulted: `source` is logged, not branched on, so
+        // a host or version that words it differently changes nothing here. A same-garden
+        // re-registration (every UserPromptSubmit, a CwdChanged, a re-fired SessionStart) finds
+        // an equal garden id and retires NOTHING — the marker it would remove is the live one.
+        //
+        // Only the marker, never the record (see removeMetaReceiverMarker), and only a marker
+        // this pid owns.
+        //
+        // AND ONLY ON AN EVENT THAT CAN ARM THE REPLACEMENT (cross-review, 2026-09-04). This
+        // block sits before the UserPromptSubmit early-return, and UPS cannot emit watchPaths —
+        // so a retirement reached from there would take a doorbell down with nothing in the same
+        // run able to put one back. A watch is retired only by a run that arms one; that is the
+        // whole rule. `armProvenanceFor` is the same predicate the arm block below uses, so the
+        // two can never disagree about which events those are.
+        //
+        // It is NOT a defence against a keystroke from a session this pid has left: measured on
+        // oracle 2026-09-04 (raw lab S1-S6, meta-bridge-hook.log), every UserPromptSubmit named
+        // the native id its own pid's preceding SessionStart had established — 8 of 8, none
+        // otherwise. The hook runs synchronously inside the session's own process, so a UPS
+        // envelope is that session speaking, and the sender pointer it moves is authoritative.
+        const previous = armProvenanceFor(eventName) !== null
+            ? readMetaSenderMarker({ backend: "claude-code", ownerPid, verifyOwner: false })
+            : null;
+        if (previous && previous.gardenId !== gardenId) {
+            const retired = removeMetaReceiverMarker({ gardenId: previous.gardenId, ownerPid });
+            logLine("INFO", retired
+                ? `retired receiver marker ${previous.gardenId} — owner pid ${ownerPid} switched to ${gardenId} (event=${eventName}, source=${source})`
+                : `no receiver marker to retire for ${previous.gardenId} — owner pid ${ownerPid} switched to ${gardenId} (event=${eventName}, source=${source})`);
+        }
         try {
             writeMetaSenderMarker({ backend: "claude-code", gardenId, nativeSessionId: sessionId, cwd, ownerPid });
-            logLine("INFO", `sender marker ${ownerPid} -> ${gardenId} (event=${eventName})`);
+            logLine("INFO", `sender marker ${ownerPid} -> ${gardenId} (event=${eventName}, source=${source})`);
         }
         catch (err) {
             logLine("WARN", `sender marker write failed (event=${eventName}, pid=${ownerPid}, garden=${gardenId}): ${err instanceof Error ? err.message : String(err)}`);
@@ -259,7 +319,7 @@ function main() {
                     ownerPid,
                     armProvenance,
                 });
-                logLine("INFO", `receiver marker ${gardenId} owner=${ownerPid} arm=${eventName}`);
+                logLine("INFO", `receiver marker ${gardenId} owner=${ownerPid} arm=${eventName} source=${source}`);
             }
             catch (err) {
                 logLine("WARN", `receiver marker write failed (event=${eventName}, garden=${gardenId}): ${err instanceof Error ? err.message : String(err)}`);

package/mcp/entwurf-bridge/src/index.ts

@@ -66,7 +66,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 
 import { controlSocketPathIn, defaultControlSocketDir } from "../../../pi-extensions/lib/control-socket-path.js";
-import { receiverMarkerMatchesIdentity } from "../../../pi-extensions/lib/entwurf-deliverability.ts";
+import { resolveMailboxReceiverFacts } from "../../../pi-extensions/lib/entwurf-deliverability.ts";
 import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provider.ts";
 import { renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.ts";
 import { computeSelfAddressability, type MetaDeliveryDomain } from "../../../pi-extensions/lib/entwurf-self-address.ts";
@@ -91,6 +91,8 @@ import {
 	readActiveStoreEntries,
 	readMetaInbox,
 	readMetaReceiverMarker,
+	readMetaSenderMarker,
+	requireBackend,
 } from "../../../pi-extensions/lib/meta-session.ts";
 import { freshCall, renderFreshCall } from "../../../pi-extensions/lib/mux-fresh-call.ts";
 import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.ts";
@@ -272,9 +274,12 @@ async function buildTrustedMetaSenderEnvelope(cwd: string = process.cwd()): Prom
 	//     admits another self-fetch citizen.
 	//   none        ← neither. omp today: no mailbox drain, no native-push adapter. Rendering
 	//     this as self-fetch printed a mailboxPath nothing drains.
-	//   self-fetch (claude-code/copilot): can this citizen's own inbox wake? → the receiver
-	//     presence marker (readMetaReceiverMarker folds a dead/reused owner to null, so a match
-	//     means a live, ARMED receiver — the sender marker proves identity, never an armed watch).
+	//   self-fetch (claude-code/copilot): can this citizen's own inbox wake? → the SHARED
+	//     receiver composition `resolveMailboxReceiverFacts`, the same one the v2 dispatch seam
+	//     uses, so a citizen's self-reported replyability can never disagree with what dispatch
+	//     decides about it. It reads the presence marker (a dead/reused owner already folds to
+	//     null) AND, where the watch owner is the sender-marker process, the #101 join that says
+	//     the owner is still serving THIS garden rather than one it switched away from.
 	//   native-push (antigravity): there is no inbox and no watch. A reply is injected into a
 	//     live app-server conversation, so only an adapter probe can answer. Composing the
 	//     receiver atom here would demand `watchArmed` from a backend that never arms one, and
@@ -298,14 +303,17 @@ async function buildTrustedMetaSenderEnvelope(cwd: string = process.cwd()): Prom
 				}
 			: metaDeliveryDomain === "self-fetch"
 				? (() => {
-						const receiver = readMetaReceiverMarker({ gardenId: identity.gardenId });
-						const active = receiverMarkerMatchesIdentity(receiver, identity);
+						const receiver = resolveMailboxReceiverFacts(identity, {
+							readReceiverMarker: (gardenId: string) => readMetaReceiverMarker({ gardenId }),
+							readSenderMarker: (backend: string, ownerPid: number) =>
+								readMetaSenderMarker({ backend: requireBackend(backend), ownerPid }),
+						});
 						return {
 							origin: "meta-session" as const,
 							metaDeliveryDomain,
 							recordBacked: true,
-							ownerAlive: active,
-							watchArmed: active,
+							ownerAlive: receiver.ownerAlive,
+							watchArmed: receiver.watchArmed,
 						};
 					})()
 				: {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.17.1",
+	"version": "0.18.0",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {
@@ -143,6 +143,7 @@
 		"check-omp-receive-arm": "./run.sh check-omp-receive-arm",
 		"check-omp-fresh-preflight": "./run.sh check-omp-fresh-preflight",
 		"check-hook-launch-topology": "./run.sh check-hook-launch-topology",
+		"check-meta-hook-session-switch": "./run.sh check-meta-hook-session-switch",
 		"check-acp-carrier-augment": "./run.sh check-acp-carrier-augment",
 		"check-agy-permission-matrix": "./run.sh check-agy-permission-matrix",
 		"check-gate-qualification": "./run.sh check-gate-qualification",
@@ -165,7 +166,7 @@
 		"check:toolchain": "pnpm lint && pnpm typecheck",
 		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface",
 		"check:contracts": "./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-resume-args && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-entwurf-facts && ./run.sh check-control-socket-path && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment",
-		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex",
+		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex",
 		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},
 	"pi": {

package/pi/meta-bridge/entwurf-meta-receive/hooks/hooks.json

@@ -45,7 +45,9 @@
 						"command": "${CLAUDE_PLUGIN_ROOT}/scripts/hook-launch.sh",
 						"args": ["${CLAUDE_PLUGIN_ROOT}/scripts/doorbell.sh"],
 						"asyncRewake": true,
-						"timeout": 20
+						"timeout": 20,
+						"rewakeSummary": "entwurf inbox: sibling mail arrived",
+						"rewakeMessage": "entwurf mailbox notice:"
 					}
 				]
 			}

package/pi/meta-bridge/entwurf-meta-receive/scripts/doorbell.sh

@@ -6,15 +6,20 @@
 # with a doorbell notice. Free: a file write + continuation of an already-running
 # subscription session (no `claude -p` spawn).
 #
-# ADDRESSED by GARDEN ID: the changed path arrives on stdin as `file_path`; its
-# directory IS this session's garden mailbox (<meta-mailbox>/<garden-id>/). So
-# this hook touches ONLY its own mailbox — a sender that pokes one garden id's
-# signal wakes only that session. No node needed here; the dirname is the mailbox.
+# ADDRESSED by GARDEN ID: the changed path arrives on stdin as `file_path` and this
+# hook takes its DIRECTORY as the mailbox to process. No node needed here; the
+# dirname is the mailbox.
 #
-# DOORBELL ONLY: announce "you have mail" + the body path on stderr (the sole
-# asyncRewake payload channel — stdout is dropped). NEVER push imperatives; strong
-# models flag hook-injected commands as prompt injection. The agent self-fetches
-# the body with its own trusted tool, and that inbox-read is the real D7 receipt.
+# Two statements, deliberately kept apart (#98, 2026-09-03 — they used to be one
+# sentence claiming this hook "touches ONLY its own mailbox"):
+#   - PREMISE: under a normal install the only watch this session armed is its own
+#     <garden-id>/inbox.signal, so that is the only file_path that arrives.
+#   - LIMIT: this script does not verify it. It trusts `file_path` and never compares
+#     the dirname against its garden id. Measured — a second FileChanged hook in the
+#     same session made this doorbell process the OTHER mailbox and race it to exit 2,
+#     which is why a second such hook cannot coexist with this one.
+#   Receipt: scripts/raw-async-delivery/README.md, "What the probe session actually
+#   touches". Not a live defect: nothing pokes a signal outside the garden mailbox.
 #
 # RUNTIME DEPS: bash + python3 (the FileChanged stdin JSON is parsed with python3
 # below — robust against escaping, unlike sed/grep). The meta-bridge doctor must