@junghanacs/entwurf 0.17.1 → 0.18.0

package/pi-extensions/lib/entwurf-deliverability.ts

@@ -109,6 +109,110 @@ export function receiverMarkerMatchesIdentity(
 	);
 }
 
+// ── the watch-owner ↔ sender-marker join (#101 결함 B) ──────────────────────
+// A receiver marker proves "a LIVE process once armed a watch for this garden".
+// It does NOT prove "that process is serving this garden RIGHT NOW". One native
+// process can hold markers for several gardens and drain exactly one of them:
+// Claude Code's session switch (an in-session `/resume` or `/clear`) fires a second
+// SessionStart inside the SAME pid under a NEW native session id, so the first
+// garden's marker keeps naming a live owner forever while the doorbell it advertises
+// is gone. Measured on oracle 2026-09-04 (#101): one pid held both markers, a
+// 09:33 enqueue to the retired garden sat unread as a bare `.msg` for ≥50 minutes —
+// the "enqueue into a void" this module's header exists to refuse.
+//
+// The join that decides it is already on disk: the SENDER marker is keyed by owner
+// pid and rewritten with the CURRENT garden on every arm/prompt, so
+// `meta-senders/<backend>/<ownerPid>.json.gardenId` is the answer to "which garden
+// does this process serve now?". A receiver marker naming a different garden than
+// its own owner's sender marker is a retired watch.
+//
+// SCOPE IS NOT UNIVERSAL, AND THE MARKER SAYS SO. The join only exists where the
+// watch owner IS the process the sender marker is keyed to. That is true for the
+// Claude hook (one `ownerPid` variable writes both markers —
+// `meta-bridge-hook.ts` sender + receiver arm) and false BY CONSTRUCTION for
+// Copilot, whose watch lives in a forked first-party extension child
+// (`extension.mjs` writes `ownerPid: process.pid`) while its sender marker is keyed
+// to the CLI parent (`meta-bridge-hook-copilot.ts` uses `process.ppid`). Applying
+// the join there would make every Copilot citizen permanently undeliverable — a
+// regression on a shipped lane, not a fix. `ownerKind` is recorded on the marker for
+// exactly this reason ("the marker records which, because the pid a reader verifies
+// differs" — AGENTS.md, self-fetch domain), so it is the axis, not `backend`.
+//
+// `omp-host` is a CANDIDATE, deliberately not admitted here: OMP already retires the
+// previous garden in-process on its `/new` edge (the unarm the claude hook lacked),
+// so the cell this join closes has a different owner there. Admitting it needs its
+// own measurement, not this file's optimism.
+export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = ["claude-code-cli"];
+
+/** Does this watch owner share its pid with the backend's sender marker? */
+export function receiverOwnerKindJoinsSender(ownerKind: string): boolean {
+	return SENDER_JOINED_RECEIVER_OWNER_KINDS.includes(ownerKind);
+}
+
+/** The receiver-marker fields the join reads (a structural shape, like ReceiverIdentityFacts). */
+export interface ReceiverOwnerFacts extends ReceiverIdentityFacts {
+	ownerPid: number;
+	ownerKind: string;
+}
+
+/** The sender-marker fields the join reads: which garden this owner pid serves NOW. */
+export interface SenderOwnerFacts {
+	gardenId: string;
+	backend: string;
+}
+
+/**
+ * Is the watch owner still serving THIS garden? Fail-closed inside the join's scope:
+ * an absent/unreadable sender marker, or one naming another garden or backend, means
+ * the watch is retired. Outside the scope (an ownerKind whose watch owner is not the
+ * sender-marker process) the join does not apply and the marker's own live-owner guard
+ * is the whole rule — returning true here is NOT optimism, it is "this axis says
+ * nothing", and the caller has already required the marker to match the identity.
+ */
+export function receiverOwnerServesGarden(
+	marker: ReceiverOwnerFacts,
+	senderMarker: SenderOwnerFacts | null | undefined,
+): boolean {
+	if (!receiverOwnerKindJoinsSender(marker.ownerKind)) return true;
+	return !!senderMarker && senderMarker.gardenId === marker.gardenId && senderMarker.backend === marker.backend;
+}
+
+/** The two marker readers the mailbox receiver facts are composed from (injected — this module does no IO). */
+export interface MailboxReceiverReaders {
+	/** Read the receiver presence marker for a garden id (null = absent/corrupt/dead owner). */
+	readReceiverMarker: (gardenId: string) => ReceiverOwnerFacts | null;
+	/** Read the sender marker for an owner pid (null = absent/corrupt/dead owner). */
+	readSenderMarker: (backend: string, ownerPid: number) => SenderOwnerFacts | null;
+}
+
+/**
+ * THE single composition of the two mailbox receiver facts, over injected readers.
+ * Both production consumers — the v2 `mailboxDeliverabilityFor` seam and the MCP
+ * bridge's `entwurf_self` — call THIS, so a direct send, a re-resolved fallback send
+ * and a citizen's own replyability can never drift to different verdicts.
+ *
+ *   ownerAlive  — a live-owner marker that names THIS identity (the reader already ran
+ *                 the plausibility + start-key guards; this adds the identity match).
+ *   watchArmed  — that owner is still serving this garden (the join above). It is a
+ *                 MEASUREMENT, never a copy of ownerAlive: copying it is what let a
+ *                 retired watch read as an armed doorbell (#101 결함 B).
+ *
+ * `recordBacked` is NOT decided here — it stays the caller's explicit fact, so an
+ * absent record and a dead owner stay distinguishable in the reason string.
+ */
+export function resolveMailboxReceiverFacts(
+	identity: ReceiverIdentityFacts,
+	readers: MailboxReceiverReaders,
+): { ownerAlive: boolean; watchArmed: boolean } {
+	const marker = readers.readReceiverMarker(identity.gardenId);
+	const ownerAlive = receiverMarkerMatchesIdentity(marker, identity);
+	if (!ownerAlive || !marker) return { ownerAlive: false, watchArmed: false };
+	const senderMarker = receiverOwnerKindJoinsSender(marker.ownerKind)
+		? readers.readSenderMarker(marker.backend, marker.ownerPid)
+		: null;
+	return { ownerAlive, watchArmed: receiverOwnerServesGarden(marker, senderMarker) };
+}
+
 export interface MailboxDeliverabilityFacts extends MetaReceiverActiveFacts {
 	/** The target backend's wake mode (from the capability registry). */
 	wakeMode?: WakeMode | string;

package/pi-extensions/lib/entwurf-fact-provider.ts

@@ -27,7 +27,13 @@
  * one diagnostic carries the fact. (pi + same-gid socket = the normal merge.)
  */
 
-import { type FactList, isOutOfSocketDomainGardenIdConflict, resolveFactList } from "./entwurf-facts.ts";
+import {
+	type FactList,
+	isOutOfSocketDomainGardenIdConflict,
+	type PeerObserver,
+	resolveFactList,
+} from "./entwurf-facts.ts";
+import { observePeerFacts } from "./entwurf-peer-observe.ts";
 import { isLivenessSupported } from "./entwurf-v2-contract.ts";
 import {
 	type ActiveStoreEntry,
@@ -93,6 +99,12 @@ export interface EntwurfFactsDeps {
 	readRecord: (filename: string) => string;
 	/** Socket axis: injected into scanSocketProbes (controlDir/readdir/probe). */
 	socket?: Partial<SocketScanDeps>;
+	/** Observation axis (#101): per-citizen receiver + transcript facts. Defaults to the
+	 * REAL measurement — the same seam shape `makeProductionEntwurfV2Deps` uses, so the two
+	 * wiring sites (MCP + pi-native) cannot drift by each passing their own observer, and a
+	 * gate still drives the assembly with a fake and no filesystem. A caller that injects
+	 * nothing gets facts; a caller that injects `() => UNOBSERVED_PEER` says so on every row. */
+	observe?: PeerObserver;
 }
 
 function diagnosticSortKey(d: EntwurfDiagnostic): string {
@@ -113,10 +125,12 @@ function diagnosticSortKey(d: EntwurfDiagnostic): string {
 }
 
 /**
- * Assemble the facts-only listing. Pure over its injected deps (no direct IO) so
- * the gate drives it without a filesystem; slice 4c supplies the real readdir /
- * readFile / probe. Probes are gid + liveness only (#50 C4 — the per-socket
- * get_info enrich left with the socket-only quasi-citizen listing).
+ * Assemble the facts-only listing. Driven entirely through injected deps, so the gate
+ * runs it without a filesystem; slice 4c supplies the real readdir / readFile / probe.
+ * The one dep with a REAL default is `observe` (#101) — see its comment: a per-citizen
+ * measurement both wiring sites must make identically is safer as one default than as two
+ * call-site arguments. Probes are gid + liveness only (#50 C4 — the per-socket get_info
+ * enrich left with the socket-only quasi-citizen listing).
  */
 export async function listEntwurfFacts(deps: EntwurfFactsDeps): Promise<EntwurfFactsResult> {
 	const diagnostics: EntwurfDiagnostic[] = [];
@@ -183,7 +197,7 @@ export async function listEntwurfFacts(deps: EntwurfFactsDeps): Promise<EntwurfF
 	//    fire as the last line of defense, never caught here.
 	const cleanIdentities = identities.filter((i) => !conflictGids.has(i.gardenId));
 	const cleanProbes = probes.filter((p) => !conflictGids.has(p.gardenId));
-	const facts: FactList = resolveFactList(cleanIdentities, cleanProbes);
+	const facts: FactList = resolveFactList(cleanIdentities, cleanProbes, deps.observe ?? observePeerFacts);
 
 	// 5. #50 C4 demotion: a record-less socket is a diagnostic, not a listing
 	//    section. One diagnostic per socket (subjects aggregate at render, F8);

package/pi-extensions/lib/entwurf-facts.ts

@@ -19,6 +19,9 @@
  *     a peer-facing fact; `entwurf_peers` exposes identity + cwd-history, not
  *     filesystem internals. (who-can / dispatch read it via the meta-record
  *     directly when they genuinely need it — it does not belong in the listing.)
+ *     Whether that transcript EXISTS is a different thing and is carried (#101):
+ *     the path stays private, the fact that a citizen has never written a turn
+ *     does not.
  *
  * The 4-value liveness (`alive|dead|indeterminate|unsupported`, R3b) and the
  * out-of-domain → `unsupported` rule (R1: never coerce an unprobed backend to
@@ -47,8 +50,44 @@ export interface PeerFact {
 	recordUpdatedAt: string;
 	// — the single computed fact: 4-value liveness (R1/R3b). NOT a verb. —
 	liveness: FactLiveness;
+	// — observed state (#101). Facts, not verbs: they say what was found on disk, not
+	//   what a caller may do about it. For claude-code every row reads
+	//   `liveness=unsupported` — the control-socket probe does not apply — so the listing
+	//   showed nothing that separated a live citizen from a phantom, and a caller picking
+	//   "the newest record in this cwd" picked the phantom as often as the real one.
+	receiver: ReceiverObservation;
+	transcript: TranscriptObservation;
 }
 
+/**
+ * The mailbox receiver axis, as OBSERVED for this citizen.
+ *   active     a presence marker whose owner is live AND still serving this garden.
+ *   inactive   a marker exists but fails that test (dead owner, drifted identity, or an
+ *              owner that switched to another garden).
+ *   none       no marker at all — never armed, or retired.
+ *   n/a        this backend has no mailbox receiver axis (pi, antigravity).
+ *   unobserved nobody measured it. Only reachable when a caller drives the fact core
+ *              without an observer; it is the honest word for "not looked at", never a
+ *              quiet stand-in for `none`.
+ */
+export type ReceiverObservation = "active" | "inactive" | "none" | "n/a" | "unobserved";
+
+/** Does the recorded transcript exist on disk? `absent` is what a never-used registration
+ * looks like: a record with no conversation behind it. */
+export type TranscriptObservation = "exists" | "absent" | "unobserved";
+
+export interface PeerObservations {
+	receiver: ReceiverObservation;
+	transcript: TranscriptObservation;
+}
+
+/** What a caller that measured nothing must say. Explicit and greppable — a row that
+ * silently defaulted to `none`/`absent` would be a fabricated fact. */
+export const UNOBSERVED_PEER: PeerObservations = { receiver: "unobserved", transcript: "unobserved" };
+
+/** Measure the two observed axes for one citizen. Injected, so this module stays pure. */
+export type PeerObserver = (identity: MetaIdentity) => PeerObservations;
+
 /**
  * Compose a `PeerFact` from a citizen's identity and an optional socket probe.
  *
@@ -61,7 +100,11 @@ export interface PeerFact {
  *
  * Pure: same inputs → same output, no IO.
  */
-export function resolvePeerFact(identity: MetaIdentity, socket: SocketLiveness | null): PeerFact {
+export function resolvePeerFact(
+	identity: MetaIdentity,
+	socket: SocketLiveness | null,
+	observations: PeerObservations = UNOBSERVED_PEER,
+): PeerFact {
 	return {
 		gardenId: identity.gardenId,
 		backend: identity.backend,
@@ -71,6 +114,8 @@ export function resolvePeerFact(identity: MetaIdentity, socket: SocketLiveness |
 		createdAt: identity.createdAt,
 		recordUpdatedAt: identity.recordUpdatedAt,
 		liveness: factLivenessOf(identity.backend, socket),
+		receiver: observations.receiver,
+		transcript: observations.transcript,
 	};
 }
 
@@ -172,7 +217,11 @@ export interface FactList {
  * A gardenId is never emitted as both a `PeerFact` and a `RecordLessSocketFact`;
  * a record-less socket becomes a `PeerFact` the moment a record claims the gid.
  */
-export function resolveFactList(identities: MetaIdentity[], socketProbes: SocketProbe[]): FactList {
+export function resolveFactList(
+	identities: MetaIdentity[],
+	socketProbes: SocketProbe[],
+	observe: PeerObserver = () => UNOBSERVED_PEER,
+): FactList {
 	const probeMap = new Map<string, SocketProbe>();
 	for (const probe of socketProbes) {
 		if (probeMap.has(probe.gardenId)) {
@@ -207,7 +256,7 @@ export function resolveFactList(identities: MetaIdentity[], socketProbes: Socket
 			}
 			socket = null;
 		}
-		peers.push(resolvePeerFact(identity, socket));
+		peers.push(resolvePeerFact(identity, socket, observe(identity)));
 		consumed.add(gid);
 	}
 

package/pi-extensions/lib/entwurf-peer-observe.ts

@@ -0,0 +1,77 @@
+/**
+ * entwurf-peer-observe — the IO half of the two OBSERVED peer facts (#101).
+ *
+ * `entwurf_peers` used to answer a claude-code citizen with `liveness=unsupported` and
+ * nothing else, because the control-socket probe genuinely does not apply to a self-fetch
+ * backend. Two same-cwd rows — one a live conversation, one an abandoned startup session
+ * whose transcript was never written — were therefore byte-identical in the listing, and
+ * a caller picking "the newest record in this cwd" (the natural heuristic, and the one the
+ * surface encourages) picked the phantom as often as the real one. Both halves of the
+ * distinction were already on disk; nothing read them.
+ *
+ * FACTS, NOT VERBS. `receiver` and `transcript` say what was found, never what to do
+ * about it: no `sendable`, no `deliverable`, no transport. The listing stays a listing —
+ * dispatch still computes routing at call time from the same underlying markers.
+ *
+ * ONE MEASUREMENT, TWO WORDS. `receiver` is derived from the SAME
+ * `resolveMailboxReceiverFacts` composition the v2 dispatch seam and `entwurf_self` use.
+ * The surfaces are allowed to phrase it differently — a listing wants an enum, a reject
+ * wants a sentence — but they may not disagree, so the enum is a projection of that atom
+ * rather than a second opinion about the same markers.
+ */
+
+import * as fs from "node:fs";
+import { resolveMailboxReceiverFacts } from "./entwurf-deliverability.ts";
+import type { PeerObservations, ReceiverObservation, TranscriptObservation } from "./entwurf-facts.ts";
+import {
+	type MetaBackend,
+	type MetaIdentity,
+	metaCapabilityFor,
+	metaReceiverMarkerPath,
+	readMetaReceiverMarker,
+	readMetaSenderMarker,
+	requireBackend,
+} from "./meta-session.ts";
+
+/**
+ * The mailbox receiver axis for one citizen.
+ *
+ * `n/a` is not a failure: a backend with no mailbox (pi's control socket, antigravity's
+ * native push) has no receiver marker to be right or wrong about, and printing `none`
+ * there would invent a missing thing. The `inactive` / `none` split is what a reader
+ * needs to tell "a watch was armed and is no longer valid" from "no watch was ever
+ * armed here", so it is taken from the marker FILE's existence rather than from the
+ * reader's null — the reader folds absent, corrupt and dead-owner into one null.
+ */
+function observeReceiver(identity: MetaIdentity): ReceiverObservation {
+	if (metaCapabilityFor(identity.backend).wakeMode !== "self-fetch") return "n/a";
+	const facts = resolveMailboxReceiverFacts(identity, {
+		readReceiverMarker: (gardenId: string) => readMetaReceiverMarker({ gardenId }),
+		readSenderMarker: (backend: string, ownerPid: number) =>
+			readMetaSenderMarker({ backend: requireBackend(backend) as MetaBackend, ownerPid }),
+	});
+	if (facts.ownerAlive && facts.watchArmed) return "active";
+	return fs.existsSync(metaReceiverMarkerPath(identity.gardenId)) ? "inactive" : "none";
+}
+
+/**
+ * Does the recorded transcript exist? A record is minted at SessionStart, but a harness
+ * that writes its transcript lazily (Claude Code writes on the first turn) leaves a
+ * citizen with no conversation behind it until someone actually says something. The PATH
+ * stays private — only its existence crosses to the listing.
+ */
+function observeTranscript(identity: MetaIdentity): TranscriptObservation {
+	try {
+		// A record with no recorded transcript path has nothing to stat — that is the same
+		// observable state as a path that is not there, and neither is an `exists` claim.
+		return identity.transcriptPath && fs.existsSync(identity.transcriptPath) ? "exists" : "absent";
+	} catch {
+		// A transcript we cannot stat is not a transcript we can claim exists.
+		return "absent";
+	}
+}
+
+/** The production observer: both axes, measured for one citizen. */
+export function observePeerFacts(identity: MetaIdentity): PeerObservations {
+	return { receiver: observeReceiver(identity), transcript: observeTranscript(identity) };
+}

package/pi-extensions/lib/entwurf-peers-render.ts

@@ -39,9 +39,20 @@ export interface EntwurfPeersRender {
 	payload: EntwurfPeersPayload;
 }
 
+// `receiver` and `transcript` are OBSERVED facts, not routing (#101): they say what was
+// found on disk for this citizen, and a caller still asks entwurf_v2 what may be done
+// about it. They earn a column because for every claude-code row `liveness` reads
+// `unsupported` — the socket probe does not apply — so two rows in one cwd, a live
+// conversation and an abandoned startup session whose transcript was never written, used to
+// be indistinguishable here. `receiver=active|inactive|none|n/a` is a projection of the
+// same measurement dispatch uses; `transcript=exists|absent` is the record's transcript,
+// existence only, never the path.
 function renderPeerLine(p: PeerFact): string {
 	const model = p.model ?? "(unknown)";
-	return `- ${p.gardenId}  backend=${p.backend}  liveness=${p.liveness}  cwd=${p.cwd}  model=${model}`;
+	return (
+		`- ${p.gardenId}  backend=${p.backend}  liveness=${p.liveness}  receiver=${p.receiver}  ` +
+		`transcript=${p.transcript}  cwd=${p.cwd}  model=${model}`
+	);
 }
 
 function renderDiagnosticLine(d: EntwurfDiagnostic): string {

package/pi-extensions/lib/entwurf-v2-decider.ts

@@ -128,13 +128,24 @@ export type ExecutionPlan =
 // claim so 5c's at-most-once re-resolve runs under the same nonce) and null for the
 // lock-free meta-mailbox path (？7).
 //
-// A reject's optional machine-readable diagnostic. Only `target-locked` carries one:
-// the `LockConflict` (holder pid/host/createdAt, lockPath, human detail) the lock
-// primitive produced on contention. It rides ALONGSIDE the receipt — the receipt
-// schema is unchanged; 5d's surface renders it onto the reject. (B3: without this the
-// holder evidence was dropped at the decider boundary, so a PID-reuse permanent lock
-// could not be observed/cleared — F2-P2 "관측 가능해야 수용".)
-export type RejectDiagnostic = { kind: "target-locked"; conflict: LockConflict };
+// A reject's optional machine-readable diagnostic, riding ALONGSIDE the receipt — the
+// receipt schema is unchanged and 5d's surface renders the diagnostic onto the reject.
+// Two kinds, both here for the same reason: the evidence that decided the reject was
+// produced one layer down and would otherwise be dropped at this boundary, leaving the
+// caller a verdict with no way to see or clear its cause (F2-P2 "관측 가능해야 수용").
+//
+//   target-locked         the `LockConflict` (holder pid/host/createdAt, lockPath, human
+//                         detail) the lock primitive produced on contention. B3: without
+//                         it a PID-reuse permanent lock could not be observed/cleared.
+//   mailbox-undeliverable WHICH receiver axis failed, in the deliverability predicate's own
+//                         words — no backing record vs. a dead owner vs. a watch that is no
+//                         longer armed are three different situations with three different
+//                         fixes, and the bare `mailbox-undeliverable` reason told a caller
+//                         none of them (#101 갭 C). The predicate already computes the
+//                         sentence; this carries it instead of discarding it.
+export type RejectDiagnostic =
+	| { kind: "target-locked"; conflict: LockConflict }
+	| { kind: "mailbox-undeliverable"; reason: string };
 
 export type DispatchDecision =
 	| { kind: "reject"; receipt: RejectReceipt; diagnostic?: RejectDiagnostic }
@@ -327,7 +338,14 @@ export async function decideDispatch(input: DispatchInput, deps: DispatchDecider
 		// fail-closed (SE-2 2d-3). resolveDispatch then routes intent × deliverable.
 		const deliverability = await deps.mailboxDeliverabilityFor(identity);
 		const receipt = resolveDispatch(input.intent, "unsupported", deliverability.deliverable);
-		if (!receipt.ok) return reject(receipt);
+		// The predicate's reason travels with the reject (#101 갭 C). It is attached only when
+		// undeliverability is what produced the reject — an intent-shaped refusal on a
+		// DELIVERABLE target must not be dressed up as a receiver problem.
+		if (!receipt.ok) {
+			return deliverability.deliverable
+				? reject(receipt)
+				: reject(receipt, { kind: "mailbox-undeliverable", reason: deliverability.reason });
+		}
 		// the only allow cell here is fire-and-forget → meta-mailbox send.
 		const plan: ExecutionPlan = {
 			transport: "meta-mailbox",

package/pi-extensions/lib/entwurf-v2-mailbox.ts

@@ -50,6 +50,13 @@ export interface MetaMailboxSendDeps {
  * legacy mailbox path used). `plan.wantsReply` is threaded into the body — v2 carries the
  * caller's intent, a DELIBERATE divergence from the legacy hard-coded `false`. An enqueue
  * throw PROPAGATES; it is never converted to `{success:false}`.
+ *
+ * #98 R — the SEND receipt: `enqueueMetaMessage` already returns the exact `.msg` path it
+ * wrote ("Returns the paths so a sender can show exactly what was queued"), and this body
+ * used to flatten it to `{success:true}`. It now carries that ONE field through. Nothing
+ * else from the enqueue result crosses: no timestamps, and specifically no `lastReadAt` —
+ * see the `RpcSendResult` note. The path is reported verbatim from the enqueue result, not
+ * re-derived from the plan, so it can never disagree with the file that was actually written.
  */
 export function executeMetaMailboxSend(
 	plan: MetaMailboxPlan,
@@ -57,13 +64,13 @@ export function executeMetaMailboxSend(
 	deps: MetaMailboxSendDeps,
 ): RpcSendResult {
 	const body = sender ? formatMetaMailboxBody(sender, plan.message, plan.wantsReply) : plan.message;
-	deps.enqueue({
+	const enqueued = deps.enqueue({
 		gardenId: plan.targetGardenId,
 		body,
 		sessionsDir: plan.sessionsDir,
 		mailboxDir: plan.mailboxDir,
 	});
-	return { success: true };
+	return { success: true, messagePath: enqueued.messagePath };
 }
 
 /**

package/pi-extensions/lib/entwurf-v2-production.ts

@@ -39,7 +39,7 @@ import {
 import {
 	type MailboxDeliverabilityResult,
 	mailboxConversationalDeliverable,
-	receiverMarkerMatchesIdentity,
+	resolveMailboxReceiverFacts,
 } from "./entwurf-deliverability.ts";
 import { isOutOfSocketDomainGardenIdConflict } from "./entwurf-facts.ts";
 import { isLivenessSupported } from "./entwurf-v2-contract.ts";
@@ -75,10 +75,13 @@ import {
 	enqueueMetaMessage,
 	type MetaIdentity,
 	type MetaReceiverMarker,
+	type MetaSenderMarker,
 	metaCapabilityFor,
 	metaRecordExistsByGardenId,
 	readAddressableMetaIdentity,
 	readMetaReceiverMarker,
+	readMetaSenderMarker,
+	requireBackend,
 } from "./meta-session.ts";
 import {
 	type NativePushAdapter,
@@ -111,6 +114,10 @@ export interface ProductionEntwurfV2Seams {
 	 * SE-2 2d-3 active-receiver source; the factory's `mailboxDeliverabilityFor` closure verifies
 	 * its identity match. */
 	readReceiverMarker: (gardenId: string) => MetaReceiverMarker | null;
+	/** Read the sender marker keyed to a receiver's owner pid — the "which garden does this
+	 * process serve NOW?" fact the #101 watch-owner join reads. Null = absent / dead owner /
+	 * corrupt, which the join treats as a retired watch inside its scope. */
+	readSenderMarker: (backend: string, ownerPid: number) => MetaSenderMarker | null;
 	/** Record-side lstat of the EXACT target socket path (no connect) for the pre-probe conflict. */
 	inspectPath: (socketPath: string) => Promise<TargetSocketInspection>;
 	acquireLock: (gid: string, deps: { dir?: string }) => AcquireLockResult;
@@ -183,6 +190,9 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 		metaRecordExists: s.metaRecordExists ?? metaRecordExistsByGardenId,
 		readIdentity: s.readIdentity ?? readAddressableMetaIdentity,
 		readReceiverMarker: s.readReceiverMarker ?? ((gid: string) => readMetaReceiverMarker({ gardenId: gid })),
+		readSenderMarker:
+			s.readSenderMarker ??
+			((backend: string, ownerPid: number) => readMetaSenderMarker({ backend: requireBackend(backend), ownerPid })),
 		inspectPath: s.inspectPath ?? inspectControlSocketPath,
 		acquireLock: s.acquireLock ?? realAcquireLock,
 		releaseLock: s.releaseLock ?? realReleaseLock,
@@ -207,22 +217,32 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 	});
 
 	// ── ONE deliverability seam (SE-2 2d-3): wake-mode capability AND a live active-
-	// receiver (a presence marker that matches THIS identity). The SAME closure is injected
-	// into the decider AND the dead-fallback, so a direct send and a re-resolved fallback
-	// send can never drift to different deliverability verdicts. recordBacked is true by
-	// construction — resolveTarget already proved the record exists before any unsupported-
-	// backend mailbox route, and the closure is only consulted on that route. A null /
-	// dead-owner / identity-mismatched marker is fail-closed to inactive (SE-2): a reply to a
-	// terminated self-fetch citizen is rejected, not enqueued as mailbox garbage. ──────────
+	// receiver. The SAME closure is injected into the decider AND the dead-fallback, so a
+	// direct send and a re-resolved fallback send can never drift to different deliverability
+	// verdicts. recordBacked is true by construction — resolveTarget already proved the record
+	// exists before any unsupported-backend mailbox route, and the closure is only consulted on
+	// that route. A null / dead-owner / identity-mismatched marker is fail-closed to inactive
+	// (SE-2): a reply to a terminated self-fetch citizen is rejected, not enqueued as mailbox
+	// garbage.
+	//
+	// The two receiver facts come from the SHARED composition (#101 결함 B), never from one
+	// value copied into both slots. `ownerAlive` is the marker↔identity match on a live owner;
+	// `watchArmed` is the separate measurement that this owner is STILL serving this garden.
+	// They were the same expression until a Claude session switch inside one pid left a retired
+	// garden's marker reading as an armed doorbell and a real message rotted unread in its
+	// mailbox. `entwurf_self` calls the same composition, so a citizen's own replyability can
+	// never disagree with what dispatch decided about it. ──────────
 	const mailboxDeliverabilityFor = (identity: MetaIdentity): MailboxDeliverabilityResult => {
 		const wakeMode = metaCapabilityFor(identity.backend).wakeMode;
-		const marker = io.readReceiverMarker(identity.gardenId);
-		const matched = receiverMarkerMatchesIdentity(marker, identity);
+		const { ownerAlive, watchArmed } = resolveMailboxReceiverFacts(identity, {
+			readReceiverMarker: io.readReceiverMarker,
+			readSenderMarker: io.readSenderMarker,
+		});
 		return mailboxConversationalDeliverable({
 			wakeMode,
 			recordBacked: true,
-			ownerAlive: matched,
-			watchArmed: matched,
+			ownerAlive,
+			watchArmed,
 		});
 	};
 

package/pi-extensions/lib/entwurf-v2-runner.ts

@@ -61,12 +61,17 @@ export interface DispatchExecutorDeps {
 }
 
 /** The per-transport success outcome, discriminated by transport so the surface renders
- * each without guessing. `control-socket` carries the optional N3 `rejectReason`;
+ * each without guessing. `control-socket` carries the optional N3 `rejectReason` and,
+ * when a dead-socket re-resolve fell back to the mailbox, that leg's #98 R `messagePath`;
  * `meta-mailbox` is always `success:true` (enqueue has no in-band refuse — a failure is
- * a throw, handled as `execution-failed`). */
+ * a throw, handled as `execution-failed`) and carries the #98 R send receipt: the path of
+ * the `.msg` the enqueue actually wrote. OPTIONAL because a fake/legacy `sendMailbox` dep
+ * may omit it — a missing receipt must degrade the rendered line, never fail the delivery,
+ * and it is the ONLY enqueue-side datum carried (never a read timestamp; see
+ * `RpcSendResult`). */
 export type ExecutedOutcome =
-	| { transport: "control-socket"; outcome: SendFinalOutcome; rejectReason?: string }
-	| { transport: "meta-mailbox"; success: true }
+	| { transport: "control-socket"; outcome: SendFinalOutcome; rejectReason?: string; messagePath?: string }
+	| { transport: "meta-mailbox"; success: true; messagePath?: string }
 	// native-push carries `retried` so the surface can note the 1-shot re-probe retry fired.
 	| { transport: "native-push"; success: true; retried: boolean };
 
@@ -118,7 +123,12 @@ export async function executeDispatch(
 					kind: "executed",
 					receipt,
 					transport,
-					outcome: { transport: "control-socket", outcome: r.outcome, rejectReason: r.rejectReason },
+					outcome: {
+						transport: "control-socket",
+						outcome: r.outcome,
+						rejectReason: r.rejectReason,
+						messagePath: r.messagePath,
+					},
 				};
 			} catch (err) {
 				// N1: a delivered/refused send whose release then threw — lock dirty, do NOT retry.
@@ -150,7 +160,14 @@ export async function executeDispatch(
 						"entwurf-v2-runner: meta-mailbox send returned success:false (contract violation; a mailbox has no in-band reject).",
 					);
 				}
-				return { kind: "executed", receipt, transport, outcome: { transport: "meta-mailbox", success: true } };
+				return {
+					kind: "executed",
+					receipt,
+					transport,
+					// #98 R: carry the enqueue receipt verbatim. `undefined` stays `undefined` —
+					// the runner never substitutes a guessed path for a missing one.
+					outcome: { transport: "meta-mailbox", success: true, messagePath: r.messagePath },
+				};
 			} catch (err) {
 				return { kind: "execution-failed", receipt, transport, error: errorMessage(err), retrySafe: false };
 			}

package/pi-extensions/lib/entwurf-v2-send.ts

@@ -52,10 +52,20 @@ export type MetaMailboxPlan = Extract<ExecutionPlan, { transport: "meta-mailbox"
 export type SendFinalOutcome = "sent" | "fallback-sent" | "rejected" | "failed";
 
 /** What a single RPC / mailbox enqueue reports. `success:false` is an in-band reject
- * (the receiver answered and refused) — distinct from a thrown connect error. */
+ * (the receiver answered and refused) — distinct from a thrown connect error.
+ *
+ * `messagePath` is the SEND-side receipt (#98 R) and is OPTIONAL because only the
+ * mailbox rail has one: an enqueue writes a file, so there is a per-message artifact
+ * to name. A control-socket RPC hands the body to a live receiver and produces no
+ * file, so it leaves this undefined rather than inventing one. It carries the ENQUEUED
+ * path and NOTHING about reading: `lastReadAt` at enqueue time is the PREVIOUS
+ * message's read stamp, so surfacing it here would read as "my message was read" —
+ * the exact misreading #98 opened on. The per-message read receipt is the `.read`
+ * suffix on this very file, never a state.json slot. */
 export interface RpcSendResult {
 	success: boolean;
 	error?: string;
+	messagePath?: string;
 }
 
 /** The same-lock one-shot re-resolve result (5c-2b implements the resolver; 5c-2a
@@ -98,6 +108,14 @@ export interface ControlSocketSendResult {
 	 * 5d runner carries this verbatim so the surface can tell "in-band refusal" from
 	 * "no live route" — the N3 carry-over the hand boundary used to drop. */
 	rejectReason?: string;
+	/** #98 R, fallback leg: the `.msg` a dead-socket re-resolve enqueued. Present ONLY
+	 * when the fallback actually routed to the mailbox and the enqueue succeeded — a
+	 * control-socket retry hands the body to a live receiver and writes no file, so it
+	 * leaves this undefined rather than inventing one. Same rule as `RpcSendResult`: the
+	 * ENQUEUED path and nothing about reading. Without it a `fallback-sent` is the one
+	 * mailbox delivery whose sender gets no per-message identifier — the same letter the
+	 * primary mailbox rail names. */
+	messagePath?: string;
 }
 
 // A drive step's verdict: the terminal outcome, plus the original error to RETHROW on
@@ -107,6 +125,8 @@ interface SendDrive {
 	outcome: SendFinalOutcome;
 	error?: unknown;
 	rejectReason?: string;
+	/** #98 R receipt from the mailbox fallback leg (see `ControlSocketSendResult`). */
+	messagePath?: string;
 }
 
 /**
@@ -139,7 +159,7 @@ export async function executeControlSocketSend(
 		drive = { outcome: "failed", error: err };
 	}
 	finalizeRelease(policy, deps, held, drive);
-	return { outcome: drive.outcome, rejectReason: drive.rejectReason };
+	return { outcome: drive.outcome, rejectReason: drive.rejectReason, messagePath: drive.messagePath };
 }
 
 /** Drive the 1차 send and route a connect failure through the F3 split. */
@@ -208,7 +228,10 @@ async function driveDeadFallback(
 			// hand never reaches for the mailbox on its own; only the resolver routes here.
 			try {
 				const r = await deps.sendViaMailbox(rePlan, lock);
-				return { outcome: r.success ? "fallback-sent" : "rejected" };
+				// #98 R: this leg writes a `.msg` exactly like the primary mailbox rail, so it
+				// owes the sender the same per-message receipt. Carried only on success — a
+				// `rejected` enqueue wrote no file to name.
+				return r.success ? { outcome: "fallback-sent", messagePath: r.messagePath } : { outcome: "rejected" };
 			} catch (err) {
 				return { outcome: "failed", error: err };
 			}