@junghanacs/entwurf 0.17.1 → 0.18.0

package/pi-extensions/lib/entwurf-v2-surface.ts

@@ -19,6 +19,7 @@
  *     surface never needs to name the `EntwurfV2RunResult` union (it only sees `{text,isError}`).
  */
 
+import { basename } from "node:path";
 import type { SenderEnvelope } from "./entwurf-control-rpc.ts";
 import type { DispatchInput, EntwurfV2Mode } from "./entwurf-v2-decider.ts";
 import { makeProductionEntwurfV2Deps, type ProductionEntwurfV2Opts } from "./entwurf-v2-production.ts";
@@ -137,6 +138,12 @@ export function renderEntwurfV2Result(result: EntwurfV2RunResult): EntwurfV2Surf
 					`\n  ${c.detail}` +
 					(c.holder ? `\n  holder: pid ${c.holder.pid} on ${c.holder.hostname} since ${c.holder.createdAt}` : "");
 			}
+			// #101 갭 C: name WHICH receiver axis failed. "mailbox-undeliverable" alone sent a
+			// caller looking for a dead session when the session was alive and had simply
+			// switched to another garden — the predicate knew that and the surface threw it away.
+			if (result.diagnostic?.kind === "mailbox-undeliverable") {
+				text += `\n  mailbox-undeliverable: ${result.diagnostic.reason}`;
+			}
 			return { text, isError: true };
 		}
 		case "executed": {
@@ -144,8 +151,13 @@ export function renderEntwurfV2Result(result: EntwurfV2RunResult): EntwurfV2Surf
 			if (o.transport === "control-socket") {
 				const delivered = o.outcome === "sent" || o.outcome === "fallback-sent";
 				const reason = o.rejectReason ? ` (reason: ${o.rejectReason})` : "";
+				// #98 R, fallback leg: a dead socket that re-resolved to the mailbox wrote a
+				// `.msg` — name it, exactly as the primary mailbox rail does. Absent on a
+				// socket-to-socket retry (no file) and on every non-mailbox outcome, so the
+				// line degrades to the bare outcome rather than printing "undefined".
+				const enqueued = o.messagePath ? ` (enqueued ${basename(o.messagePath)})` : "";
 				return {
-					text: `entwurf_v2 control-socket → ${o.outcome}${reason}`,
+					text: `entwurf_v2 control-socket → ${o.outcome}${reason}${enqueued}`,
 					isError: !delivered,
 				};
 			}
@@ -156,8 +168,17 @@ export function renderEntwurfV2Result(result: EntwurfV2RunResult): EntwurfV2Surf
 					isError: false,
 				};
 			}
-			// meta-mailbox
-			return { text: "entwurf_v2 meta-mailbox → enqueued", isError: false };
+			// meta-mailbox. #98 R: name the FILE that was enqueued, so the sender's transcript
+			// carries a per-message identifier instead of a bare literal. Only the basename —
+			// the directory is `<meta-mailbox>/<target garden id>/`, which the caller already
+			// typed. Deliberately NOT a read stamp: at enqueue time `lastReadAt` belongs to the
+			// PREVIOUS message, so printing it would claim a read that has not happened.
+			// A dep that omits the receipt falls back to the old literal rather than printing
+			// "undefined" — the delivery still happened.
+			return {
+				text: `entwurf_v2 meta-mailbox → enqueued${o.messagePath ? ` (${basename(o.messagePath)})` : ""}`,
+				isError: false,
+			};
 		}
 		case "execution-failed": {
 			if (result.releaseFailed && result.finalizedOutcome) {

package/pi-extensions/lib/meta-session.ts

@@ -2017,6 +2017,50 @@ export function readMetaReceiverMarker(opts: ReadMetaReceiverMarkerOptions): Met
 	}
 }
 
+export interface RemoveMetaReceiverMarkerOptions {
+	gardenId: string;
+	/** Only remove a marker this pid owns — a retirement must never reach another process's watch. */
+	ownerPid: number;
+	receiversDir?: string;
+}
+
+/**
+ * Retire a receiver presence marker THIS owner pid wrote (#101 결함 A).
+ *
+ * A native process that switches sessions in place — an in-session `/resume` or `/clear`
+ * fires a second SessionStart inside the same pid under a new native session id — leaves
+ * the previous garden's marker behind, naming a live owner whose watch is gone. Measured
+ * on oracle 2026-09-04: one pid (143742) held two gardens' markers four seconds apart, and
+ * mail sent to the retired one sat unread.
+ *
+ * ONLY THE MARKER. The meta-record stays: records are identity, and deleting one
+ * outside `meta-bridge-fresh-cut` would fight store certification (Hard Rule 7/8).
+ * A retired citizen keeps its record, its transcript and its listing — it loses only
+ * the claim that a doorbell is armed for it, which is exactly the claim that stopped
+ * being true.
+ *
+ * Fail-closed the other way too: the marker is read back first and removed ONLY when its
+ * `ownerPid` field equals the one passed here — pid equality, which is what a caller can
+ * actually check; it does not prove the same PROCESS wrote it (a reused pid compares equal),
+ * and the reader-side start-key guard is where that finer distinction lives. It is enough for
+ * the rule this serves: a hook never retires a watch some other pid is holding. Returns whether a marker was actually removed. Never throws — a retirement
+ * that cannot happen is a log line, not a broken session start.
+ */
+export function removeMetaReceiverMarker(opts: RemoveMetaReceiverMarkerOptions): boolean {
+	try {
+		const receiversDir = opts.receiversDir ?? defaultMetaReceiversDir();
+		const file = metaReceiverMarkerPath(opts.gardenId, receiversDir);
+		// verifyOwner:false — the point is the OWNERSHIP field, not the owner's liveness;
+		// a marker whose owner already died is still this pid's to clean up when it names it.
+		const marker = readMetaReceiverMarker({ markerPath: file, verifyOwner: false });
+		if (!marker || marker.ownerPid !== opts.ownerPid) return false;
+		fs.unlinkSync(file);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
 export interface UpsertMetaSessionOptions {
 	input: MetaIdentityMintInput;
 	/** Override the store directory (defaults to {@link defaultMetaSessionsDir}). */
@@ -2532,9 +2576,17 @@ export interface ReadMetaInboxResult {
  * Drain a garden citizen's mailbox: read every unread message (a fresh `.msg`
  * read before its doorbell, or a doorbell-rung `.msg.delivered`), archive each to
  * `*.read` so a re-read never double-returns, and — only if at least one message
- * was read — stamp `lastReadAt` (NOT `lastDeliveredAt`: the doorbell owns
- * delivery-time, see the stamp-site note below). An empty inbox mutates nothing:
- * reading nothing is not a receipt.
+ * was read — stamp `lastReadAt`. `lastDeliveredAt` stays untouched (see the
+ * stamp-site note below). An empty inbox mutates nothing: reading nothing is not
+ * a receipt.
+ *
+ * WHERE THE PER-MESSAGE TRUTH LIVES (#98 5a, corrected 2026-09-03). The FILE SUFFIX
+ * is the per-message receipt: `.msg` = enqueued, `.msg.delivered` = the doorbell
+ * rang for it, `.msg.delivered.read` = this function handed it to the reader.
+ * `state.json` is NOT that — its three slots are GARDEN-WIDE and overwritten, so
+ * `lastReadAt` says "this citizen last read something at T", never "message X was
+ * read". A sender that quotes `lastReadAt` back as the fate of the letter it just
+ * queued is quoting the PREVIOUS letter's read. That misreading is what opened #98.
  */
 export function readMetaInbox(opts: ReadMetaInboxOptions): ReadMetaInboxResult {
 	const now = opts.now ?? new Date();
@@ -2560,10 +2612,18 @@ export function readMetaInbox(opts: ReadMetaInboxOptions): ReadMetaInboxResult {
 		return { gardenId: citizen.gardenId, messages, readAt: null, recordPath: recordFile };
 	}
 
-	// 3D-4 the cut: the read receipt lives SOLELY in the mailbox state store now.
-	// Stamp lastReadAt — the one receipt this layer stamps honestly (it KNOWS the body
-	// reached the reader). lastDeliveredAt is the doorbell's to own; stamping it here
-	// would report read-time as delivery-time, so it is left as the doorbell left it.
+	// 3D-4 the cut: the garden-wide read receipt lives SOLELY in the mailbox state store
+	// now. Stamp lastReadAt — the one slot this layer stamps honestly (it KNOWS a body
+	// reached the reader at this instant). lastDeliveredAt is left alone, and #98 5a
+	// corrects WHY: the old comment said "the doorbell owns it", but the shipped
+	// doorbell.sh (54 lines) writes NOTHING to state.json — measured, zero state writes.
+	// So `lastDeliveredAt` is a RESERVED SLOT nobody stamps, permanently null on all
+	// ~180 on-disk states, while 900+ files carry a `.delivered` suffix. Stamping it
+	// here would still be wrong (it would report read-time as delivery-time), so it
+	// stays null — but do not read "the doorbell will fill it in" into that. The
+	// per-message delivery fact is the `.delivered` SUFFIX. The field is left in place
+	// deliberately: removing it is a migration (the parser rejects unknown keys AND a
+	// bumped schemaVersion, and every stamp re-parses first), tracked as #98 5b.
 	// The state stamp returns the updated state, whose lastReadAt IS the D7 read-receipt.
 	// Inside the messages.length>0 branch by construction — an empty inbox already
 	// early-returned (no .read archive, state untouched), so "read nothing" is no
@@ -2603,6 +2663,15 @@ export const MAILBOX_RECEIPT_SCHEMA_VERSION = 1 as const;
  * The per-citizen mailbox receipt state. Holds exactly the three delivery
  * timestamps that move out of `record.delivery` (wakeMode/deliveryLevel are
  * capability, deliberately absent). Body is SSOT; the on-disk path is derived.
+ *
+ * SCOPE (#98 5a): these are GARDEN-WIDE "last activity" slots, single-valued and
+ * overwritten — NOT per-message receipts. Per message, the receipt is the file
+ * suffix in the same directory (`.msg` → `.msg.delivered` → `.msg.delivered.read`).
+ * `lastEnqueuedAt`/`lastReadAt` are stamped by `enqueueMetaMessage`/`readMetaInbox`.
+ * `lastDeliveredAt` is stamped by NOBODY: the doorbell does not write state.json, so
+ * it is a reserved slot that is null everywhere. Kept rather than removed because the
+ * parser is doubly strict (exact schemaVersion + no unknown keys) and every stamp
+ * re-parses, so dropping it is a migration over the existing on-disk v1 files (#98 5b).
  */
 export interface MailboxReceiptState {
 	schemaVersion: typeof MAILBOX_RECEIPT_SCHEMA_VERSION;

package/pi-extensions/meta-bridge-hook.ts

@@ -28,6 +28,20 @@
  * a UserPromptSubmit fire does a degraded RECORD backfill (upsert) but cannot
  * re-arm the idle watch — the record's address is restored, the wake is not.
  *
+ * SESSION SWITCH (#101). One Claude process serves one session at a time, but it can
+ * change which. Measured on oracle 2026-09-04 (raw lab S1-S6, Claude Code 2.1.260): a bare
+ * `claude` mints a NEW session (`source=startup`), and an in-session `/resume` or `/clear`
+ * then fires a SECOND SessionStart under the SAME pid for a DIFFERENT native id
+ * (`source=resume` / `source=clear`). The first garden is left behind — in the #101 field
+ * case its transcript was never written at all — while its receiver marker still names a
+ * LIVE owner, so a sender reads an armed doorbell nobody holds. This hook therefore reads
+ * the sender marker BEFORE overwriting it and retires the previous garden's receiver marker
+ * (marker only — records are identity and are never deleted here; and only a marker this
+ * pid owns). Compaction (`source=compact`) re-fires SessionStart for the SAME native id, so
+ * the same rule retires nothing there — measured, not assumed. The envelope's `source` is
+ * logged beside all of it and decides nothing: the switch is settled by what is on disk,
+ * which holds on every host and vendor version.
+ *
  * LAUNCH: never invoked directly by Claude. `hooks.json` declares the EXEC form
  * (`command` = `<plugin-root>/scripts/hook-launch.sh`, `args` = [node, this file]),
  * and the launcher `exec`s that argv — so this process inherits the launcher's pid
@@ -51,6 +65,8 @@ import {
 	defaultMetaSessionsDir,
 	isPlausibleOwnerPid,
 	type MetaReceiverArmProvenance,
+	readMetaSenderMarker,
+	removeMetaReceiverMarker,
 	upsertMetaSession,
 	writeMetaReceiverMarker,
 	writeMetaSenderMarker,
@@ -191,6 +207,13 @@ function main(): void {
 				? env.model_id
 				: undefined;
 	const eventName = typeof env.hook_event_name === "string" ? env.hook_event_name : "SessionStart";
+	// `source` (startup | resume | clear | compact) is Claude's own word for WHY this
+	// SessionStart fired. It is logged on every line below and decides nothing: a session
+	// switch is settled by what is on disk (the sender marker's garden), which is true on
+	// every host and every vendor version. Logging it is how this host finally gets a
+	// receipt for the envelope order the #101 diagnosis could only read from vendor docs —
+	// and the raw lab (scripts/raw-claude-session-switch) reads these lines, not a guess.
+	const source = typeof env.source === "string" && env.source.length > 0 ? env.source : "(unset)";
 
 	if (!sessionId || !transcriptPath) {
 		// A degraded envelope: cannot mint an honest reference record. Log + no-op
@@ -213,7 +236,10 @@ function main(): void {
 			input: { backend: "claude-code", nativeSessionId: sessionId, transcriptPath, cwd, model },
 		});
 		gardenId = result.record.gardenId;
-		logLine("INFO", `${result.action} record ${path.basename(result.path)} (event=${eventName}, native=${sessionId})`);
+		logLine(
+			"INFO",
+			`${result.action} record ${path.basename(result.path)} (event=${eventName}, source=${source}, native=${sessionId})`,
+		);
 	} catch (err) {
 		// Best-effort: a broken record store must surface via the doctor, not by
 		// breaking the user's session open. Log and continue with no arm. This is
@@ -241,9 +267,52 @@ function main(): void {
 	// an env var. Missing launcher provenance or an implausible parent yields no marker.
 	const ownerPid = resolveMetaHookOwnerPid();
 	if (ownerPid !== null) {
+		// SESSION SWITCH RETIREMENT (#101 결함 A). One Claude process serves ONE session at a
+		// time, but it can switch which: an in-session `/resume` or `/clear` fires a second
+		// SessionStart under the same pid for a different native id, leaving the session the
+		// process started with behind (measured on oracle, meta-bridge-hook.log 2026-09-04
+		// 13:13:04 `source=startup` → 13:13:37 `source=resume`; the field case at 09:31:35 →
+		// 09:31:39 is the same shape). Whatever it was serving before is no longer being
+		// drained, so the marker advertising its doorbell has to go.
+		//
+		// The evidence is the sender marker as it stands RIGHT NOW — pid → the garden this
+		// process serves — which is why this reads it BEFORE the write below overwrites it with
+		// the new garden. No vendor field is consulted: `source` is logged, not branched on, so
+		// a host or version that words it differently changes nothing here. A same-garden
+		// re-registration (every UserPromptSubmit, a CwdChanged, a re-fired SessionStart) finds
+		// an equal garden id and retires NOTHING — the marker it would remove is the live one.
+		//
+		// Only the marker, never the record (see removeMetaReceiverMarker), and only a marker
+		// this pid owns.
+		//
+		// AND ONLY ON AN EVENT THAT CAN ARM THE REPLACEMENT (cross-review, 2026-09-04). This
+		// block sits before the UserPromptSubmit early-return, and UPS cannot emit watchPaths —
+		// so a retirement reached from there would take a doorbell down with nothing in the same
+		// run able to put one back. A watch is retired only by a run that arms one; that is the
+		// whole rule. `armProvenanceFor` is the same predicate the arm block below uses, so the
+		// two can never disagree about which events those are.
+		//
+		// It is NOT a defence against a keystroke from a session this pid has left: measured on
+		// oracle 2026-09-04 (raw lab S1-S6, meta-bridge-hook.log), every UserPromptSubmit named
+		// the native id its own pid's preceding SessionStart had established — 8 of 8, none
+		// otherwise. The hook runs synchronously inside the session's own process, so a UPS
+		// envelope is that session speaking, and the sender pointer it moves is authoritative.
+		const previous =
+			armProvenanceFor(eventName) !== null
+				? readMetaSenderMarker({ backend: "claude-code", ownerPid, verifyOwner: false })
+				: null;
+		if (previous && previous.gardenId !== gardenId) {
+			const retired = removeMetaReceiverMarker({ gardenId: previous.gardenId, ownerPid });
+			logLine(
+				"INFO",
+				retired
+					? `retired receiver marker ${previous.gardenId} — owner pid ${ownerPid} switched to ${gardenId} (event=${eventName}, source=${source})`
+					: `no receiver marker to retire for ${previous.gardenId} — owner pid ${ownerPid} switched to ${gardenId} (event=${eventName}, source=${source})`,
+			);
+		}
 		try {
 			writeMetaSenderMarker({ backend: "claude-code", gardenId, nativeSessionId: sessionId, cwd, ownerPid });
-			logLine("INFO", `sender marker ${ownerPid} -> ${gardenId} (event=${eventName})`);
+			logLine("INFO", `sender marker ${ownerPid} -> ${gardenId} (event=${eventName}, source=${source})`);
 		} catch (err) {
 			logLine(
 				"WARN",
@@ -294,7 +363,7 @@ function main(): void {
 					ownerPid,
 					armProvenance,
 				});
-				logLine("INFO", `receiver marker ${gardenId} owner=${ownerPid} arm=${eventName}`);
+				logLine("INFO", `receiver marker ${gardenId} owner=${ownerPid} arm=${eventName} source=${source}`);
 			} catch (err) {
 				logLine(
 					"WARN",

package/run.sh

@@ -144,6 +144,7 @@ Usage:
   ./run.sh check-meta-mailbox-state-write # deterministic gate (0.11 Stage 0 step 3D-4 commit2): post-cut receipt is state-only — meta-record file byte-identical across enqueue/read, state carries lastEnqueuedAt/lastReadAt (field isolation), empty inbox no-op on record+state, drift surfaces; no API
   ./run.sh check-meta-receiver-marker # deterministic gate (SE-2): receiver marker round-trip/start-key/provenance, UserPromptSubmit cannot mint presence, reader does not gate on record existence — marker SEMANTICS only; launch topology moved to check-hook-launch-topology
   ./run.sh check-hook-launch-topology # #51 gate 1: shipped hooks.json is exec form through hook-launch.sh, launcher is loud on an empty argv (older Claude's silent args drop), exec preserves the pid so the hook's parent is Claude, and a space/$/backtick plugin path survives as one argv element
+  ./run.sh check-meta-hook-session-switch # #101 gate: ONE Claude pid, TWO SessionStarts (resume picker placeholder -> resumed id). The hook retires the marker of the garden it stopped serving (records untouched, same-garden re-registration retires nothing), the reader stays fail-closed on a re-planted stale marker (watchArmed measured against the owner's sender marker, never copied), production dispatch refuses the retired garden and NAMES the failing axis, and exactly one of the two gardens is deliverable. Sandboxed roots, no API
   ./run.sh check-meta-identity-consumers # deterministic gate: V3-only consumer seam — per-entry targeted read + addressable read snapshot uniqueness, non-regular rivals never read, drift/unparseable rivals unreachable, unreadable regular rivals fail loud; strict upsert refuses an unreadable store before any write, no API
   ./run.sh check-meta-capability-source # deterministic gate (0.11 Stage 0 step 3D-3): capability-source cut-over — mint/parse read wakeMode/deliveryLevel from the registry (metaCapabilityFor, registry-driven via injection), not META_BACKEND_DESCRIPTORS; behaviour-preserving (registry ≡ const); the record.delivery slot 3D-3 preserved was deleted by 3D-4, no API
   ./run.sh check-socket-probe          # deterministic gate (0.11 Stage 0, F3): three-valued control-socket liveness (alive|dead|indeterminate) — GC reclaims dead only, indeterminate survives; pure classify + 2-socket integration, no API
@@ -894,6 +895,23 @@ check_meta_receiver_marker() {
   run_ts scripts/check-meta-receiver-marker.ts
 }
 
+check_meta_hook_session_switch() {
+  # #101 gate: a Claude Code SESSION SWITCH — one native process that stops serving one
+  # garden and starts serving another. The resume picker (and `/clear`) fire SessionStart
+  # twice inside one pid: once for the TUI's placeholder id, once for the id the operator
+  # picked. Before this gate nothing asked "one owner pid, two gardens", so a placeholder
+  # citizen stayed registered with an armed-looking doorbell and real mail rotted in it.
+  # Plays Claude the way check-hook-launch-topology does (spawn the SHIPPED launcher with
+  # the manifest's argv, so the hook's parent is this process = one fake owner pid) with
+  # every meta root sandboxed. Asserts: both records survive (marker retired, never the
+  # record); the retired garden's marker is gone; a same-garden re-registration retires
+  # NOTHING; a re-planted stale marker is still undeliverable (the sender-marker join,
+  # fail-closed at the reader); production dispatch refuses it and carries the predicate's
+  # reason to the rendered surface; exactly one garden is deliverable and it is the served
+  # one. Real tmpdir, no API.
+  run_ts scripts/check-meta-hook-session-switch.ts
+}
+
 check_copilot_birth_hook() {
   # #82 gate: the Copilot BIRTH path, proven without Copilot. Drives the REAL
   # assembler (--assemble-only, into a temp dir), then fires the baked launcher the
@@ -5700,6 +5718,9 @@ case "$cmd" in
   check-meta-receiver-marker)
     check_meta_receiver_marker
     ;;
+  check-meta-hook-session-switch)
+    check_meta_hook_session_switch
+    ;;
   check-meta-identity-consumers)
     check_meta_identity_consumers
     ;;

package/scripts/check-bridge-delivery.ts

@@ -181,16 +181,40 @@ writeMetaReceiverMarker({
 
 // RECEIVER — a different armed self-fetch citizen. A dead/unarmed target must remain
 // mailbox-undeliverable, so this marker isolates artifact delivery from target liveness.
+//
+// It is owned by a DIFFERENT live pid than the sender, and that is not decoration (#101):
+// a claude-code watch owner serves exactly one garden at a time, and deliverability now
+// requires that owner's sender marker to still name the garden being addressed. Two
+// citizens armed under ONE pid is a state the real world does not produce — it is what a
+// session switch leaves behind — so a fixture that modelled it would be asking the
+// artifact to deliver into a retired watch.
+//
+// The stand-in second native CLI is a spawned idle process, NOT this gate's parent: the
+// subject bridge resolves its own sender identity through its ancestry, and an ancestor
+// holding a second garden's marker is the "ambiguous sender identity" refusal the bridge
+// already ships. A live pid outside that ancestry is what a real second CLI looks like.
+// It exits on its own timer, and is killed in the outer finally.
+const receiverOwner = spawn(process.execPath, ["-e", "setTimeout(() => {}, 300000)"], { stdio: "ignore" });
+const receiverOwnerPid = receiverOwner.pid;
+if (typeof receiverOwnerPid !== "number") throw new Error("could not spawn the stand-in receiver owner process");
 const receiver = upsertMetaSession({
 	input: { backend: "claude-code", nativeSessionId: `bridge-delivery-receiver-${process.pid}`, cwd: tmp },
 	dir: sessionsDir,
 });
 const gid = receiver.record.gardenId;
+writeMetaSenderMarker({
+	backend: "claude-code",
+	gardenId: gid,
+	nativeSessionId: receiver.record.nativeSessionId,
+	cwd: tmp,
+	ownerPid: receiverOwnerPid,
+	sendersDir,
+});
 writeMetaReceiverMarker({
 	gardenId: gid,
 	backend: "claude-code",
 	nativeSessionId: receiver.record.nativeSessionId,
-	ownerPid: process.pid,
+	ownerPid: receiverOwnerPid,
 	armProvenance: "session-start",
 	receiversDir,
 });
@@ -471,6 +495,20 @@ try {
 	await fsp.writeFile(receiverRecordFile, receiverRecordV3Bytes);
 	const anonSendersDir = path.join(tmp, "meta-senders-anon");
 	await fsp.mkdir(anonSendersDir, { recursive: true });
+	// The TARGET's owner marker still belongs in this dir (#101). Anonymity is about the
+	// CALLER — no marker under the bridge child's own owner pid — while deliverability asks
+	// a different question of a different pid: is the target's watch owner still serving the
+	// target's garden? Leaving it out would make every cell below fail as
+	// mailbox-undeliverable and prove nothing about the anonymous hatch. In production no
+	// one swaps this dir; the split exists only because this fixture does.
+	writeMetaSenderMarker({
+		backend: "claude-code",
+		gardenId: gid,
+		nativeSessionId: receiver.record.nativeSessionId,
+		cwd: tmp,
+		ownerPid: receiverOwnerPid,
+		sendersDir: anonSendersDir,
+	});
 	const oneShotV2 = async (
 		cellEnv: NodeJS.ProcessEnv,
 		message: string,
@@ -582,6 +620,9 @@ try {
 	try {
 		child?.kill("SIGTERM");
 	} catch {}
+	try {
+		receiverOwner.kill("SIGTERM");
+	} catch {}
 	await fsp.rm(tmp, { recursive: true, force: true });
 }
 

package/scripts/check-entwurf-fact-provider.ts

@@ -19,7 +19,12 @@
  *     socket-dir-read-error diagnostic (P2e②),
  *   - diagnostics are kind-tagged and sorted.
  *
- * No IO — meta entries/reader and socket dir/readdir/probe are injected fakes.
+ * No IO — meta entries/reader and socket dir/readdir/probe are injected fakes, and so is
+ * the #101 `observe` seam. That seam is the one dep whose PRODUCTION default is real IO
+ * (one default is safer than two wiring sites each passing their own observer), so a gate
+ * that left it out would quietly stat the operator's real garden roots for fabricated
+ * garden ids. It is injected here for that reason, and the cell below proves the injected
+ * observation actually reaches the fact rather than being dropped on the way.
  */
 
 import assert from "node:assert/strict";
@@ -74,6 +79,11 @@ function deps(
 ): EntwurfFactsDeps {
 	const symlinkSet = new Set(opts.symlinks ?? []);
 	return {
+		// Injected observation (see the header): a per-identity fake, never the real IO.
+		observe: (identity) => ({
+			receiver: identity.backend === "claude-code" ? "inactive" : "n/a",
+			transcript: identity.gardenId === GID_CLAUDE ? "absent" : "exists",
+		}),
 		// Kind-carrying entries, like the real bindings: the listing must be able to refuse a
 		// symlinked record without following it. `irregularMeta` names the ones that are not
 		// regular files.
@@ -144,6 +154,17 @@ async function main(): Promise<void> {
 			);
 			ok("basic: record-less-socket diagnostic keyset exact", true);
 		}
+		// #101: the injected observation rides onto each peer. A provider that dropped the
+		// seam would return `unobserved` rows — visible, but useless to the caller the
+		// columns exist for.
+		{
+			const claude = r.facts.peers.find((p) => p.gardenId === GID_CLAUDE);
+			const pi = r.facts.peers.find((p) => p.gardenId === GID_PI);
+			ok(
+				"basic: the injected observation reaches every peer fact",
+				claude?.receiver === "inactive" && claude?.transcript === "absent" && pi?.receiver === "n/a",
+			);
+		}
 		// A DEAD record-less socket groups under a different (stale) message — no fresh-cut
 		// pointer for a leftover file, so same-state sockets aggregate per liveness.
 		const r2 = await listEntwurfFacts(deps({}, { [GID_SOCKET_ONLY]: "dead" }));

package/scripts/check-entwurf-facts.ts

@@ -138,7 +138,8 @@ for (const backend of META_CITIZEN_BACKENDS) {
 	ok("passthrough recordUpdatedAt", fact.recordUpdatedAt === id.recordUpdatedAt);
 }
 
-// ── facts-only keyset: identity facts + liveness, NO verb-routing/transcript ─
+// ── facts-only keyset: identity facts + liveness + the two observed axes, and
+// still NO verb-routing / no transcript PATH ────────────────────────────────
 {
 	const fact = resolvePeerFact(identity("pi"), "alive");
 	const keys = Object.keys(fact).sort();
@@ -151,9 +152,23 @@ for (const backend of META_CITIZEN_BACKENDS) {
 		"model",
 		"nativeSessionId",
 		"recordUpdatedAt",
+		"receiver",
+		"transcript",
 	].sort();
 	assert.deepStrictEqual(keys, expected, `PeerFact keyset drift: got ${keys.join(",")}`);
-	ok("facts-only keyset exact (identity facts + liveness)", true);
+	ok("facts-only keyset exact (identity facts + liveness + observed receiver/transcript)", true);
+
+	// #101: an unmeasured row says so. `unobserved` is the default for a caller that
+	// injected no observer — never `none`/`absent`, which would be a fabricated fact.
+	ok(
+		"an observer-less composition reports both axes as unobserved (never a default fact)",
+		fact.receiver === "unobserved" && fact.transcript === "unobserved",
+	);
+	const observed = resolvePeerFact(identity("claude-code"), null, { receiver: "inactive", transcript: "absent" });
+	ok(
+		"an injected observation rides onto the fact verbatim",
+		observed.receiver === "inactive" && observed.transcript === "absent",
+	);
 
 	const FORBIDDEN = [
 		"resumable",

package/scripts/check-entwurf-peers-surface.ts

@@ -47,7 +47,12 @@ const FORBIDDEN = ["sendable", "resumable", "dispatch", "action", "transport", "
 // #50 C4: socket-shaped identity must not reappear on this surface.
 const FORBIDDEN_C4_KEYS = ["sessions", "socketOnly", "controlDir", "socketPath", "count"];
 
-function peer(gardenId: string, backend: MetaCitizenBackend, liveness: FactLiveness): PeerFact {
+function peer(
+	gardenId: string,
+	backend: MetaCitizenBackend,
+	liveness: FactLiveness,
+	observed: Partial<Pick<PeerFact, "receiver" | "transcript">> = {},
+): PeerFact {
 	return {
 		gardenId,
 		backend,
@@ -57,6 +62,8 @@ function peer(gardenId: string, backend: MetaCitizenBackend, liveness: FactLiven
 		createdAt: "2026-06-11T00:00:00.000Z",
 		recordUpdatedAt: "2026-06-11T00:00:00.000Z",
 		liveness,
+		receiver: observed.receiver ?? "n/a",
+		transcript: observed.transcript ?? "exists",
 	};
 }
 
@@ -91,7 +98,7 @@ function main(): void {
 				peer(GID_PI_ALIVE, "pi", "alive"),
 				peer(GID_PI_DEAD, "pi", "dead"),
 				peer(GID_PI_INDET, "pi", "indeterminate"),
-				peer(GID_CLAUDE, "claude-code", "unsupported"),
+				peer(GID_CLAUDE, "claude-code", "unsupported", { receiver: "inactive", transcript: "absent" }),
 			],
 			// The provider has already folded these into diagnostics; the render layer
 			// never re-renders them as a section (facts carry them for the union math).
@@ -116,6 +123,17 @@ function main(): void {
 		ok("C4: payload is exactly { peers, diagnostics }", true);
 	}
 	ok("peers carry all 4 citizens (unsupported NOT dropped)", payload.peers.length === 4);
+	// #101: the two observed axes are the only thing separating two same-cwd claude rows,
+	// since `liveness` reads `unsupported` for every one of them. They are FACTS on the
+	// row — the forbidden-word scans below still apply to them unchanged.
+	ok(
+		"observed receiver + transcript ride the row in text",
+		new RegExp(`${GID_CLAUDE}.*receiver=inactive.*transcript=absent`).test(text),
+	);
+	ok(
+		"observed axes ride the JSON payload too",
+		payload.peers.some((p) => p.gardenId === GID_CLAUDE && p.receiver === "inactive" && p.transcript === "absent"),
+	);
 	ok(
 		"unsupported citizen present in peers",
 		payload.peers.some((p) => p.gardenId === GID_CLAUDE && p.liveness === "unsupported"),

package/scripts/check-entwurf-self-address.ts

@@ -469,8 +469,26 @@ const metaBody = functionBody("buildTrustedMetaSenderEnvelope");
 ok("buildTrustedMetaSenderEnvelope calls computeSelfAddressability", /computeSelfAddressability\s*\(/.test(metaBody));
 ok("buildTrustedMetaSenderEnvelope no longer hardcodes `replyable: true`", !/replyable:\s*true/.test(metaBody));
 ok(
-	"buildTrustedMetaSenderEnvelope derives active-receiver from the receiver marker (identity-matched)",
-	/readMetaReceiverMarker\s*\(/.test(metaBody) && /receiverMarkerMatchesIdentity\s*\(/.test(metaBody),
+	// #101: the identity match alone is no longer the whole answer. `entwurf_self` composes
+	// the SAME `resolveMailboxReceiverFacts` the v2 dispatch seam uses — reading the receiver
+	// marker AND, where the watch owner is the sender-marker process, the join that says that
+	// owner is still serving this garden. A citizen's self-reported replyability and what
+	// dispatch decides about it come from one measurement, so they cannot disagree.
+	"buildTrustedMetaSenderEnvelope derives active-receiver from the SHARED receiver composition (both markers)",
+	/resolveMailboxReceiverFacts\s*\(/.test(metaBody) &&
+		/readMetaReceiverMarker\s*\(/.test(metaBody) &&
+		/readMetaSenderMarker\s*\(/.test(metaBody),
+);
+ok(
+	"buildTrustedMetaSenderEnvelope no longer copies one match into both receiver facts",
+	!/ownerAlive:\s*active/.test(metaBody) && !/watchArmed:\s*active/.test(metaBody),
+);
+ok(
+	// #101 (cross-review): both markers are read with their liveness guards ON. A reader that
+	// opted out would accept a dead session's leftover file as "which garden this pid serves
+	// now", and every fixture pid in a gate is live, so nothing dynamic here could tell.
+	"buildTrustedMetaSenderEnvelope reads neither marker with the owner guard disabled",
+	!/verifyOwner:\s*false/.test(metaBody),
 );
 ok(
 	"buildTrustedMetaSenderEnvelope keeps meta identity + derived replyable (inactive → not null)",

package/scripts/check-entwurf-v2-decider.ts

@@ -207,11 +207,13 @@ async function main(): Promise<void> {
 		ok("target-locked: diagnostic carried", d.kind === "reject" && d.diagnostic?.kind === "target-locked");
 		ok(
 			"target-locked: diagnostic holder pid preserved",
-			d.kind === "reject" && d.diagnostic?.conflict.holder?.pid === 4242,
+			d.kind === "reject" && d.diagnostic?.kind === "target-locked" && d.diagnostic.conflict.holder?.pid === 4242,
 		);
 		ok(
 			"target-locked: diagnostic lockPath preserved",
-			d.kind === "reject" && d.diagnostic?.conflict.lockPath === `/fake/locks/${GID}.lock`,
+			d.kind === "reject" &&
+				d.diagnostic?.kind === "target-locked" &&
+				d.diagnostic.conflict.lockPath === `/fake/locks/${GID}.lock`,
 		);
 	}
 
@@ -253,7 +255,8 @@ async function main(): Promise<void> {
 		ok(
 			"target-locked(corrupt): diagnostic detail preserved",
 			d.kind === "reject" &&
-				d.diagnostic?.conflict.detail === "lockfile is empty, corrupt, or holds a different garden id",
+				d.diagnostic?.kind === "target-locked" &&
+				d.diagnostic.conflict.detail === "lockfile is empty, corrupt, or holds a different garden id",
 		);
 	}
 

package/scripts/check-entwurf-v2-mailbox.ts

@@ -158,6 +158,32 @@ function recordingEnqueue(): {
 	ok("6: successful enqueue → {success:true}", res.success === true && res.error === undefined);
 }
 
+// ── 6b. #98 R: the enqueue result's messagePath is the SEND receipt ──────────
+// Reported VERBATIM from the enqueue result, never re-derived from the plan — a
+// re-derived path could disagree with the file that was actually written.
+{
+	const enq = recordingEnqueue();
+	const res = executeMetaMailboxSend(mailboxPlan(), SENDER, { enqueue: enq.fn });
+	ok("6b: result carries the enqueue's messagePath verbatim", res.messagePath === `/fake/mailbox/${GID}/m.msg`);
+}
+{
+	// The path is taken from the RESULT, not from `plan.mailboxDir` + gardenId: an enqueue
+	// that lands somewhere else (env override, tilde expansion, a resolved symlink) must be
+	// reported where it actually landed.
+	const res = executeMetaMailboxSend(mailboxPlan(), SENDER, {
+		enqueue: (opts) => ({
+			gardenId: opts.gardenId,
+			recordPath: "/elsewhere/rec.json",
+			messagePath: "/elsewhere/queued-here.msg",
+			signalPath: "/elsewhere/inbox.signal",
+		}),
+	});
+	ok(
+		"6b: a messagePath outside the plan's mailboxDir is still reported as-is",
+		res.messagePath === "/elsewhere/queued-here.msg",
+	);
+}
+
 // ── 7. production adapter: ignores lock entirely (poison LockClaim) ───────────
 {
 	const enq = recordingEnqueue();
@@ -223,6 +249,13 @@ function recordingEnqueue(): {
 	for (const forbidden of ["releaseLock", "inspectSocket", "probeSocket", "resolveDispatch", "resolveTarget"]) {
 		ok(`9: lib code has no '${forbidden}' (no release / no routing seam)`, !code.includes(forbidden));
 	}
+	// #98 R, the negative half stated as an assertion: a SEND receipt may never carry a
+	// read/delivery stamp. At enqueue time `lastReadAt` holds the PREVIOUS message's read,
+	// so carrying it here would let a sender read "my message was read" off a stamp that
+	// says nothing of the kind. The per-message read receipt is the `.read` suffix.
+	for (const forbidden of ["lastReadAt", "lastDeliveredAt", "readAt"]) {
+		ok(`9: lib code never carries '${forbidden}' into the send receipt`, !code.includes(forbidden));
+	}
 }
 
 console.log(`\ncheck-entwurf-v2-mailbox: ${passed} checks passed`);