@junghanacs/entwurf 0.17.1 → 0.18.0

package/scripts/check-entwurf-v2-matrix.ts

@@ -42,6 +42,7 @@ import {
 	type DispatchDecision,
 	decideDispatch,
 	type ExecutionPlan,
+	type RejectDiagnostic,
 	type TargetResolution,
 } from "../pi-extensions/lib/entwurf-v2-decider.ts";
 import type { AcquireLockResult, LockClaim } from "../pi-extensions/lib/entwurf-v2-lock.ts";
@@ -156,7 +157,10 @@ type LockClass = "none" | "held" | "mailbox-null" | "released" | "acquire-fail";
 
 type Expect =
 	| { decision: "execute"; transport: EntwurfV2Transport; lock: LockClass }
-	| { decision: "reject"; reason: string; lock: LockClass; diagnostic?: boolean };
+	// `diagnostic` names the KIND a reject must carry, not a boolean: two reject cells now
+	// carry machine-readable evidence, and the axis has to say which — a reject that carried
+	// the wrong diagnostic would pass a yes/no cell (#101 갭 C).
+	| { decision: "reject"; reason: string; lock: LockClass; diagnostic?: RejectDiagnostic["kind"] };
 
 /**
  * Which IO seams the decider is ALLOWED to touch — the "어느 축을 만지면 안 되는지"
@@ -211,7 +215,7 @@ const ROWS: Row[] = [
 		targetKind: "pi, lock held by another",
 		intent: "fire-and-forget",
 		scenario: { resolution: { identity: identity("pi"), preProbeAddressConflict: false }, lock: "conflict" },
-		expect: { decision: "reject", reason: "target-locked", lock: "acquire-fail", diagnostic: true },
+		expect: { decision: "reject", reason: "target-locked", lock: "acquire-fail", diagnostic: "target-locked" },
 	},
 	{
 		name: "unsupported self-fetch active → meta-mailbox",
@@ -231,7 +235,8 @@ const ROWS: Row[] = [
 			resolution: { identity: identity("claude-code"), preProbeAddressConflict: false },
 			mailboxDeliverable: false,
 		},
-		expect: { decision: "reject", reason: "mailbox-undeliverable", lock: "none" },
+		// #101 갭 C: an undeliverable mailbox reject carries the receiver axis that failed.
+		expect: { decision: "reject", reason: "mailbox-undeliverable", lock: "none", diagnostic: "mailbox-undeliverable" },
 	},
 	{
 		name: "in-domain live ff → control-socket",
@@ -338,8 +343,8 @@ async function runRow(row: Row): Promise<void> {
 		}
 		if (row.expect.diagnostic) {
 			ok(
-				`${row.name}: carries target-locked diagnostic`,
-				d.kind === "reject" && d.diagnostic?.kind === "target-locked",
+				`${row.name}: carries the ${row.expect.diagnostic} diagnostic`,
+				d.kind === "reject" && d.diagnostic?.kind === row.expect.diagnostic,
 			);
 		} else {
 			ok(`${row.name}: no diagnostic`, d.kind === "reject" && d.diagnostic === undefined);

package/scripts/check-entwurf-v2-production.ts

@@ -13,6 +13,9 @@
  *   E. Q3 + Q5 — a dead control send re-resolves (claude-code citizen) to the mailbox and
  *      enqueues through the SAME sendViaMailbox instance (same enqueue spy) on the SAME dirs
  *      the direct hand used — direct send and fallback send never drift.
+ *   E4. #101 — the deliverability seam reads BOTH markers: a live receiver marker whose
+ *      owner's sender marker names ANOTHER garden is undeliverable. The SAME closure serves
+ *      the direct send and the dead-control fallback, so neither can be fooled alone.
  *
  * No real IO — every seam is a spy; the factory's COMPOSITION is what is under test.
  */
@@ -26,7 +29,7 @@ import {
 } from "../pi-extensions/lib/entwurf-v2-production.ts";
 import { runEntwurfV2 } from "../pi-extensions/lib/entwurf-v2-runner.ts";
 import type { ControlSocketPlan, MetaMailboxPlan } from "../pi-extensions/lib/entwurf-v2-send.ts";
-import type { MetaIdentity, MetaReceiverMarker } from "../pi-extensions/lib/meta-session.ts";
+import type { MetaIdentity, MetaReceiverMarker, MetaSenderMarker } from "../pi-extensions/lib/meta-session.ts";
 import type { NativePushAdapter, NativePushProbeResult } from "../pi-extensions/lib/native-push/adapter.ts";
 import type { TargetSocketInspection } from "../pi-extensions/lib/socket-discovery.ts";
 
@@ -38,6 +41,8 @@ function ok(label: string, cond: boolean): void {
 }
 
 const GID = "20260613T100000-aaaaaa";
+/** The garden a switched-away owner serves instead (#101). */
+const OTHER_GID = "20260613T100000-bbbbbb";
 const LOCK_DIR = "/fake/locks";
 const SESSIONS_DIR = "/fake/sessions";
 const MAILBOX_DIR = "/fake/mailbox";
@@ -74,6 +79,19 @@ function receiverMarker(gid: string, backend: string, nativeSessionId = "n"): Me
 	};
 }
 
+/** The receiver owner's sender marker — "which garden does this pid serve NOW?" (#101). */
+function senderMarker(gardenId: string, backend: string, ownerPid: number): MetaSenderMarker {
+	return {
+		gardenId,
+		backend: backend as MetaSenderMarker["backend"],
+		nativeSessionId: "n",
+		cwd: "/cwd",
+		ownerPid,
+		ownerStartKey: "x",
+		updatedAt: "t",
+	};
+}
+
 function lockClaim(gardenId = GID): LockClaim {
 	return {
 		gardenId,
@@ -133,6 +151,11 @@ function makeSpiedFactory(over: {
 	/** SE-2 2d-3 — the target's receiver presence marker: "active" (matches identity,
 	 * default), "absent" (terminated/never-armed), or "mismatch" (drifted native id). */
 	receiverMarker?: "active" | "absent" | "mismatch";
+	/** #101 — the receiver owner's SENDER marker, i.e. which garden that pid serves NOW:
+	 * "same" (still this one, default), "other-garden" (the owner switched sessions in
+	 * place — a live marker whose watch is retired), or "absent" (no sender marker at all).
+	 * Injected rather than defaulted so this gate never stats the operator's real roots. */
+	senderMarker?: "same" | "other-garden" | "absent";
 }) {
 	const spies: Spies = {
 		acquire: [],
@@ -161,6 +184,10 @@ function makeSpiedFactory(over: {
 				const nsid = over.receiverMarker === "mismatch" ? "DRIFT" : "n";
 				return receiverMarker(gid, over.backend ?? "pi", nsid);
 			},
+			readSenderMarker: (backend, ownerPid) => {
+				if (over.senderMarker === "absent") return null;
+				return senderMarker(over.senderMarker === "other-garden" ? OTHER_GID : GID, backend, ownerPid);
+			},
 			inspectPath: async (socketPath) => {
 				spies.inspectPath.push({ socketPath });
 				if (over.inspectKind === "indeterminate") {
@@ -388,6 +415,50 @@ async function main(): Promise<void> {
 		ok("E3: drifted marker → enqueue NEVER called (presence ≠ identity match)", spies.enqueue.length === 0);
 	}
 
+	// ── E4: #101 — a LIVE receiver marker whose owner switched gardens. Every axis the
+	// pre-#101 seam looked at says "active": the marker exists, its owner is live, and it
+	// matches this identity exactly. Only the owner's sender marker — which garden that pid
+	// serves NOW — says the watch is retired. This is the cell where a real message was
+	// enqueued into a mailbox nobody was draining (oracle, 2026-09-04). ─────────────────
+	{
+		const { deps, spies } = makeSpiedFactory({
+			backend: "claude-code",
+			rpc: "dead-throw",
+			classifyDead: true,
+			receiverMarker: "active",
+			senderMarker: "other-garden",
+		});
+		const res = await deps.executor.sendControl(CONTROL_PLAN, lockClaim());
+		ok(
+			"E4: owner switched gardens → rejected (mailbox-undeliverable), never fallback-sent",
+			res.outcome === "rejected" && res.rejectReason === "mailbox-undeliverable",
+		);
+		ok("E4: nothing enqueued into the retired garden's mailbox", spies.enqueue.length === 0);
+		// …and the same wiring still DELIVERS when that owner is serving this garden, so the
+		// join is a measurement and not a blanket refusal.
+		const served = makeSpiedFactory({
+			backend: "claude-code",
+			rpc: "dead-throw",
+			classifyDead: true,
+			receiverMarker: "active",
+			senderMarker: "same",
+		});
+		const ok2 = await served.deps.executor.sendControl(CONTROL_PLAN, lockClaim());
+		ok("E4: the served garden still falls back to a real mailbox enqueue", ok2.outcome === "fallback-sent");
+		ok(
+			"E4: a MISSING sender marker is fail-closed, not optimistic",
+			(
+				await makeSpiedFactory({
+					backend: "claude-code",
+					rpc: "dead-throw",
+					classifyDead: true,
+					receiverMarker: "active",
+					senderMarker: "absent",
+				}).deps.executor.sendControl(CONTROL_PLAN, lockClaim())
+			).outcome === "rejected",
+		);
+	}
+
 	// ── F: #50 C4 — record-LESS control socket → pre-probe record-less-socket reject ──
 	// resolveTarget finds no meta-record, does ONE record-side lstat (inspectPath), sees a
 	// non-symlink socket → recordLessSocket. EVERY intent then rejects pre-probe as

package/scripts/check-entwurf-v2-runner.ts

@@ -212,6 +212,24 @@ async function main(): Promise<void> {
 			"4: executed{meta-mailbox, success}",
 			res.kind === "executed" && res.outcome.transport === "meta-mailbox" && res.outcome.success === true,
 		);
+		// #98 R: a dep that reports no path leaves the outcome's receipt undefined. The
+		// runner must not invent one — a guessed path is worse than no path.
+		ok(
+			"4: no enqueue receipt from the dep → messagePath stays undefined (never invented)",
+			res.kind === "executed" && res.outcome.transport === "meta-mailbox" && res.outcome.messagePath === undefined,
+		);
+	}
+
+	// ── 4a: #98 R — the mailbox enqueue receipt is carried through verbatim ───
+	{
+		const { deps } = makeDeps({ mailbox: { result: { success: true, messagePath: "/fake/mailbox/g/2026.msg" } } });
+		const res = await executeDispatch(executeDecision(MAILBOX_PLAN, null), deps);
+		ok(
+			"4a: executed{meta-mailbox} carries the dep's messagePath verbatim",
+			res.kind === "executed" &&
+				res.outcome.transport === "meta-mailbox" &&
+				res.outcome.messagePath === "/fake/mailbox/g/2026.msg",
+		);
 	}
 
 	// ── 4b: native-push execute → sendNativePush(plan, null), lock-free (봉인 4) ──

package/scripts/check-entwurf-v2-send.ts

@@ -213,6 +213,9 @@ async function main(): Promise<void> {
 			fallbackSend: { result: { success: true } },
 		});
 		ok("dead → re-resolve(control) success → fallback-sent", result.outcome === "fallback-sent");
+		// A socket retry hands the body to a live receiver and writes no file: no receipt to
+		// invent (#98 R is a per-FILE identifier, not a per-delivery one).
+		ok("dead → socket retry carries NO messagePath (no file exists)", result.messagePath === undefined);
 		ok("dead → deadFallback called exactly once", trace.deadFallbackCalls === 1);
 		ok("dead → re-resolve used the alt socket", trace.socketSends[1]?.socketPath === "/fake/ctl/alt.sock");
 		ok("dead → release ×1", trace.releases.length === 1);
@@ -277,9 +280,16 @@ async function main(): Promise<void> {
 		const sent = await run({
 			firstSend: { throwCode: "ECONNREFUSED" },
 			deadFallback: { kind: "execute", plan: MAILBOX_PLAN },
-			fallbackSend: { result: { success: true } },
+			fallbackSend: { result: { success: true, messagePath: "/fake/mb/gid/2026-fallback.msg" } },
 		});
 		ok("dead → re-resolve(mailbox) enqueue → fallback-sent", sent.result.outcome === "fallback-sent");
+		// #98 R, fallback leg: this enqueue wrote a file, so the sender gets its name — the
+		// same per-message receipt the primary mailbox rail hands back. Dropping it here was
+		// the one mailbox delivery with no identifier.
+		ok(
+			"dead → mailbox fallback carries the #98 R messagePath",
+			sent.result.messagePath === "/fake/mb/gid/2026-fallback.msg",
+		);
 		ok("dead → mailbox helper called once", sent.trace.mailboxSends.length === 1);
 		ok("dead → mailbox reached only via resolver, release ×1", sent.trace.releases.length === 1);
 
@@ -289,6 +299,8 @@ async function main(): Promise<void> {
 			fallbackSend: { result: { success: false } },
 		});
 		ok("dead → mailbox enqueue success:false → rejected", refused.result.outcome === "rejected");
+		// No file was written, so there is nothing to name — never echo a dep's stray path.
+		ok("dead → rejected enqueue carries NO messagePath", refused.result.messagePath === undefined);
 	}
 
 	// ── 9: single-release across every outcome (release at most once) ─────────

package/scripts/check-entwurf-v2-surface.ts

@@ -361,20 +361,92 @@ async function main(): Promise<void> {
 			cr.isError && cr.text.includes("dormant-fire-forget-unsupported"),
 		);
 
+		// control-socket fallback-sent that re-resolved to the MAILBOX: same file, same
+		// receipt. Before this the fallback leg was the one mailbox delivery whose sender
+		// line carried no per-message identifier.
+		const fallback: EntwurfV2RunResult = {
+			kind: "executed",
+			receipt: { ...SUCCESS_RECEIPT, transport: "control-socket" },
+			transport: "control-socket",
+			outcome: {
+				transport: "control-socket",
+				outcome: "fallback-sent",
+				messagePath: "/home/x/.pi/agent/meta-mailbox/20260903T134455-e55e87/2026-09-03T09-58-02-114Z-ab12cd.msg",
+			},
+		};
+		const fb = renderEntwurfV2Result(fallback);
+		ok("2: fallback-sent is a delivery (not an error)", !fb.isError && fb.text.includes("fallback-sent"));
+		ok(
+			"2: fallback-sent names the enqueued FILE (#98 R, fallback leg)",
+			fb.text.includes("2026-09-03T09-58-02-114Z-ab12cd.msg"),
+		);
+		ok(
+			"2: fallback-sent prints the basename, not the whole path",
+			!fb.text.includes("/home/x/") && !fb.text.includes("meta-mailbox/20260903T134455-e55e87"),
+		);
+		ok(
+			"2: fallback-sent carries NO read stamp (same ban as the primary rail)",
+			!/lastReadAt|lastDeliveredAt/i.test(fb.text),
+		);
+		// A socket-to-socket retry writes no file. No receipt, and no "(enqueued undefined)".
+		const fallbackSocket: EntwurfV2RunResult = {
+			kind: "executed",
+			receipt: { ...SUCCESS_RECEIPT, transport: "control-socket" },
+			transport: "control-socket",
+			outcome: { transport: "control-socket", outcome: "fallback-sent" },
+		};
+		const fbs = renderEntwurfV2Result(fallbackSocket);
+		ok(
+			"2: socket-retry fallback-sent degrades to the bare outcome (no file to name)",
+			fbs.text === "entwurf_v2 control-socket → fallback-sent" && !fbs.isError,
+		);
+
 		// The two spawn-bg render cells (lock-retained / socket-alive) were deleted with the
 		// transport itself. Nothing renders them anymore, and `EntwurfV2Transport` no longer
 		// admits the literal — a cell kept here would only prove the type is still wrong.
 
-		// meta-mailbox → enqueued
+		// meta-mailbox → enqueued, carrying the #98 R send receipt (the enqueued FILE).
 		const mailbox: EntwurfV2RunResult = {
+			kind: "executed",
+			receipt: { ...SUCCESS_RECEIPT, transport: "meta-mailbox" },
+			transport: "meta-mailbox",
+			outcome: {
+				transport: "meta-mailbox",
+				success: true,
+				messagePath: "/home/x/.pi/agent/meta-mailbox/20260903T134455-e55e87/2026-09-03T07-19-31-803Z-113443.msg",
+			},
+		};
+		const mb = renderEntwurfV2Result(mailbox);
+		ok("2: meta-mailbox → not error + enqueued", !mb.isError && mb.text.includes("enqueued"));
+		ok(
+			"2: meta-mailbox names the enqueued message FILE (#98 R send receipt)",
+			mb.text.includes("2026-09-03T07-19-31-803Z-113443.msg"),
+		);
+		// The basename alone — printing the whole path would put the operator's home and the
+		// target garden id (which the caller just typed) into every send line.
+		ok(
+			"2: meta-mailbox prints the basename, not the whole path",
+			!mb.text.includes("/home/x/") && !mb.text.includes("meta-mailbox/20260903T134455-e55e87"),
+		);
+		// The assertion #98 asks for BY NAME: an enqueue receipt must never carry a read
+		// stamp. At enqueue time `lastReadAt` is the PREVIOUS message's read, so surfacing it
+		// would read as "my message was read" — the misreading that opened the issue.
+		ok(
+			"2: meta-mailbox carries NO read stamp (lastReadAt is forbidden on a send receipt)",
+			!/lastReadAt|lastDeliveredAt|\bread\b/i.test(mb.text),
+		);
+		// A dep that hands back no receipt must degrade to the old literal — never
+		// "enqueued (undefined)". The delivery happened either way.
+		const mailboxNoReceipt: EntwurfV2RunResult = {
 			kind: "executed",
 			receipt: { ...SUCCESS_RECEIPT, transport: "meta-mailbox" },
 			transport: "meta-mailbox",
 			outcome: { transport: "meta-mailbox", success: true },
 		};
+		const mbn = renderEntwurfV2Result(mailboxNoReceipt);
 		ok(
-			"2: meta-mailbox → not error + enqueued",
-			!renderEntwurfV2Result(mailbox).isError && renderEntwurfV2Result(mailbox).text.includes("enqueued"),
+			"2: meta-mailbox with no receipt degrades to the bare literal (never 'undefined')",
+			!mbn.isError && mbn.text === "entwurf_v2 meta-mailbox → enqueued",
 		);
 
 		// native-push → delivered (no retry)

package/scripts/check-gate-qualification.ts

@@ -814,6 +814,7 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 		"copilot-receive": 18,
 		"fresh-cut": 1,
 		"meta-facts": 4,
+		"meta-hook-session-switch": 17,
 		"meta-identity": 4,
 		"meta-retire": 3,
 		"mux-boundary": 14,

package/scripts/check-hook-launch-topology.ts

@@ -58,7 +58,20 @@ const PLUGIN_SRC = path.join(REPO_DIR, "pi", "meta-bridge", "entwurf-meta-receiv
 const LAUNCHER = path.join(PLUGIN_SRC, "scripts", "hook-launch.sh");
 const PLACEHOLDER = "${CLAUDE_PLUGIN_ROOT}";
 
-type Leaf = { type?: string; command?: string; args?: string[]; asyncRewake?: boolean; timeout?: number };
+type Leaf = {
+	type?: string;
+	command?: string;
+	args?: string[];
+	asyncRewake?: boolean;
+	timeout?: number;
+	rewakeSummary?: string;
+	rewakeMessage?: string;
+};
+
+/** #98 A/A″ length ceiling for the two rewake strings. The operator row is ONE line in a
+ * terminal status area; the model prefix is glued in front of the doorbell's stderr. There
+ * is no engine cap on the config path (see the lint block below), so this is ours. */
+const REWAKE_MAX_LEN = 80;
 const manifest = JSON.parse(readFileSync(path.join(PLUGIN_SRC, "hooks", "hooks.json"), "utf8")) as {
 	hooks: Record<string, Array<{ matcher?: string; hooks: Leaf[] }>>;
 };
@@ -99,6 +112,62 @@ for (const event of OWNER_EVENTS) {
 	ok("FileChanged: timeout stays declared", typeof bell.timeout === "number" && bell.timeout > 0);
 }
 
+// ── 1b. #98 A/A″: the two rewake strings, and the lint the engine does NOT do ─
+// WHY A LINT AT ALL. Measured on Claude 2.1.236/2.1.258/2.1.259 (#98 Phase 1): the
+// stdout-JSON form of `rewakeSummary` is sanitised by the engine
+// (`.trim().replace(/\s+/g," ").slice(0,cap)`), but the hooks.json CONFIG form is not —
+// it reaches the operator's row verbatim, guarded only by the schema's `min(1)`. Two
+// concrete failures that guard cannot see:
+//   - a value containing a newline breaks the one-row status area;
+//   - a whitespace-only value passes `min(1)` and draws a BLANK row, which is worse than
+//     the default `Stop hook feedback` because it looks like nothing arrived.
+// (A third, `<summary>` missing entirely → the whole notification is hidden, is covered
+// by asserting the field is present and non-empty at all.)
+{
+	const bell = leafOf("FileChanged");
+	// A″ — the model-facing prefix. It REPLACES `Stop hook blocking error from command "…":`,
+	// so without it every arriving letter is named an error in the transcript.
+	ok(
+		"FileChanged: rewakeMessage is declared (model wakes to mail, not to a 'blocking error')",
+		typeof bell.rewakeMessage === "string",
+	);
+	// A — the operator-facing row. Static by nature: the renderer draws this ONE string, so
+	// it cannot carry the unread count (the statusline badge does that half).
+	ok(
+		"FileChanged: rewakeSummary is declared (operator row is not 'Stop hook feedback')",
+		typeof bell.rewakeSummary === "string",
+	);
+	for (const field of ["rewakeSummary", "rewakeMessage"] as const) {
+		const value = bell[field];
+		ok(
+			`FileChanged: ${field} is a single line (a newline would break the one-row status area)`,
+			typeof value === "string" && !/[\r\n]/.test(value),
+		);
+		ok(
+			`FileChanged: ${field} is not whitespace-only (min(1) passes a blank row; we must not)`,
+			typeof value === "string" && value.trim().length > 0,
+		);
+		ok(
+			`FileChanged: ${field} is <= ${REWAKE_MAX_LEN} chars (unsanitised config path, no engine cap)`,
+			typeof value === "string" && value.length <= REWAKE_MAX_LEN,
+		);
+	}
+	// Prefix hygiene (#98 (b)): the model body is `rewakeMessage + " " + stderr`, and the
+	// doorbell's stderr ALREADY opens with `[entwurf inbox]`. A bracketed prefix here would
+	// render `[entwurf …] [entwurf inbox] …` — one tag per line, and the stderr owns it.
+	ok(
+		"FileChanged: rewakeMessage carries no bracket tag (doorbell stderr already opens with [entwurf inbox])",
+		typeof bell.rewakeMessage === "string" && !bell.rewakeMessage.includes("["),
+	);
+	// The doorbell's own opening tag, read from the shipped script rather than assumed —
+	// if someone changes the stderr tag, the no-duplicate-prefix rule above must be re-read.
+	const doorbellSrc = readFileSync(path.join(PLUGIN_SRC, "scripts", "doorbell.sh"), "utf8");
+	ok(
+		"doorbell stderr still opens with the [entwurf inbox] tag the prefix rule assumes",
+		doorbellSrc.includes('echo "[entwurf inbox]'),
+	);
+}
+
 // ── 2. no shell-form regression anywhere in the shipped manifest ─────────────
 // The retired form is recognizable by its carrier; assert the whole file is free of
 // it rather than only the leaves we happen to read above.

package/scripts/check-mailbox-receipt-state.ts

@@ -120,6 +120,12 @@ try {
 		now: new Date("2026-03-01T12:05:00.000Z"),
 	});
 	ok("stamp lastReadAt: state.json created on first stamp", fs.existsSync(mailboxReceiptStatePath(mailboxDir, GID)));
+	// The two `lastDeliveredAt === null` pins below are FIELD-ISOLATION pins, not a
+	// "waiting for the doorbell" state. #98 5a: no writer stamps lastDeliveredAt at all —
+	// the shipped doorbell.sh does not touch state.json — so this null is the field's
+	// permanent value. state.json holds garden-wide last-activity; the per-message receipts
+	// are the file suffixes (`.msg` → `.msg.delivered` → `.msg.delivered.read`). Removing
+	// the field is a migration over existing on-disk v1 states (#98 5b), not a comment fix.
 	ok(
 		"stamp lastReadAt: only lastReadAt set, others null (읽음이 남는다)",
 		afterRead.lastReadAt === "2026-03-01T12:05:00.000Z" &&

package/scripts/check-meta-doctor-oracle.sh

@@ -631,6 +631,79 @@ else
 fi
 unset FAKE_MCP_TAIL
 
+# M14 — a MANAGED SETTINGS SCALAR drifted. Added with #94, which retired the two
+# compaction keys and so deleted two of this doctor's drift cells. Until now the
+# mutation set planted only hook/cache/receiver/MCP/delivery defects: not one cell
+# asked whether the managed-scalar sweep still detects anything at all. That made
+# "retiring these two costs no detection power" an unprovable claim — the gate
+# could not have noticed if the whole sweep had gone silent. `verbose` stands in
+# for the ten scalars that remain owned; it is the cheapest of them and carries no
+# policy weight of its own.
+python3 - "$CLAUDE_CONFIG_DIR/settings.json" <<'PY'
+import json, sys
+p = sys.argv[1]
+d = json.load(open(p, encoding="utf-8"))
+d["verbose"] = True
+json.dump(d, open(p, "w", encoding="utf-8"), indent=2)
+PY
+expect_red "a managed settings scalar (verbose) drifted" "settings verbose missing/drifted at verbose"
+python3 - "$CLAUDE_CONFIG_DIR/settings.json" <<'PY'
+import json, sys
+p = sys.argv[1]
+d = json.load(open(p, encoding="utf-8"))
+d["verbose"] = False
+json.dump(d, open(p, "w", encoding="utf-8"), indent=2)
+PY
+
+# M15 (negative) — the same sweep must NOT claim a RETIRED key. Planted here is the
+# EXACT state oracle sat in on 2026-09-02, the one that opened #94: Claude Code had
+# put `autoCompactEnabled` back to true while entwurf's `env.DISABLE_AUTOCOMPACT`
+# stayed "1". Under the old code that drift is what turned the doctor red; under #94
+# both keys are the operator's and it must be green.
+#
+# Two things this cell will not do. It does not plant entwurf's own former desired
+# value (`false`), which is green under BOTH codes and so could not tell "retired"
+# apart from "still checked, message reworded". And it does not REMOVE the env key
+# to make the state tidier: leaving "1" in place is the stronger claim, because a
+# retired key must be ignored while still carrying the value we used to force, not
+# merely once the operator has finished cleaning up after us.
+cp "$CLAUDE_CONFIG_DIR/settings.json" "$TMP/settings-m15.bak"
+python3 - "$CLAUDE_CONFIG_DIR/settings.json" <<'PY'
+import json, sys
+p = sys.argv[1]
+d = json.load(open(p, encoding="utf-8"))
+d["autoCompactEnabled"] = True
+d.setdefault("env", {})["DISABLE_AUTOCOMPACT"] = "1"
+json.dump(d, open(p, "w", encoding="utf-8"), indent=2)
+PY
+run_doctor
+if [ "$DOC_RC" -eq 0 ]; then
+  ok "an operator who turned compaction back ON is not drift (retired keys leave the doctor green)"
+else
+  bad "compaction re-enabled by the operator still reddens the doctor (the keys are not really retired):"$'\n'"$(printf '%s\n' "$DOC_OUT" | grep -E '^  FAIL' | sed 's/^/        /')"
+fi
+cp "$TMP/settings-m15.bak" "$CLAUDE_CONFIG_DIR/settings.json"
+
+# M16 — the ONE nudge a retired key still owes. `check()` refuses while the ledger
+# still carries ownership entwurf has not yet relinquished, which is the state an
+# upgraded host is in between `git pull` and `install-meta-bridge`. No other
+# mutation reaches that branch, so without this cell the whole retirement path
+# could stop refusing and every gate would stay green.
+cp "$CLAUDE_CONFIG_DIR/entwurf.install-state.json" "$TMP/state-m16.bak"
+python3 - "$CLAUDE_CONFIG_DIR/entwurf.install-state.json" <<'PY'
+import json, sys
+p = sys.argv[1]
+d = json.load(open(p, encoding="utf-8"))
+d["files"]["settings"]["keys"]["autoCompactEnabled"] = {
+    "kind": "scalar",
+    "path": ["autoCompactEnabled"],
+    "original": {"existed": False, "value": None},
+}
+json.dump(d, open(p, "w", encoding="utf-8"), indent=2)
+PY
+expect_red "install-state still owns a retired scalar (upgrade not yet relinquished)" "install-state still owns retired scalar autoCompactEnabled"
+cp "$TMP/state-m16.bak" "$CLAUDE_CONFIG_DIR/entwurf.install-state.json"
+
 # --- 5. the control must still hold after every restore ----------------------
 echo "[control] re-run after all mutations were reverted"
 run_doctor