@junghanacs/entwurf 0.17.2 → 0.18.0

package/AGENTS.md

@@ -90,7 +90,7 @@ A `--entwurf-control` pi session is a citizen for the same reason a native bridg
 
 - **control-socket domain (currently `pi`)**: socket liveness, per-target lock, live send, and a dormant cell that rejects.
 - **No relaunch transport exists inside delivery.** `spawn-bg` — a detached, window-less resume child — was removed under the visible-first rule, not deprecated behind a reject, and `entwurf_v2` still starts no process: a dormant socket-domain citizen is refused as `dormant-fire-forget-unsupported`. Reopening one is the separate lifecycle verb `entwurf_resume_call`, which is pi-only (`target-not-pi` otherwise), returns a LAUNCH receipt and an OBSERVATION receipt that are never merged, releases its per-gid lock on every path, and on an unobserved socket leaves the visible window open rather than retrying. No watcher, no retry, no supervisor. Do not re-route it through `entwurf_v2` and do not describe a spawn domain that does not exist.
-- **self-fetch domain (Claude Code, Copilot CLI)**: active receiver + mailbox deliverability; no resume authority. The two arm that receiver through different vendor surfaces — a Claude hook that emits watchPaths, a Copilot first-party extension that holds the watch in a forked child — and the marker records which, because the pid a reader verifies differs.
+- **self-fetch domain (Claude Code, Copilot CLI)**: active receiver + mailbox deliverability; no resume authority. The two arm that receiver through different vendor surfaces — a Claude hook that emits watchPaths, a Copilot first-party extension that holds the watch in a forked child — and the marker records which, because the pid a reader verifies differs. A live marker is not by itself an armed doorbell: where the watch owner IS the process the sender marker is keyed to (`ownerKind: claude-code-cli`), that owner may switch sessions in place, so deliverability also requires its sender marker to still name the same garden. That join is `ownerKind`-scoped by construction — a Copilot watch lives in a forked child with its own pid, so the join does not exist there and must never be applied to it (#101).
 - **native-push domain (currently Antigravity)**: adapter probe + direct injection; no mailbox and no resume authority.
 - `origin: "pi-session" | "meta-session" | "external-mcp"` records sender provenance. It is not the citizen identity schema and not a hierarchy.
 - `entwurf_peers` reports record citizens and liveness facts only. It never embeds routing verbs or socket addresses for peers.
@@ -172,6 +172,7 @@ implement → affected focused gates → independent review → one amendment bu
 | `pi-extensions/lib/entwurf-v2-*.ts` | v2 contract, decider, transports, runner, production wiring; visible resume keeps launch injected |
 | `pi-extensions/lib/mux-*.ts` | same-tmux placement plus narrow fresh-call and visible-resume launch compositions |
 | `pi-extensions/lib/entwurf-fact*.ts` | record citizens + transport-specific liveness facts |
+| `pi-extensions/lib/entwurf-peer-observe.ts` | the IO half of the observed peer facts (receiver / transcript) |
 | `pi-extensions/lib/native-push/` | native-push adapter/probe/register leaf |
 | `pi-extensions/acp-provider.ts` | `entwurf` provider registration |
 | `pi-extensions/lib/acp/` | ACP adapter rail, config/overlay, augment, turn loop, event mapping |

package/CHANGELOG.md

@@ -4,6 +4,133 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.18.0 - 2026-09-04
+
+### Fixed
+
+- **A Claude window that changes which session it serves no longer leaves an armed receiver behind
+  (#101).** One process serves one garden at a time but can change which: open a bare `claude` and
+  then `/resume` or `/clear` inside it, and a second `SessionStart` arrives under the same pid,
+  seconds later, naming a different session. The garden it stopped serving kept a receiver marker
+  naming a LIVE owner, so dispatch read an armed doorbell nobody held — a sibling's message was
+  reported as sent and then sat unread in that mailbox for over 50 minutes (oracle, 2026-09-04; that
+  unread letter is what opened the issue).
+  - **Deliverability now asks about *now*, not *ever*.** `watchArmed` was a copy of the identity
+    match; it is a measurement — the receiver owner's own sender marker
+    (`meta-senders/<backend>/<pid>.json`) must still name the same garden. Both consumers, the v2
+    production seam and `entwurf_self`, go through one shared composition, so a citizen's
+    self-report and dispatch cannot disagree.
+  - **The hook retires what it stopped serving** — the marker only, never the record (a record is a
+    citizen's identity, not sweepable state), only a marker its own pid owns, and only on an
+    arm-capable event. `UserPromptSubmit` cannot emit `watchPaths`, so retiring on a keystroke would
+    disarm the session the operator is sitting in with no way to re-arm. The vendor's `source` is
+    logged on every line and branched on nowhere: the switch is settled by what is on disk.
+  - **The join is scoped by the marker's `ownerKind`, not by backend** — today that is
+    `claude-code-cli`. A Copilot watch lives in a forked extension child with its own pid while its
+    sender marker carries the CLI's `process.ppid`, so applying the same check there would make
+    every Copilot citizen permanently `mailbox-undeliverable`. That is a scope decision with a
+    measured reason, not an omission.
+
+### Added
+
+- **A rejected delivery now names which receiver axis failed (#101).** A bare `mailbox-undeliverable`
+  sent one sibling hunting for a live session it had read as dead. The rejection now says whether
+  the doorbell is not armed, the owner is not alive, or there is no record.
+- **`entwurf_peers` separates a live citizen from a phantom (#101).** Every claude-code row reads
+  `liveness=unsupported`, so two rows were byte-identical whether or not anyone was home. Each row
+  now carries two observed facts — `receiver=` (doorbell state) and `transcript=` (whether a
+  conversation was ever written):
+
+  ```text
+  - 20260904T072015-e09b66  liveness=unsupported  receiver=active    transcript=exists
+  - 20260904T093135-ac7a1a  liveness=unsupported  receiver=inactive  transcript=absent
+  ```
+
+- **`check-meta-hook-session-switch` (28 assertions) and the first mutant lane the Claude hook has
+  ever had (#101).** The gate drives the shipped launcher twice under one fake owner pid and
+  requires that exactly one of the two gardens is deliverable — and that it is the one the operator
+  is sitting in. `scripts/mutants/meta-hook-session-switch.json` carries **17 claims**, 1:1 with the
+  gate's `[QK:…]` labels, each re-planting the defect this lane closed and requiring the gate to go
+  red at its claimed signature. Three of those six new mutants exist because cross-review found two
+  QK labels with no mutant behind them and three real weakenings walking straight through: the
+  join's `ownerKind` scope, the sender marker's start-key guard, and its backend equality.
+
+### Changed
+
+- **One inherited sentence about the resume picker is retired, and it was retired by measurement
+  (#101).** The diagnosis said the picker fires `SessionStart` twice — a placeholder id, then the
+  picked one. Six LIVE cells on this host (Claude Code 2.1.260, hook log verbatim in
+  `scripts/raw-claude-session-switch/README.md`) show it fires **once**, carrying the real id,
+  whether the id comes from the picker or from argv. The two-`SessionStart` shape is a bare `claude`
+  followed by an in-session `/resume` or `/clear` — which is exactly what the field case did, four
+  seconds before its second envelope. The repair is unaffected (either way one pid stops serving one
+  garden), so only the prose moved, in four places. Compaction, manual and automatic, re-fires
+  `SessionStart` for the **same** native id and retires nothing; the same-garden rule already
+  covered it.
+- **A `UserPromptSubmit` envelope is trusted for the receiver join, on a measured footing.** The
+  cross-review threat model ("a stale or out-of-order UPS") was withdrawn rather than defended: it
+  claimed the sender pointer is untrustworthy for the join while the same pointer stays authoritative
+  for sender identity — two incompatible readings of one file. Across the raw lab's four pids, every
+  `UserPromptSubmit` named the native id its own pid's preceding `SessionStart` had established,
+  **8 of 8**. The arm-capable restriction stays on its own footing.
+- **Three LIVE smokes stopped depending on a fixture the new join reads as retired.** Five smokes
+  seeded a receiver marker with no sender marker beside it — three of them release MUSTs — so each
+  would have failed on its own fixture rather than on the rail it exists to prove. They now seed
+  both and sandbox the senders root, the shape `smoke-mux-lifecycle-live` and `smoke-omp-fresh-live`
+  already had. `smoke-entwurf-chain-live` additionally gives its terminus an owner **outside hop 1's
+  ancestry**: seeding it under the smoke's own pid put two garden citizens on one host process and
+  the bridge refused the hop outright with `ambiguous sender identity`.
+
+### Upgrade note
+
+**Run `entwurf setup` once after upgrading — every rail, not just Claude.** This release changes
+`pi-extensions/lib/meta-session.ts` and the Claude hook, and **four install paths deploy that
+file** — `install-meta-bridge` (Claude), `install-omp-bridge` and `install-omp-receive` (OMP),
+`install-copilot-bridge` (Copilot). Every one of them present on the host now carries a STALE
+writer until it is re-installed, and its own doctor says so by name. Re-installing only the Claude
+rail leaves the others stale, and that does not surface until a LIVE gate turns red — measured in
+the 0.17.2 cut, where it blocked `smoke-omp-receive-live` and made the first `--cut` run BLOCKED.
+
+`entwurf setup` is presence-driven and re-synthesizes exactly the units this host has, which is why
+it is the upgrade command rather than any single `install-*`. An already-open Claude Code session
+keeps the old manifest until it restarts — and, for this release specifically, an already-open
+session also keeps the old hook, which is the code that retires a switched-away receiver.
+
+### Verification
+
+All of the following ran on oracle (Linux, Claude Code 2.1.260, node 24.18.1, pi 0.84.4, omp 18.0.0).
+
+- **`pnpm run check:full` — exit 0**, 440s on the prepared tree and 446s inside the release gate.
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.18.0c.xZlKjZ --cut` — `cut: OK`,
+  exit 0.** **MUST PASS=23 FAIL=0 SKIP=0**, **BEHAVIOR PASS=1 FAIL=0 SKIP=0**. Run 18:57→19:48 KST
+  on `faee8f6`, with `env -u CLAUDE_CONFIG_DIR -u PI_SESSION_ID -u PI_AGENT_ID`. Log:
+  `/tmp/entwurf-release-gate-0.18.0c.xZlKjZ/release-gate.log`. It carried `check:full` and
+  `check-gate-qualification` (**364/364 KILLED**, up from 347 — the 17 new claims are this lane's
+  `MHSS-*`) as MUST steps.
+- **This lane's own gate: `check-meta-hook-session-switch` — 28 assertions passed**, and all 17
+  `MHSS-*` mutants killed at their claimed signatures inside that qualification run.
+- **The three LIVE smokes whose fixtures this lane changed are green**, including
+  `smoke-entwurf-chain-live` — **24 assertions**, four citizens across three harnesses, and its new
+  pre-flight cell `fixture: the terminus is a deliverable citizen at the moment the chain starts`
+  passed before the chain ran.
+- **One unattributed `smoke-entwurf-chain-live` failure is on the record and is NOT closed.** During
+  the lane (2026-09-04 16:58 KST) one run rejected at hop 3 with `mailbox-undeliverable (observed
+  liveness: unsupported)`; the runs before and after it passed and it has not reproduced. A
+  start-key race and an early idle-owner exit were excluded by measurement; a memory-pressure
+  hypothesis is neither confirmed nor refuted (no OOM or kill entries in the host journal for that
+  window). The instrument that will split the next occurrence shipped in this release — the fixture
+  pre-flight assertion above, plus a `terminus fixture at timeout:` line naming owner liveness and
+  both receiver facts.
+- **The first `--cut` attempt of this cut was BLOCKED, and the cause was operator error, not the
+  product.** `check-gate-qualification` aborted with `origin HEAD changed during qualification`
+  because a commit was created while the gate was running. Every other MUST step in that run passed
+  (`MUST PASS=22 FAIL=1 SKIP=0`). The run above is the re-measurement on a frozen HEAD. One LIVE
+  gate run before that was killed by the host harness's low-memory watchdog rather than by any
+  assertion, and was re-run under tmux.
+- **Exact-SHA CI on the pre-version HEAD `e56eee0`** — `check`, `install-surface`,
+  `artifact-consumer` all `success`.
+  Run: https://github.com/junghan0611/entwurf/actions/runs/33853363923
+
 ## 0.17.2 - 2026-09-03
 
 ### Added

package/mcp/entwurf-bridge/dist/mcp/entwurf-bridge/src/index.js

@@ -64,7 +64,7 @@ import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
 import { controlSocketPathIn, defaultControlSocketDir } from "../../../pi-extensions/lib/control-socket-path.js";
-import { receiverMarkerMatchesIdentity } from "../../../pi-extensions/lib/entwurf-deliverability.js";
+import { resolveMailboxReceiverFacts } from "../../../pi-extensions/lib/entwurf-deliverability.js";
 import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provider.js";
 import { renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.js";
 import { computeSelfAddressability } from "../../../pi-extensions/lib/entwurf-self-address.js";
@@ -73,7 +73,7 @@ import { resolveMailboxWakeModeCapability } from "../../../pi-extensions/lib/ent
 import { runAndRenderEntwurfV2FromSurface } from "../../../pi-extensions/lib/entwurf-v2-surface.js";
 import { makeVisibleResumeDeps, renderVisibleResume, visibleResume, } from "../../../pi-extensions/lib/entwurf-v2-visible-resume.js";
 import { probeNativeSenderAlive, resolveTrustedMetaSenderIdentity, } from "../../../pi-extensions/lib/meta-sender-identity.js";
-import { applyOmpBridgeChildRootPolicy, defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaInbox, readMetaReceiverMarker, } from "../../../pi-extensions/lib/meta-session.js";
+import { applyOmpBridgeChildRootPolicy, defaultMetaMailboxDir, defaultMetaSessionsDir, makeStoreRecordReader, readActiveStoreEntries, readMetaInbox, readMetaReceiverMarker, readMetaSenderMarker, requireBackend, } from "../../../pi-extensions/lib/meta-session.js";
 import { freshCall, renderFreshCall } from "../../../pi-extensions/lib/mux-fresh-call.js";
 import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.js";
 import { registerNativeConversation } from "../../../pi-extensions/lib/native-push/register.js";
@@ -223,9 +223,12 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
     //     admits another self-fetch citizen.
     //   none        ← neither. omp today: no mailbox drain, no native-push adapter. Rendering
     //     this as self-fetch printed a mailboxPath nothing drains.
-    //   self-fetch (claude-code/copilot): can this citizen's own inbox wake? → the receiver
-    //     presence marker (readMetaReceiverMarker folds a dead/reused owner to null, so a match
-    //     means a live, ARMED receiver — the sender marker proves identity, never an armed watch).
+    //   self-fetch (claude-code/copilot): can this citizen's own inbox wake? → the SHARED
+    //     receiver composition `resolveMailboxReceiverFacts`, the same one the v2 dispatch seam
+    //     uses, so a citizen's self-reported replyability can never disagree with what dispatch
+    //     decides about it. It reads the presence marker (a dead/reused owner already folds to
+    //     null) AND, where the watch owner is the sender-marker process, the #101 join that says
+    //     the owner is still serving THIS garden rather than one it switched away from.
     //   native-push (antigravity): there is no inbox and no watch. A reply is injected into a
     //     live app-server conversation, so only an adapter probe can answer. Composing the
     //     receiver atom here would demand `watchArmed` from a backend that never arms one, and
@@ -248,14 +251,16 @@ async function buildTrustedMetaSenderEnvelope(cwd = process.cwd()) {
         }
         : metaDeliveryDomain === "self-fetch"
             ? (() => {
-                const receiver = readMetaReceiverMarker({ gardenId: identity.gardenId });
-                const active = receiverMarkerMatchesIdentity(receiver, identity);
+                const receiver = resolveMailboxReceiverFacts(identity, {
+                    readReceiverMarker: (gardenId) => readMetaReceiverMarker({ gardenId }),
+                    readSenderMarker: (backend, ownerPid) => readMetaSenderMarker({ backend: requireBackend(backend), ownerPid }),
+                });
                 return {
                     origin: "meta-session",
                     metaDeliveryDomain,
                     recordBacked: true,
-                    ownerAlive: active,
-                    watchArmed: active,
+                    ownerAlive: receiver.ownerAlive,
+                    watchArmed: receiver.watchArmed,
                 };
             })()
             : {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-deliverability.js

@@ -72,6 +72,82 @@ export function receiverMarkerMatchesIdentity(marker, identity) {
         marker.backend === identity.backend &&
         marker.nativeSessionId === identity.nativeSessionId);
 }
+// ── the watch-owner ↔ sender-marker join (#101 결함 B) ──────────────────────
+// A receiver marker proves "a LIVE process once armed a watch for this garden".
+// It does NOT prove "that process is serving this garden RIGHT NOW". One native
+// process can hold markers for several gardens and drain exactly one of them:
+// Claude Code's session switch (an in-session `/resume` or `/clear`) fires a second
+// SessionStart inside the SAME pid under a NEW native session id, so the first
+// garden's marker keeps naming a live owner forever while the doorbell it advertises
+// is gone. Measured on oracle 2026-09-04 (#101): one pid held both markers, a
+// 09:33 enqueue to the retired garden sat unread as a bare `.msg` for ≥50 minutes —
+// the "enqueue into a void" this module's header exists to refuse.
+//
+// The join that decides it is already on disk: the SENDER marker is keyed by owner
+// pid and rewritten with the CURRENT garden on every arm/prompt, so
+// `meta-senders/<backend>/<ownerPid>.json.gardenId` is the answer to "which garden
+// does this process serve now?". A receiver marker naming a different garden than
+// its own owner's sender marker is a retired watch.
+//
+// SCOPE IS NOT UNIVERSAL, AND THE MARKER SAYS SO. The join only exists where the
+// watch owner IS the process the sender marker is keyed to. That is true for the
+// Claude hook (one `ownerPid` variable writes both markers —
+// `meta-bridge-hook.ts` sender + receiver arm) and false BY CONSTRUCTION for
+// Copilot, whose watch lives in a forked first-party extension child
+// (`extension.mjs` writes `ownerPid: process.pid`) while its sender marker is keyed
+// to the CLI parent (`meta-bridge-hook-copilot.ts` uses `process.ppid`). Applying
+// the join there would make every Copilot citizen permanently undeliverable — a
+// regression on a shipped lane, not a fix. `ownerKind` is recorded on the marker for
+// exactly this reason ("the marker records which, because the pid a reader verifies
+// differs" — AGENTS.md, self-fetch domain), so it is the axis, not `backend`.
+//
+// `omp-host` is a CANDIDATE, deliberately not admitted here: OMP already retires the
+// previous garden in-process on its `/new` edge (the unarm the claude hook lacked),
+// so the cell this join closes has a different owner there. Admitting it needs its
+// own measurement, not this file's optimism.
+export const SENDER_JOINED_RECEIVER_OWNER_KINDS = ["claude-code-cli"];
+/** Does this watch owner share its pid with the backend's sender marker? */
+export function receiverOwnerKindJoinsSender(ownerKind) {
+    return SENDER_JOINED_RECEIVER_OWNER_KINDS.includes(ownerKind);
+}
+/**
+ * Is the watch owner still serving THIS garden? Fail-closed inside the join's scope:
+ * an absent/unreadable sender marker, or one naming another garden or backend, means
+ * the watch is retired. Outside the scope (an ownerKind whose watch owner is not the
+ * sender-marker process) the join does not apply and the marker's own live-owner guard
+ * is the whole rule — returning true here is NOT optimism, it is "this axis says
+ * nothing", and the caller has already required the marker to match the identity.
+ */
+export function receiverOwnerServesGarden(marker, senderMarker) {
+    if (!receiverOwnerKindJoinsSender(marker.ownerKind))
+        return true;
+    return !!senderMarker && senderMarker.gardenId === marker.gardenId && senderMarker.backend === marker.backend;
+}
+/**
+ * THE single composition of the two mailbox receiver facts, over injected readers.
+ * Both production consumers — the v2 `mailboxDeliverabilityFor` seam and the MCP
+ * bridge's `entwurf_self` — call THIS, so a direct send, a re-resolved fallback send
+ * and a citizen's own replyability can never drift to different verdicts.
+ *
+ *   ownerAlive  — a live-owner marker that names THIS identity (the reader already ran
+ *                 the plausibility + start-key guards; this adds the identity match).
+ *   watchArmed  — that owner is still serving this garden (the join above). It is a
+ *                 MEASUREMENT, never a copy of ownerAlive: copying it is what let a
+ *                 retired watch read as an armed doorbell (#101 결함 B).
+ *
+ * `recordBacked` is NOT decided here — it stays the caller's explicit fact, so an
+ * absent record and a dead owner stay distinguishable in the reason string.
+ */
+export function resolveMailboxReceiverFacts(identity, readers) {
+    const marker = readers.readReceiverMarker(identity.gardenId);
+    const ownerAlive = receiverMarkerMatchesIdentity(marker, identity);
+    if (!ownerAlive || !marker)
+        return { ownerAlive: false, watchArmed: false };
+    const senderMarker = receiverOwnerKindJoinsSender(marker.ownerKind)
+        ? readers.readSenderMarker(marker.backend, marker.ownerPid)
+        : null;
+    return { ownerAlive, watchArmed: receiverOwnerServesGarden(marker, senderMarker) };
+}
 /**
  * The conversational-mailbox enqueue gate. False (no enqueue) unless the backend is
  * self-fetch AND the receiver is active. A direct-inject backend (pi / codex /

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-fact-provider.js

@@ -26,7 +26,8 @@
  * a same-gid socket exists would be half a lie. Both leave the normal output;
  * one diagnostic carries the fact. (pi + same-gid socket = the normal merge.)
  */
-import { isOutOfSocketDomainGardenIdConflict, resolveFactList } from "./entwurf-facts.js";
+import { isOutOfSocketDomainGardenIdConflict, resolveFactList, } from "./entwurf-facts.js";
+import { observePeerFacts } from "./entwurf-peer-observe.js";
 import { isLivenessSupported } from "./entwurf-v2-contract.js";
 import { FRESH_CUT_PRESCRIPTION, listAllMetaIdentities, } from "./meta-session.js";
 import { scanSocketProbes } from "./socket-discovery.js";
@@ -65,10 +66,12 @@ function diagnosticSortKey(d) {
     }
 }
 /**
- * Assemble the facts-only listing. Pure over its injected deps (no direct IO) so
- * the gate drives it without a filesystem; slice 4c supplies the real readdir /
- * readFile / probe. Probes are gid + liveness only (#50 C4 — the per-socket
- * get_info enrich left with the socket-only quasi-citizen listing).
+ * Assemble the facts-only listing. Driven entirely through injected deps, so the gate
+ * runs it without a filesystem; slice 4c supplies the real readdir / readFile / probe.
+ * The one dep with a REAL default is `observe` (#101) — see its comment: a per-citizen
+ * measurement both wiring sites must make identically is safer as one default than as two
+ * call-site arguments. Probes are gid + liveness only (#50 C4 — the per-socket get_info
+ * enrich left with the socket-only quasi-citizen listing).
  */
 export async function listEntwurfFacts(deps) {
     const diagnostics = [];
@@ -129,7 +132,7 @@ export async function listEntwurfFacts(deps) {
     //    fire as the last line of defense, never caught here.
     const cleanIdentities = identities.filter((i) => !conflictGids.has(i.gardenId));
     const cleanProbes = probes.filter((p) => !conflictGids.has(p.gardenId));
-    const facts = resolveFactList(cleanIdentities, cleanProbes);
+    const facts = resolveFactList(cleanIdentities, cleanProbes, deps.observe ?? observePeerFacts);
     // 5. #50 C4 demotion: a record-less socket is a diagnostic, not a listing
     //    section. One diagnostic per socket (subjects aggregate at render, F8);
     //    the message is liveness-keyed so same-state sockets group into one line.

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-facts.js

@@ -19,6 +19,9 @@
  *     a peer-facing fact; `entwurf_peers` exposes identity + cwd-history, not
  *     filesystem internals. (who-can / dispatch read it via the meta-record
  *     directly when they genuinely need it — it does not belong in the listing.)
+ *     Whether that transcript EXISTS is a different thing and is carried (#101):
+ *     the path stays private, the fact that a citizen has never written a turn
+ *     does not.
  *
  * The 4-value liveness (`alive|dead|indeterminate|unsupported`, R3b) and the
  * out-of-domain → `unsupported` rule (R1: never coerce an unprobed backend to
@@ -27,6 +30,9 @@
  * the surrounding identity facts around it.
  */
 import { factLivenessOf, isLivenessSupported } from "./entwurf-v2-contract.js";
+/** What a caller that measured nothing must say. Explicit and greppable — a row that
+ * silently defaulted to `none`/`absent` would be a fabricated fact. */
+export const UNOBSERVED_PEER = { receiver: "unobserved", transcript: "unobserved" };
 /**
  * Compose a `PeerFact` from a citizen's identity and an optional socket probe.
  *
@@ -39,7 +45,7 @@ import { factLivenessOf, isLivenessSupported } from "./entwurf-v2-contract.js";
  *
  * Pure: same inputs → same output, no IO.
  */
-export function resolvePeerFact(identity, socket) {
+export function resolvePeerFact(identity, socket, observations = UNOBSERVED_PEER) {
     return {
         gardenId: identity.gardenId,
         backend: identity.backend,
@@ -49,6 +55,8 @@ export function resolvePeerFact(identity, socket) {
         createdAt: identity.createdAt,
         recordUpdatedAt: identity.recordUpdatedAt,
         liveness: factLivenessOf(identity.backend, socket),
+        receiver: observations.receiver,
+        transcript: observations.transcript,
     };
 }
 /**
@@ -98,7 +106,7 @@ export function isOutOfSocketDomainGardenIdConflict(backend, gardenId, socketGid
  * A gardenId is never emitted as both a `PeerFact` and a `RecordLessSocketFact`;
  * a record-less socket becomes a `PeerFact` the moment a record claims the gid.
  */
-export function resolveFactList(identities, socketProbes) {
+export function resolveFactList(identities, socketProbes, observe = () => UNOBSERVED_PEER) {
     const probeMap = new Map();
     for (const probe of socketProbes) {
         if (probeMap.has(probe.gardenId)) {
@@ -129,7 +137,7 @@ export function resolveFactList(identities, socketProbes) {
             }
             socket = null;
         }
-        peers.push(resolvePeerFact(identity, socket));
+        peers.push(resolvePeerFact(identity, socket, observe(identity)));
         consumed.add(gid);
     }
     const recordLessSockets = [];

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-peer-observe.js

@@ -0,0 +1,66 @@
+/**
+ * entwurf-peer-observe — the IO half of the two OBSERVED peer facts (#101).
+ *
+ * `entwurf_peers` used to answer a claude-code citizen with `liveness=unsupported` and
+ * nothing else, because the control-socket probe genuinely does not apply to a self-fetch
+ * backend. Two same-cwd rows — one a live conversation, one an abandoned startup session
+ * whose transcript was never written — were therefore byte-identical in the listing, and
+ * a caller picking "the newest record in this cwd" (the natural heuristic, and the one the
+ * surface encourages) picked the phantom as often as the real one. Both halves of the
+ * distinction were already on disk; nothing read them.
+ *
+ * FACTS, NOT VERBS. `receiver` and `transcript` say what was found, never what to do
+ * about it: no `sendable`, no `deliverable`, no transport. The listing stays a listing —
+ * dispatch still computes routing at call time from the same underlying markers.
+ *
+ * ONE MEASUREMENT, TWO WORDS. `receiver` is derived from the SAME
+ * `resolveMailboxReceiverFacts` composition the v2 dispatch seam and `entwurf_self` use.
+ * The surfaces are allowed to phrase it differently — a listing wants an enum, a reject
+ * wants a sentence — but they may not disagree, so the enum is a projection of that atom
+ * rather than a second opinion about the same markers.
+ */
+import * as fs from "node:fs";
+import { resolveMailboxReceiverFacts } from "./entwurf-deliverability.js";
+import { metaCapabilityFor, metaReceiverMarkerPath, readMetaReceiverMarker, readMetaSenderMarker, requireBackend, } from "./meta-session.js";
+/**
+ * The mailbox receiver axis for one citizen.
+ *
+ * `n/a` is not a failure: a backend with no mailbox (pi's control socket, antigravity's
+ * native push) has no receiver marker to be right or wrong about, and printing `none`
+ * there would invent a missing thing. The `inactive` / `none` split is what a reader
+ * needs to tell "a watch was armed and is no longer valid" from "no watch was ever
+ * armed here", so it is taken from the marker FILE's existence rather than from the
+ * reader's null — the reader folds absent, corrupt and dead-owner into one null.
+ */
+function observeReceiver(identity) {
+    if (metaCapabilityFor(identity.backend).wakeMode !== "self-fetch")
+        return "n/a";
+    const facts = resolveMailboxReceiverFacts(identity, {
+        readReceiverMarker: (gardenId) => readMetaReceiverMarker({ gardenId }),
+        readSenderMarker: (backend, ownerPid) => readMetaSenderMarker({ backend: requireBackend(backend), ownerPid }),
+    });
+    if (facts.ownerAlive && facts.watchArmed)
+        return "active";
+    return fs.existsSync(metaReceiverMarkerPath(identity.gardenId)) ? "inactive" : "none";
+}
+/**
+ * Does the recorded transcript exist? A record is minted at SessionStart, but a harness
+ * that writes its transcript lazily (Claude Code writes on the first turn) leaves a
+ * citizen with no conversation behind it until someone actually says something. The PATH
+ * stays private — only its existence crosses to the listing.
+ */
+function observeTranscript(identity) {
+    try {
+        // A record with no recorded transcript path has nothing to stat — that is the same
+        // observable state as a path that is not there, and neither is an `exists` claim.
+        return identity.transcriptPath && fs.existsSync(identity.transcriptPath) ? "exists" : "absent";
+    }
+    catch {
+        // A transcript we cannot stat is not a transcript we can claim exists.
+        return "absent";
+    }
+}
+/** The production observer: both axes, measured for one citizen. */
+export function observePeerFacts(identity) {
+    return { receiver: observeReceiver(identity), transcript: observeTranscript(identity) };
+}

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-peers-render.js

@@ -22,9 +22,18 @@
  *     socketPath rows — the pre-record socket-scan worldview) is gone with the
  *     `controlDir` it exposed. Socket paths are dispatch-internal transport.
  */
+// `receiver` and `transcript` are OBSERVED facts, not routing (#101): they say what was
+// found on disk for this citizen, and a caller still asks entwurf_v2 what may be done
+// about it. They earn a column because for every claude-code row `liveness` reads
+// `unsupported` — the socket probe does not apply — so two rows in one cwd, a live
+// conversation and an abandoned startup session whose transcript was never written, used to
+// be indistinguishable here. `receiver=active|inactive|none|n/a` is a projection of the
+// same measurement dispatch uses; `transcript=exists|absent` is the record's transcript,
+// existence only, never the path.
 function renderPeerLine(p) {
     const model = p.model ?? "(unknown)";
-    return `- ${p.gardenId}  backend=${p.backend}  liveness=${p.liveness}  cwd=${p.cwd}  model=${model}`;
+    return (`- ${p.gardenId}  backend=${p.backend}  liveness=${p.liveness}  receiver=${p.receiver}  ` +
+        `transcript=${p.transcript}  cwd=${p.cwd}  model=${model}`);
 }
 function renderDiagnosticLine(d) {
     switch (d.kind) {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-decider.js

@@ -151,8 +151,14 @@ export async function decideDispatch(input, deps) {
         // fail-closed (SE-2 2d-3). resolveDispatch then routes intent × deliverable.
         const deliverability = await deps.mailboxDeliverabilityFor(identity);
         const receipt = resolveDispatch(input.intent, "unsupported", deliverability.deliverable);
-        if (!receipt.ok)
-            return reject(receipt);
+        // The predicate's reason travels with the reject (#101 갭 C). It is attached only when
+        // undeliverability is what produced the reject — an intent-shaped refusal on a
+        // DELIVERABLE target must not be dressed up as a receiver problem.
+        if (!receipt.ok) {
+            return deliverability.deliverable
+                ? reject(receipt)
+                : reject(receipt, { kind: "mailbox-undeliverable", reason: deliverability.reason });
+        }
         // the only allow cell here is fire-and-forget → meta-mailbox send.
         const plan = {
             transport: "meta-mailbox",

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-production.js

@@ -29,7 +29,7 @@
  * claiming "no conflict". The decider's later `inspectSocket` probe is a SEPARATE step.
  */
 import { sendRpcCommand as realSendRpc, } from "./entwurf-control-rpc.js";
-import { mailboxConversationalDeliverable, receiverMarkerMatchesIdentity, } from "./entwurf-deliverability.js";
+import { mailboxConversationalDeliverable, resolveMailboxReceiverFacts, } from "./entwurf-deliverability.js";
 import { isOutOfSocketDomainGardenIdConflict } from "./entwurf-facts.js";
 import { isLivenessSupported } from "./entwurf-v2-contract.js";
 import { decideDispatch, } from "./entwurf-v2-decider.js";
@@ -38,7 +38,7 @@ import { makeProductionSendViaMailbox } from "./entwurf-v2-mailbox.js";
 import { makeNativePushSend } from "./entwurf-v2-native-push.js";
 import { executeControlSocketSend, } from "./entwurf-v2-send.js";
 import { resolveDeadControlSendFallback } from "./entwurf-v2-send-fallback.js";
-import { defaultMetaMailboxDir, defaultMetaSessionsDir, enqueueMetaMessage, metaCapabilityFor, metaRecordExistsByGardenId, readAddressableMetaIdentity, readMetaReceiverMarker, } from "./meta-session.js";
+import { defaultMetaMailboxDir, defaultMetaSessionsDir, enqueueMetaMessage, metaCapabilityFor, metaRecordExistsByGardenId, readAddressableMetaIdentity, readMetaReceiverMarker, readMetaSenderMarker, requireBackend, } from "./meta-session.js";
 import { resolveNativePushAdapter as realResolveNativePushAdapter, } from "./native-push/adapter.js";
 import { CONTROL_SOCKET_DIR, controlSocketPath, inspectControlSocketPath, inspectTargetControlSocket, isRecordLessSocketCandidate, } from "./socket-discovery.js";
 import { classifyConnectError, probeSocketLiveness } from "./socket-probe.js";
@@ -77,6 +77,8 @@ export function makeProductionEntwurfV2Deps(opts) {
         metaRecordExists: s.metaRecordExists ?? metaRecordExistsByGardenId,
         readIdentity: s.readIdentity ?? readAddressableMetaIdentity,
         readReceiverMarker: s.readReceiverMarker ?? ((gid) => readMetaReceiverMarker({ gardenId: gid })),
+        readSenderMarker: s.readSenderMarker ??
+            ((backend, ownerPid) => readMetaSenderMarker({ backend: requireBackend(backend), ownerPid })),
         inspectPath: s.inspectPath ?? inspectControlSocketPath,
         acquireLock: s.acquireLock ?? realAcquireLock,
         releaseLock: s.releaseLock ?? realReleaseLock,
@@ -98,22 +100,32 @@ export function makeProductionEntwurfV2Deps(opts) {
         enqueue: io.enqueue,
     });
     // ── ONE deliverability seam (SE-2 2d-3): wake-mode capability AND a live active-
-    // receiver (a presence marker that matches THIS identity). The SAME closure is injected
-    // into the decider AND the dead-fallback, so a direct send and a re-resolved fallback
-    // send can never drift to different deliverability verdicts. recordBacked is true by
-    // construction — resolveTarget already proved the record exists before any unsupported-
-    // backend mailbox route, and the closure is only consulted on that route. A null /
-    // dead-owner / identity-mismatched marker is fail-closed to inactive (SE-2): a reply to a
-    // terminated self-fetch citizen is rejected, not enqueued as mailbox garbage. ──────────
+    // receiver. The SAME closure is injected into the decider AND the dead-fallback, so a
+    // direct send and a re-resolved fallback send can never drift to different deliverability
+    // verdicts. recordBacked is true by construction — resolveTarget already proved the record
+    // exists before any unsupported-backend mailbox route, and the closure is only consulted on
+    // that route. A null / dead-owner / identity-mismatched marker is fail-closed to inactive
+    // (SE-2): a reply to a terminated self-fetch citizen is rejected, not enqueued as mailbox
+    // garbage.
+    //
+    // The two receiver facts come from the SHARED composition (#101 결함 B), never from one
+    // value copied into both slots. `ownerAlive` is the marker↔identity match on a live owner;
+    // `watchArmed` is the separate measurement that this owner is STILL serving this garden.
+    // They were the same expression until a Claude session switch inside one pid left a retired
+    // garden's marker reading as an armed doorbell and a real message rotted unread in its
+    // mailbox. `entwurf_self` calls the same composition, so a citizen's own replyability can
+    // never disagree with what dispatch decided about it. ──────────
     const mailboxDeliverabilityFor = (identity) => {
         const wakeMode = metaCapabilityFor(identity.backend).wakeMode;
-        const marker = io.readReceiverMarker(identity.gardenId);
-        const matched = receiverMarkerMatchesIdentity(marker, identity);
+        const { ownerAlive, watchArmed } = resolveMailboxReceiverFacts(identity, {
+            readReceiverMarker: io.readReceiverMarker,
+            readSenderMarker: io.readSenderMarker,
+        });
         return mailboxConversationalDeliverable({
             wakeMode,
             recordBacked: true,
-            ownerAlive: matched,
-            watchArmed: matched,
+            ownerAlive,
+            watchArmed,
         });
     };
     // ── target resolution (QB1 + QB2) ─────────────────────────────────────────

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-surface.js

@@ -103,6 +103,12 @@ export function renderEntwurfV2Result(result) {
                         `\n  ${c.detail}` +
                         (c.holder ? `\n  holder: pid ${c.holder.pid} on ${c.holder.hostname} since ${c.holder.createdAt}` : "");
             }
+            // #101 갭 C: name WHICH receiver axis failed. "mailbox-undeliverable" alone sent a
+            // caller looking for a dead session when the session was alive and had simply
+            // switched to another garden — the predicate knew that and the surface threw it away.
+            if (result.diagnostic?.kind === "mailbox-undeliverable") {
+                text += `\n  mailbox-undeliverable: ${result.diagnostic.reason}`;
+            }
             return { text, isError: true };
         }
         case "executed": {

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js

@@ -1661,6 +1661,44 @@ export function readMetaReceiverMarker(opts) {
         return null;
     }
 }
+/**
+ * Retire a receiver presence marker THIS owner pid wrote (#101 결함 A).
+ *
+ * A native process that switches sessions in place — an in-session `/resume` or `/clear`
+ * fires a second SessionStart inside the same pid under a new native session id — leaves
+ * the previous garden's marker behind, naming a live owner whose watch is gone. Measured
+ * on oracle 2026-09-04: one pid (143742) held two gardens' markers four seconds apart, and
+ * mail sent to the retired one sat unread.
+ *
+ * ONLY THE MARKER. The meta-record stays: records are identity, and deleting one
+ * outside `meta-bridge-fresh-cut` would fight store certification (Hard Rule 7/8).
+ * A retired citizen keeps its record, its transcript and its listing — it loses only
+ * the claim that a doorbell is armed for it, which is exactly the claim that stopped
+ * being true.
+ *
+ * Fail-closed the other way too: the marker is read back first and removed ONLY when its
+ * `ownerPid` field equals the one passed here — pid equality, which is what a caller can
+ * actually check; it does not prove the same PROCESS wrote it (a reused pid compares equal),
+ * and the reader-side start-key guard is where that finer distinction lives. It is enough for
+ * the rule this serves: a hook never retires a watch some other pid is holding. Returns whether a marker was actually removed. Never throws — a retirement
+ * that cannot happen is a log line, not a broken session start.
+ */
+export function removeMetaReceiverMarker(opts) {
+    try {
+        const receiversDir = opts.receiversDir ?? defaultMetaReceiversDir();
+        const file = metaReceiverMarkerPath(opts.gardenId, receiversDir);
+        // verifyOwner:false — the point is the OWNERSHIP field, not the owner's liveness;
+        // a marker whose owner already died is still this pid's to clean up when it names it.
+        const marker = readMetaReceiverMarker({ markerPath: file, verifyOwner: false });
+        if (!marker || marker.ownerPid !== opts.ownerPid)
+            return false;
+        fs.unlinkSync(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Idempotent fs upsert (writes v3 identity). CERTIFY the whole active store, then
  * decide create-vs-attach on record EXISTENCE and write atomically as v3. On