@junghanacs/entwurf 0.17.2 → 0.18.0

package/mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js

@@ -28,6 +28,20 @@
  * a UserPromptSubmit fire does a degraded RECORD backfill (upsert) but cannot
  * re-arm the idle watch — the record's address is restored, the wake is not.
  *
+ * SESSION SWITCH (#101). One Claude process serves one session at a time, but it can
+ * change which. Measured on oracle 2026-09-04 (raw lab S1-S6, Claude Code 2.1.260): a bare
+ * `claude` mints a NEW session (`source=startup`), and an in-session `/resume` or `/clear`
+ * then fires a SECOND SessionStart under the SAME pid for a DIFFERENT native id
+ * (`source=resume` / `source=clear`). The first garden is left behind — in the #101 field
+ * case its transcript was never written at all — while its receiver marker still names a
+ * LIVE owner, so a sender reads an armed doorbell nobody holds. This hook therefore reads
+ * the sender marker BEFORE overwriting it and retires the previous garden's receiver marker
+ * (marker only — records are identity and are never deleted here; and only a marker this
+ * pid owns). Compaction (`source=compact`) re-fires SessionStart for the SAME native id, so
+ * the same rule retires nothing there — measured, not assumed. The envelope's `source` is
+ * logged beside all of it and decides nothing: the switch is settled by what is on disk,
+ * which holds on every host and vendor version.
+ *
  * LAUNCH: never invoked directly by Claude. `hooks.json` declares the EXEC form
  * (`command` = `<plugin-root>/scripts/hook-launch.sh`, `args` = [node, this file]),
  * and the launcher `exec`s that argv — so this process inherits the launcher's pid
@@ -45,7 +59,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { defaultMetaMailboxDir, defaultMetaSessionsDir, isPlausibleOwnerPid, upsertMetaSession, writeMetaReceiverMarker, writeMetaSenderMarker, } from "./lib/meta-session.js";
+import { defaultMetaMailboxDir, defaultMetaSessionsDir, isPlausibleOwnerPid, readMetaSenderMarker, removeMetaReceiverMarker, upsertMetaSession, writeMetaReceiverMarker, writeMetaSenderMarker, } from "./lib/meta-session.js";
 function logLine(level, message) {
     try {
         // dirname(meta-sessions) == the pi agent dir — no extra resolver export needed.
@@ -168,6 +182,13 @@ function main() {
             ? env.model_id
             : undefined;
     const eventName = typeof env.hook_event_name === "string" ? env.hook_event_name : "SessionStart";
+    // `source` (startup | resume | clear | compact) is Claude's own word for WHY this
+    // SessionStart fired. It is logged on every line below and decides nothing: a session
+    // switch is settled by what is on disk (the sender marker's garden), which is true on
+    // every host and every vendor version. Logging it is how this host finally gets a
+    // receipt for the envelope order the #101 diagnosis could only read from vendor docs —
+    // and the raw lab (scripts/raw-claude-session-switch) reads these lines, not a guess.
+    const source = typeof env.source === "string" && env.source.length > 0 ? env.source : "(unset)";
     if (!sessionId || !transcriptPath) {
         // A degraded envelope: cannot mint an honest reference record. Log + no-op
         // rather than write a half-record or guess a transcript path. LEVEL depends
@@ -185,7 +206,7 @@ function main() {
             input: { backend: "claude-code", nativeSessionId: sessionId, transcriptPath, cwd, model },
         });
         gardenId = result.record.gardenId;
-        logLine("INFO", `${result.action} record ${path.basename(result.path)} (event=${eventName}, native=${sessionId})`);
+        logLine("INFO", `${result.action} record ${path.basename(result.path)} (event=${eventName}, source=${source}, native=${sessionId})`);
     }
     catch (err) {
         // Best-effort: a broken record store must surface via the doctor, not by
@@ -210,9 +231,48 @@ function main() {
     // an env var. Missing launcher provenance or an implausible parent yields no marker.
     const ownerPid = resolveMetaHookOwnerPid();
     if (ownerPid !== null) {
+        // SESSION SWITCH RETIREMENT (#101 결함 A). One Claude process serves ONE session at a
+        // time, but it can switch which: an in-session `/resume` or `/clear` fires a second
+        // SessionStart under the same pid for a different native id, leaving the session the
+        // process started with behind (measured on oracle, meta-bridge-hook.log 2026-09-04
+        // 13:13:04 `source=startup` → 13:13:37 `source=resume`; the field case at 09:31:35 →
+        // 09:31:39 is the same shape). Whatever it was serving before is no longer being
+        // drained, so the marker advertising its doorbell has to go.
+        //
+        // The evidence is the sender marker as it stands RIGHT NOW — pid → the garden this
+        // process serves — which is why this reads it BEFORE the write below overwrites it with
+        // the new garden. No vendor field is consulted: `source` is logged, not branched on, so
+        // a host or version that words it differently changes nothing here. A same-garden
+        // re-registration (every UserPromptSubmit, a CwdChanged, a re-fired SessionStart) finds
+        // an equal garden id and retires NOTHING — the marker it would remove is the live one.
+        //
+        // Only the marker, never the record (see removeMetaReceiverMarker), and only a marker
+        // this pid owns.
+        //
+        // AND ONLY ON AN EVENT THAT CAN ARM THE REPLACEMENT (cross-review, 2026-09-04). This
+        // block sits before the UserPromptSubmit early-return, and UPS cannot emit watchPaths —
+        // so a retirement reached from there would take a doorbell down with nothing in the same
+        // run able to put one back. A watch is retired only by a run that arms one; that is the
+        // whole rule. `armProvenanceFor` is the same predicate the arm block below uses, so the
+        // two can never disagree about which events those are.
+        //
+        // It is NOT a defence against a keystroke from a session this pid has left: measured on
+        // oracle 2026-09-04 (raw lab S1-S6, meta-bridge-hook.log), every UserPromptSubmit named
+        // the native id its own pid's preceding SessionStart had established — 8 of 8, none
+        // otherwise. The hook runs synchronously inside the session's own process, so a UPS
+        // envelope is that session speaking, and the sender pointer it moves is authoritative.
+        const previous = armProvenanceFor(eventName) !== null
+            ? readMetaSenderMarker({ backend: "claude-code", ownerPid, verifyOwner: false })
+            : null;
+        if (previous && previous.gardenId !== gardenId) {
+            const retired = removeMetaReceiverMarker({ gardenId: previous.gardenId, ownerPid });
+            logLine("INFO", retired
+                ? `retired receiver marker ${previous.gardenId} — owner pid ${ownerPid} switched to ${gardenId} (event=${eventName}, source=${source})`
+                : `no receiver marker to retire for ${previous.gardenId} — owner pid ${ownerPid} switched to ${gardenId} (event=${eventName}, source=${source})`);
+        }
         try {
             writeMetaSenderMarker({ backend: "claude-code", gardenId, nativeSessionId: sessionId, cwd, ownerPid });
-            logLine("INFO", `sender marker ${ownerPid} -> ${gardenId} (event=${eventName})`);
+            logLine("INFO", `sender marker ${ownerPid} -> ${gardenId} (event=${eventName}, source=${source})`);
         }
         catch (err) {
             logLine("WARN", `sender marker write failed (event=${eventName}, pid=${ownerPid}, garden=${gardenId}): ${err instanceof Error ? err.message : String(err)}`);
@@ -259,7 +319,7 @@ function main() {
                     ownerPid,
                     armProvenance,
                 });
-                logLine("INFO", `receiver marker ${gardenId} owner=${ownerPid} arm=${eventName}`);
+                logLine("INFO", `receiver marker ${gardenId} owner=${ownerPid} arm=${eventName} source=${source}`);
             }
             catch (err) {
                 logLine("WARN", `receiver marker write failed (event=${eventName}, garden=${gardenId}): ${err instanceof Error ? err.message : String(err)}`);

package/mcp/entwurf-bridge/src/index.ts

@@ -66,7 +66,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 
 import { controlSocketPathIn, defaultControlSocketDir } from "../../../pi-extensions/lib/control-socket-path.js";
-import { receiverMarkerMatchesIdentity } from "../../../pi-extensions/lib/entwurf-deliverability.ts";
+import { resolveMailboxReceiverFacts } from "../../../pi-extensions/lib/entwurf-deliverability.ts";
 import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provider.ts";
 import { renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.ts";
 import { computeSelfAddressability, type MetaDeliveryDomain } from "../../../pi-extensions/lib/entwurf-self-address.ts";
@@ -91,6 +91,8 @@ import {
 	readActiveStoreEntries,
 	readMetaInbox,
 	readMetaReceiverMarker,
+	readMetaSenderMarker,
+	requireBackend,
 } from "../../../pi-extensions/lib/meta-session.ts";
 import { freshCall, renderFreshCall } from "../../../pi-extensions/lib/mux-fresh-call.ts";
 import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.ts";
@@ -272,9 +274,12 @@ async function buildTrustedMetaSenderEnvelope(cwd: string = process.cwd()): Prom
 	//     admits another self-fetch citizen.
 	//   none        ← neither. omp today: no mailbox drain, no native-push adapter. Rendering
 	//     this as self-fetch printed a mailboxPath nothing drains.
-	//   self-fetch (claude-code/copilot): can this citizen's own inbox wake? → the receiver
-	//     presence marker (readMetaReceiverMarker folds a dead/reused owner to null, so a match
-	//     means a live, ARMED receiver — the sender marker proves identity, never an armed watch).
+	//   self-fetch (claude-code/copilot): can this citizen's own inbox wake? → the SHARED
+	//     receiver composition `resolveMailboxReceiverFacts`, the same one the v2 dispatch seam
+	//     uses, so a citizen's self-reported replyability can never disagree with what dispatch
+	//     decides about it. It reads the presence marker (a dead/reused owner already folds to
+	//     null) AND, where the watch owner is the sender-marker process, the #101 join that says
+	//     the owner is still serving THIS garden rather than one it switched away from.
 	//   native-push (antigravity): there is no inbox and no watch. A reply is injected into a
 	//     live app-server conversation, so only an adapter probe can answer. Composing the
 	//     receiver atom here would demand `watchArmed` from a backend that never arms one, and
@@ -298,14 +303,17 @@ async function buildTrustedMetaSenderEnvelope(cwd: string = process.cwd()): Prom
 				}
 			: metaDeliveryDomain === "self-fetch"
 				? (() => {
-						const receiver = readMetaReceiverMarker({ gardenId: identity.gardenId });
-						const active = receiverMarkerMatchesIdentity(receiver, identity);
+						const receiver = resolveMailboxReceiverFacts(identity, {
+							readReceiverMarker: (gardenId: string) => readMetaReceiverMarker({ gardenId }),
+							readSenderMarker: (backend: string, ownerPid: number) =>
+								readMetaSenderMarker({ backend: requireBackend(backend), ownerPid }),
+						});
 						return {
 							origin: "meta-session" as const,
 							metaDeliveryDomain,
 							recordBacked: true,
-							ownerAlive: active,
-							watchArmed: active,
+							ownerAlive: receiver.ownerAlive,
+							watchArmed: receiver.watchArmed,
 						};
 					})()
 				: {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.17.2",
+	"version": "0.18.0",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {
@@ -143,6 +143,7 @@
 		"check-omp-receive-arm": "./run.sh check-omp-receive-arm",
 		"check-omp-fresh-preflight": "./run.sh check-omp-fresh-preflight",
 		"check-hook-launch-topology": "./run.sh check-hook-launch-topology",
+		"check-meta-hook-session-switch": "./run.sh check-meta-hook-session-switch",
 		"check-acp-carrier-augment": "./run.sh check-acp-carrier-augment",
 		"check-agy-permission-matrix": "./run.sh check-agy-permission-matrix",
 		"check-gate-qualification": "./run.sh check-gate-qualification",
@@ -165,7 +166,7 @@
 		"check:toolchain": "pnpm lint && pnpm typecheck",
 		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface",
 		"check:contracts": "./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-resume-args && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-entwurf-facts && ./run.sh check-control-socket-path && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment",
-		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex",
+		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex",
 		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},
 	"pi": {

package/pi-extensions/lib/entwurf-deliverability.ts

@@ -109,6 +109,110 @@ export function receiverMarkerMatchesIdentity(
 	);
 }
 
+// ── the watch-owner ↔ sender-marker join (#101 결함 B) ──────────────────────
+// A receiver marker proves "a LIVE process once armed a watch for this garden".
+// It does NOT prove "that process is serving this garden RIGHT NOW". One native
+// process can hold markers for several gardens and drain exactly one of them:
+// Claude Code's session switch (an in-session `/resume` or `/clear`) fires a second
+// SessionStart inside the SAME pid under a NEW native session id, so the first
+// garden's marker keeps naming a live owner forever while the doorbell it advertises
+// is gone. Measured on oracle 2026-09-04 (#101): one pid held both markers, a
+// 09:33 enqueue to the retired garden sat unread as a bare `.msg` for ≥50 minutes —
+// the "enqueue into a void" this module's header exists to refuse.
+//
+// The join that decides it is already on disk: the SENDER marker is keyed by owner
+// pid and rewritten with the CURRENT garden on every arm/prompt, so
+// `meta-senders/<backend>/<ownerPid>.json.gardenId` is the answer to "which garden
+// does this process serve now?". A receiver marker naming a different garden than
+// its own owner's sender marker is a retired watch.
+//
+// SCOPE IS NOT UNIVERSAL, AND THE MARKER SAYS SO. The join only exists where the
+// watch owner IS the process the sender marker is keyed to. That is true for the
+// Claude hook (one `ownerPid` variable writes both markers —
+// `meta-bridge-hook.ts` sender + receiver arm) and false BY CONSTRUCTION for
+// Copilot, whose watch lives in a forked first-party extension child
+// (`extension.mjs` writes `ownerPid: process.pid`) while its sender marker is keyed
+// to the CLI parent (`meta-bridge-hook-copilot.ts` uses `process.ppid`). Applying
+// the join there would make every Copilot citizen permanently undeliverable — a
+// regression on a shipped lane, not a fix. `ownerKind` is recorded on the marker for
+// exactly this reason ("the marker records which, because the pid a reader verifies
+// differs" — AGENTS.md, self-fetch domain), so it is the axis, not `backend`.
+//
+// `omp-host` is a CANDIDATE, deliberately not admitted here: OMP already retires the
+// previous garden in-process on its `/new` edge (the unarm the claude hook lacked),
+// so the cell this join closes has a different owner there. Admitting it needs its
+// own measurement, not this file's optimism.
+export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = ["claude-code-cli"];
+
+/** Does this watch owner share its pid with the backend's sender marker? */
+export function receiverOwnerKindJoinsSender(ownerKind: string): boolean {
+	return SENDER_JOINED_RECEIVER_OWNER_KINDS.includes(ownerKind);
+}
+
+/** The receiver-marker fields the join reads (a structural shape, like ReceiverIdentityFacts). */
+export interface ReceiverOwnerFacts extends ReceiverIdentityFacts {
+	ownerPid: number;
+	ownerKind: string;
+}
+
+/** The sender-marker fields the join reads: which garden this owner pid serves NOW. */
+export interface SenderOwnerFacts {
+	gardenId: string;
+	backend: string;
+}
+
+/**
+ * Is the watch owner still serving THIS garden? Fail-closed inside the join's scope:
+ * an absent/unreadable sender marker, or one naming another garden or backend, means
+ * the watch is retired. Outside the scope (an ownerKind whose watch owner is not the
+ * sender-marker process) the join does not apply and the marker's own live-owner guard
+ * is the whole rule — returning true here is NOT optimism, it is "this axis says
+ * nothing", and the caller has already required the marker to match the identity.
+ */
+export function receiverOwnerServesGarden(
+	marker: ReceiverOwnerFacts,
+	senderMarker: SenderOwnerFacts | null | undefined,
+): boolean {
+	if (!receiverOwnerKindJoinsSender(marker.ownerKind)) return true;
+	return !!senderMarker && senderMarker.gardenId === marker.gardenId && senderMarker.backend === marker.backend;
+}
+
+/** The two marker readers the mailbox receiver facts are composed from (injected — this module does no IO). */
+export interface MailboxReceiverReaders {
+	/** Read the receiver presence marker for a garden id (null = absent/corrupt/dead owner). */
+	readReceiverMarker: (gardenId: string) => ReceiverOwnerFacts | null;
+	/** Read the sender marker for an owner pid (null = absent/corrupt/dead owner). */
+	readSenderMarker: (backend: string, ownerPid: number) => SenderOwnerFacts | null;
+}
+
+/**
+ * THE single composition of the two mailbox receiver facts, over injected readers.
+ * Both production consumers — the v2 `mailboxDeliverabilityFor` seam and the MCP
+ * bridge's `entwurf_self` — call THIS, so a direct send, a re-resolved fallback send
+ * and a citizen's own replyability can never drift to different verdicts.
+ *
+ *   ownerAlive  — a live-owner marker that names THIS identity (the reader already ran
+ *                 the plausibility + start-key guards; this adds the identity match).
+ *   watchArmed  — that owner is still serving this garden (the join above). It is a
+ *                 MEASUREMENT, never a copy of ownerAlive: copying it is what let a
+ *                 retired watch read as an armed doorbell (#101 결함 B).
+ *
+ * `recordBacked` is NOT decided here — it stays the caller's explicit fact, so an
+ * absent record and a dead owner stay distinguishable in the reason string.
+ */
+export function resolveMailboxReceiverFacts(
+	identity: ReceiverIdentityFacts,
+	readers: MailboxReceiverReaders,
+): { ownerAlive: boolean; watchArmed: boolean } {
+	const marker = readers.readReceiverMarker(identity.gardenId);
+	const ownerAlive = receiverMarkerMatchesIdentity(marker, identity);
+	if (!ownerAlive || !marker) return { ownerAlive: false, watchArmed: false };
+	const senderMarker = receiverOwnerKindJoinsSender(marker.ownerKind)
+		? readers.readSenderMarker(marker.backend, marker.ownerPid)
+		: null;
+	return { ownerAlive, watchArmed: receiverOwnerServesGarden(marker, senderMarker) };
+}
+
 export interface MailboxDeliverabilityFacts extends MetaReceiverActiveFacts {
 	/** The target backend's wake mode (from the capability registry). */
 	wakeMode?: WakeMode | string;

package/pi-extensions/lib/entwurf-fact-provider.ts

@@ -27,7 +27,13 @@
  * one diagnostic carries the fact. (pi + same-gid socket = the normal merge.)
  */
 
-import { type FactList, isOutOfSocketDomainGardenIdConflict, resolveFactList } from "./entwurf-facts.ts";
+import {
+	type FactList,
+	isOutOfSocketDomainGardenIdConflict,
+	type PeerObserver,
+	resolveFactList,
+} from "./entwurf-facts.ts";
+import { observePeerFacts } from "./entwurf-peer-observe.ts";
 import { isLivenessSupported } from "./entwurf-v2-contract.ts";
 import {
 	type ActiveStoreEntry,
@@ -93,6 +99,12 @@ export interface EntwurfFactsDeps {
 	readRecord: (filename: string) => string;
 	/** Socket axis: injected into scanSocketProbes (controlDir/readdir/probe). */
 	socket?: Partial<SocketScanDeps>;
+	/** Observation axis (#101): per-citizen receiver + transcript facts. Defaults to the
+	 * REAL measurement — the same seam shape `makeProductionEntwurfV2Deps` uses, so the two
+	 * wiring sites (MCP + pi-native) cannot drift by each passing their own observer, and a
+	 * gate still drives the assembly with a fake and no filesystem. A caller that injects
+	 * nothing gets facts; a caller that injects `() => UNOBSERVED_PEER` says so on every row. */
+	observe?: PeerObserver;
 }
 
 function diagnosticSortKey(d: EntwurfDiagnostic): string {
@@ -113,10 +125,12 @@ function diagnosticSortKey(d: EntwurfDiagnostic): string {
 }
 
 /**
- * Assemble the facts-only listing. Pure over its injected deps (no direct IO) so
- * the gate drives it without a filesystem; slice 4c supplies the real readdir /
- * readFile / probe. Probes are gid + liveness only (#50 C4 — the per-socket
- * get_info enrich left with the socket-only quasi-citizen listing).
+ * Assemble the facts-only listing. Driven entirely through injected deps, so the gate
+ * runs it without a filesystem; slice 4c supplies the real readdir / readFile / probe.
+ * The one dep with a REAL default is `observe` (#101) — see its comment: a per-citizen
+ * measurement both wiring sites must make identically is safer as one default than as two
+ * call-site arguments. Probes are gid + liveness only (#50 C4 — the per-socket get_info
+ * enrich left with the socket-only quasi-citizen listing).
  */
 export async function listEntwurfFacts(deps: EntwurfFactsDeps): Promise<EntwurfFactsResult> {
 	const diagnostics: EntwurfDiagnostic[] = [];
@@ -183,7 +197,7 @@ export async function listEntwurfFacts(deps: EntwurfFactsDeps): Promise<EntwurfF
 	//    fire as the last line of defense, never caught here.
 	const cleanIdentities = identities.filter((i) => !conflictGids.has(i.gardenId));
 	const cleanProbes = probes.filter((p) => !conflictGids.has(p.gardenId));
-	const facts: FactList = resolveFactList(cleanIdentities, cleanProbes);
+	const facts: FactList = resolveFactList(cleanIdentities, cleanProbes, deps.observe ?? observePeerFacts);
 
 	// 5. #50 C4 demotion: a record-less socket is a diagnostic, not a listing
 	//    section. One diagnostic per socket (subjects aggregate at render, F8);

package/pi-extensions/lib/entwurf-facts.ts

@@ -19,6 +19,9 @@
  *     a peer-facing fact; `entwurf_peers` exposes identity + cwd-history, not
  *     filesystem internals. (who-can / dispatch read it via the meta-record
  *     directly when they genuinely need it — it does not belong in the listing.)
+ *     Whether that transcript EXISTS is a different thing and is carried (#101):
+ *     the path stays private, the fact that a citizen has never written a turn
+ *     does not.
  *
  * The 4-value liveness (`alive|dead|indeterminate|unsupported`, R3b) and the
  * out-of-domain → `unsupported` rule (R1: never coerce an unprobed backend to
@@ -47,8 +50,44 @@ export interface PeerFact {
 	recordUpdatedAt: string;
 	// — the single computed fact: 4-value liveness (R1/R3b). NOT a verb. —
 	liveness: FactLiveness;
+	// — observed state (#101). Facts, not verbs: they say what was found on disk, not
+	//   what a caller may do about it. For claude-code every row reads
+	//   `liveness=unsupported` — the control-socket probe does not apply — so the listing
+	//   showed nothing that separated a live citizen from a phantom, and a caller picking
+	//   "the newest record in this cwd" picked the phantom as often as the real one.
+	receiver: ReceiverObservation;
+	transcript: TranscriptObservation;
 }
 
+/**
+ * The mailbox receiver axis, as OBSERVED for this citizen.
+ *   active     a presence marker whose owner is live AND still serving this garden.
+ *   inactive   a marker exists but fails that test (dead owner, drifted identity, or an
+ *              owner that switched to another garden).
+ *   none       no marker at all — never armed, or retired.
+ *   n/a        this backend has no mailbox receiver axis (pi, antigravity).
+ *   unobserved nobody measured it. Only reachable when a caller drives the fact core
+ *              without an observer; it is the honest word for "not looked at", never a
+ *              quiet stand-in for `none`.
+ */
+export type ReceiverObservation = "active" | "inactive" | "none" | "n/a" | "unobserved";
+
+/** Does the recorded transcript exist on disk? `absent` is what a never-used registration
+ * looks like: a record with no conversation behind it. */
+export type TranscriptObservation = "exists" | "absent" | "unobserved";
+
+export interface PeerObservations {
+	receiver: ReceiverObservation;
+	transcript: TranscriptObservation;
+}
+
+/** What a caller that measured nothing must say. Explicit and greppable — a row that
+ * silently defaulted to `none`/`absent` would be a fabricated fact. */
+export const UNOBSERVED_PEER: PeerObservations = { receiver: "unobserved", transcript: "unobserved" };
+
+/** Measure the two observed axes for one citizen. Injected, so this module stays pure. */
+export type PeerObserver = (identity: MetaIdentity) => PeerObservations;
+
 /**
  * Compose a `PeerFact` from a citizen's identity and an optional socket probe.
  *
@@ -61,7 +100,11 @@ export interface PeerFact {
  *
  * Pure: same inputs → same output, no IO.
  */
-export function resolvePeerFact(identity: MetaIdentity, socket: SocketLiveness | null): PeerFact {
+export function resolvePeerFact(
+	identity: MetaIdentity,
+	socket: SocketLiveness | null,
+	observations: PeerObservations = UNOBSERVED_PEER,
+): PeerFact {
 	return {
 		gardenId: identity.gardenId,
 		backend: identity.backend,
@@ -71,6 +114,8 @@ export function resolvePeerFact(identity: MetaIdentity, socket: SocketLiveness |
 		createdAt: identity.createdAt,
 		recordUpdatedAt: identity.recordUpdatedAt,
 		liveness: factLivenessOf(identity.backend, socket),
+		receiver: observations.receiver,
+		transcript: observations.transcript,
 	};
 }
 
@@ -172,7 +217,11 @@ export interface FactList {
  * A gardenId is never emitted as both a `PeerFact` and a `RecordLessSocketFact`;
  * a record-less socket becomes a `PeerFact` the moment a record claims the gid.
  */
-export function resolveFactList(identities: MetaIdentity[], socketProbes: SocketProbe[]): FactList {
+export function resolveFactList(
+	identities: MetaIdentity[],
+	socketProbes: SocketProbe[],
+	observe: PeerObserver = () => UNOBSERVED_PEER,
+): FactList {
 	const probeMap = new Map<string, SocketProbe>();
 	for (const probe of socketProbes) {
 		if (probeMap.has(probe.gardenId)) {
@@ -207,7 +256,7 @@ export function resolveFactList(identities: MetaIdentity[], socketProbes: Socket
 			}
 			socket = null;
 		}
-		peers.push(resolvePeerFact(identity, socket));
+		peers.push(resolvePeerFact(identity, socket, observe(identity)));
 		consumed.add(gid);
 	}
 

package/pi-extensions/lib/entwurf-peer-observe.ts

@@ -0,0 +1,77 @@
+/**
+ * entwurf-peer-observe — the IO half of the two OBSERVED peer facts (#101).
+ *
+ * `entwurf_peers` used to answer a claude-code citizen with `liveness=unsupported` and
+ * nothing else, because the control-socket probe genuinely does not apply to a self-fetch
+ * backend. Two same-cwd rows — one a live conversation, one an abandoned startup session
+ * whose transcript was never written — were therefore byte-identical in the listing, and
+ * a caller picking "the newest record in this cwd" (the natural heuristic, and the one the
+ * surface encourages) picked the phantom as often as the real one. Both halves of the
+ * distinction were already on disk; nothing read them.
+ *
+ * FACTS, NOT VERBS. `receiver` and `transcript` say what was found, never what to do
+ * about it: no `sendable`, no `deliverable`, no transport. The listing stays a listing —
+ * dispatch still computes routing at call time from the same underlying markers.
+ *
+ * ONE MEASUREMENT, TWO WORDS. `receiver` is derived from the SAME
+ * `resolveMailboxReceiverFacts` composition the v2 dispatch seam and `entwurf_self` use.
+ * The surfaces are allowed to phrase it differently — a listing wants an enum, a reject
+ * wants a sentence — but they may not disagree, so the enum is a projection of that atom
+ * rather than a second opinion about the same markers.
+ */
+
+import * as fs from "node:fs";
+import { resolveMailboxReceiverFacts } from "./entwurf-deliverability.ts";
+import type { PeerObservations, ReceiverObservation, TranscriptObservation } from "./entwurf-facts.ts";
+import {
+	type MetaBackend,
+	type MetaIdentity,
+	metaCapabilityFor,
+	metaReceiverMarkerPath,
+	readMetaReceiverMarker,
+	readMetaSenderMarker,
+	requireBackend,
+} from "./meta-session.ts";
+
+/**
+ * The mailbox receiver axis for one citizen.
+ *
+ * `n/a` is not a failure: a backend with no mailbox (pi's control socket, antigravity's
+ * native push) has no receiver marker to be right or wrong about, and printing `none`
+ * there would invent a missing thing. The `inactive` / `none` split is what a reader
+ * needs to tell "a watch was armed and is no longer valid" from "no watch was ever
+ * armed here", so it is taken from the marker FILE's existence rather than from the
+ * reader's null — the reader folds absent, corrupt and dead-owner into one null.
+ */
+function observeReceiver(identity: MetaIdentity): ReceiverObservation {
+	if (metaCapabilityFor(identity.backend).wakeMode !== "self-fetch") return "n/a";
+	const facts = resolveMailboxReceiverFacts(identity, {
+		readReceiverMarker: (gardenId: string) => readMetaReceiverMarker({ gardenId }),
+		readSenderMarker: (backend: string, ownerPid: number) =>
+			readMetaSenderMarker({ backend: requireBackend(backend) as MetaBackend, ownerPid }),
+	});
+	if (facts.ownerAlive && facts.watchArmed) return "active";
+	return fs.existsSync(metaReceiverMarkerPath(identity.gardenId)) ? "inactive" : "none";
+}
+
+/**
+ * Does the recorded transcript exist? A record is minted at SessionStart, but a harness
+ * that writes its transcript lazily (Claude Code writes on the first turn) leaves a
+ * citizen with no conversation behind it until someone actually says something. The PATH
+ * stays private — only its existence crosses to the listing.
+ */
+function observeTranscript(identity: MetaIdentity): TranscriptObservation {
+	try {
+		// A record with no recorded transcript path has nothing to stat — that is the same
+		// observable state as a path that is not there, and neither is an `exists` claim.
+		return identity.transcriptPath && fs.existsSync(identity.transcriptPath) ? "exists" : "absent";
+	} catch {
+		// A transcript we cannot stat is not a transcript we can claim exists.
+		return "absent";
+	}
+}
+
+/** The production observer: both axes, measured for one citizen. */
+export function observePeerFacts(identity: MetaIdentity): PeerObservations {
+	return { receiver: observeReceiver(identity), transcript: observeTranscript(identity) };
+}

package/pi-extensions/lib/entwurf-peers-render.ts

@@ -39,9 +39,20 @@ export interface EntwurfPeersRender {
 	payload: EntwurfPeersPayload;
 }
 
+// `receiver` and `transcript` are OBSERVED facts, not routing (#101): they say what was
+// found on disk for this citizen, and a caller still asks entwurf_v2 what may be done
+// about it. They earn a column because for every claude-code row `liveness` reads
+// `unsupported` — the socket probe does not apply — so two rows in one cwd, a live
+// conversation and an abandoned startup session whose transcript was never written, used to
+// be indistinguishable here. `receiver=active|inactive|none|n/a` is a projection of the
+// same measurement dispatch uses; `transcript=exists|absent` is the record's transcript,
+// existence only, never the path.
 function renderPeerLine(p: PeerFact): string {
 	const model = p.model ?? "(unknown)";
-	return `- ${p.gardenId}  backend=${p.backend}  liveness=${p.liveness}  cwd=${p.cwd}  model=${model}`;
+	return (
+		`- ${p.gardenId}  backend=${p.backend}  liveness=${p.liveness}  receiver=${p.receiver}  ` +
+		`transcript=${p.transcript}  cwd=${p.cwd}  model=${model}`
+	);
 }
 
 function renderDiagnosticLine(d: EntwurfDiagnostic): string {

package/pi-extensions/lib/entwurf-v2-decider.ts

@@ -128,13 +128,24 @@ export type ExecutionPlan =
 // claim so 5c's at-most-once re-resolve runs under the same nonce) and null for the
 // lock-free meta-mailbox path (？7).
 //
-// A reject's optional machine-readable diagnostic. Only `target-locked` carries one:
-// the `LockConflict` (holder pid/host/createdAt, lockPath, human detail) the lock
-// primitive produced on contention. It rides ALONGSIDE the receipt — the receipt
-// schema is unchanged; 5d's surface renders it onto the reject. (B3: without this the
-// holder evidence was dropped at the decider boundary, so a PID-reuse permanent lock
-// could not be observed/cleared — F2-P2 "관측 가능해야 수용".)
-export type RejectDiagnostic = { kind: "target-locked"; conflict: LockConflict };
+// A reject's optional machine-readable diagnostic, riding ALONGSIDE the receipt — the
+// receipt schema is unchanged and 5d's surface renders the diagnostic onto the reject.
+// Two kinds, both here for the same reason: the evidence that decided the reject was
+// produced one layer down and would otherwise be dropped at this boundary, leaving the
+// caller a verdict with no way to see or clear its cause (F2-P2 "관측 가능해야 수용").
+//
+//   target-locked         the `LockConflict` (holder pid/host/createdAt, lockPath, human
+//                         detail) the lock primitive produced on contention. B3: without
+//                         it a PID-reuse permanent lock could not be observed/cleared.
+//   mailbox-undeliverable WHICH receiver axis failed, in the deliverability predicate's own
+//                         words — no backing record vs. a dead owner vs. a watch that is no
+//                         longer armed are three different situations with three different
+//                         fixes, and the bare `mailbox-undeliverable` reason told a caller
+//                         none of them (#101 갭 C). The predicate already computes the
+//                         sentence; this carries it instead of discarding it.
+export type RejectDiagnostic =
+	| { kind: "target-locked"; conflict: LockConflict }
+	| { kind: "mailbox-undeliverable"; reason: string };
 
 export type DispatchDecision =
 	| { kind: "reject"; receipt: RejectReceipt; diagnostic?: RejectDiagnostic }
@@ -327,7 +338,14 @@ export async function decideDispatch(input: DispatchInput, deps: DispatchDecider
 		// fail-closed (SE-2 2d-3). resolveDispatch then routes intent × deliverable.
 		const deliverability = await deps.mailboxDeliverabilityFor(identity);
 		const receipt = resolveDispatch(input.intent, "unsupported", deliverability.deliverable);
-		if (!receipt.ok) return reject(receipt);
+		// The predicate's reason travels with the reject (#101 갭 C). It is attached only when
+		// undeliverability is what produced the reject — an intent-shaped refusal on a
+		// DELIVERABLE target must not be dressed up as a receiver problem.
+		if (!receipt.ok) {
+			return deliverability.deliverable
+				? reject(receipt)
+				: reject(receipt, { kind: "mailbox-undeliverable", reason: deliverability.reason });
+		}
 		// the only allow cell here is fire-and-forget → meta-mailbox send.
 		const plan: ExecutionPlan = {
 			transport: "meta-mailbox",