@junghanacs/entwurf 0.17.2 → 0.18.0

package/pi-extensions/lib/entwurf-v2-production.ts

@@ -39,7 +39,7 @@ import {
 import {
 	type MailboxDeliverabilityResult,
 	mailboxConversationalDeliverable,
-	receiverMarkerMatchesIdentity,
+	resolveMailboxReceiverFacts,
 } from "./entwurf-deliverability.ts";
 import { isOutOfSocketDomainGardenIdConflict } from "./entwurf-facts.ts";
 import { isLivenessSupported } from "./entwurf-v2-contract.ts";
@@ -75,10 +75,13 @@ import {
 	enqueueMetaMessage,
 	type MetaIdentity,
 	type MetaReceiverMarker,
+	type MetaSenderMarker,
 	metaCapabilityFor,
 	metaRecordExistsByGardenId,
 	readAddressableMetaIdentity,
 	readMetaReceiverMarker,
+	readMetaSenderMarker,
+	requireBackend,
 } from "./meta-session.ts";
 import {
 	type NativePushAdapter,
@@ -111,6 +114,10 @@ export interface ProductionEntwurfV2Seams {
 	 * SE-2 2d-3 active-receiver source; the factory's `mailboxDeliverabilityFor` closure verifies
 	 * its identity match. */
 	readReceiverMarker: (gardenId: string) => MetaReceiverMarker | null;
+	/** Read the sender marker keyed to a receiver's owner pid — the "which garden does this
+	 * process serve NOW?" fact the #101 watch-owner join reads. Null = absent / dead owner /
+	 * corrupt, which the join treats as a retired watch inside its scope. */
+	readSenderMarker: (backend: string, ownerPid: number) => MetaSenderMarker | null;
 	/** Record-side lstat of the EXACT target socket path (no connect) for the pre-probe conflict. */
 	inspectPath: (socketPath: string) => Promise<TargetSocketInspection>;
 	acquireLock: (gid: string, deps: { dir?: string }) => AcquireLockResult;
@@ -183,6 +190,9 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 		metaRecordExists: s.metaRecordExists ?? metaRecordExistsByGardenId,
 		readIdentity: s.readIdentity ?? readAddressableMetaIdentity,
 		readReceiverMarker: s.readReceiverMarker ?? ((gid: string) => readMetaReceiverMarker({ gardenId: gid })),
+		readSenderMarker:
+			s.readSenderMarker ??
+			((backend: string, ownerPid: number) => readMetaSenderMarker({ backend: requireBackend(backend), ownerPid })),
 		inspectPath: s.inspectPath ?? inspectControlSocketPath,
 		acquireLock: s.acquireLock ?? realAcquireLock,
 		releaseLock: s.releaseLock ?? realReleaseLock,
@@ -207,22 +217,32 @@ export function makeProductionEntwurfV2Deps(opts: ProductionEntwurfV2Opts): Entw
 	});
 
 	// ── ONE deliverability seam (SE-2 2d-3): wake-mode capability AND a live active-
-	// receiver (a presence marker that matches THIS identity). The SAME closure is injected
-	// into the decider AND the dead-fallback, so a direct send and a re-resolved fallback
-	// send can never drift to different deliverability verdicts. recordBacked is true by
-	// construction — resolveTarget already proved the record exists before any unsupported-
-	// backend mailbox route, and the closure is only consulted on that route. A null /
-	// dead-owner / identity-mismatched marker is fail-closed to inactive (SE-2): a reply to a
-	// terminated self-fetch citizen is rejected, not enqueued as mailbox garbage. ──────────
+	// receiver. The SAME closure is injected into the decider AND the dead-fallback, so a
+	// direct send and a re-resolved fallback send can never drift to different deliverability
+	// verdicts. recordBacked is true by construction — resolveTarget already proved the record
+	// exists before any unsupported-backend mailbox route, and the closure is only consulted on
+	// that route. A null / dead-owner / identity-mismatched marker is fail-closed to inactive
+	// (SE-2): a reply to a terminated self-fetch citizen is rejected, not enqueued as mailbox
+	// garbage.
+	//
+	// The two receiver facts come from the SHARED composition (#101 결함 B), never from one
+	// value copied into both slots. `ownerAlive` is the marker↔identity match on a live owner;
+	// `watchArmed` is the separate measurement that this owner is STILL serving this garden.
+	// They were the same expression until a Claude session switch inside one pid left a retired
+	// garden's marker reading as an armed doorbell and a real message rotted unread in its
+	// mailbox. `entwurf_self` calls the same composition, so a citizen's own replyability can
+	// never disagree with what dispatch decided about it. ──────────
 	const mailboxDeliverabilityFor = (identity: MetaIdentity): MailboxDeliverabilityResult => {
 		const wakeMode = metaCapabilityFor(identity.backend).wakeMode;
-		const marker = io.readReceiverMarker(identity.gardenId);
-		const matched = receiverMarkerMatchesIdentity(marker, identity);
+		const { ownerAlive, watchArmed } = resolveMailboxReceiverFacts(identity, {
+			readReceiverMarker: io.readReceiverMarker,
+			readSenderMarker: io.readSenderMarker,
+		});
 		return mailboxConversationalDeliverable({
 			wakeMode,
 			recordBacked: true,
-			ownerAlive: matched,
-			watchArmed: matched,
+			ownerAlive,
+			watchArmed,
 		});
 	};
 

package/pi-extensions/lib/entwurf-v2-surface.ts

@@ -138,6 +138,12 @@ export function renderEntwurfV2Result(result: EntwurfV2RunResult): EntwurfV2Surf
 					`\n  ${c.detail}` +
 					(c.holder ? `\n  holder: pid ${c.holder.pid} on ${c.holder.hostname} since ${c.holder.createdAt}` : "");
 			}
+			// #101 갭 C: name WHICH receiver axis failed. "mailbox-undeliverable" alone sent a
+			// caller looking for a dead session when the session was alive and had simply
+			// switched to another garden — the predicate knew that and the surface threw it away.
+			if (result.diagnostic?.kind === "mailbox-undeliverable") {
+				text += `\n  mailbox-undeliverable: ${result.diagnostic.reason}`;
+			}
 			return { text, isError: true };
 		}
 		case "executed": {

package/pi-extensions/lib/meta-session.ts

@@ -2017,6 +2017,50 @@ export function readMetaReceiverMarker(opts: ReadMetaReceiverMarkerOptions): Met
 	}
 }
 
+export interface RemoveMetaReceiverMarkerOptions {
+	gardenId: string;
+	/** Only remove a marker this pid owns — a retirement must never reach another process's watch. */
+	ownerPid: number;
+	receiversDir?: string;
+}
+
+/**
+ * Retire a receiver presence marker THIS owner pid wrote (#101 결함 A).
+ *
+ * A native process that switches sessions in place — an in-session `/resume` or `/clear`
+ * fires a second SessionStart inside the same pid under a new native session id — leaves
+ * the previous garden's marker behind, naming a live owner whose watch is gone. Measured
+ * on oracle 2026-09-04: one pid (143742) held two gardens' markers four seconds apart, and
+ * mail sent to the retired one sat unread.
+ *
+ * ONLY THE MARKER. The meta-record stays: records are identity, and deleting one
+ * outside `meta-bridge-fresh-cut` would fight store certification (Hard Rule 7/8).
+ * A retired citizen keeps its record, its transcript and its listing — it loses only
+ * the claim that a doorbell is armed for it, which is exactly the claim that stopped
+ * being true.
+ *
+ * Fail-closed the other way too: the marker is read back first and removed ONLY when its
+ * `ownerPid` field equals the one passed here — pid equality, which is what a caller can
+ * actually check; it does not prove the same PROCESS wrote it (a reused pid compares equal),
+ * and the reader-side start-key guard is where that finer distinction lives. It is enough for
+ * the rule this serves: a hook never retires a watch some other pid is holding. Returns whether a marker was actually removed. Never throws — a retirement
+ * that cannot happen is a log line, not a broken session start.
+ */
+export function removeMetaReceiverMarker(opts: RemoveMetaReceiverMarkerOptions): boolean {
+	try {
+		const receiversDir = opts.receiversDir ?? defaultMetaReceiversDir();
+		const file = metaReceiverMarkerPath(opts.gardenId, receiversDir);
+		// verifyOwner:false — the point is the OWNERSHIP field, not the owner's liveness;
+		// a marker whose owner already died is still this pid's to clean up when it names it.
+		const marker = readMetaReceiverMarker({ markerPath: file, verifyOwner: false });
+		if (!marker || marker.ownerPid !== opts.ownerPid) return false;
+		fs.unlinkSync(file);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
 export interface UpsertMetaSessionOptions {
 	input: MetaIdentityMintInput;
 	/** Override the store directory (defaults to {@link defaultMetaSessionsDir}). */

package/pi-extensions/meta-bridge-hook.ts

@@ -28,6 +28,20 @@
  * a UserPromptSubmit fire does a degraded RECORD backfill (upsert) but cannot
  * re-arm the idle watch — the record's address is restored, the wake is not.
  *
+ * SESSION SWITCH (#101). One Claude process serves one session at a time, but it can
+ * change which. Measured on oracle 2026-09-04 (raw lab S1-S6, Claude Code 2.1.260): a bare
+ * `claude` mints a NEW session (`source=startup`), and an in-session `/resume` or `/clear`
+ * then fires a SECOND SessionStart under the SAME pid for a DIFFERENT native id
+ * (`source=resume` / `source=clear`). The first garden is left behind — in the #101 field
+ * case its transcript was never written at all — while its receiver marker still names a
+ * LIVE owner, so a sender reads an armed doorbell nobody holds. This hook therefore reads
+ * the sender marker BEFORE overwriting it and retires the previous garden's receiver marker
+ * (marker only — records are identity and are never deleted here; and only a marker this
+ * pid owns). Compaction (`source=compact`) re-fires SessionStart for the SAME native id, so
+ * the same rule retires nothing there — measured, not assumed. The envelope's `source` is
+ * logged beside all of it and decides nothing: the switch is settled by what is on disk,
+ * which holds on every host and vendor version.
+ *
  * LAUNCH: never invoked directly by Claude. `hooks.json` declares the EXEC form
  * (`command` = `<plugin-root>/scripts/hook-launch.sh`, `args` = [node, this file]),
  * and the launcher `exec`s that argv — so this process inherits the launcher's pid
@@ -51,6 +65,8 @@ import {
 	defaultMetaSessionsDir,
 	isPlausibleOwnerPid,
 	type MetaReceiverArmProvenance,
+	readMetaSenderMarker,
+	removeMetaReceiverMarker,
 	upsertMetaSession,
 	writeMetaReceiverMarker,
 	writeMetaSenderMarker,
@@ -191,6 +207,13 @@ function main(): void {
 				? env.model_id
 				: undefined;
 	const eventName = typeof env.hook_event_name === "string" ? env.hook_event_name : "SessionStart";
+	// `source` (startup | resume | clear | compact) is Claude's own word for WHY this
+	// SessionStart fired. It is logged on every line below and decides nothing: a session
+	// switch is settled by what is on disk (the sender marker's garden), which is true on
+	// every host and every vendor version. Logging it is how this host finally gets a
+	// receipt for the envelope order the #101 diagnosis could only read from vendor docs —
+	// and the raw lab (scripts/raw-claude-session-switch) reads these lines, not a guess.
+	const source = typeof env.source === "string" && env.source.length > 0 ? env.source : "(unset)";
 
 	if (!sessionId || !transcriptPath) {
 		// A degraded envelope: cannot mint an honest reference record. Log + no-op
@@ -213,7 +236,10 @@ function main(): void {
 			input: { backend: "claude-code", nativeSessionId: sessionId, transcriptPath, cwd, model },
 		});
 		gardenId = result.record.gardenId;
-		logLine("INFO", `${result.action} record ${path.basename(result.path)} (event=${eventName}, native=${sessionId})`);
+		logLine(
+			"INFO",
+			`${result.action} record ${path.basename(result.path)} (event=${eventName}, source=${source}, native=${sessionId})`,
+		);
 	} catch (err) {
 		// Best-effort: a broken record store must surface via the doctor, not by
 		// breaking the user's session open. Log and continue with no arm. This is
@@ -241,9 +267,52 @@ function main(): void {
 	// an env var. Missing launcher provenance or an implausible parent yields no marker.
 	const ownerPid = resolveMetaHookOwnerPid();
 	if (ownerPid !== null) {
+		// SESSION SWITCH RETIREMENT (#101 결함 A). One Claude process serves ONE session at a
+		// time, but it can switch which: an in-session `/resume` or `/clear` fires a second
+		// SessionStart under the same pid for a different native id, leaving the session the
+		// process started with behind (measured on oracle, meta-bridge-hook.log 2026-09-04
+		// 13:13:04 `source=startup` → 13:13:37 `source=resume`; the field case at 09:31:35 →
+		// 09:31:39 is the same shape). Whatever it was serving before is no longer being
+		// drained, so the marker advertising its doorbell has to go.
+		//
+		// The evidence is the sender marker as it stands RIGHT NOW — pid → the garden this
+		// process serves — which is why this reads it BEFORE the write below overwrites it with
+		// the new garden. No vendor field is consulted: `source` is logged, not branched on, so
+		// a host or version that words it differently changes nothing here. A same-garden
+		// re-registration (every UserPromptSubmit, a CwdChanged, a re-fired SessionStart) finds
+		// an equal garden id and retires NOTHING — the marker it would remove is the live one.
+		//
+		// Only the marker, never the record (see removeMetaReceiverMarker), and only a marker
+		// this pid owns.
+		//
+		// AND ONLY ON AN EVENT THAT CAN ARM THE REPLACEMENT (cross-review, 2026-09-04). This
+		// block sits before the UserPromptSubmit early-return, and UPS cannot emit watchPaths —
+		// so a retirement reached from there would take a doorbell down with nothing in the same
+		// run able to put one back. A watch is retired only by a run that arms one; that is the
+		// whole rule. `armProvenanceFor` is the same predicate the arm block below uses, so the
+		// two can never disagree about which events those are.
+		//
+		// It is NOT a defence against a keystroke from a session this pid has left: measured on
+		// oracle 2026-09-04 (raw lab S1-S6, meta-bridge-hook.log), every UserPromptSubmit named
+		// the native id its own pid's preceding SessionStart had established — 8 of 8, none
+		// otherwise. The hook runs synchronously inside the session's own process, so a UPS
+		// envelope is that session speaking, and the sender pointer it moves is authoritative.
+		const previous =
+			armProvenanceFor(eventName) !== null
+				? readMetaSenderMarker({ backend: "claude-code", ownerPid, verifyOwner: false })
+				: null;
+		if (previous && previous.gardenId !== gardenId) {
+			const retired = removeMetaReceiverMarker({ gardenId: previous.gardenId, ownerPid });
+			logLine(
+				"INFO",
+				retired
+					? `retired receiver marker ${previous.gardenId} — owner pid ${ownerPid} switched to ${gardenId} (event=${eventName}, source=${source})`
+					: `no receiver marker to retire for ${previous.gardenId} — owner pid ${ownerPid} switched to ${gardenId} (event=${eventName}, source=${source})`,
+			);
+		}
 		try {
 			writeMetaSenderMarker({ backend: "claude-code", gardenId, nativeSessionId: sessionId, cwd, ownerPid });
-			logLine("INFO", `sender marker ${ownerPid} -> ${gardenId} (event=${eventName})`);
+			logLine("INFO", `sender marker ${ownerPid} -> ${gardenId} (event=${eventName}, source=${source})`);
 		} catch (err) {
 			logLine(
 				"WARN",
@@ -294,7 +363,7 @@ function main(): void {
 					ownerPid,
 					armProvenance,
 				});
-				logLine("INFO", `receiver marker ${gardenId} owner=${ownerPid} arm=${eventName}`);
+				logLine("INFO", `receiver marker ${gardenId} owner=${ownerPid} arm=${eventName} source=${source}`);
 			} catch (err) {
 				logLine(
 					"WARN",

package/run.sh

@@ -144,6 +144,7 @@ Usage:
   ./run.sh check-meta-mailbox-state-write # deterministic gate (0.11 Stage 0 step 3D-4 commit2): post-cut receipt is state-only — meta-record file byte-identical across enqueue/read, state carries lastEnqueuedAt/lastReadAt (field isolation), empty inbox no-op on record+state, drift surfaces; no API
   ./run.sh check-meta-receiver-marker # deterministic gate (SE-2): receiver marker round-trip/start-key/provenance, UserPromptSubmit cannot mint presence, reader does not gate on record existence — marker SEMANTICS only; launch topology moved to check-hook-launch-topology
   ./run.sh check-hook-launch-topology # #51 gate 1: shipped hooks.json is exec form through hook-launch.sh, launcher is loud on an empty argv (older Claude's silent args drop), exec preserves the pid so the hook's parent is Claude, and a space/$/backtick plugin path survives as one argv element
+  ./run.sh check-meta-hook-session-switch # #101 gate: ONE Claude pid, TWO SessionStarts (resume picker placeholder -> resumed id). The hook retires the marker of the garden it stopped serving (records untouched, same-garden re-registration retires nothing), the reader stays fail-closed on a re-planted stale marker (watchArmed measured against the owner's sender marker, never copied), production dispatch refuses the retired garden and NAMES the failing axis, and exactly one of the two gardens is deliverable. Sandboxed roots, no API
   ./run.sh check-meta-identity-consumers # deterministic gate: V3-only consumer seam — per-entry targeted read + addressable read snapshot uniqueness, non-regular rivals never read, drift/unparseable rivals unreachable, unreadable regular rivals fail loud; strict upsert refuses an unreadable store before any write, no API
   ./run.sh check-meta-capability-source # deterministic gate (0.11 Stage 0 step 3D-3): capability-source cut-over — mint/parse read wakeMode/deliveryLevel from the registry (metaCapabilityFor, registry-driven via injection), not META_BACKEND_DESCRIPTORS; behaviour-preserving (registry ≡ const); the record.delivery slot 3D-3 preserved was deleted by 3D-4, no API
   ./run.sh check-socket-probe          # deterministic gate (0.11 Stage 0, F3): three-valued control-socket liveness (alive|dead|indeterminate) — GC reclaims dead only, indeterminate survives; pure classify + 2-socket integration, no API
@@ -894,6 +895,23 @@ check_meta_receiver_marker() {
   run_ts scripts/check-meta-receiver-marker.ts
 }
 
+check_meta_hook_session_switch() {
+  # #101 gate: a Claude Code SESSION SWITCH — one native process that stops serving one
+  # garden and starts serving another. The resume picker (and `/clear`) fire SessionStart
+  # twice inside one pid: once for the TUI's placeholder id, once for the id the operator
+  # picked. Before this gate nothing asked "one owner pid, two gardens", so a placeholder
+  # citizen stayed registered with an armed-looking doorbell and real mail rotted in it.
+  # Plays Claude the way check-hook-launch-topology does (spawn the SHIPPED launcher with
+  # the manifest's argv, so the hook's parent is this process = one fake owner pid) with
+  # every meta root sandboxed. Asserts: both records survive (marker retired, never the
+  # record); the retired garden's marker is gone; a same-garden re-registration retires
+  # NOTHING; a re-planted stale marker is still undeliverable (the sender-marker join,
+  # fail-closed at the reader); production dispatch refuses it and carries the predicate's
+  # reason to the rendered surface; exactly one garden is deliverable and it is the served
+  # one. Real tmpdir, no API.
+  run_ts scripts/check-meta-hook-session-switch.ts
+}
+
 check_copilot_birth_hook() {
   # #82 gate: the Copilot BIRTH path, proven without Copilot. Drives the REAL
   # assembler (--assemble-only, into a temp dir), then fires the baked launcher the
@@ -5700,6 +5718,9 @@ case "$cmd" in
   check-meta-receiver-marker)
     check_meta_receiver_marker
     ;;
+  check-meta-hook-session-switch)
+    check_meta_hook_session_switch
+    ;;
   check-meta-identity-consumers)
     check_meta_identity_consumers
     ;;

package/scripts/check-bridge-delivery.ts

@@ -181,16 +181,40 @@ writeMetaReceiverMarker({
 
 // RECEIVER — a different armed self-fetch citizen. A dead/unarmed target must remain
 // mailbox-undeliverable, so this marker isolates artifact delivery from target liveness.
+//
+// It is owned by a DIFFERENT live pid than the sender, and that is not decoration (#101):
+// a claude-code watch owner serves exactly one garden at a time, and deliverability now
+// requires that owner's sender marker to still name the garden being addressed. Two
+// citizens armed under ONE pid is a state the real world does not produce — it is what a
+// session switch leaves behind — so a fixture that modelled it would be asking the
+// artifact to deliver into a retired watch.
+//
+// The stand-in second native CLI is a spawned idle process, NOT this gate's parent: the
+// subject bridge resolves its own sender identity through its ancestry, and an ancestor
+// holding a second garden's marker is the "ambiguous sender identity" refusal the bridge
+// already ships. A live pid outside that ancestry is what a real second CLI looks like.
+// It exits on its own timer, and is killed in the outer finally.
+const receiverOwner = spawn(process.execPath, ["-e", "setTimeout(() => {}, 300000)"], { stdio: "ignore" });
+const receiverOwnerPid = receiverOwner.pid;
+if (typeof receiverOwnerPid !== "number") throw new Error("could not spawn the stand-in receiver owner process");
 const receiver = upsertMetaSession({
 	input: { backend: "claude-code", nativeSessionId: `bridge-delivery-receiver-${process.pid}`, cwd: tmp },
 	dir: sessionsDir,
 });
 const gid = receiver.record.gardenId;
+writeMetaSenderMarker({
+	backend: "claude-code",
+	gardenId: gid,
+	nativeSessionId: receiver.record.nativeSessionId,
+	cwd: tmp,
+	ownerPid: receiverOwnerPid,
+	sendersDir,
+});
 writeMetaReceiverMarker({
 	gardenId: gid,
 	backend: "claude-code",
 	nativeSessionId: receiver.record.nativeSessionId,
-	ownerPid: process.pid,
+	ownerPid: receiverOwnerPid,
 	armProvenance: "session-start",
 	receiversDir,
 });
@@ -471,6 +495,20 @@ try {
 	await fsp.writeFile(receiverRecordFile, receiverRecordV3Bytes);
 	const anonSendersDir = path.join(tmp, "meta-senders-anon");
 	await fsp.mkdir(anonSendersDir, { recursive: true });
+	// The TARGET's owner marker still belongs in this dir (#101). Anonymity is about the
+	// CALLER — no marker under the bridge child's own owner pid — while deliverability asks
+	// a different question of a different pid: is the target's watch owner still serving the
+	// target's garden? Leaving it out would make every cell below fail as
+	// mailbox-undeliverable and prove nothing about the anonymous hatch. In production no
+	// one swaps this dir; the split exists only because this fixture does.
+	writeMetaSenderMarker({
+		backend: "claude-code",
+		gardenId: gid,
+		nativeSessionId: receiver.record.nativeSessionId,
+		cwd: tmp,
+		ownerPid: receiverOwnerPid,
+		sendersDir: anonSendersDir,
+	});
 	const oneShotV2 = async (
 		cellEnv: NodeJS.ProcessEnv,
 		message: string,
@@ -582,6 +620,9 @@ try {
 	try {
 		child?.kill("SIGTERM");
 	} catch {}
+	try {
+		receiverOwner.kill("SIGTERM");
+	} catch {}
 	await fsp.rm(tmp, { recursive: true, force: true });
 }
 

package/scripts/check-entwurf-fact-provider.ts

@@ -19,7 +19,12 @@
  *     socket-dir-read-error diagnostic (P2e②),
  *   - diagnostics are kind-tagged and sorted.
  *
- * No IO — meta entries/reader and socket dir/readdir/probe are injected fakes.
+ * No IO — meta entries/reader and socket dir/readdir/probe are injected fakes, and so is
+ * the #101 `observe` seam. That seam is the one dep whose PRODUCTION default is real IO
+ * (one default is safer than two wiring sites each passing their own observer), so a gate
+ * that left it out would quietly stat the operator's real garden roots for fabricated
+ * garden ids. It is injected here for that reason, and the cell below proves the injected
+ * observation actually reaches the fact rather than being dropped on the way.
  */
 
 import assert from "node:assert/strict";
@@ -74,6 +79,11 @@ function deps(
 ): EntwurfFactsDeps {
 	const symlinkSet = new Set(opts.symlinks ?? []);
 	return {
+		// Injected observation (see the header): a per-identity fake, never the real IO.
+		observe: (identity) => ({
+			receiver: identity.backend === "claude-code" ? "inactive" : "n/a",
+			transcript: identity.gardenId === GID_CLAUDE ? "absent" : "exists",
+		}),
 		// Kind-carrying entries, like the real bindings: the listing must be able to refuse a
 		// symlinked record without following it. `irregularMeta` names the ones that are not
 		// regular files.
@@ -144,6 +154,17 @@ async function main(): Promise<void> {
 			);
 			ok("basic: record-less-socket diagnostic keyset exact", true);
 		}
+		// #101: the injected observation rides onto each peer. A provider that dropped the
+		// seam would return `unobserved` rows — visible, but useless to the caller the
+		// columns exist for.
+		{
+			const claude = r.facts.peers.find((p) => p.gardenId === GID_CLAUDE);
+			const pi = r.facts.peers.find((p) => p.gardenId === GID_PI);
+			ok(
+				"basic: the injected observation reaches every peer fact",
+				claude?.receiver === "inactive" && claude?.transcript === "absent" && pi?.receiver === "n/a",
+			);
+		}
 		// A DEAD record-less socket groups under a different (stale) message — no fresh-cut
 		// pointer for a leftover file, so same-state sockets aggregate per liveness.
 		const r2 = await listEntwurfFacts(deps({}, { [GID_SOCKET_ONLY]: "dead" }));

package/scripts/check-entwurf-facts.ts

@@ -138,7 +138,8 @@ for (const backend of META_CITIZEN_BACKENDS) {
 	ok("passthrough recordUpdatedAt", fact.recordUpdatedAt === id.recordUpdatedAt);
 }
 
-// ── facts-only keyset: identity facts + liveness, NO verb-routing/transcript ─
+// ── facts-only keyset: identity facts + liveness + the two observed axes, and
+// still NO verb-routing / no transcript PATH ────────────────────────────────
 {
 	const fact = resolvePeerFact(identity("pi"), "alive");
 	const keys = Object.keys(fact).sort();
@@ -151,9 +152,23 @@ for (const backend of META_CITIZEN_BACKENDS) {
 		"model",
 		"nativeSessionId",
 		"recordUpdatedAt",
+		"receiver",
+		"transcript",
 	].sort();
 	assert.deepStrictEqual(keys, expected, `PeerFact keyset drift: got ${keys.join(",")}`);
-	ok("facts-only keyset exact (identity facts + liveness)", true);
+	ok("facts-only keyset exact (identity facts + liveness + observed receiver/transcript)", true);
+
+	// #101: an unmeasured row says so. `unobserved` is the default for a caller that
+	// injected no observer — never `none`/`absent`, which would be a fabricated fact.
+	ok(
+		"an observer-less composition reports both axes as unobserved (never a default fact)",
+		fact.receiver === "unobserved" && fact.transcript === "unobserved",
+	);
+	const observed = resolvePeerFact(identity("claude-code"), null, { receiver: "inactive", transcript: "absent" });
+	ok(
+		"an injected observation rides onto the fact verbatim",
+		observed.receiver === "inactive" && observed.transcript === "absent",
+	);
 
 	const FORBIDDEN = [
 		"resumable",

package/scripts/check-entwurf-peers-surface.ts

@@ -47,7 +47,12 @@ const FORBIDDEN = ["sendable", "resumable", "dispatch", "action", "transport", "
 // #50 C4: socket-shaped identity must not reappear on this surface.
 const FORBIDDEN_C4_KEYS = ["sessions", "socketOnly", "controlDir", "socketPath", "count"];
 
-function peer(gardenId: string, backend: MetaCitizenBackend, liveness: FactLiveness): PeerFact {
+function peer(
+	gardenId: string,
+	backend: MetaCitizenBackend,
+	liveness: FactLiveness,
+	observed: Partial<Pick<PeerFact, "receiver" | "transcript">> = {},
+): PeerFact {
 	return {
 		gardenId,
 		backend,
@@ -57,6 +62,8 @@ function peer(gardenId: string, backend: MetaCitizenBackend, liveness: FactLiven
 		createdAt: "2026-06-11T00:00:00.000Z",
 		recordUpdatedAt: "2026-06-11T00:00:00.000Z",
 		liveness,
+		receiver: observed.receiver ?? "n/a",
+		transcript: observed.transcript ?? "exists",
 	};
 }
 
@@ -91,7 +98,7 @@ function main(): void {
 				peer(GID_PI_ALIVE, "pi", "alive"),
 				peer(GID_PI_DEAD, "pi", "dead"),
 				peer(GID_PI_INDET, "pi", "indeterminate"),
-				peer(GID_CLAUDE, "claude-code", "unsupported"),
+				peer(GID_CLAUDE, "claude-code", "unsupported", { receiver: "inactive", transcript: "absent" }),
 			],
 			// The provider has already folded these into diagnostics; the render layer
 			// never re-renders them as a section (facts carry them for the union math).
@@ -116,6 +123,17 @@ function main(): void {
 		ok("C4: payload is exactly { peers, diagnostics }", true);
 	}
 	ok("peers carry all 4 citizens (unsupported NOT dropped)", payload.peers.length === 4);
+	// #101: the two observed axes are the only thing separating two same-cwd claude rows,
+	// since `liveness` reads `unsupported` for every one of them. They are FACTS on the
+	// row — the forbidden-word scans below still apply to them unchanged.
+	ok(
+		"observed receiver + transcript ride the row in text",
+		new RegExp(`${GID_CLAUDE}.*receiver=inactive.*transcript=absent`).test(text),
+	);
+	ok(
+		"observed axes ride the JSON payload too",
+		payload.peers.some((p) => p.gardenId === GID_CLAUDE && p.receiver === "inactive" && p.transcript === "absent"),
+	);
 	ok(
 		"unsupported citizen present in peers",
 		payload.peers.some((p) => p.gardenId === GID_CLAUDE && p.liveness === "unsupported"),

package/scripts/check-entwurf-self-address.ts

@@ -469,8 +469,26 @@ const metaBody = functionBody("buildTrustedMetaSenderEnvelope");
 ok("buildTrustedMetaSenderEnvelope calls computeSelfAddressability", /computeSelfAddressability\s*\(/.test(metaBody));
 ok("buildTrustedMetaSenderEnvelope no longer hardcodes `replyable: true`", !/replyable:\s*true/.test(metaBody));
 ok(
-	"buildTrustedMetaSenderEnvelope derives active-receiver from the receiver marker (identity-matched)",
-	/readMetaReceiverMarker\s*\(/.test(metaBody) && /receiverMarkerMatchesIdentity\s*\(/.test(metaBody),
+	// #101: the identity match alone is no longer the whole answer. `entwurf_self` composes
+	// the SAME `resolveMailboxReceiverFacts` the v2 dispatch seam uses — reading the receiver
+	// marker AND, where the watch owner is the sender-marker process, the join that says that
+	// owner is still serving this garden. A citizen's self-reported replyability and what
+	// dispatch decides about it come from one measurement, so they cannot disagree.
+	"buildTrustedMetaSenderEnvelope derives active-receiver from the SHARED receiver composition (both markers)",
+	/resolveMailboxReceiverFacts\s*\(/.test(metaBody) &&
+		/readMetaReceiverMarker\s*\(/.test(metaBody) &&
+		/readMetaSenderMarker\s*\(/.test(metaBody),
+);
+ok(
+	"buildTrustedMetaSenderEnvelope no longer copies one match into both receiver facts",
+	!/ownerAlive:\s*active/.test(metaBody) && !/watchArmed:\s*active/.test(metaBody),
+);
+ok(
+	// #101 (cross-review): both markers are read with their liveness guards ON. A reader that
+	// opted out would accept a dead session's leftover file as "which garden this pid serves
+	// now", and every fixture pid in a gate is live, so nothing dynamic here could tell.
+	"buildTrustedMetaSenderEnvelope reads neither marker with the owner guard disabled",
+	!/verifyOwner:\s*false/.test(metaBody),
 );
 ok(
 	"buildTrustedMetaSenderEnvelope keeps meta identity + derived replyable (inactive → not null)",

package/scripts/check-entwurf-v2-decider.ts

@@ -207,11 +207,13 @@ async function main(): Promise<void> {
 		ok("target-locked: diagnostic carried", d.kind === "reject" && d.diagnostic?.kind === "target-locked");
 		ok(
 			"target-locked: diagnostic holder pid preserved",
-			d.kind === "reject" && d.diagnostic?.conflict.holder?.pid === 4242,
+			d.kind === "reject" && d.diagnostic?.kind === "target-locked" && d.diagnostic.conflict.holder?.pid === 4242,
 		);
 		ok(
 			"target-locked: diagnostic lockPath preserved",
-			d.kind === "reject" && d.diagnostic?.conflict.lockPath === `/fake/locks/${GID}.lock`,
+			d.kind === "reject" &&
+				d.diagnostic?.kind === "target-locked" &&
+				d.diagnostic.conflict.lockPath === `/fake/locks/${GID}.lock`,
 		);
 	}
 
@@ -253,7 +255,8 @@ async function main(): Promise<void> {
 		ok(
 			"target-locked(corrupt): diagnostic detail preserved",
 			d.kind === "reject" &&
-				d.diagnostic?.conflict.detail === "lockfile is empty, corrupt, or holds a different garden id",
+				d.diagnostic?.kind === "target-locked" &&
+				d.diagnostic.conflict.detail === "lockfile is empty, corrupt, or holds a different garden id",
 		);
 	}
 

package/scripts/check-entwurf-v2-matrix.ts

@@ -42,6 +42,7 @@ import {
 	type DispatchDecision,
 	decideDispatch,
 	type ExecutionPlan,
+	type RejectDiagnostic,
 	type TargetResolution,
 } from "../pi-extensions/lib/entwurf-v2-decider.ts";
 import type { AcquireLockResult, LockClaim } from "../pi-extensions/lib/entwurf-v2-lock.ts";
@@ -156,7 +157,10 @@ type LockClass = "none" | "held" | "mailbox-null" | "released" | "acquire-fail";
 
 type Expect =
 	| { decision: "execute"; transport: EntwurfV2Transport; lock: LockClass }
-	| { decision: "reject"; reason: string; lock: LockClass; diagnostic?: boolean };
+	// `diagnostic` names the KIND a reject must carry, not a boolean: two reject cells now
+	// carry machine-readable evidence, and the axis has to say which — a reject that carried
+	// the wrong diagnostic would pass a yes/no cell (#101 갭 C).
+	| { decision: "reject"; reason: string; lock: LockClass; diagnostic?: RejectDiagnostic["kind"] };
 
 /**
  * Which IO seams the decider is ALLOWED to touch — the "어느 축을 만지면 안 되는지"
@@ -211,7 +215,7 @@ const ROWS: Row[] = [
 		targetKind: "pi, lock held by another",
 		intent: "fire-and-forget",
 		scenario: { resolution: { identity: identity("pi"), preProbeAddressConflict: false }, lock: "conflict" },
-		expect: { decision: "reject", reason: "target-locked", lock: "acquire-fail", diagnostic: true },
+		expect: { decision: "reject", reason: "target-locked", lock: "acquire-fail", diagnostic: "target-locked" },
 	},
 	{
 		name: "unsupported self-fetch active → meta-mailbox",
@@ -231,7 +235,8 @@ const ROWS: Row[] = [
 			resolution: { identity: identity("claude-code"), preProbeAddressConflict: false },
 			mailboxDeliverable: false,
 		},
-		expect: { decision: "reject", reason: "mailbox-undeliverable", lock: "none" },
+		// #101 갭 C: an undeliverable mailbox reject carries the receiver axis that failed.
+		expect: { decision: "reject", reason: "mailbox-undeliverable", lock: "none", diagnostic: "mailbox-undeliverable" },
 	},
 	{
 		name: "in-domain live ff → control-socket",
@@ -338,8 +343,8 @@ async function runRow(row: Row): Promise<void> {
 		}
 		if (row.expect.diagnostic) {
 			ok(
-				`${row.name}: carries target-locked diagnostic`,
-				d.kind === "reject" && d.diagnostic?.kind === "target-locked",
+				`${row.name}: carries the ${row.expect.diagnostic} diagnostic`,
+				d.kind === "reject" && d.diagnostic?.kind === row.expect.diagnostic,
 			);
 		} else {
 			ok(`${row.name}: no diagnostic`, d.kind === "reject" && d.diagnostic === undefined);