@junghanacs/entwurf 0.17.2 → 0.18.1

package/mcp/entwurf-bridge/dist/pi-extensions/meta-bridge-hook.js

@@ -28,6 +28,20 @@
  * a UserPromptSubmit fire does a degraded RECORD backfill (upsert) but cannot
  * re-arm the idle watch — the record's address is restored, the wake is not.
  *
+ * SESSION SWITCH (#101). One Claude process serves one session at a time, but it can
+ * change which. Measured on oracle 2026-09-04 (raw lab S1-S6, Claude Code 2.1.260): a bare
+ * `claude` mints a NEW session (`source=startup`), and an in-session `/resume` or `/clear`
+ * then fires a SECOND SessionStart under the SAME pid for a DIFFERENT native id
+ * (`source=resume` / `source=clear`). The first garden is left behind — in the #101 field
+ * case its transcript was never written at all — while its receiver marker still names a
+ * LIVE owner, so a sender reads an armed doorbell nobody holds. This hook therefore reads
+ * the sender marker BEFORE overwriting it and retires the previous garden's receiver marker
+ * (marker only — records are identity and are never deleted here; and only a marker this
+ * pid owns). Compaction (`source=compact`) re-fires SessionStart for the SAME native id, so
+ * the same rule retires nothing there — measured, not assumed. The envelope's `source` is
+ * logged beside all of it and decides nothing: the switch is settled by what is on disk,
+ * which holds on every host and vendor version.
+ *
  * LAUNCH: never invoked directly by Claude. `hooks.json` declares the EXEC form
  * (`command` = `<plugin-root>/scripts/hook-launch.sh`, `args` = [node, this file]),
  * and the launcher `exec`s that argv — so this process inherits the launcher's pid
@@ -45,7 +59,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { defaultMetaMailboxDir, defaultMetaSessionsDir, isPlausibleOwnerPid, upsertMetaSession, writeMetaReceiverMarker, writeMetaSenderMarker, } from "./lib/meta-session.js";
+import { defaultMetaMailboxDir, defaultMetaSessionsDir, isPlausibleOwnerPid, readMetaSenderMarker, removeMetaReceiverMarker, upsertMetaSession, writeMetaReceiverMarker, writeMetaSenderMarker, } from "./lib/meta-session.js";
 function logLine(level, message) {
     try {
         // dirname(meta-sessions) == the pi agent dir — no extra resolver export needed.
@@ -168,6 +182,13 @@ function main() {
             ? env.model_id
             : undefined;
     const eventName = typeof env.hook_event_name === "string" ? env.hook_event_name : "SessionStart";
+    // `source` (startup | resume | clear | compact) is Claude's own word for WHY this
+    // SessionStart fired. It is logged on every line below and decides nothing: a session
+    // switch is settled by what is on disk (the sender marker's garden), which is true on
+    // every host and every vendor version. Logging it is how this host finally gets a
+    // receipt for the envelope order the #101 diagnosis could only read from vendor docs —
+    // and the raw lab (scripts/raw-claude-session-switch) reads these lines, not a guess.
+    const source = typeof env.source === "string" && env.source.length > 0 ? env.source : "(unset)";
     if (!sessionId || !transcriptPath) {
         // A degraded envelope: cannot mint an honest reference record. Log + no-op
         // rather than write a half-record or guess a transcript path. LEVEL depends
@@ -185,7 +206,7 @@ function main() {
             input: { backend: "claude-code", nativeSessionId: sessionId, transcriptPath, cwd, model },
         });
         gardenId = result.record.gardenId;
-        logLine("INFO", `${result.action} record ${path.basename(result.path)} (event=${eventName}, native=${sessionId})`);
+        logLine("INFO", `${result.action} record ${path.basename(result.path)} (event=${eventName}, source=${source}, native=${sessionId})`);
     }
     catch (err) {
         // Best-effort: a broken record store must surface via the doctor, not by
@@ -210,9 +231,48 @@ function main() {
     // an env var. Missing launcher provenance or an implausible parent yields no marker.
     const ownerPid = resolveMetaHookOwnerPid();
     if (ownerPid !== null) {
+        // SESSION SWITCH RETIREMENT (#101 결함 A). One Claude process serves ONE session at a
+        // time, but it can switch which: an in-session `/resume` or `/clear` fires a second
+        // SessionStart under the same pid for a different native id, leaving the session the
+        // process started with behind (measured on oracle, meta-bridge-hook.log 2026-09-04
+        // 13:13:04 `source=startup` → 13:13:37 `source=resume`; the field case at 09:31:35 →
+        // 09:31:39 is the same shape). Whatever it was serving before is no longer being
+        // drained, so the marker advertising its doorbell has to go.
+        //
+        // The evidence is the sender marker as it stands RIGHT NOW — pid → the garden this
+        // process serves — which is why this reads it BEFORE the write below overwrites it with
+        // the new garden. No vendor field is consulted: `source` is logged, not branched on, so
+        // a host or version that words it differently changes nothing here. A same-garden
+        // re-registration (every UserPromptSubmit, a CwdChanged, a re-fired SessionStart) finds
+        // an equal garden id and retires NOTHING — the marker it would remove is the live one.
+        //
+        // Only the marker, never the record (see removeMetaReceiverMarker), and only a marker
+        // this pid owns.
+        //
+        // AND ONLY ON AN EVENT THAT CAN ARM THE REPLACEMENT (cross-review, 2026-09-04). This
+        // block sits before the UserPromptSubmit early-return, and UPS cannot emit watchPaths —
+        // so a retirement reached from there would take a doorbell down with nothing in the same
+        // run able to put one back. A watch is retired only by a run that arms one; that is the
+        // whole rule. `armProvenanceFor` is the same predicate the arm block below uses, so the
+        // two can never disagree about which events those are.
+        //
+        // It is NOT a defence against a keystroke from a session this pid has left: measured on
+        // oracle 2026-09-04 (raw lab S1-S6, meta-bridge-hook.log), every UserPromptSubmit named
+        // the native id its own pid's preceding SessionStart had established — 8 of 8, none
+        // otherwise. The hook runs synchronously inside the session's own process, so a UPS
+        // envelope is that session speaking, and the sender pointer it moves is authoritative.
+        const previous = armProvenanceFor(eventName) !== null
+            ? readMetaSenderMarker({ backend: "claude-code", ownerPid, verifyOwner: false })
+            : null;
+        if (previous && previous.gardenId !== gardenId) {
+            const retired = removeMetaReceiverMarker({ gardenId: previous.gardenId, ownerPid });
+            logLine("INFO", retired
+                ? `retired receiver marker ${previous.gardenId} — owner pid ${ownerPid} switched to ${gardenId} (event=${eventName}, source=${source})`
+                : `no receiver marker to retire for ${previous.gardenId} — owner pid ${ownerPid} switched to ${gardenId} (event=${eventName}, source=${source})`);
+        }
         try {
             writeMetaSenderMarker({ backend: "claude-code", gardenId, nativeSessionId: sessionId, cwd, ownerPid });
-            logLine("INFO", `sender marker ${ownerPid} -> ${gardenId} (event=${eventName})`);
+            logLine("INFO", `sender marker ${ownerPid} -> ${gardenId} (event=${eventName}, source=${source})`);
         }
         catch (err) {
             logLine("WARN", `sender marker write failed (event=${eventName}, pid=${ownerPid}, garden=${gardenId}): ${err instanceof Error ? err.message : String(err)}`);
@@ -259,7 +319,7 @@ function main() {
                     ownerPid,
                     armProvenance,
                 });
-                logLine("INFO", `receiver marker ${gardenId} owner=${ownerPid} arm=${eventName}`);
+                logLine("INFO", `receiver marker ${gardenId} owner=${ownerPid} arm=${eventName} source=${source}`);
             }
             catch (err) {
                 logLine("WARN", `receiver marker write failed (event=${eventName}, garden=${gardenId}): ${err instanceof Error ? err.message : String(err)}`);

package/mcp/entwurf-bridge/src/index.ts

@@ -66,7 +66,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 
 import { controlSocketPathIn, defaultControlSocketDir } from "../../../pi-extensions/lib/control-socket-path.js";
-import { receiverMarkerMatchesIdentity } from "../../../pi-extensions/lib/entwurf-deliverability.ts";
+import { resolveMailboxReceiverFacts } from "../../../pi-extensions/lib/entwurf-deliverability.ts";
 import { listEntwurfFacts } from "../../../pi-extensions/lib/entwurf-fact-provider.ts";
 import { renderEntwurfPeers } from "../../../pi-extensions/lib/entwurf-peers-render.ts";
 import { computeSelfAddressability, type MetaDeliveryDomain } from "../../../pi-extensions/lib/entwurf-self-address.ts";
@@ -91,6 +91,8 @@ import {
 	readActiveStoreEntries,
 	readMetaInbox,
 	readMetaReceiverMarker,
+	readMetaSenderMarker,
+	requireBackend,
 } from "../../../pi-extensions/lib/meta-session.ts";
 import { freshCall, renderFreshCall } from "../../../pi-extensions/lib/mux-fresh-call.ts";
 import { RESUME_CALL_REJECT_HINT, resumeCall } from "../../../pi-extensions/lib/mux-resume-call.ts";
@@ -272,9 +274,12 @@ async function buildTrustedMetaSenderEnvelope(cwd: string = process.cwd()): Prom
 	//     admits another self-fetch citizen.
 	//   none        ← neither. omp today: no mailbox drain, no native-push adapter. Rendering
 	//     this as self-fetch printed a mailboxPath nothing drains.
-	//   self-fetch (claude-code/copilot): can this citizen's own inbox wake? → the receiver
-	//     presence marker (readMetaReceiverMarker folds a dead/reused owner to null, so a match
-	//     means a live, ARMED receiver — the sender marker proves identity, never an armed watch).
+	//   self-fetch (claude-code/copilot): can this citizen's own inbox wake? → the SHARED
+	//     receiver composition `resolveMailboxReceiverFacts`, the same one the v2 dispatch seam
+	//     uses, so a citizen's self-reported replyability can never disagree with what dispatch
+	//     decides about it. It reads the presence marker (a dead/reused owner already folds to
+	//     null) AND, where the watch owner is the sender-marker process, the #101 join that says
+	//     the owner is still serving THIS garden rather than one it switched away from.
 	//   native-push (antigravity): there is no inbox and no watch. A reply is injected into a
 	//     live app-server conversation, so only an adapter probe can answer. Composing the
 	//     receiver atom here would demand `watchArmed` from a backend that never arms one, and
@@ -298,14 +303,17 @@ async function buildTrustedMetaSenderEnvelope(cwd: string = process.cwd()): Prom
 				}
 			: metaDeliveryDomain === "self-fetch"
 				? (() => {
-						const receiver = readMetaReceiverMarker({ gardenId: identity.gardenId });
-						const active = receiverMarkerMatchesIdentity(receiver, identity);
+						const receiver = resolveMailboxReceiverFacts(identity, {
+							readReceiverMarker: (gardenId: string) => readMetaReceiverMarker({ gardenId }),
+							readSenderMarker: (backend: string, ownerPid: number) =>
+								readMetaSenderMarker({ backend: requireBackend(backend), ownerPid }),
+						});
 						return {
 							origin: "meta-session" as const,
 							metaDeliveryDomain,
 							recordBacked: true,
-							ownerAlive: active,
-							watchArmed: active,
+							ownerAlive: receiver.ownerAlive,
+							watchArmed: receiver.watchArmed,
 						};
 					})()
 				: {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.17.2",
+	"version": "0.18.1",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {
@@ -82,23 +82,23 @@
 		"claudeCodeFloor": ">=2.1.217"
 	},
 	"dependencies": {
-		"@agentclientprotocol/claude-agent-acp": "0.73.0",
+		"@agentclientprotocol/claude-agent-acp": "0.75.1",
 		"@agentclientprotocol/sdk": "1.4.0",
 		"@anthropic-ai/sdk": "0.100.1",
 		"@modelcontextprotocol/sdk": "^1.12.1",
 		"zod": "^3.25.0 || ^4.0.0"
 	},
 	"peerDependencies": {
-		"@earendil-works/pi-ai": ">=0.84.4 <0.85",
-		"@earendil-works/pi-coding-agent": ">=0.84.4 <0.85",
-		"@earendil-works/pi-tui": ">=0.84.4 <0.85",
+		"@earendil-works/pi-ai": ">=0.85.1 <0.86",
+		"@earendil-works/pi-coding-agent": ">=0.85.1 <0.86",
+		"@earendil-works/pi-tui": ">=0.85.1 <0.86",
 		"typebox": "*"
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.4.13",
-		"@earendil-works/pi-ai": "0.84.4",
-		"@earendil-works/pi-coding-agent": "0.84.4",
-		"@earendil-works/pi-tui": "0.84.4",
+		"@earendil-works/pi-ai": "0.85.1",
+		"@earendil-works/pi-coding-agent": "0.85.1",
+		"@earendil-works/pi-tui": "0.85.1",
 		"@types/node": "^24.3.0",
 		"husky": "^9.1.7",
 		"rregex": "1.13.1",
@@ -143,6 +143,7 @@
 		"check-omp-receive-arm": "./run.sh check-omp-receive-arm",
 		"check-omp-fresh-preflight": "./run.sh check-omp-fresh-preflight",
 		"check-hook-launch-topology": "./run.sh check-hook-launch-topology",
+		"check-meta-hook-session-switch": "./run.sh check-meta-hook-session-switch",
 		"check-acp-carrier-augment": "./run.sh check-acp-carrier-augment",
 		"check-agy-permission-matrix": "./run.sh check-agy-permission-matrix",
 		"check-gate-qualification": "./run.sh check-gate-qualification",
@@ -165,7 +166,7 @@
 		"check:toolchain": "pnpm lint && pnpm typecheck",
 		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface",
 		"check:contracts": "./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-lock && ./run.sh check-entwurf-v2-decider && ./run.sh check-entwurf-v2-matrix && ./run.sh check-entwurf-v2-release && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-send-fallback && ./run.sh check-entwurf-v2-mailbox && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-runner && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-entwurf-resume-args && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-entwurf-facts && ./run.sh check-control-socket-path && ./run.sh check-socket-discovery && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment",
-		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex",
+		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-birth-hook && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-gate-manifests && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex",
 		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},
 	"pi": {

package/pi-extensions/entwurf-control.ts

@@ -79,7 +79,7 @@ import type {
 	MessageRenderer,
 } from "@earendil-works/pi-coding-agent";
 import { getMarkdownTheme, type Theme } from "@earendil-works/pi-coding-agent";
-import { Box, type Container, Markdown, Spacer, Text } from "@earendil-works/pi-tui";
+import { Box, type Component, Markdown, Spacer, Text } from "@earendil-works/pi-tui";
 import { ENTWURF_SENT_MESSAGE_TYPE } from "../protocol.js";
 import { CONTROL_SOCKET_SUFFIX, controlSocketPathIn, defaultControlSocketDir } from "./lib/control-socket-path.js";
 import {
@@ -548,7 +548,17 @@ interface SentBoxData {
 // `expanded` truncates the body the same way as renderSessionMessage so a
 // large send shows the same preview shape as a large receive. operators
 // reading the transcript should not need different mental models.
-const buildSentMessageBox = (data: SentBoxData, expanded: boolean, theme: Theme): Container => {
+// Return type is `Component`, the interface `MessageRenderer` actually asks for
+// (`Component | undefined`, read at pi-coding-agent
+// `dist/core/extensions/types.d.ts:889`) — NOT the concrete `Container`.
+// `[측정 2026-09-06]` pi 0.85.0's mouse work gave `Container` a `private mouseLayout?`
+// (`pi-tui dist/tui.d.ts:198`; 0.84.4's `Container` had no private member at all), and
+// `Box` declares a SEPARATE private `mouseLayout` of its own. TypeScript only accepts a
+// private member from the same declaration, so the structural assignment `Box -> Container`
+// that held through 0.84.4 became TS2322 at 0.85.x. This was an UNDECLARED break — the
+// upstream Breaking section names only `createGatewayBindingFetch`. Annotating the shared
+// interface is the honest fix: nothing here ever needed Container's own surface.
+const buildSentMessageBox = (data: SentBoxData, expanded: boolean, theme: Theme): Component => {
 	let body = data.body || "(no content)";
 	if (!expanded) {
 		const lines = body.split("\n");

package/pi-extensions/lib/acp/acp-client.ts

@@ -46,8 +46,8 @@ import type { AcpTextBlock } from "./context.js";
  * shape) and never onto those four. A field rename upstream fails the typecheck
  * here rather than silently zeroing the operator's cache-effect badge.
  */
-/** One `_meta.quota.token_count` row (claude-agent-acp 0.73.0
- *  `dist/acp-agent.js:5750-5765`). `cachedInputTokens` is cache READS — the name
+/** One `_meta.quota.token_count` row (claude-agent-acp 0.75.1
+ *  `dist/acp-agent.js:6493-6502`). `cachedInputTokens` is cache READS — the name
  *  differs from `usage.cachedReadTokens` because the shape is shared with
  *  codex-acp; `cachedWriteTokens` is Claude's extra sibling. */
 export type AcpQuotaTokenCount = {
@@ -64,7 +64,7 @@ export type AcpPromptResponse = {
 	/** Vendor-private, version-pinned. `_meta` is a standard ACP extension slot
 	 *  whose values a client may not assume, and `quota` is NOT in
 	 *  claude-agent-acp's exported types — it is produced by the private
-	 *  `turnQuotaMeta()` (read at 0.73.0 `dist/acp-agent.js:5738-5748`). Read
+	 *  `turnQuotaMeta()` (read at 0.75.1 `dist/acp-agent.js:6476-6485`). Read
 	 *  defensively, never structurally required, and re-measure on a pin move. */
 	_meta?: {
 		quota?: {

package/pi-extensions/lib/acp/backend-adapter.ts

@@ -150,7 +150,7 @@ export interface AcpAdapterSettingsParams {
  *
  * During stream handling the vendor keeps a per-message snapshot in
  * `lastAssistantUsage`, but its `usage_update` publishes only the scalar `used`
- * value (read at claude-agent-acp 0.73.0 `dist/acp-agent.js:3273-3297`). Until
+ * value (read at claude-agent-acp 0.75.1 `dist/acp-agent.js:3853-3878`). Until
  * that partition is carried on the wire, NOTHING honest can go in pi's four
  * fields, so entwurf writes none of them.
  */
@@ -342,8 +342,8 @@ export const claudeAdapter: AcpBackendAdapter = {
 
 	// MEASURED (2026-09-02, #93): claude-agent-acp's `usage_update` carries a
 	// session-cumulative ESTIMATED cost (`cost.amount = message.total_cost_usd`)
-	// and a context-occupancy scalar (`used`; both read at 0.73.0
-	// `dist/acp-agent.js:2918-2924`). Both are measured, so backend.ts seals them.
+	// and a context-occupancy scalar (`used`; both read at 0.75.1
+	// `dist/acp-agent.js:3467-3482`). Both are measured, so backend.ts seals them.
 	// The token partition is NOT declared here: ACP's only token carrier is a
 	// per-turn round-trip aggregate, which is not what pi's four fields mean.
 	sealsTurnAccounting: true,

package/pi-extensions/lib/acp/backend.ts

@@ -137,7 +137,7 @@ function finiteOrZero(value: unknown): number {
  * "the accounting-grade figure per the SDK" — it also counts Task subagents,
  * sidechains, and INTERNAL CALLS SUCH AS COMPACTION, so its rows "can total more
  * than `token_count`" and are "the fuller picture, not a decomposition of it"
- * (read at claude-agent-acp 0.73.0 `dist/acp-agent.js:5728-5748`). The narrower
+ * (read at claude-agent-acp 0.75.1 `dist/acp-agent.js:6465-6485`). The narrower
  * `PromptResponse.usage` (== `quota.token_count`) is the MAIN AGENT LOOP only.
  *
  * The wider one is the right numerator because the denominator already has that
@@ -1237,7 +1237,7 @@ export function streamAcpTurn(
 		// Writing zeros is not a placeholder for a better number we could compute:
 		// the per-request partition is genuinely absent from the wire. The vendor
 		// builds it in `lastAssistantUsage` and sends only its scalar sum (read at
-		// claude-agent-acp 0.73.0 `dist/acp-agent.js:3273-3297`) — #96.
+		// claude-agent-acp 0.75.1 `dist/acp-agent.js:3853-3878`) — #96.
 		//
 		// But silence is NOT the resting state. A cache miss the operator never sees
 		// is a false reading, not a modest one: a session can run for hours believing
@@ -1356,7 +1356,7 @@ export function streamAcpTurn(
 				// between them is exactly why the notice below names a MECHANISM and
 				// never a cause: claude-agent-acp's `conversation_reset` handler only
 				// switches the SDK to a fresh conversation and touches no cost at all
-				// (read at 0.73.0 `dist/acp-agent.js:3675-3682`), while claude-agent-sdk
+				// (read at 0.75.1 `dist/acp-agent.js:4282-4289`), while claude-agent-sdk
 				// separately documents that "a mid-session /clear resets the running
 				// total" (read at 0.3.257 `sdk.d.ts:4884`). A reset therefore PLAUSIBLY
 				// explains a backwards total, but nothing here has MEASURED that it did,

package/pi-extensions/lib/acp/event-mapper.ts

@@ -60,8 +60,8 @@ export type AcpPiStreamState = {
 	 *
 	 * Last write wins, never a sum: both are latest session-level observations, and
 	 * one turn can legitimately see several (claude emits one per `result` message,
-	 * including a sub-agent's own — read at claude-agent-acp 0.73.0
-	 * `dist/acp-agent.js:2918-2933`), each carrying that result's current values.
+	 * including a sub-agent's own — read at claude-agent-acp 0.75.1
+	 * `dist/acp-agent.js:3467-3482`), each carrying that result's current values.
 	 */
 	observedSessionCostUsd?: number;
 	observedContextOccupancyTokens?: number;
@@ -346,9 +346,9 @@ export function applyAcpSessionUpdate(
 		case "usage_update": {
 			// `used` is OCCUPANCY-shaped — the backend's post-turn context size, not
 			// the prompt response's turn aggregate. Claude sends `lastAssistantTotalUsage`
-			// as `used` (read at claude-agent-acp 0.73.0
-			// `dist/acp-agent.js:3290-3297`), after constructing that scalar from the
-			// latest assistant snapshot (`:3273-3289`). pi reads `usage.totalTokens` as
+			// as `used` (read at claude-agent-acp 0.75.1
+			// `dist/acp-agent.js:3867-3878`), after constructing that scalar from the
+			// latest assistant snapshot (`:3853-3866`). pi reads `usage.totalTokens` as
 			// exactly that occupancy (`calculateContextTokens(usage) = usage.totalTokens
 			// || input + output + cacheRead + cacheWrite`, read at pi-coding-agent
 			// `dist/core/compaction/compaction.js:86-88`). The assignment below is the

package/pi-extensions/lib/entwurf-deliverability.ts

@@ -109,6 +109,110 @@ export function receiverMarkerMatchesIdentity(
 	);
 }
 
+// ── the watch-owner ↔ sender-marker join (#101 결함 B) ──────────────────────
+// A receiver marker proves "a LIVE process once armed a watch for this garden".
+// It does NOT prove "that process is serving this garden RIGHT NOW". One native
+// process can hold markers for several gardens and drain exactly one of them:
+// Claude Code's session switch (an in-session `/resume` or `/clear`) fires a second
+// SessionStart inside the SAME pid under a NEW native session id, so the first
+// garden's marker keeps naming a live owner forever while the doorbell it advertises
+// is gone. Measured on oracle 2026-09-04 (#101): one pid held both markers, a
+// 09:33 enqueue to the retired garden sat unread as a bare `.msg` for ≥50 minutes —
+// the "enqueue into a void" this module's header exists to refuse.
+//
+// The join that decides it is already on disk: the SENDER marker is keyed by owner
+// pid and rewritten with the CURRENT garden on every arm/prompt, so
+// `meta-senders/<backend>/<ownerPid>.json.gardenId` is the answer to "which garden
+// does this process serve now?". A receiver marker naming a different garden than
+// its own owner's sender marker is a retired watch.
+//
+// SCOPE IS NOT UNIVERSAL, AND THE MARKER SAYS SO. The join only exists where the
+// watch owner IS the process the sender marker is keyed to. That is true for the
+// Claude hook (one `ownerPid` variable writes both markers —
+// `meta-bridge-hook.ts` sender + receiver arm) and false BY CONSTRUCTION for
+// Copilot, whose watch lives in a forked first-party extension child
+// (`extension.mjs` writes `ownerPid: process.pid`) while its sender marker is keyed
+// to the CLI parent (`meta-bridge-hook-copilot.ts` uses `process.ppid`). Applying
+// the join there would make every Copilot citizen permanently undeliverable — a
+// regression on a shipped lane, not a fix. `ownerKind` is recorded on the marker for
+// exactly this reason ("the marker records which, because the pid a reader verifies
+// differs" — AGENTS.md, self-fetch domain), so it is the axis, not `backend`.
+//
+// `omp-host` is a CANDIDATE, deliberately not admitted here: OMP already retires the
+// previous garden in-process on its `/new` edge (the unarm the claude hook lacked),
+// so the cell this join closes has a different owner there. Admitting it needs its
+// own measurement, not this file's optimism.
+export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = ["claude-code-cli"];
+
+/** Does this watch owner share its pid with the backend's sender marker? */
+export function receiverOwnerKindJoinsSender(ownerKind: string): boolean {
+	return SENDER_JOINED_RECEIVER_OWNER_KINDS.includes(ownerKind);
+}
+
+/** The receiver-marker fields the join reads (a structural shape, like ReceiverIdentityFacts). */
+export interface ReceiverOwnerFacts extends ReceiverIdentityFacts {
+	ownerPid: number;
+	ownerKind: string;
+}
+
+/** The sender-marker fields the join reads: which garden this owner pid serves NOW. */
+export interface SenderOwnerFacts {
+	gardenId: string;
+	backend: string;
+}
+
+/**
+ * Is the watch owner still serving THIS garden? Fail-closed inside the join's scope:
+ * an absent/unreadable sender marker, or one naming another garden or backend, means
+ * the watch is retired. Outside the scope (an ownerKind whose watch owner is not the
+ * sender-marker process) the join does not apply and the marker's own live-owner guard
+ * is the whole rule — returning true here is NOT optimism, it is "this axis says
+ * nothing", and the caller has already required the marker to match the identity.
+ */
+export function receiverOwnerServesGarden(
+	marker: ReceiverOwnerFacts,
+	senderMarker: SenderOwnerFacts | null | undefined,
+): boolean {
+	if (!receiverOwnerKindJoinsSender(marker.ownerKind)) return true;
+	return !!senderMarker && senderMarker.gardenId === marker.gardenId && senderMarker.backend === marker.backend;
+}
+
+/** The two marker readers the mailbox receiver facts are composed from (injected — this module does no IO). */
+export interface MailboxReceiverReaders {
+	/** Read the receiver presence marker for a garden id (null = absent/corrupt/dead owner). */
+	readReceiverMarker: (gardenId: string) => ReceiverOwnerFacts | null;
+	/** Read the sender marker for an owner pid (null = absent/corrupt/dead owner). */
+	readSenderMarker: (backend: string, ownerPid: number) => SenderOwnerFacts | null;
+}
+
+/**
+ * THE single composition of the two mailbox receiver facts, over injected readers.
+ * Both production consumers — the v2 `mailboxDeliverabilityFor` seam and the MCP
+ * bridge's `entwurf_self` — call THIS, so a direct send, a re-resolved fallback send
+ * and a citizen's own replyability can never drift to different verdicts.
+ *
+ *   ownerAlive  — a live-owner marker that names THIS identity (the reader already ran
+ *                 the plausibility + start-key guards; this adds the identity match).
+ *   watchArmed  — that owner is still serving this garden (the join above). It is a
+ *                 MEASUREMENT, never a copy of ownerAlive: copying it is what let a
+ *                 retired watch read as an armed doorbell (#101 결함 B).
+ *
+ * `recordBacked` is NOT decided here — it stays the caller's explicit fact, so an
+ * absent record and a dead owner stay distinguishable in the reason string.
+ */
+export function resolveMailboxReceiverFacts(
+	identity: ReceiverIdentityFacts,
+	readers: MailboxReceiverReaders,
+): { ownerAlive: boolean; watchArmed: boolean } {
+	const marker = readers.readReceiverMarker(identity.gardenId);
+	const ownerAlive = receiverMarkerMatchesIdentity(marker, identity);
+	if (!ownerAlive || !marker) return { ownerAlive: false, watchArmed: false };
+	const senderMarker = receiverOwnerKindJoinsSender(marker.ownerKind)
+		? readers.readSenderMarker(marker.backend, marker.ownerPid)
+		: null;
+	return { ownerAlive, watchArmed: receiverOwnerServesGarden(marker, senderMarker) };
+}
+
 export interface MailboxDeliverabilityFacts extends MetaReceiverActiveFacts {
 	/** The target backend's wake mode (from the capability registry). */
 	wakeMode?: WakeMode | string;

package/pi-extensions/lib/entwurf-fact-provider.ts

@@ -27,7 +27,13 @@
  * one diagnostic carries the fact. (pi + same-gid socket = the normal merge.)
  */
 
-import { type FactList, isOutOfSocketDomainGardenIdConflict, resolveFactList } from "./entwurf-facts.ts";
+import {
+	type FactList,
+	isOutOfSocketDomainGardenIdConflict,
+	type PeerObserver,
+	resolveFactList,
+} from "./entwurf-facts.ts";
+import { observePeerFacts } from "./entwurf-peer-observe.ts";
 import { isLivenessSupported } from "./entwurf-v2-contract.ts";
 import {
 	type ActiveStoreEntry,
@@ -93,6 +99,12 @@ export interface EntwurfFactsDeps {
 	readRecord: (filename: string) => string;
 	/** Socket axis: injected into scanSocketProbes (controlDir/readdir/probe). */
 	socket?: Partial<SocketScanDeps>;
+	/** Observation axis (#101): per-citizen receiver + transcript facts. Defaults to the
+	 * REAL measurement — the same seam shape `makeProductionEntwurfV2Deps` uses, so the two
+	 * wiring sites (MCP + pi-native) cannot drift by each passing their own observer, and a
+	 * gate still drives the assembly with a fake and no filesystem. A caller that injects
+	 * nothing gets facts; a caller that injects `() => UNOBSERVED_PEER` says so on every row. */
+	observe?: PeerObserver;
 }
 
 function diagnosticSortKey(d: EntwurfDiagnostic): string {
@@ -113,10 +125,12 @@ function diagnosticSortKey(d: EntwurfDiagnostic): string {
 }
 
 /**
- * Assemble the facts-only listing. Pure over its injected deps (no direct IO) so
- * the gate drives it without a filesystem; slice 4c supplies the real readdir /
- * readFile / probe. Probes are gid + liveness only (#50 C4 — the per-socket
- * get_info enrich left with the socket-only quasi-citizen listing).
+ * Assemble the facts-only listing. Driven entirely through injected deps, so the gate
+ * runs it without a filesystem; slice 4c supplies the real readdir / readFile / probe.
+ * The one dep with a REAL default is `observe` (#101) — see its comment: a per-citizen
+ * measurement both wiring sites must make identically is safer as one default than as two
+ * call-site arguments. Probes are gid + liveness only (#50 C4 — the per-socket get_info
+ * enrich left with the socket-only quasi-citizen listing).
  */
 export async function listEntwurfFacts(deps: EntwurfFactsDeps): Promise<EntwurfFactsResult> {
 	const diagnostics: EntwurfDiagnostic[] = [];
@@ -183,7 +197,7 @@ export async function listEntwurfFacts(deps: EntwurfFactsDeps): Promise<EntwurfF
 	//    fire as the last line of defense, never caught here.
 	const cleanIdentities = identities.filter((i) => !conflictGids.has(i.gardenId));
 	const cleanProbes = probes.filter((p) => !conflictGids.has(p.gardenId));
-	const facts: FactList = resolveFactList(cleanIdentities, cleanProbes);
+	const facts: FactList = resolveFactList(cleanIdentities, cleanProbes, deps.observe ?? observePeerFacts);
 
 	// 5. #50 C4 demotion: a record-less socket is a diagnostic, not a listing
 	//    section. One diagnostic per socket (subjects aggregate at render, F8);

package/pi-extensions/lib/entwurf-facts.ts

@@ -19,6 +19,9 @@
  *     a peer-facing fact; `entwurf_peers` exposes identity + cwd-history, not
  *     filesystem internals. (who-can / dispatch read it via the meta-record
  *     directly when they genuinely need it — it does not belong in the listing.)
+ *     Whether that transcript EXISTS is a different thing and is carried (#101):
+ *     the path stays private, the fact that a citizen has never written a turn
+ *     does not.
  *
  * The 4-value liveness (`alive|dead|indeterminate|unsupported`, R3b) and the
  * out-of-domain → `unsupported` rule (R1: never coerce an unprobed backend to
@@ -47,8 +50,44 @@ export interface PeerFact {
 	recordUpdatedAt: string;
 	// — the single computed fact: 4-value liveness (R1/R3b). NOT a verb. —
 	liveness: FactLiveness;
+	// — observed state (#101). Facts, not verbs: they say what was found on disk, not
+	//   what a caller may do about it. For claude-code every row reads
+	//   `liveness=unsupported` — the control-socket probe does not apply — so the listing
+	//   showed nothing that separated a live citizen from a phantom, and a caller picking
+	//   "the newest record in this cwd" picked the phantom as often as the real one.
+	receiver: ReceiverObservation;
+	transcript: TranscriptObservation;
 }
 
+/**
+ * The mailbox receiver axis, as OBSERVED for this citizen.
+ *   active     a presence marker whose owner is live AND still serving this garden.
+ *   inactive   a marker exists but fails that test (dead owner, drifted identity, or an
+ *              owner that switched to another garden).
+ *   none       no marker at all — never armed, or retired.
+ *   n/a        this backend has no mailbox receiver axis (pi, antigravity).
+ *   unobserved nobody measured it. Only reachable when a caller drives the fact core
+ *              without an observer; it is the honest word for "not looked at", never a
+ *              quiet stand-in for `none`.
+ */
+export type ReceiverObservation = "active" | "inactive" | "none" | "n/a" | "unobserved";
+
+/** Does the recorded transcript exist on disk? `absent` is what a never-used registration
+ * looks like: a record with no conversation behind it. */
+export type TranscriptObservation = "exists" | "absent" | "unobserved";
+
+export interface PeerObservations {
+	receiver: ReceiverObservation;
+	transcript: TranscriptObservation;
+}
+
+/** What a caller that measured nothing must say. Explicit and greppable — a row that
+ * silently defaulted to `none`/`absent` would be a fabricated fact. */
+export const UNOBSERVED_PEER: PeerObservations = { receiver: "unobserved", transcript: "unobserved" };
+
+/** Measure the two observed axes for one citizen. Injected, so this module stays pure. */
+export type PeerObserver = (identity: MetaIdentity) => PeerObservations;
+
 /**
  * Compose a `PeerFact` from a citizen's identity and an optional socket probe.
  *
@@ -61,7 +100,11 @@ export interface PeerFact {
  *
  * Pure: same inputs → same output, no IO.
  */
-export function resolvePeerFact(identity: MetaIdentity, socket: SocketLiveness | null): PeerFact {
+export function resolvePeerFact(
+	identity: MetaIdentity,
+	socket: SocketLiveness | null,
+	observations: PeerObservations = UNOBSERVED_PEER,
+): PeerFact {
 	return {
 		gardenId: identity.gardenId,
 		backend: identity.backend,
@@ -71,6 +114,8 @@ export function resolvePeerFact(identity: MetaIdentity, socket: SocketLiveness |
 		createdAt: identity.createdAt,
 		recordUpdatedAt: identity.recordUpdatedAt,
 		liveness: factLivenessOf(identity.backend, socket),
+		receiver: observations.receiver,
+		transcript: observations.transcript,
 	};
 }
 
@@ -172,7 +217,11 @@ export interface FactList {
  * A gardenId is never emitted as both a `PeerFact` and a `RecordLessSocketFact`;
  * a record-less socket becomes a `PeerFact` the moment a record claims the gid.
  */
-export function resolveFactList(identities: MetaIdentity[], socketProbes: SocketProbe[]): FactList {
+export function resolveFactList(
+	identities: MetaIdentity[],
+	socketProbes: SocketProbe[],
+	observe: PeerObserver = () => UNOBSERVED_PEER,
+): FactList {
 	const probeMap = new Map<string, SocketProbe>();
 	for (const probe of socketProbes) {
 		if (probeMap.has(probe.gardenId)) {
@@ -207,7 +256,7 @@ export function resolveFactList(identities: MetaIdentity[], socketProbes: Socket
 			}
 			socket = null;
 		}
-		peers.push(resolvePeerFact(identity, socket));
+		peers.push(resolvePeerFact(identity, socket, observe(identity)));
 		consumed.add(gid);
 	}