@junghanacs/entwurf 0.17.2 → 0.18.1

package/run.sh

@@ -144,6 +144,7 @@ Usage:
   ./run.sh check-meta-mailbox-state-write # deterministic gate (0.11 Stage 0 step 3D-4 commit2): post-cut receipt is state-only — meta-record file byte-identical across enqueue/read, state carries lastEnqueuedAt/lastReadAt (field isolation), empty inbox no-op on record+state, drift surfaces; no API
   ./run.sh check-meta-receiver-marker # deterministic gate (SE-2): receiver marker round-trip/start-key/provenance, UserPromptSubmit cannot mint presence, reader does not gate on record existence — marker SEMANTICS only; launch topology moved to check-hook-launch-topology
   ./run.sh check-hook-launch-topology # #51 gate 1: shipped hooks.json is exec form through hook-launch.sh, launcher is loud on an empty argv (older Claude's silent args drop), exec preserves the pid so the hook's parent is Claude, and a space/$/backtick plugin path survives as one argv element
+  ./run.sh check-meta-hook-session-switch # #101 gate: ONE Claude pid, TWO SessionStarts (resume picker placeholder -> resumed id). The hook retires the marker of the garden it stopped serving (records untouched, same-garden re-registration retires nothing), the reader stays fail-closed on a re-planted stale marker (watchArmed measured against the owner's sender marker, never copied), production dispatch refuses the retired garden and NAMES the failing axis, and exactly one of the two gardens is deliverable. Sandboxed roots, no API
   ./run.sh check-meta-identity-consumers # deterministic gate: V3-only consumer seam — per-entry targeted read + addressable read snapshot uniqueness, non-regular rivals never read, drift/unparseable rivals unreachable, unreadable regular rivals fail loud; strict upsert refuses an unreadable store before any write, no API
   ./run.sh check-meta-capability-source # deterministic gate (0.11 Stage 0 step 3D-3): capability-source cut-over — mint/parse read wakeMode/deliveryLevel from the registry (metaCapabilityFor, registry-driven via injection), not META_BACKEND_DESCRIPTORS; behaviour-preserving (registry ≡ const); the record.delivery slot 3D-3 preserved was deleted by 3D-4, no API
   ./run.sh check-socket-probe          # deterministic gate (0.11 Stage 0, F3): three-valued control-socket liveness (alive|dead|indeterminate) — GC reclaims dead only, indeterminate survives; pure classify + 2-socket integration, no API
@@ -191,6 +192,7 @@ Usage:
   ./run.sh smoke-omp-receive-live      # #87 bundle B acceptance: another harness wakes an ALREADY-OPEN omp citizen, which reads its inbox and answers in the same session. Decides its own outcome from the capability registry — omp without a drainable mailbox is a protocol SKIP (no receiver unit exists to arm), which an unattended release-gate reports and `--cut` reads as RED; a registry that claims a receive rail with no acceptance body here is a FAIL
   ./run.sh smoke-entwurf-chain-live    # LIVE cross-harness delivery chain: native Claude Code -> pi GPT -> pi ACP Sonnet -> mailbox terminus, proving sender identity/replyable at every hop and a real read receipt at the end. Prerequisites (claude on PATH, pi credentials per backend) report protocol SKIP, never a pass
   ./run.sh check-release-gate-outcomes  # release-gate STEP OUTCOME protocol (P1): one skip exit code shared by the shell + TS halves, classifier never rounds a skip up to a pass, `--cut` refuses a MUST SKIP while a bare diagnostic stays exit 0, no LIVE smoke keeps the old exit-0 skip shape, and both real skip surfaces are INVOKED and observed to propagate the code
+  ./run.sh check-gate-manifests         # the HEAD of that qualification, on its own: runner self-test + the committed manifests validated against the origin index + the declared lane inventory. Executes ZERO mutants and never snapshots this repo (~8s), which is why it lives in check:hermetic while the body stays on CI/release-gate — three of the five reds qualification ever produced in CI died right here, before a mutant gate ran (#99 B-3)
   ./run.sh check-gate-qualification    # kill-proof qualification (the gate-of-gates): runner self-test (classifier truth table + synthetic negatives incl. wrong-reason/hang/control-red/impurity) + committed mutant manifests (scripts/mutants/*.json) run in an isolated snapshot repo under control→mutant→restore→control; the real checkout is never written. Evidence = claim IDs + killed mutant IDs, never assertion counts
   ./run.sh check-probe-ordering        # §11-7 ordering-probe deterministic gate: raw-client SAMENESS pinned to backend.ts (sequence/args/timeouts/permission policy — the probe may never measure a lookalike), phase attribution incl. set-model, probe-mode fixture wire markers (delay honored, probeRunId REQUIRED, smoke-acp-mcp-live legacy compat), event-log door integrity (reserved keys refused at write; unknown marker name, broken sort axis, or a payload the classifier cannot judge on is MALFORMED, never a quiet event), and the §11-7 paired-verdict truth table (P0/I0 outside the space, phase-qualified D, B promotion ladder, C, A two-delay rule). Offline/deterministic; one product claim (no production prompt cutoff) is replant-qualified via scripts/mutants/probe-ordering.json, while the other assertions are direct [CHECK:*] contracts
   ./run.sh check-probe-cli-shim        # §11-7-c B-name-snapshot PRODUCER gate: the CLI shim driven as a REAL process against fake CLIs (no API, no cost). Proves what a defect would buy — FABRICATED evidence (a malformed init is never reported as an empty name set; the boot report carries the true target path+sha256 the classifier verifies against the roster), a DESTROYED turn (byte transparency across mid-UTF8/CRLF/oversized/unterminated framing, exit-code fidelity, signal re-raise, inbound signal forwarding, stderr passthrough, stdout backpressure), and LEAKED operator state (exact-allowlist env scrub, no argv/env/prompt body in the log). Offline/deterministic; 20 direct [CHECK:*] contracts, deliberately no longer replant-qualified after #70 subtraction
@@ -252,7 +254,7 @@ Usage:
   ./run.sh check-dep-versions         # local deterministic check that the pi pin agrees across package.json (devDeps + peer range), run.sh (peer-install pins), and the baseline docs (AGENTS/README/ROADMAP/setup-clean-host/demo)
   ./run.sh check-node-floor-coherence # binds the Node floor (24+, single axis) across engines.node, run.sh setup preflight, meta-bridge install/doctor judgment logic, clean-host docs, the bridge launcher header, and the CI runner node-version — engines.node is the SSOT, everything else is derived; sweeps tracked contract text for an unregistered declaration
   ./run.sh check-pack                 # publish gate (dry-run): npm pack --dry-run + tarball invariants (runtime-critical present, dev residue absent)
-  ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes (version boundary: @0.84.40 must leak, @0.84.4 bare/peer-hash must pass); snapshot-safe qualification oracle, also run first inside check-pack-install
+  ./run.sh check-pack-pin-matcher     # pure self-test of check-pack-install's pin-leak matcher against synthetic .pnpm lookalikes, one cell per property: version boundary (@0.85.10 must leak, @0.85.1 bare or with either measured peer-hash must pass) and closure prefix (an off-pin @earendil-works/chord must leak — it carries no `pi-` prefix); snapshot-safe qualification oracle, also run first inside check-pack-install
   ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
   ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke with the pinned pi peers (pins derived from the package.json devDep; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES) + the INSTALLED-PACKAGE branch of the Copilot and OMP birth installers actually RUN (compiled entry selected, no raw .ts, and a real birth edge mints a citizen — the half a required-artifact list can never stand in for)
   ./run.sh check-install-container    # 0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)
@@ -894,6 +896,23 @@ check_meta_receiver_marker() {
   run_ts scripts/check-meta-receiver-marker.ts
 }
 
+check_meta_hook_session_switch() {
+  # #101 gate: a Claude Code SESSION SWITCH — one native process that stops serving one
+  # garden and starts serving another. The resume picker (and `/clear`) fire SessionStart
+  # twice inside one pid: once for the TUI's placeholder id, once for the id the operator
+  # picked. Before this gate nothing asked "one owner pid, two gardens", so a placeholder
+  # citizen stayed registered with an armed-looking doorbell and real mail rotted in it.
+  # Plays Claude the way check-hook-launch-topology does (spawn the SHIPPED launcher with
+  # the manifest's argv, so the hook's parent is this process = one fake owner pid) with
+  # every meta root sandboxed. Asserts: both records survive (marker retired, never the
+  # record); the retired garden's marker is gone; a same-garden re-registration retires
+  # NOTHING; a re-planted stale marker is still undeliverable (the sender-marker join,
+  # fail-closed at the reader); production dispatch refuses it and carries the predicate's
+  # reason to the rendered surface; exactly one garden is deliverable and it is the served
+  # one. Real tmpdir, no API.
+  run_ts scripts/check-meta-hook-session-switch.ts
+}
+
 check_copilot_birth_hook() {
   # #82 gate: the Copilot BIRTH path, proven without Copilot. Drives the REAL
   # assembler (--assemble-only, into a temp dir), then fires the baked launcher the
@@ -1827,13 +1846,13 @@ assert.equal(peerTui, piAi,
 // floor tracks the devDep pin so a consumer can't install against a pi lacking
 // the public trust exports the bridge imports at the pinned minor, AND an upper
 // bound at the next minor stops a fresh install from silently pulling a future
-// pi (past the declared ceiling — 0.85+ at the current 0.84.4 pin) whose
+// pi (past the declared ceiling — 0.86+ at the current 0.85.1 pin) whose
 // internal export surface has drifted from the one we typecheck against.
 // pi moves its public surface every minor (the 0.79→0.80 getModels→provider-
 // factory churn is exactly this), so an open `>=` floor is exactly how the next
 // installer re-acquires the drift. The floor is also the HARD MINIMUM a consumer
-// install resolves: at `>=0.84.4` an existing 0.84.3 host is upgraded, not kept.
-// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.84.4 <0.85`).
+// install resolves: at `>=0.85.1` an existing 0.85.0 host is upgraded, not kept.
+// Expected shape: `>=<devDep> <0.<minor+1>` (e.g. `>=0.85.1 <0.86`).
 const [piMaj, piMin] = piAi.split('.').map(Number);
 assert.equal(piMaj, 0,
   `pi pin major must stay 0 for the next-minor ceiling rule (got ${piAi}); revisit check-dep-versions when pi reaches 1.x`);
@@ -1860,7 +1879,11 @@ assert.equal(peerDepTui, expectedPeer,
 // Scope is deliberately narrow: only sentences that DECLARE the pi pin. History
 // (CHANGELOG/NEXT) keeps its old versions, and a pi mention without a version
 // (an uninstall line, a type import) is not a declaration.
-const BASELINE_DOCS = ['AGENTS.md', 'README.md', 'ROADMAP.md', 'docs/setup-clean-host.md', 'demo/README.md'];
+// VERIFY.md joined on 2026-09-06: it declared the pi range in prose that no gate
+// read, and sat two bumps stale (`>=0.84.3 <0.85` at a 0.85.1 pin) precisely
+// because it was outside this list. Its declaration is a plain range, so the
+// range scan below binds it — no new PROSE_DECL is needed for it.
+const BASELINE_DOCS = ['AGENTS.md', 'README.md', 'ROADMAP.md', 'docs/setup-clean-host.md', 'demo/README.md', 'VERIFY.md'];
 let rangeDecls = 0, exactDecls = 0;
 for (const file of BASELINE_DOCS) {
   const text = readFileSync(file, 'utf8');
@@ -3096,35 +3119,65 @@ check_pack() {
 }
 
 # The pin-leak filter for the install tree's .pnpm listing, shared by the real scan and its
-# self-test below. The version BOUNDARY is load-bearing: a pnpm .pnpm entry is
-# `<name>@<version>` followed by either `_<peer-hash>` or end-of-name (measured pnpm 11.20.0
-# on this tree), so an unbounded substring match would bless a lookalike such as `@0.84.40`
-# while announcing the pinned floor — a false-green oracle (found by independent review,
-# 2026-08-25).
+# self-test below. TWO properties are load-bearing and each has its own cell below.
+#
+# (1) The version BOUNDARY. A pnpm .pnpm entry is `<name>@<version>` followed by either
+#     `_<peer-hash>` or end-of-name (measured pnpm 11.20.0 on this tree), so an unbounded
+#     substring match would bless a lookalike such as `@0.85.10` while announcing the pinned
+#     floor — a false-green oracle (found by independent review, 2026-08-25).
+# (2) The name PREFIX covers the whole @earendil-works closure, not the `pi-` families alone.
+#     0.85.0 added `@earendil-works/chord`, declared as a runtime `dependencies` entry by
+#     pi-coding-agent, pi-agent-core, pi-client and pi-protocol — inside the closure, with a
+#     name that carries no `pi-` prefix. `[측정 2026-09-06]` a real 0.85.1 install tree lists
+#     `@earendil-works+chord@0.85.1` next to the seven pi entries, and the old
+#     `^@earendil-works+pi-` filter did not see it: chord would have floated silently while
+#     this gate printed a verified pin. The prefix is the closure's org, not one family in it.
+#     (The measured peer-hash suffix moved too — `_ws@8.21.3` at 0.85.1 where 0.84.4 carried
+#     `_@modelcontextprotocol+sdk@…` — which is exactly what property (1)'s `(_|$)` absorbs;
+#     both shapes are fixtures below so a future suffix change cannot pass vacuously.)
 pack_install_leaked_pi() {
-  grep '^@earendil-works+pi-' | grep -Ev '@0\.84\.4(_|$)' || true
+  grep '^@earendil-works+' | grep -Ev '@0\.85\.1(_|$)' || true
 }
 
-# Matcher self-test on SYNTHETIC lookalikes: a healthy install tree cannot exercise the
-# false-green shape (it contains no 0.84.40), so the oracle is proven against a fixture
-# listing. Expected: the two lookalikes leak, the pinned version passes bare and with a
-# peer-hash suffix. Exposed as its own snapshot-safe subcommand because the heavy
-# check-pack-install cannot run inside the qualification snapshot (no install environment),
-# and a kill-proof needs a control-green gate there; check-pack-install still runs this
-# first so the heavy gate cannot proceed on a broken oracle.
+# Matcher self-test on SYNTHETIC lookalikes: a healthy install tree cannot exercise either
+# false-green shape (it contains no 0.85.10 and no off-pin chord), so the oracle is proven
+# against fixture listings. One cell per property of pack_install_leaked_pi, so a regression
+# in either is named by its own signature rather than folded into a single verdict. Exposed
+# as its own snapshot-safe subcommand because the heavy check-pack-install cannot run inside
+# the qualification snapshot (no install environment), and a kill-proof needs a control-green
+# gate there; check-pack-install still runs this first so the heavy gate cannot proceed on a
+# broken oracle.
 check_pack_pin_matcher() {
   local matcher_probe
+
+  # Cell 1 — the version boundary. Both measured peer-hash shapes are fixtures: the
+  # 0.84.4-era `_@modelcontextprotocol+sdk@…` and the `_ws@8.21.3` observed on a real
+  # 0.85.1 tree. Neither may leak; the two lookalikes must.
   matcher_probe=$(printf '%s\n' \
-    '@earendil-works+pi-ai@0.84.4' \
-    '@earendil-works+pi-ai@0.84.4_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
-    '@earendil-works+pi-ai@0.84.40' \
-    '@earendil-works+pi-agent-core@0.84.3' | pack_install_leaked_pi)
-  if [ "$matcher_probe" != '@earendil-works+pi-ai@0.84.40
-@earendil-works+pi-agent-core@0.84.3' ]; then
-    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the 0.84.40/0.84.3 lookalikes and pass 0.84.4 bare or with a peer-hash — got: ${matcher_probe:-<nothing leaked>}"
+    '@earendil-works+pi-ai@0.85.1' \
+    '@earendil-works+pi-ai@0.85.1_@modelcontextprotocol+sdk@1.29.0_zod@4.3.6' \
+    '@earendil-works+pi-ai@0.85.1_ws@8.21.3' \
+    '@earendil-works+pi-ai@0.85.10' \
+    '@earendil-works+pi-agent-core@0.85.0' | pack_install_leaked_pi)
+  if [ "$matcher_probe" != '@earendil-works+pi-ai@0.85.10
+@earendil-works+pi-agent-core@0.85.0' ]; then
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED] the pin-leak matcher must flag the 0.85.10/0.85.0 lookalikes and pass 0.85.1 bare or with either measured peer-hash — got: ${matcher_probe:-<nothing leaked>}"
     return 1
   fi
-  echo "[check-pack-pin-matcher] ok — the pin-leak matcher is version-bounded (lookalikes leak, pinned version passes bare and with a peer-hash)"
+
+  # Cell 2 — the closure prefix. chord is a non-`pi-` member of the same runtime closure
+  # (0.85.0 onward). An off-pin chord MUST leak; the pinned one must not. A matcher narrowed
+  # back to `^@earendil-works+pi-` sees nothing here and dies at this signature.
+  matcher_probe=$(printf '%s\n' \
+    '@earendil-works+chord@0.85.1' \
+    '@earendil-works+chord@0.85.0' \
+    '@earendil-works+pi-ai@0.85.1' | pack_install_leaked_pi)
+  if [ "$matcher_probe" != '@earendil-works+chord@0.85.0' ]; then
+    fail "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE] the pin-leak matcher must cover every @earendil-works closure member, not just the pi-* families — an off-pin @earendil-works/chord has to leak (it is a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol at 0.85.x) — got: ${matcher_probe:-<nothing leaked>}"
+    return 1
+  fi
+
+  echo "[check-pack-pin-matcher] ok — the pin-leak matcher is version-bounded (lookalikes leak, pinned version passes bare and with either measured peer-hash) and covers the whole @earendil-works closure (chord included)"
 }
 
 _check_pack_install_impl() {
@@ -3351,7 +3404,7 @@ _check_pack_install_impl() {
   printf '%s\n' '{ "name": "entwurf-install-smoke", "version": "0.0.0", "private": true }' > "$tmp/package.json"
 
   # pi-agent-core is pinned even though we never import it: pi-coding-agent depends
-  # on it by CARET (`^0.84.x`), so with no lockfile in this fresh temp project it
+  # on it by CARET (`^0.85.x`), so with no lockfile in this fresh temp project it
   # floats to whatever pi published last — and that newer core then drags a NESTED
   # pi-ai of its own. Measured 2026-07-21: pinning only the three we import left
   # pi-agent-core@0.80.10 + pi-ai@0.80.10 in the tree while the gate still announced
@@ -3369,21 +3422,30 @@ _check_pack_install_impl() {
   # `^0.84.x` carets on it), and upstream's 0.84.4 patch publish (2026-08-28
   # 22:04Z) floated that caret in this lockfile-less temp install, turning CI
   # red through the leak assertion below. That explicit pin is what held the
-  # line until the bump lane ran; the verified floor is 0.84.4 as of
-  # 2026-09-01, and the pin moved WITH it rather than being retired. The leak
-  # assertion below still covers every other pi package, including any package
-  # a future pi bump adds to the closure.
-  echo "[check-pack-install] pnpm add into $tmp (with 0.84.x peers + typebox)"
+  # line until the bump lane ran; the pin moved WITH each verified floor rather
+  # than being retired.
+  #
+  # At 0.85.1 the constellation GREW AGAIN, and this time outside the `pi-`
+  # naming: `@earendil-works/chord` is new in 0.85.0 and is a runtime
+  # `dependencies` entry of pi-coding-agent, pi-agent-core, pi-client and
+  # pi-protocol (`[측정 2026-09-06]` `npm view <pkg>@0.85.1 dependencies`), so an
+  # unpinned `^0.85.x` caret on it floats exactly like pi-agent-core did in 2026-07-21.
+  # It is pinned here for the first time. The leak assertion below covers every
+  # other @earendil-works package too — but only because the matcher's prefix was
+  # widened from `pi-` to the org in the same change; before that it was blind to
+  # precisely this class of new member. The verified floor is 0.85.1 as of 2026-09-06.
+  echo "[check-pack-install] pnpm add into $tmp (with 0.85.x peers + chord + typebox)"
   local install_log
   install_log=$(cd "$tmp" && pnpm add \
     "$tgz_path" \
-    "@earendil-works/pi-ai@0.84.4" \
-    "@earendil-works/pi-coding-agent@0.84.4" \
-    "@earendil-works/pi-tui@0.84.4" \
-    "@earendil-works/pi-agent-core@0.84.4" \
-    "@earendil-works/pi-client@0.84.4" \
-    "@earendil-works/pi-protocol@0.84.4" \
-    "@earendil-works/pi-telemetry@0.84.4" \
+    "@earendil-works/pi-ai@0.85.1" \
+    "@earendil-works/pi-coding-agent@0.85.1" \
+    "@earendil-works/pi-tui@0.85.1" \
+    "@earendil-works/pi-agent-core@0.85.1" \
+    "@earendil-works/pi-client@0.85.1" \
+    "@earendil-works/pi-protocol@0.85.1" \
+    "@earendil-works/pi-telemetry@0.85.1" \
+    "@earendil-works/chord@0.85.1" \
     "typebox@latest" \
     --ignore-workspace --ignore-scripts 2>&1) || {
     fail "[check-pack-install] pnpm add failed:"
@@ -3392,18 +3454,18 @@ _check_pack_install_impl() {
   }
 
   # A pin is a wish until the resolved tree is read back. Assert it: EVERY
-  # @earendil-works pi package present — direct or transitive, top level or nested —
-  # must be the pinned 0.84.4. Anything else means an unpinned caret floated and the
-  # rest of this gate would be exercising a runtime nobody verified, while still
-  # printing "pinned pi 0.84.4". Fail loud instead of proving the wrong floor.
+  # @earendil-works package present — direct or transitive, top level or nested,
+  # chord included — must be the pinned 0.85.1. Anything else means an unpinned caret
+  # floated and the rest of this gate would be exercising a runtime nobody verified,
+  # while still printing "pinned pi 0.85.1". Fail loud instead of proving the wrong floor.
   local leaked_pi
   leaked_pi=$(ls "$tmp/node_modules/.pnpm" 2>/dev/null | pack_install_leaked_pi)
   if [ -n "$leaked_pi" ]; then
-    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.84.4):"
+    fail "[check-pack-install] UNVERIFIED pi runtime resolved into the install tree (expected only 0.85.1):"
     printf '%s\n' "$leaked_pi" | sed 's/^/    /' >&2
     return 1
   fi
-  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works pi package is 0.84.4"
+  echo "[check-pack-install] pi runtime tree pin verified: every @earendil-works package is 0.85.1 (chord included)"
 
   # Resolve the installed package.json and confirm pi.extensions
   # arrived intact. If pi.extensions is empty or missing, the
@@ -3701,10 +3763,23 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
   # SAME installed candidate, on a FRESH sandbox home with every harness absent.
   # This is the first living consumer of package-installed `entwurf setup`:
   # mode=installed decided by name before anything else, NO pnpm bootstrap inside
-  # node_modules, pi/claude/agy explicit zero-state SKIPs, stable bins PASS as
-  # npm-provided, core bridge boundary PASS, computed green, zero harness/auth
-  # writes. Harness probes are pinned absent via the PI_BIN/CLAUDE_BIN/AGY_BIN/
-  # COPILOT_BIN seams so the gate host's real harnesses never leak in.
+  # node_modules, pi/claude/agy/copilot/omp explicit zero-state SKIPs, stable bins
+  # PASS as npm-provided, core bridge boundary PASS, computed green, zero
+  # harness/auth writes. Harness probes are pinned absent via the FIVE
+  # PI_BIN/CLAUDE_BIN/AGY_BIN/COPILOT_BIN/OMP_BIN seams so the gate host's real
+  # harnesses never leak in.
+  #
+  # OMP_BIN was MISSING here from the 0.16.0 OMP admission until 2026-09-06, while
+  # the two sibling fixtures (`smoke-setup-verdict.sh:70`,
+  # `check-setup-qualification.sh:76`) both carried it. On a host that HAS omp on
+  # PATH the row's own premise was false: setup detected omp, and the omp config /
+  # receiver installers then refused — correctly — because this row also exports
+  # `PI_CODING_AGENT_DIR`, which omp reads too, so the target directory is
+  # ambiguous. Nothing was wrong with the product; the fixture was. It stayed
+  # invisible because CI runners carry no omp AND `release_gate()` does not run
+  # this gate (it is prepublishOnly + the CI install-surface job). The skip probe
+  # below now requires FIVE zero-states, so a sixth harness cannot be admitted
+  # while this seam is quietly left behind again.
   local setup_home="$npm_tmp/setuphome" setup_proj="$npm_tmp/setupproj" setup_out setup_rc setup_auth
   mkdir -p "$setup_home/.pi/agent" "$setup_proj"
   setup_auth="$setup_home/.pi/agent/auth.json"
@@ -3715,7 +3790,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
   setup_out=$(HOME="$setup_home" XDG_DATA_HOME="$setup_home/.local/share" XDG_STATE_HOME="$setup_home/.local/state" \
     XDG_CACHE_HOME="$setup_home/.cache" XDG_CONFIG_HOME="$setup_home/.config" PI_CODING_AGENT_DIR="$setup_home/.pi/agent" \
     PI_BIN="$npm_tmp/definitely-absent" CLAUDE_BIN="$npm_tmp/definitely-absent" AGY_BIN="$npm_tmp/definitely-absent" \
-    COPILOT_BIN="$npm_tmp/definitely-absent" \
+    COPILOT_BIN="$npm_tmp/definitely-absent" OMP_BIN="$npm_tmp/definitely-absent" \
     "$npmroot/node_modules/.bin/entwurf" setup "$setup_proj" 2>&1)
   setup_rc=$?
   set -e
@@ -3735,7 +3810,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
     return 1
   fi
   local skip_probe
-  for skip_probe in "pi: SKIP" "claude: SKIP" "agy: SKIP" "copilot: SKIP"; do
+  for skip_probe in "pi: SKIP" "claude: SKIP" "agy: SKIP" "copilot: SKIP" "omp: SKIP"; do
     if ! grep -q "$skip_probe" <<<"$setup_out"; then
       fail "[check-pack-install] installed all-absent setup missing explicit zero-state '$skip_probe':"
       echo "$setup_out" | tail -25 | sed 's/^/    /' >&2
@@ -3760,7 +3835,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
     fail "[check-pack-install] installed setup touched the credential store (byte drift or .bak)"
     return 1
   fi
-  echo "[check-pack-install] installed all-absent setup pass (mode-first, no bootstrap, 4x SKIP, bins npm-provided, core PASS, computed green, zero writes)"
+  echo "[check-pack-install] installed all-absent setup pass (mode-first, no bootstrap, 5x SKIP, bins npm-provided, core PASS, computed green, zero writes)"
 
   # Installed copilot-present aggregate `setup` row (#86 C3b): the SAME consumer
   # bin on a fresh sandbox home, with the shared fake vendor
@@ -3786,6 +3861,7 @@ sys.exit(0 if any(isinstance(s,str) and s.rstrip('/')== '$npm2_pkg' for s in src
   setup_out=$(HOME="$cop_setup_home" XDG_DATA_HOME="$cop_setup_home/.local/share" XDG_STATE_HOME="$cop_setup_home/.local/state" \
     XDG_CACHE_HOME="$cop_setup_home/.cache" XDG_CONFIG_HOME="$cop_setup_home/.config" PI_CODING_AGENT_DIR="$cop_setup_home/.pi/agent" \
     PI_BIN="$npm_tmp/definitely-absent" CLAUDE_BIN="$npm_tmp/definitely-absent" AGY_BIN="$npm_tmp/definitely-absent" \
+    OMP_BIN="$npm_tmp/definitely-absent" \
     COPILOT_BIN="$cop_fake/copilot" PATH="$cop_fake:$npmroot/node_modules/.bin:$PATH" \
     "$npmroot/node_modules/.bin/entwurf" setup "$cop_setup_proj" 2>&1)
   setup_rc=$?
@@ -5440,10 +5516,11 @@ release_gate() {
     results+=("FAIL  static (pnpm run check:full)"); failc=$((failc + 1))
   fi
 
-  # 1b. Discriminating power of that floor. check-gate-qualification left the
-  # default check chains (operator inner-loop cost), so release acceptance
-  # carries it explicitly as its own MUST step: a cut must re-prove the gates
-  # still kill what they claim to kill.
+  # 1b. Discriminating power of that floor. The mutant-EXECUTING body left the
+  # default check chains (operator inner-loop cost) — only its head rides along,
+  # as check-gate-manifests inside check:hermetic — so release acceptance carries
+  # the body explicitly as its own MUST step: a cut must re-prove the gates still
+  # kill what they claim to kill.
   section "release-gate step: check-gate-qualification"
   if (cd "$REPO_DIR" && bash "$self" check-gate-qualification); then
     ok "check-gate-qualification: PASS"
@@ -5700,6 +5777,9 @@ case "$cmd" in
   check-meta-receiver-marker)
     check_meta_receiver_marker
     ;;
+  check-meta-hook-session-switch)
+    check_meta_hook_session_switch
+    ;;
   check-meta-identity-consumers)
     check_meta_identity_consumers
     ;;
@@ -6015,6 +6095,16 @@ case "$cmd" in
     # per cell; offline + deterministic (deps: python3).
     (cd "$REPO_DIR" && python3 scripts/check-agy-permission-matrix.py)
     ;;
+  check-gate-manifests)
+    # The HEAD of check-gate-qualification, exposed on its own so the deterministic
+    # floor can pay for it: the runner self-test (classifier truth table + synthetic
+    # negatives) plus the REAL manifests — schema, global claim uniqueness, subjects
+    # tracked and lstat-regular in the origin index, claim tokens exactly once in their
+    # gate sources — plus the declared lane inventory. It executes ZERO mutants and
+    # makes NO snapshot of this repo; the body (check-gate-qualification) owns that and
+    # is unchanged. Cheap enough for check:hermetic (~8s).
+    run_ts scripts/check-gate-qualification.ts --manifests-only
+    ;;
   check-gate-qualification)
     # Kill-proof qualification — the gate-of-gates. Proves the committed defect mutants
     # (scripts/mutants/*.json) make their gates fail BOUNDED and FOR THE CLAIMED REASON

package/scripts/check-acp-usage-accounting.ts

@@ -72,7 +72,7 @@ interface WireUsage {
  * One `_meta.quota.token_count` row. The field NAMES deliberately differ from
  * `PromptResponse.usage`: cache reads are `cachedInputTokens` here because the
  * shape is shared with codex-acp, and `cachedWriteTokens` is Claude's extra
- * sibling (read at claude-agent-acp 0.73.0 `dist/acp-agent.js:5750-5765`).
+ * sibling (read at claude-agent-acp 0.75.1 `dist/acp-agent.js:6493-6502`).
  * Reading a quota row with the `usage` field names silently yields zeros, so the
  * fixture below spells the vendor's names out rather than reusing `WireUsage`.
  */
@@ -137,7 +137,7 @@ function makeFakeChild() {
  *
  * Each `prompt` call consumes the next TurnScript: it first pushes that turn's
  * `usage_update` notification (the wire the running cost total actually arrives
- * on — read at claude-agent-acp 0.73.0 `dist/acp-agent.js:2918-2933`), then answers the
+ * on — read at claude-agent-acp 0.75.1 `dist/acp-agent.js:3467-3482`), then answers the
  * prompt with that turn's `PromptResponse.usage` (the wire the turn aggregate
  * arrives on). Both orderings are the real one: the notification precedes the
  * response, because the SDK emits it from the `result` message that ENDS the turn.
@@ -393,8 +393,8 @@ try {
 	// AGENT LOOP only. `_meta.quota.model_usage` comes from `result.modelUsage` and
 	// also counts Task subagents, sidechains and INTERNAL CALLS SUCH AS COMPACTION;
 	// the vendor states its rows "can total more than `token_count`" and are "the
-	// fuller picture, not a decomposition of it" (read at claude-agent-acp 0.73.0
-	// `dist/acp-agent.js:5732-5738`).
+	// fuller picture, not a decomposition of it" (read at claude-agent-acp 0.75.1
+	// `dist/acp-agent.js:6468-6474`).
 	//
 	// The wide one is required, not merely nicer, because the DENOMINATOR already
 	// has that scope: turn cost is the adjacent diff of the backend's running total,
@@ -608,8 +608,8 @@ try {
 	// identity that produces the bound is a property of the MAIN AGENT LOOP's
 	// cache breakpoints. `_meta.quota.model_usage` is a WIDER scope: the vendor
 	// states those rows also count Task subagents, sidechains, and INTERNAL
-	// CALLS SUCH AS COMPACTION (read at claude-agent-acp 0.73.0
-	// `dist/acp-agent.js:5728-5748`). Mixing the two scopes inflates the bound
+	// CALLS SUCH AS COMPACTION (read at claude-agent-acp 0.75.1
+	// `dist/acp-agent.js:6465-6485`). Mixing the two scopes inflates the bound
 	// through both remaining terms that mention cacheWrite:
 	//   max(0, occupancy − cacheWrite) shrinks as wide cacheWrite grows, so
 	//   less is subtracted; min(rawBound, cacheWrite) rises with it.
@@ -749,9 +749,9 @@ try {
 	// CELL 3 — a turn with NO cost notification holds the baseline.
 	//
 	// Measured upstream: the result-path `usage_update` carries cost (read at
-	// claude-agent-acp 0.73.0 `dist/acp-agent.js:2913-2924`), while other
+	// claude-agent-acp 0.75.1 `dist/acp-agent.js:3467-3482`), while other
 	// `usage_update` paths can carry `used` without cost (for example the
-	// rate-limit path at `:3661-3671`). A live thinkpad ledger shows such turns
+	// rate-limit path at `:4269-4277`). A live thinkpad ledger shows such turns
 	// really occur. The honest handling is to HOLD the baseline so the amount lands
 	// in the NEXT diff: misattributed by turn, exact by session. Rebaselining to 0
 	// there would double-count the whole prefix.
@@ -831,7 +831,7 @@ try {
 	// CELL 4 — a DECREASING session total is never silently absorbed.
 	//
 	// `conversation_reset` switches the session to a fresh transcript (read at
-	// claude-agent-acp 0.73.0 `dist/acp-agent.js:3675-3682`), but whether that
+	// claude-agent-acp 0.75.1 `dist/acp-agent.js:4282-4289`), but whether that
 	// changes `total_cost_usd` is an SDK-internal value we cannot observe here.
 	// A diff can therefore go negative in a session we are still holding.
 	// Absorbing it quietly would both misreport the turn and destroy the only

package/scripts/check-bridge-delivery.ts

@@ -181,16 +181,40 @@ writeMetaReceiverMarker({
 
 // RECEIVER — a different armed self-fetch citizen. A dead/unarmed target must remain
 // mailbox-undeliverable, so this marker isolates artifact delivery from target liveness.
+//
+// It is owned by a DIFFERENT live pid than the sender, and that is not decoration (#101):
+// a claude-code watch owner serves exactly one garden at a time, and deliverability now
+// requires that owner's sender marker to still name the garden being addressed. Two
+// citizens armed under ONE pid is a state the real world does not produce — it is what a
+// session switch leaves behind — so a fixture that modelled it would be asking the
+// artifact to deliver into a retired watch.
+//
+// The stand-in second native CLI is a spawned idle process, NOT this gate's parent: the
+// subject bridge resolves its own sender identity through its ancestry, and an ancestor
+// holding a second garden's marker is the "ambiguous sender identity" refusal the bridge
+// already ships. A live pid outside that ancestry is what a real second CLI looks like.
+// It exits on its own timer, and is killed in the outer finally.
+const receiverOwner = spawn(process.execPath, ["-e", "setTimeout(() => {}, 300000)"], { stdio: "ignore" });
+const receiverOwnerPid = receiverOwner.pid;
+if (typeof receiverOwnerPid !== "number") throw new Error("could not spawn the stand-in receiver owner process");
 const receiver = upsertMetaSession({
 	input: { backend: "claude-code", nativeSessionId: `bridge-delivery-receiver-${process.pid}`, cwd: tmp },
 	dir: sessionsDir,
 });
 const gid = receiver.record.gardenId;
+writeMetaSenderMarker({
+	backend: "claude-code",
+	gardenId: gid,
+	nativeSessionId: receiver.record.nativeSessionId,
+	cwd: tmp,
+	ownerPid: receiverOwnerPid,
+	sendersDir,
+});
 writeMetaReceiverMarker({
 	gardenId: gid,
 	backend: "claude-code",
 	nativeSessionId: receiver.record.nativeSessionId,
-	ownerPid: process.pid,
+	ownerPid: receiverOwnerPid,
 	armProvenance: "session-start",
 	receiversDir,
 });
@@ -471,6 +495,20 @@ try {
 	await fsp.writeFile(receiverRecordFile, receiverRecordV3Bytes);
 	const anonSendersDir = path.join(tmp, "meta-senders-anon");
 	await fsp.mkdir(anonSendersDir, { recursive: true });
+	// The TARGET's owner marker still belongs in this dir (#101). Anonymity is about the
+	// CALLER — no marker under the bridge child's own owner pid — while deliverability asks
+	// a different question of a different pid: is the target's watch owner still serving the
+	// target's garden? Leaving it out would make every cell below fail as
+	// mailbox-undeliverable and prove nothing about the anonymous hatch. In production no
+	// one swaps this dir; the split exists only because this fixture does.
+	writeMetaSenderMarker({
+		backend: "claude-code",
+		gardenId: gid,
+		nativeSessionId: receiver.record.nativeSessionId,
+		cwd: tmp,
+		ownerPid: receiverOwnerPid,
+		sendersDir: anonSendersDir,
+	});
 	const oneShotV2 = async (
 		cellEnv: NodeJS.ProcessEnv,
 		message: string,
@@ -582,6 +620,9 @@ try {
 	try {
 		child?.kill("SIGTERM");
 	} catch {}
+	try {
+		receiverOwner.kill("SIGTERM");
+	} catch {}
 	await fsp.rm(tmp, { recursive: true, force: true });
 }
 

package/scripts/check-entwurf-fact-provider.ts

@@ -19,7 +19,12 @@
  *     socket-dir-read-error diagnostic (P2e②),
  *   - diagnostics are kind-tagged and sorted.
  *
- * No IO — meta entries/reader and socket dir/readdir/probe are injected fakes.
+ * No IO — meta entries/reader and socket dir/readdir/probe are injected fakes, and so is
+ * the #101 `observe` seam. That seam is the one dep whose PRODUCTION default is real IO
+ * (one default is safer than two wiring sites each passing their own observer), so a gate
+ * that left it out would quietly stat the operator's real garden roots for fabricated
+ * garden ids. It is injected here for that reason, and the cell below proves the injected
+ * observation actually reaches the fact rather than being dropped on the way.
  */
 
 import assert from "node:assert/strict";
@@ -74,6 +79,11 @@ function deps(
 ): EntwurfFactsDeps {
 	const symlinkSet = new Set(opts.symlinks ?? []);
 	return {
+		// Injected observation (see the header): a per-identity fake, never the real IO.
+		observe: (identity) => ({
+			receiver: identity.backend === "claude-code" ? "inactive" : "n/a",
+			transcript: identity.gardenId === GID_CLAUDE ? "absent" : "exists",
+		}),
 		// Kind-carrying entries, like the real bindings: the listing must be able to refuse a
 		// symlinked record without following it. `irregularMeta` names the ones that are not
 		// regular files.
@@ -144,6 +154,17 @@ async function main(): Promise<void> {
 			);
 			ok("basic: record-less-socket diagnostic keyset exact", true);
 		}
+		// #101: the injected observation rides onto each peer. A provider that dropped the
+		// seam would return `unobserved` rows — visible, but useless to the caller the
+		// columns exist for.
+		{
+			const claude = r.facts.peers.find((p) => p.gardenId === GID_CLAUDE);
+			const pi = r.facts.peers.find((p) => p.gardenId === GID_PI);
+			ok(
+				"basic: the injected observation reaches every peer fact",
+				claude?.receiver === "inactive" && claude?.transcript === "absent" && pi?.receiver === "n/a",
+			);
+		}
 		// A DEAD record-less socket groups under a different (stale) message — no fresh-cut
 		// pointer for a leftover file, so same-state sockets aggregate per liveness.
 		const r2 = await listEntwurfFacts(deps({}, { [GID_SOCKET_ONLY]: "dead" }));

package/scripts/check-entwurf-facts.ts

@@ -138,7 +138,8 @@ for (const backend of META_CITIZEN_BACKENDS) {
 	ok("passthrough recordUpdatedAt", fact.recordUpdatedAt === id.recordUpdatedAt);
 }
 
-// ── facts-only keyset: identity facts + liveness, NO verb-routing/transcript ─
+// ── facts-only keyset: identity facts + liveness + the two observed axes, and
+// still NO verb-routing / no transcript PATH ────────────────────────────────
 {
 	const fact = resolvePeerFact(identity("pi"), "alive");
 	const keys = Object.keys(fact).sort();
@@ -151,9 +152,23 @@ for (const backend of META_CITIZEN_BACKENDS) {
 		"model",
 		"nativeSessionId",
 		"recordUpdatedAt",
+		"receiver",
+		"transcript",
 	].sort();
 	assert.deepStrictEqual(keys, expected, `PeerFact keyset drift: got ${keys.join(",")}`);
-	ok("facts-only keyset exact (identity facts + liveness)", true);
+	ok("facts-only keyset exact (identity facts + liveness + observed receiver/transcript)", true);
+
+	// #101: an unmeasured row says so. `unobserved` is the default for a caller that
+	// injected no observer — never `none`/`absent`, which would be a fabricated fact.
+	ok(
+		"an observer-less composition reports both axes as unobserved (never a default fact)",
+		fact.receiver === "unobserved" && fact.transcript === "unobserved",
+	);
+	const observed = resolvePeerFact(identity("claude-code"), null, { receiver: "inactive", transcript: "absent" });
+	ok(
+		"an injected observation rides onto the fact verbatim",
+		observed.receiver === "inactive" && observed.transcript === "absent",
+	);
 
 	const FORBIDDEN = [
 		"resumable",

package/scripts/check-entwurf-peers-surface.ts

@@ -47,7 +47,12 @@ const FORBIDDEN = ["sendable", "resumable", "dispatch", "action", "transport", "
 // #50 C4: socket-shaped identity must not reappear on this surface.
 const FORBIDDEN_C4_KEYS = ["sessions", "socketOnly", "controlDir", "socketPath", "count"];
 
-function peer(gardenId: string, backend: MetaCitizenBackend, liveness: FactLiveness): PeerFact {
+function peer(
+	gardenId: string,
+	backend: MetaCitizenBackend,
+	liveness: FactLiveness,
+	observed: Partial<Pick<PeerFact, "receiver" | "transcript">> = {},
+): PeerFact {
 	return {
 		gardenId,
 		backend,
@@ -57,6 +62,8 @@ function peer(gardenId: string, backend: MetaCitizenBackend, liveness: FactLiven
 		createdAt: "2026-06-11T00:00:00.000Z",
 		recordUpdatedAt: "2026-06-11T00:00:00.000Z",
 		liveness,
+		receiver: observed.receiver ?? "n/a",
+		transcript: observed.transcript ?? "exists",
 	};
 }
 
@@ -91,7 +98,7 @@ function main(): void {
 				peer(GID_PI_ALIVE, "pi", "alive"),
 				peer(GID_PI_DEAD, "pi", "dead"),
 				peer(GID_PI_INDET, "pi", "indeterminate"),
-				peer(GID_CLAUDE, "claude-code", "unsupported"),
+				peer(GID_CLAUDE, "claude-code", "unsupported", { receiver: "inactive", transcript: "absent" }),
 			],
 			// The provider has already folded these into diagnostics; the render layer
 			// never re-renders them as a section (facts carry them for the union math).
@@ -116,6 +123,17 @@ function main(): void {
 		ok("C4: payload is exactly { peers, diagnostics }", true);
 	}
 	ok("peers carry all 4 citizens (unsupported NOT dropped)", payload.peers.length === 4);
+	// #101: the two observed axes are the only thing separating two same-cwd claude rows,
+	// since `liveness` reads `unsupported` for every one of them. They are FACTS on the
+	// row — the forbidden-word scans below still apply to them unchanged.
+	ok(
+		"observed receiver + transcript ride the row in text",
+		new RegExp(`${GID_CLAUDE}.*receiver=inactive.*transcript=absent`).test(text),
+	);
+	ok(
+		"observed axes ride the JSON payload too",
+		payload.peers.some((p) => p.gardenId === GID_CLAUDE && p.receiver === "inactive" && p.transcript === "absent"),
+	);
 	ok(
 		"unsupported citizen present in peers",
 		payload.peers.some((p) => p.gardenId === GID_CLAUDE && p.liveness === "unsupported"),