@junghanacs/entwurf 0.20.1 → 0.22.0

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-native-push.js

@@ -5,23 +5,21 @@
  * ROUTING (the NATIVE_PUSH_DISPATCH_TABLE did) and carries NO release seam — a native-push
  * plan is the LOCK-FREE path (봉인 4), so a lock leak is structurally impossible here.
  *
- * This is where the 1-shot retry lives — NOT in the adapter leaf (봉인 3). The decider
- * probed a fresh route and planted it in the plan; the executor sends over it, and on a
- * failure it re-probes ONCE (the volatile LS port may have shifted between decide and
- * execute) and re-sends. A second failure is fail-loud (no infinite loop). This mirrors the
- * control-socket send-fallback pattern: the decider stays pure, the hand owns the retry.
+ * Retry is an adapter capability, not a rail-wide assumption. Antigravity re-probes once
+ * because its volatile LS port can shift before send. Codex never retries: `codex queue`
+ * may have accepted the message before its receipt failed, so replay could duplicate it.
+ * The decider stays pure; this hand enforces the adapter's declared policy.
  *
  * A native-push send has NO in-band refuse (there is no live receiver to answer
  * success:false) — like a mailbox enqueue, it either succeeds or THROWS. The hand never
  * folds a throw into {success:false}; the runner maps a thrown error to execution-failed.
  */
+import { formatMetaMailboxBody } from "./meta-mailbox-body.js";
 import { resolveNativePushAdapter } from "./native-push/adapter.js";
 /**
- * Deliver `content` into the conversation, owning the 1-shot retry (봉인 3). Send over the
- * planted (decider-probed) route first; on failure re-probe ONCE and re-send over the fresh
- * route; a second failure PROPAGATES (fail-loud). If the re-probe finds the target no longer
- * alive, throw — a failed send into a now-dead conversation is an honest non-delivery, never
- * a silent success. The re-probe is the ONLY re-derivation of the volatile route.
+ * Deliver `content` through the decider-probed route. A non-retriable adapter propagates
+ * the first failure unchanged. A retriable adapter re-probes once and sends once more only
+ * when the target is still alive; no adapter gets a third attempt.
  */
 export async function deliverViaNativePush(adapter, route, nativeSessionId, content) {
     try {
@@ -29,8 +27,9 @@ export async function deliverViaNativePush(adapter, route, nativeSessionId, cont
         return { success: true, retried: false };
     }
     catch (firstErr) {
-        // 1-shot re-probe → re-send: the volatile LS route may have shifted since the decider
-        // probed it. Re-discover it fresh and retry exactly once.
+        if (!adapter.retriable)
+            throw firstErr;
+        // One re-probe and one retry for adapters whose send boundary is safe to replay.
         const reprobe = await adapter.probe(nativeSessionId);
         if (reprobe.status !== "alive") {
             throw new Error(`native-push deliver: first send failed and re-probe found target ${reprobe.status} (${reprobe.reason}) — not retried`, { cause: firstErr });
@@ -42,16 +41,30 @@ export async function deliverViaNativePush(adapter, route, nativeSessionId, cont
 }
 /**
  * Build the production `sendNativePush(plan, lock)` adapter the runner consumes. It IGNORES
- * `lock` entirely (a native-push plan is lock-free, 봉인 4) — the field exists only to match
- * the DispatchExecutorDeps hand signature. It resolves the adapter from the plan's backend
- * and delivers with the 1-shot retry. A delivery throw surfaces as a REJECTED promise (the
- * runner's try/catch maps it to execution-failed).
+ * `lock` entirely (a native-push plan is lock-free, 봉인 4), resolves the adapter, then applies
+ * that adapter's retry policy. A delivery throw surfaces as a REJECTED promise (the runner's
+ * try/catch maps it to execution-failed).
+ *
+ * SENDER ENVELOPE (measured #95). Direct injection used to hand the adapter the raw
+ * `plan.message`, so a native-push citizen received a body with no sender. The #95 A LIVE run
+ * measured what that costs: a fresh Pi's nonce-only callback landed in the Codex thread as
+ * bare text, and Codex could not name who called it — the callback was uncorrelatable. The
+ * control-socket rail carries the envelope in its RPC framing and the mailbox rail serializes
+ * it into the body; this rail has neither, so it renders the SAME `formatMetaMailboxBody` SSOT
+ * the mailbox uses. Rendered ONCE, before `deliverViaNativePush`, so an Antigravity re-probe
+ * retry replays byte-identical content (including its timestamp) instead of a second render.
+ * The adapter stays a dumb pipe — its signature is unchanged and it never learns about senders.
  */
 export function makeNativePushSend(deps = {}) {
     const resolveAdapter = deps.resolveAdapter ?? resolveNativePushAdapter;
+    const senderProvider = deps.senderProvider;
     // `_lock` is named for the hand contract but NEVER read — native-push owns/releases no lock.
     return async (plan, _lock) => {
+        // Resolve the sender BEFORE the adapter is resolved or touched: a provider throw must
+        // reject this send with nothing injected, not leave a half-delivered conversation.
+        const sender = senderProvider?.();
+        const content = sender ? formatMetaMailboxBody(sender, plan.message, plan.wantsReply) : plan.message;
         const adapter = resolveAdapter(plan.backend);
-        return deliverViaNativePush(adapter, plan.route, plan.nativeSessionId, plan.message);
+        return deliverViaNativePush(adapter, plan.route, plan.nativeSessionId, content);
     };
 }

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-production.js

@@ -210,7 +210,13 @@ export function makeProductionEntwurfV2Deps(opts) {
         sendMailbox: (plan, _lock) => sendViaMailbox(plan, _lock),
         // native-push (봉인 4): the SAME injected adapter resolver drives the executor send,
         // so the decider's probe and the delivery use one adapter. Lock-free (lock ignored).
-        sendNativePush: makeNativePushSend({ resolveAdapter: io.resolveNativePushAdapter }),
+        // It also receives the SAME `opts.senderProvider` the mailbox hand got — one envelope
+        // source for all three rails, so a native-push citizen can name its sender exactly as
+        // a mailbox citizen does (#95: an envelope-less direct injection is uncorrelatable).
+        sendNativePush: makeNativePushSend({
+            resolveAdapter: io.resolveNativePushAdapter,
+            senderProvider: opts.senderProvider,
+        }),
     };
     return {
         decide: (input) => decideDispatch(input, deciderDeps),

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-runner.js

@@ -12,8 +12,9 @@
  *
  * Why a result type richer than the receipt: the carry-over contracts from 5c demand it.
  *   - N3 (5c-2b): a dead-path re-resolve `rejected` carries the resolver's `rejectReason`
- *     (dormant-fire-forget-unsupported / mailbox-undeliverable / …). The runner carries it
- *     verbatim so the surface distinguishes "in-band refusal" from "no live route".
+ *     (dormant-fire-forget-unsupported / mailbox-undeliverable / …), while an in-band
+ *     refusal carries its supplied receiver error. The runner carries either verbatim;
+ *     receiver evidence is not reclassified as resolver taxonomy.
  *   - N1 (5c-2a): a non-`failed` outcome whose `releaseLock` then threw is a
  *     `SendDeliveredReleaseFailedError` — the delivery HAPPENED, the lock is dirty, a
  *     re-send would double-deliver. The runner surfaces this as `execution-failed` with

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-send.js

@@ -76,8 +76,9 @@ async function driveSend(plan, lock, deps) {
         // dead ⇒ proven non-delivery ⇒ same-lock one-shot re-resolve (lock still held).
         return await driveDeadFallback(plan, lock, deps);
     }
-    // A completed RPC: ack ⇒ sent; in-band refusal ⇒ rejected, NO fallback.
-    return { outcome: result.success ? "sent" : "rejected" };
+    // A completed RPC: ack ⇒ sent; in-band refusal ⇒ rejected, NO fallback. Preserve
+    // its receiver error verbatim when supplied; do not make a reason up when absent.
+    return result.success ? { outcome: "sent" } : inBandRejected(result);
 }
 /**
  * The dead-path fallback: re-resolve ONCE under the held lock, then run the resolver's
@@ -85,6 +86,9 @@ async function driveSend(plan, lock, deps) {
  * re-enter the fallback, it finalizes as failed). The hand only executes; the resolver
  * decided.
  */
+function inBandRejected(result) {
+    return { outcome: "rejected", rejectReason: result.error === "" ? undefined : result.error };
+}
 async function driveDeadFallback(plan, lock, deps) {
     let resolution;
     try {
@@ -112,7 +116,7 @@ async function driveDeadFallback(plan, lock, deps) {
             // connect failure finalizes as failed (no further fallback).
             try {
                 const r = await deps.sendOverSocket(rePlan);
-                return { outcome: r.success ? "fallback-sent" : "rejected" };
+                return r.success ? { outcome: "fallback-sent" } : inBandRejected(r);
             }
             catch (err) {
                 return { outcome: "failed", error: err };
@@ -125,7 +129,7 @@ async function driveDeadFallback(plan, lock, deps) {
                 // #98 R: this leg writes a `.msg` exactly like the primary mailbox rail, so it
                 // owes the sender the same per-message receipt. Carried only on success — a
                 // `rejected` enqueue wrote no file to name.
-                return r.success ? { outcome: "fallback-sent", messagePath: r.messagePath } : { outcome: "rejected" };
+                return r.success ? { outcome: "fallback-sent", messagePath: r.messagePath } : inBandRejected(r);
             }
             catch (err) {
                 return { outcome: "failed", error: err };

package/mcp/entwurf-bridge/dist/pi-extensions/lib/entwurf-v2-surface.js

@@ -67,11 +67,14 @@ export function actionableRejectHint(reason) {
                 "Re-run entwurf_peers to re-probe; if it stays indeterminate, check for a stale socket file left at " +
                 "that garden id by a session that died without cleaning up.");
         case "native-push-target-dead":
-            // The adapter probe found no live host process for the conversation.
-            return "native-push conversation is not live (no host process found). Re-open the conversation, then retry — there is nothing to inject into.";
+            // The adapter probe found no live native host serving this conversation/thread. Stays
+            // backend-neutral: agy speaks conversations over an LS port, Codex threads over an
+            // app-server socket, and this hint is read by callers of both.
+            return "the native-push conversation/thread is not live — no native host (harness process or app-server) answered the probe for it. Re-open that conversation/thread in its own harness, then retry; there is nothing to inject into.";
         case "native-push-probe-indeterminate":
-            // Host up, but no LS port served the conversation — inconclusive, not a hard dead.
-            return "native-push host is up but no port served this conversation (probe inconclusive). Retry once the conversation is loaded, or verify the conversation id.";
+            // Native host up, but nothing served this conversation/thread — inconclusive, not a
+            // hard dead. Backend-neutral for the same reason as the dead cell above.
+            return "the native host (harness process or app-server) is up, but nothing served this conversation/thread, so the probe is INCONCLUSIVE — not a measured death. Retry once it is loaded, or verify the conversation/thread id.";
         case "record-less-socket":
             // #50 C4: name the true cause AND the fix — a bare socket is a diagnostic
             // state, not an addressable citizen (the record is the address).

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-mailbox-body.js

@@ -1,22 +1,29 @@
 /**
  * meta-mailbox-body — the SINGLE source for rendering an entwurf message as a
- * meta-bridge mailbox body. Both transports that can deliver to a garden citizen
- * with no live control socket use this:
+ * meta-bridge mailbox body. Every transport that can deliver to a garden citizen
+ * with no live control socket uses this:
  *   - the MCP bridge entwurf_v2 (mcp/entwurf-bridge) — external/Claude-host sends
  *   - the pi-native entwurf_v2 (pi-extensions/entwurf-control.ts) — pi-session sends
+ *   - the native-push rail (pi-extensions/lib/entwurf-v2-native-push.ts) — direct
+ *     injection into an Antigravity conversation or a loaded Codex thread. Its
+ *     THIRD consumer, added after the #95 A LIVE run measured what an envelope-less
+ *     injection costs: a nonce-only callback arrived in a Codex thread as bare text
+ *     and the receiving citizen could not name who had called it.
  *
  * The control-socket path carries the sender envelope inside its RPC framing; the
- * mailbox path is just a file, so the envelope must be SERIALIZED INTO the body —
- * else a receiver reading entwurf_inbox_read would not know who sent it, whether
- * the sender is replyable (and at which sessionId), or whether a reply was wanted.
- * The render mirrors the live "[entwurf received ⟵]" header so a transcript reads
- * the same whether the message arrived over a socket or a mailbox.
+ * mailbox path is just a file and direct injection is just a string, so for both the
+ * envelope must be SERIALIZED INTO the body —
+ * else a receiver — reading entwurf_inbox_read, or reading an injected turn in its own
+ * conversation — would not know who sent it, whether the sender is replyable (and at
+ * which sessionId), or whether a reply was wanted. The render mirrors the live
+ * "[entwurf received ⟵]" header so a transcript reads the same whether the message
+ * arrived over a socket, a mailbox, or direct injection.
  *
  * No filesystem/network IO and no mutation — the only ambient read is
  * process.env.HOME for display abbreviation (so not strictly referentially pure,
- * but deterministic per environment). Extracted so the two senders cannot drift
- * in how a mailbox message presents who-sent-it — the field that round-trips
- * garden-id replies.
+ * but deterministic per environment). Extracted so the three consumers cannot
+ * drift in how a delivered message presents who-sent-it — the field that
+ * round-trips garden-id replies.
  */
 /** `~`-abbreviate a home-relative cwd for display. Reads process.env.HOME. */
 function abbreviateHome(cwd) {
@@ -41,7 +48,9 @@ function formatKstTimestamp(iso) {
         `${pad(kst.getUTCHours())}:${pad(kst.getUTCMinutes())}:${pad(kst.getUTCSeconds())} KST`);
 }
 /**
- * Render the full mailbox body: header envelope + separator + message. A
+ * Render the full body: header envelope + separator + message. The mailbox writes this
+ * into its message file and the native-push rail injects it directly into a live
+ * conversation; both present the sender identically. A
  * replyable sender (pi-session, or a trusted meta-session) advertises its
  * sessionId as the reply address; a non-replyable sender says so WITHOUT
  * losing its origin — a record-backed meta-session that is currently inactive

package/mcp/entwurf-bridge/dist/pi-extensions/lib/meta-sender-identity.js

@@ -34,8 +34,19 @@
  * Every candidate is collected and validated BEFORE one is chosen. A first-match loop would make
  * the answer depend on which pid or backend happened to be read first; here lookup order carries
  * no meaning, and two live identities are a refusal rather than a race.
+ *
+ * A SECOND RAIL LIVES BELOW THE MARKER RAIL, and it does not share this one's join key.
+ * Codex names its caller on EVERY `tools/call` (`_meta.threadId` plus an
+ * `x-codex-turn-metadata.{session_id,thread_id}` block), and its parent pid cannot separate
+ * citizens at all: in the delivery-capable launch mode every hook and every MCP child of N
+ * live threads resolves to the ONE app-server pid, so a pid marker would be one marker for N
+ * citizens — exactly what the store's `nativeSessionId` uniqueness forbids (measured
+ * 2026-09-08, `scripts/raw-codex-measure/README.md` S1b-C/S1b-D). So the codex resolver is
+ * REQUEST-scoped, not process-scoped: see {@link resolveCodexRequestSenderIdentity}. The two
+ * rails never merge — `codex` is deliberately absent from {@link META_SENDER_BACKENDS}, since
+ * a backend listed there is one whose hook writes a pid marker, and codex birth writes none.
  */
-import { isPlausibleOwnerPid, metaRecordExistsByGardenId, parentPid, readMetaIdentityByGardenId, readMetaSenderMarker, } from "./meta-session.js";
+import { defaultMetaSessionsDir, describe, isPlausibleOwnerPid, listAllMetaIdentities, makeStoreRecordReader, metaRecordExistsByGardenId, parentPid, readActiveStoreEntries, readMetaIdentityByGardenId, readMetaSenderMarker, } from "./meta-session.js";
 import { resolveNativePushAdapter } from "./native-push/adapter.js";
 /** Every native backend that mints a garden-id from its own hook and writes a sender marker.
  *
@@ -180,3 +191,218 @@ export async function probeNativeSenderAlive(identity, deps = {}) {
     const probe = await resolveAdapter(identity.backend).probe(identity.nativeSessionId);
     return probe.status === "alive";
 }
+// ─────────────────────────────────────────────────────────────────────────────
+// REQUEST-SCOPED SENDER IDENTITY — codex
+// ─────────────────────────────────────────────────────────────────────────────
+/**
+ * The provenance label the MANAGED codex MCP entry carries (`ENTWURF_BRIDGE_NATIVE_HOST=codex`
+ * under `[mcp_servers.entwurf-bridge]` in the codex config the entwurf config writer owns).
+ *
+ * It is an OWNERSHIP/DRIFT atom, not authentication: any process able to write that config, or
+ * to set that env on a child, can spell it. What it buys is the thing a codex bridge child
+ * genuinely cannot observe otherwise — that THIS child was launched from an entwurf-managed
+ * entry, so the request-scoped rail below is admitted deliberately rather than by sniffing.
+ * The value travels to this resolver as an EXPLICIT ARGUMENT: nothing here reads the
+ * environment, and in particular nothing here reads `ENTWURF_BRIDGE_EXTERNAL_AGENT_ID`, which
+ * is the omp root-policy label with its own policy attached (`applyOmpBridgeChildRootPolicy`)
+ * and must never double as a codex admission.
+ */
+export const CODEX_BRIDGE_PROVENANCE_LABEL = "codex";
+/**
+ * `clientInfo.name` every codex MCP client sends, and it is a FIXED VENDOR LITERAL —
+ * `Implementation::new("codex-mcp-client", CARGO_PKG_VERSION).with_title("Codex")`
+ * (`codex-mcp/src/rmcp_client.rs:1035-1039`, read at 0.153.4). `initialize` carries no
+ * identity at all and is byte-identical between two children of two different threads, so this
+ * name is a HOST-KIND gate and never an identity: it says "the peer on this stdio is a codex
+ * client", which is precisely as much as startup can honestly say.
+ */
+export const CODEX_MCP_CLIENT_NAME = "codex-mcp-client";
+/** The `_meta` member carrying the vendor turn-metadata block (`core/src/mcp_tool_call.rs`
+ * `build_mcp_tool_call_request_meta`, :1238-1263). A dash-cased key, hence the string form. */
+const CODEX_TURN_METADATA_KEY = "x-codex-turn-metadata";
+/**
+ * The codex caller's identity metadata is PRESENT but does not hold together: a `threadId` that
+ * is not a nonempty string, a missing/foreign turn-metadata block, or three ids that disagree.
+ *
+ * WHY THIS IS LOUD AND NOT `null`. `null` on this rail means "no identity claim reached me" —
+ * the bridge then refuses the send as anonymous, and the prescription is "open the session
+ * through the installed codex birth hook". A HALF claim is a different fact with a different
+ * cause (a vendor `_meta` shape that moved, or something imitating the codex client), and both
+ * ids exist precisely so neither has to be trusted alone: `threadId` and
+ * `x-codex-turn-metadata.session_id` are built by two different vendor call sites, and the
+ * hook's `session_id` is byte-identical to both (measured 2026-09-08, S1b-D/D3). Selecting a
+ * record from one field while its corroborator is absent or disagrees would address a citizen on
+ * an unverified id — the SE-1 shape — so the disagreement is reported instead.
+ */
+export class EntwurfCodexIdentityMetadataError extends Error {
+    constructor(reason) {
+        super("entwurf-bridge refused: this codex tool call carries identity metadata that does not hold " +
+            `together — ${reason} A codex caller names itself on every call with THREE ids that must be one ` +
+            `string: \`_meta.threadId\`, \`_meta.${CODEX_TURN_METADATA_KEY}.session_id\` and \`.thread_id\`. ` +
+            "Selecting a garden citizen from a partial or self-contradicting claim would send under an " +
+            "identity nothing vouched for. Report it; do not work around it — if the vendor `_meta` shape " +
+            "moved, the measurement in scripts/raw-codex-measure/README.md (S1b-D) must be re-taken.");
+        this.name = "EntwurfCodexIdentityMetadataError";
+    }
+}
+/**
+ * The codex `threadId` selected exactly one V3 record — and that record is NOT a codex citizen.
+ *
+ * This is corruption of the native→garden mapping, never a miss: the store says some other
+ * backend's session carries this exact native id. Returning `null` would report "no record for
+ * this thread" and prescribe re-opening the session, which would mint a SECOND record for the
+ * same `nativeSessionId` and turn a readable defect into the duplicate the certification
+ * refuses. Sending under the foreign citizen is worse still — it would attribute a codex
+ * caller's message to a claude-code/agy/pi session.
+ */
+export class EntwurfCodexIdentityBackendError extends Error {
+    gardenId;
+    constructor(identity) {
+        super(`entwurf-bridge refused: codex thread ${identity.nativeSessionId} selected meta-record ` +
+            `${identity.gardenId}, but that citizen's backend is "${identity.backend}", not "codex". One ` +
+            "native id is bound to one backend for the life of the record, so this store cannot say who the " +
+            "caller is — and neither re-opening the codex session nor sending under the foreign citizen is a " +
+            "fix. The record must be corrected (a fresh generation) before this thread can send.");
+        this.name = "EntwurfCodexIdentityBackendError";
+        this.gardenId = identity.gardenId;
+    }
+}
+/** A JSON OBJECT, as a narrowing guard — `typeof value === "object"` alone admits `null` and
+ * arrays, and every codex identity field is read through a member access that both would
+ * survive silently (`[]._meta` is `undefined`, not a type error). */
+function isJsonObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Read the caller's thread id out of ONE request, or refuse.
+ *
+ * `null` — this is not an admitted codex identity claim at all: no managed provenance, a peer
+ * that is not the codex client, no `_meta` object, or an `_meta` with no `threadId` member
+ * (`tools/list`, `initialize`, a non-turn call). All four are ordinary and carry no defect.
+ *
+ * THROWS {@link EntwurfCodexIdentityMetadataError} — a claim exists and is broken. The line
+ * between the two is the PRESENCE of `threadId`: absent is a call that never claimed identity,
+ * present-but-unusable is a claim that failed, and collapsing them would report "no identity"
+ * for a caller that named itself.
+ *
+ * Pure: no fs, no env, no clock. The store lookup is the next function's job on purpose — this
+ * half is the wire contract and can be pinned without a store at all.
+ */
+export function readCodexRequestThreadId(opts) {
+    if (opts.provenance !== CODEX_BRIDGE_PROVENANCE_LABEL)
+        return null;
+    if (!isJsonObject(opts.clientInfo) || opts.clientInfo.name !== CODEX_MCP_CLIENT_NAME)
+        return null;
+    const meta = opts.requestMeta;
+    if (!isJsonObject(meta))
+        return null;
+    if (!("threadId" in meta))
+        return null;
+    const threadId = meta.threadId;
+    if (typeof threadId !== "string" || threadId.length === 0) {
+        throw new EntwurfCodexIdentityMetadataError(`\`_meta.threadId\` is present but is not a nonempty string (got ${describe(threadId)}).`);
+    }
+    const turn = meta[CODEX_TURN_METADATA_KEY];
+    if (!isJsonObject(turn)) {
+        throw new EntwurfCodexIdentityMetadataError(`\`_meta.threadId\` names ${threadId} but \`_meta.${CODEX_TURN_METADATA_KEY}\` is ${describe(turn)}, not an ` +
+            "object, so the second, independently-built id that corroborates it is missing.");
+    }
+    const sessionId = turn.session_id;
+    const turnThreadId = turn.thread_id;
+    if (typeof sessionId !== "string" || sessionId.length === 0) {
+        throw new EntwurfCodexIdentityMetadataError(`\`_meta.${CODEX_TURN_METADATA_KEY}.session_id\` is not a nonempty string (got ${describe(sessionId)}) — ` +
+            "that field is the one the birth hook also sees, so without it nothing joins the wire to a record.");
+    }
+    if (typeof turnThreadId !== "string" || turnThreadId.length === 0) {
+        throw new EntwurfCodexIdentityMetadataError(`\`_meta.${CODEX_TURN_METADATA_KEY}.thread_id\` is not a nonempty string (got ${describe(turnThreadId)}).`);
+    }
+    if (sessionId !== threadId || turnThreadId !== threadId) {
+        throw new EntwurfCodexIdentityMetadataError(`the three ids disagree (threadId=${threadId}, session_id=${sessionId}, thread_id=${turnThreadId}); ` +
+            "on a healthy codex turn they are one byte-identical string.");
+    }
+    return threadId;
+}
+/**
+ * Resolve the ONE codex citizen a request names, or refuse.
+ *
+ * `null` — no admitted claim ({@link readCodexRequestThreadId}), or no record holds that
+ * `nativeSessionId`. The second case is the ordinary pre-birth window: codex birth is
+ * first-turn, not window-open, so a thread whose hook has not minted a record yet simply has no
+ * citizen, and the bridge's default anonymous refusal already names the fix.
+ *
+ * THROWS — every knowable defect, unfolded: a broken claim
+ * ({@link EntwurfCodexIdentityMetadataError}), a foreign-backend record
+ * ({@link EntwurfCodexIdentityBackendError}), or a store that cannot be certified
+ * (`MetaRecordError` from the strict listing — an unreadable/previous-generation record
+ * anywhere in the store, a duplicated `nativeSessionId`, or a store this process cannot read).
+ *
+ * THE LOOKUP IS THE STRICT STORE-WIDE LISTING, NOT A NARROW SCAN. `nativeSessionId` → garden id
+ * is the store's own authority (there is no index, by design), and the same reason
+ * `upsertMetaSession` certifies the WHOLE store before writing applies to a read that turns an
+ * id into an ADDRESS: a narrow "find my thread" pass would answer happily beside a duplicate,
+ * drifted or symlinked neighbour that the doctor refuses, so the runtime would hold the weaker
+ * contract exactly where a message gets attributed. `mode: "strict"` is what makes an
+ * unreadable record a refusal instead of an invisible one — a duplicate of THIS thread's id
+ * would otherwise be dropped from `identities` and read as "no record".
+ */
+export function resolveCodexRequestSenderIdentity(opts = {}) {
+    const threadId = readCodexRequestThreadId(opts);
+    if (threadId === null)
+        return null;
+    const dir = opts.sessionsDir ?? defaultMetaSessionsDir();
+    const { identities } = listAllMetaIdentities(readActiveStoreEntries(dir), makeStoreRecordReader(dir), {
+        mode: "strict",
+    });
+    const identity = identities.find((record) => record.nativeSessionId === threadId);
+    if (!identity)
+        return null;
+    if (identity.backend !== "codex")
+        throw new EntwurfCodexIdentityBackendError(identity);
+    return { identity, threadId, provenance: CODEX_BRIDGE_PROVENANCE_LABEL };
+}
+/**
+ * Two rails claim this MCP process for DIFFERENT addresses. Sibling of
+ * {@link EntwurfSenderIdentityAmbiguityError} and deliberately not the same error: that one is
+ * about two pid MARKERS on one owner pid, while this is about rails that do not even share a
+ * join key — a planted `PI_SESSION_ID` in a native host's environment, a pid marker inherited
+ * from a host whose child we are not, a codex `_meta` naming a thread while a marker names
+ * someone else. Which is right is unknowable here, and both are visible, so neither is used.
+ */
+export class EntwurfSenderIdentityConflictError extends Error {
+    claims;
+    constructor(claims) {
+        super("entwurf-bridge refused: conflicting sender identity. This MCP process holds authoritative " +
+            `identity claims from more than one rail, naming DIFFERENT addresses (${claims
+                .map((claim) => `${claim.rail}=${claim.id}`)
+                .join(", ")}), so which one is calling cannot be determined. A send under the wrong identity ` +
+            "is worse than no send. Report it; do not work around it.");
+        this.name = "EntwurfSenderIdentityConflictError";
+        this.claims = [...claims];
+    }
+}
+/**
+ * Fold every rail's answer into ONE address, or refuse.
+ *
+ * 0 claims → `null` (anonymous; the bridge's default refusal owns that outcome).
+ * 1+ claims that AGREE on the id → that address, carrying every rail that named it. Agreement is
+ *   the normal shape of an overlap, not a conflict: a codex citizen's request-scoped claim and a
+ *   pid marker for the same garden id are two views of one identity.
+ * claims that DISAGREE → throw {@link EntwurfSenderIdentityConflictError}.
+ *
+ * Every claim is collected and compared BEFORE one is chosen — the same rule the marker rail
+ * holds one layer up. A rail-priority order would answer even when the truth is unknown, which
+ * is the failure this exists to prevent, so callers must pass ALL rails they resolved rather
+ * than short-circuiting on the first one that answered.
+ */
+export function reconcileSenderIdentityClaims(claims) {
+    if (claims.length === 0)
+        return null;
+    const ids = new Set(claims.map((claim) => claim.id));
+    if (ids.size > 1)
+        throw new EntwurfSenderIdentityConflictError(claims);
+    const [id] = ids;
+    return {
+        id,
+        rails: [...new Set(claims.map((claim) => claim.rail))].sort(),
+    };
+}