@junghanacs/entwurf 0.21.0 → 0.23.0

package/scripts/check-entwurf-control-rpc.ts

@@ -16,6 +16,11 @@
  *      `sendRpcCommand` reject `connection closed before response` (the 2026-05-18
  *      receiver-stuck backstop the settled-guard preserves).
  *   5. get_info runtime helper parses/formats cwd/model/idle once for every caller.
+ *   7. accepted-connection disconnect policy — a REAL peer that hangs up mid-exchange must not
+ *      reach this process as an uncaught exception (the 2026-09-14 C4 incident: a resident pi died
+ *      writing a late response to a sender that had already timed out), must not be diagnosed, and
+ *      an error that is NOT a disconnect must be diagnosed exactly once without rethrowing.
+ *   8. ordering — the surface installs that policy before setEncoding and before the data handler.
  *
  * No model / auth / pi process — only `net.Server` on a tmp socket, so it rides `pnpm run check:full`.
  */
@@ -27,6 +32,7 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import {
+	attachAcceptedSocketDisconnectPolicy,
 	fetchControlSocketRuntimeInfo,
 	formatRuntimeModel,
 	formatSenderInfoBlock,
@@ -217,6 +223,138 @@ async function main(): Promise<void> {
 		ok("6: undefined origin/replyable render nothing", !formatSenderInfoBlock(base).includes("origin"));
 	}
 
+	// ── 7. accepted-connection disconnect policy (the server half of the wire) ──
+	// `[측정 2026-09-14]` a resident pi was killed by a late response written to a socket whose
+	// peer had already timed out and hung up. The EPIPE arrived asynchronously as an `error`
+	// event, and an `error` event with no listener is an uncaught exception. These cells drive a
+	// REAL unix socket to a real peer disconnect — no fake control server, no synthetic stand-in
+	// for the crash itself.
+	{
+		const dir = await fs.mkdtemp(path.join(os.tmpdir(), "rpc-disconnect-"));
+		const socketPath = path.join(dir, "s.sock");
+		const diagnostics: string[] = [];
+		const accepted: net.Socket[] = [];
+		const server = net.createServer((socket) => {
+			// Exactly what the surface does, and the ONLY error listener on this connection: if the
+			// policy stops absorbing, nothing else here is catching it.
+			attachAcceptedSocketDisconnectPolicy(socket, (line) => diagnostics.push(line));
+			accepted.push(socket);
+		});
+		await new Promise<void>((resolve) => server.listen(socketPath, resolve));
+
+		// Record instead of dying, so the crash becomes an assertion we can attribute rather than
+		// a stack trace that kills the gate run itself.
+		const uncaught: Error[] = [];
+		const onUncaught = (err: Error) => uncaught.push(err);
+		process.on("uncaughtException", onUncaught);
+		// Every socket this cell opens, torn down in `finally` — `server.close()` only calls back
+		// once the LAST connection is gone, so a client left open on a failing assertion would turn
+		// a red gate into a hang (which is not a kill: a mutant must fail bounded, with its QK).
+		const opened: net.Socket[] = [];
+		try {
+			const client = net.createConnection(socketPath);
+			opened.push(client);
+			await new Promise<void>((resolve, reject) => {
+				client.once("connect", resolve);
+				client.once("error", reject);
+			});
+			// The sender gives up and hangs up — the C4 shape exactly.
+			client.on("error", () => {});
+			client.destroy();
+
+			// The receiver answers LATE, into a peer that is gone. Bounded: writes until the stream
+			// records an error, never longer.
+			for (let i = 0; i < 200 && accepted[0] !== undefined && accepted[0].errored === null; i++) {
+				try {
+					accepted[0].write(`${"x".repeat(64 * 1024)}\n`);
+				} catch {
+					// A synchronous ERR_STREAM_DESTROYED is the OTHER half — writeResponse's own
+					// try/catch owns it. This loop is hunting the asynchronous one.
+				}
+				await new Promise<void>((resolve) => setTimeout(resolve, 10));
+			}
+
+			// Fixture integrity FIRST: if no peer-disconnect error ever landed, the two cells below
+			// would be vacuously green no matter what the policy did.
+			const errored = accepted[0]?.errored as NodeJS.ErrnoException | null | undefined;
+			ok(
+				"7: fixture — a real peer disconnect produced an async EPIPE/ECONNRESET on the accepted socket",
+				errored != null && (errored.code === "EPIPE" || errored.code === "ECONNRESET"),
+			);
+			ok(
+				"7: [QK:CONTROL-SOCKET-NO-UNCAUGHT] a vanished peer never reaches the process as an uncaught exception " +
+					`(would have killed this resident session) — uncaught=${JSON.stringify(uncaught.map((e) => String(e)))}`,
+				uncaught.length === 0,
+			);
+			ok(
+				"7: [QK:CONTROL-SOCKET-ABSORBS-PEER-DISCONNECT] a vanished peer is absorbed silently, never diagnosed " +
+					`(it describes the client, not our state) — diagnostics=${JSON.stringify(diagnostics)}`,
+				diagnostics.length === 0,
+			);
+
+			// Unexpected code on a REAL accepted socket: diagnosed exactly once, with code AND
+			// message, and the emit must not throw back out of the event callback.
+			const client2 = net.createConnection(socketPath);
+			opened.push(client2);
+			await new Promise<void>((resolve, reject) => {
+				client2.once("connect", resolve);
+				client2.once("error", reject);
+			});
+			client2.on("error", () => {});
+			// The SECOND accepted connection — live, never disconnected, so the diagnosis path is
+			// exercised on a socket in ordinary service rather than on the already-errored one.
+			for (let i = 0; i < 200 && accepted[1] === undefined; i++) {
+				await new Promise<void>((resolve) => setTimeout(resolve, 10));
+			}
+			const live = accepted[1];
+			ok("7: fixture — the second connection was accepted and carries the policy", live !== undefined);
+			const unexpected: NodeJS.ErrnoException = Object.assign(new Error("no space left on device"), {
+				code: "ENOSPC",
+			});
+			const before = diagnostics.length;
+			let threw = false;
+			try {
+				live?.emit("error", unexpected);
+			} catch {
+				threw = true;
+			}
+			const emitted = diagnostics.slice(before);
+			ok(
+				"7: [QK:CONTROL-SOCKET-DIAGNOSES-UNEXPECTED] a non-disconnect error diagnoses EXACTLY once with code and " +
+					`message, and never rethrows from the event callback — threw=${threw} emitted=${JSON.stringify(emitted)}`,
+				threw === false &&
+					emitted.length === 1 &&
+					emitted[0]!.includes("ENOSPC") &&
+					emitted[0]!.includes("no space left on device"),
+			);
+		} finally {
+			process.off("uncaughtException", onUncaught);
+			for (const socket of [...opened, ...accepted]) socket.destroy();
+			await new Promise<void>((resolve) => server.close(() => resolve()));
+			await fs.rm(dir, { recursive: true, force: true });
+		}
+	}
+
+	// ── 8. the surface installs the policy FIRST on every accepted connection ───
+	// Ordering is the contract, not merely presence: a listener attached after setEncoding or
+	// after the data handler leaves a window in which the very first write can still kill us.
+	{
+		const src = await fs.readFile(CONTROL_SRC, "utf8");
+		const accept = src.slice(src.indexOf("const server = net.createServer((socket) => {"));
+		const attachAt = accept.indexOf("attachAcceptedSocketDisconnectPolicy(socket)");
+		const encodingAt = accept.indexOf('socket.setEncoding("utf8")');
+		const dataAt = accept.indexOf('socket.on("data"');
+		ok(
+			"8: [QK:CONTROL-SOCKET-POLICY-FIRST] createServer attaches the disconnect policy before setEncoding and " +
+				`before the data handler — attach=${attachAt} setEncoding=${encodingAt} data=${dataAt}`,
+			attachAt !== -1 && encodingAt !== -1 && dataAt !== -1 && attachAt < encodingAt && attachAt < dataAt,
+		);
+		ok(
+			"8: the surface consumes the shared policy and defines no second error listener of its own",
+			/from "\.\/lib\/entwurf-control-rpc\.js"/.test(src) && !/socket\.on\("error"/.test(src),
+		);
+	}
+
 	console.log(`\ncheck-entwurf-control-rpc: ${passed} checks passed`);
 }
 

package/scripts/check-entwurf-fact-provider.ts

@@ -30,6 +30,7 @@
 import assert from "node:assert/strict";
 import * as path from "node:path";
 import { type EntwurfFactsDeps, listEntwurfFacts } from "../pi-extensions/lib/entwurf-fact-provider.ts";
+import { UNOBSERVED_PLACEMENT } from "../pi-extensions/lib/herdr-placement.ts";
 import { type MetaCitizenBackend, serializeMetaIdentity } from "../pi-extensions/lib/meta-session.ts";
 import { SOCKET_SUFFIX, type SocketDirEntry } from "../pi-extensions/lib/socket-discovery.ts";
 import type { SocketLiveness } from "../pi-extensions/lib/socket-probe.ts";
@@ -83,6 +84,7 @@ function deps(
 		observe: (identity) => ({
 			receiver: identity.backend === "claude-code" ? "inactive" : "n/a",
 			transcript: identity.gardenId === GID_CLAUDE ? "absent" : "exists",
+			placement: UNOBSERVED_PLACEMENT,
 		}),
 		// Kind-carrying entries, like the real bindings: the listing must be able to refuse a
 		// symlinked record without following it. `irregularMeta` names the ones that are not
@@ -186,7 +188,7 @@ async function main(): Promise<void> {
 		const all = deps(meta, {});
 		all.observe = (identity) => {
 			allObserved.push(identity.gardenId);
-			return { receiver: "active", transcript: "exists" };
+			return { receiver: "active", transcript: "exists", placement: UNOBSERVED_PLACEMENT };
 		};
 		await listEntwurfFacts(all);
 		ok("Q112: generic provider without a presentation limit observes all 40 citizens", allObserved.length === 40);
@@ -196,7 +198,7 @@ async function main(): Promise<void> {
 		d.observationLimit = 32;
 		d.observe = (identity) => {
 			observed.push(identity.gardenId);
-			return { receiver: "active", transcript: "exists" };
+			return { receiver: "active", transcript: "exists", placement: UNOBSERVED_PLACEMENT };
 		};
 		const r = await listEntwurfFacts(d);
 		ok("Q112: full machine payload retains all 40 certified citizens", r.facts.peers.length === 40);

package/scripts/check-entwurf-facts.ts

@@ -36,6 +36,7 @@ import {
 	isLivenessSupported,
 	LIVENESS_DOMAIN_BACKENDS,
 } from "../pi-extensions/lib/entwurf-v2-contract.ts";
+import { UNOBSERVED_PLACEMENT } from "../pi-extensions/lib/herdr-placement.ts";
 import {
 	META_CITIZEN_BACKENDS,
 	type MetaCitizenBackend,
@@ -138,7 +139,7 @@ for (const backend of META_CITIZEN_BACKENDS) {
 	ok("passthrough recordUpdatedAt", fact.recordUpdatedAt === id.recordUpdatedAt);
 }
 
-// ── facts-only keyset: identity facts + liveness + the two observed axes, and
+// ── facts-only keyset: identity facts + liveness + the three observed axes, and
 // still NO verb-routing / no transcript PATH ────────────────────────────────
 {
 	const fact = resolvePeerFact(identity("pi"), "alive");
@@ -154,20 +155,25 @@ for (const backend of META_CITIZEN_BACKENDS) {
 		"recordUpdatedAt",
 		"receiver",
 		"transcript",
+		"placement",
 	].sort();
 	assert.deepStrictEqual(keys, expected, `PeerFact keyset drift: got ${keys.join(",")}`);
-	ok("facts-only keyset exact (identity facts + liveness + observed receiver/transcript)", true);
+	ok("facts-only keyset exact (identity facts + liveness + observed receiver/transcript/placement)", true);
 
 	// #101: an unmeasured row says so. `unobserved` is the default for a caller that
 	// injected no observer — never `none`/`absent`, which would be a fabricated fact.
 	ok(
-		"an observer-less composition reports both axes as unobserved (never a default fact)",
-		fact.receiver === "unobserved" && fact.transcript === "unobserved",
+		"an observer-less composition reports all three axes as unobserved (never a default fact)",
+		fact.receiver === "unobserved" && fact.transcript === "unobserved" && fact.placement.kind === "unobserved",
 	);
-	const observed = resolvePeerFact(identity("claude-code"), null, { receiver: "inactive", transcript: "absent" });
+	const observed = resolvePeerFact(identity("claude-code"), null, {
+		receiver: "inactive",
+		transcript: "absent",
+		placement: UNOBSERVED_PLACEMENT,
+	});
 	ok(
 		"an injected observation rides onto the fact verbatim",
-		observed.receiver === "inactive" && observed.transcript === "absent",
+		observed.receiver === "inactive" && observed.transcript === "absent" && observed.placement.kind === "unobserved",
 	);
 
 	const FORBIDDEN = [

package/scripts/check-entwurf-peers-surface.ts

@@ -33,6 +33,7 @@ import { type EntwurfFactsResult, recordLessSocketMessage } from "../pi-extensio
 import type { PeerFact } from "../pi-extensions/lib/entwurf-facts.ts";
 import { ENTWURF_PEERS_RENDER_LIMIT, renderEntwurfPeers } from "../pi-extensions/lib/entwurf-peers-render.ts";
 import type { FactLiveness } from "../pi-extensions/lib/entwurf-v2-contract.ts";
+import { UNOBSERVED_PLACEMENT } from "../pi-extensions/lib/herdr-placement.ts";
 import type { MetaCitizenBackend } from "../pi-extensions/lib/meta-session.ts";
 import type { SocketLiveness } from "../pi-extensions/lib/socket-probe.ts";
 
@@ -51,7 +52,7 @@ function peer(
 	gardenId: string,
 	backend: MetaCitizenBackend,
 	liveness: FactLiveness,
-	observed: Partial<Pick<PeerFact, "receiver" | "transcript">> = {},
+	observed: Partial<Pick<PeerFact, "receiver" | "transcript" | "placement">> = {},
 ): PeerFact {
 	return {
 		gardenId,
@@ -64,6 +65,7 @@ function peer(
 		liveness,
 		receiver: observed.receiver ?? "n/a",
 		transcript: observed.transcript ?? "exists",
+		placement: observed.placement ?? UNOBSERVED_PLACEMENT,
 	};
 }
 

package/scripts/check-entwurf-self-address.ts

@@ -44,6 +44,7 @@ import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import {
 	computeSelfAddressability,
+	decideUncitizenedNotice,
 	type SelfAddressabilityFacts,
 	type SocketState,
 } from "../pi-extensions/lib/entwurf-self-address.ts";
@@ -512,4 +513,71 @@ ok(
 		!/import[^;]*from\s*"\.\/lib\/entwurf-self-address\.(js|ts)"/.test(nativeSrc),
 );
 
+// ── the other half of the same honesty: a session that is NOT a citizen says so ──
+// This gate exists because a surface must not CLAIM an addressability it does not have. The mirror
+// of that is a surface that has none and says nothing: `[관측: GLG, 날것 PC, 2026-09-17]` a herdr
+// plugin install wires this extension at USER scope, so it loads in every pi on the host while
+// citizenship stays argv-gated — a plain `pi` after a green install is silent, tool-less and
+// indistinguishable from an install that did nothing.
+//
+// WHY THESE THREE CELLS AND NOT ONE REGEX. The first cut pinned "told once, on the UI only" with a
+// source regex that only proved a call existed somewhere. `[측정 2026-09-17, 독립 검수
+// claude-opus-5 + 재현]` two mutants walked through it green: moving the call into the CITIZEN
+// branch, and deleting the once-latch — 51/51 both times. That was a false success, so the
+// conditions moved into a pure decision the truth table below exhausts, and what is left at the
+// call site is narrow enough for a source pin to actually cover.
+{
+	const decide = (controlEnabled: boolean, hasUI: boolean, alreadyShown: boolean): boolean =>
+		decideUncitizenedNotice({ controlEnabled, hasUI, alreadyShown });
+	const table = {
+		citizenFirstUI: decide(true, true, false),
+		citizenNoUI: decide(true, false, false),
+		citizenShown: decide(true, true, true),
+		uncitizenedFirstUI: decide(false, true, false),
+		uncitizenedNoUI: decide(false, false, false),
+		uncitizenedShown: decide(false, true, true),
+		uncitizenedShownNoUI: decide(false, false, true),
+	};
+	ok(
+		"a citizen is never told it is not one, a session with no UI is never told anything, and the " +
+			`answer is true in exactly ONE of the eight states [QK:SELFADDR-UNCITIZENED-DECISION] (${JSON.stringify(table)})`,
+		table.uncitizenedFirstUI === true &&
+			table.citizenFirstUI === false &&
+			table.citizenNoUI === false &&
+			table.citizenShown === false &&
+			table.uncitizenedNoUI === false &&
+			table.uncitizenedShown === false &&
+			table.uncitizenedShownNoUI === false,
+	);
+}
+
+// The call site carries the REAL flag as a fact and is unconditional — there is no branch left for
+// a mutant to move it into, and passing a constant would make the decision above unreachable.
+const noticeBody = nativeSrc.slice(
+	nativeSrc.indexOf("async function noticeUncitizenedSession"),
+	nativeSrc.indexOf("function shouldRegisterControlTools"),
+);
+ok(
+	"pi-native: the not-a-citizen notice is decided from the REAL flag, on the UI only, never on stderr " +
+		"[QK:SELFADDR-UNCITIZENED-NOTICED]",
+	/const enabled = pi\.getFlag\(ENTWURF_FLAG\) === true;\n\t\tawait noticeUncitizenedSession\(ctx, enabled\);/.test(
+		nativeSrc,
+	) &&
+		/decideUncitizenedNotice\(\{ controlEnabled, hasUI: ctx\.hasUI, alreadyShown: uncitizenedNoticeShown \}\)/.test(
+			noticeBody,
+		) &&
+		/--entwurf-control/.test(noticeBody) &&
+		!/process\.stderr/.test(noticeBody),
+);
+
+// The latch is the difference between a hint and a nag: `refreshServer` runs again on session
+// switches, so the line that records "already said it" is load-bearing, not bookkeeping.
+ok(
+	"pi-native: the notice records that it fired, so a session switch does not repeat it " +
+		"[QK:SELFADDR-UNCITIZENED-ONCE]",
+	/let uncitizenedNoticeShown = false;/.test(nativeSrc) &&
+		/uncitizenedNoticeShown = true;/.test(noticeBody) &&
+		noticeBody.indexOf("uncitizenedNoticeShown = true;") < noticeBody.indexOf("ctx.ui.notify("),
+);
+
 console.log(`\ncheck-entwurf-self-address: ${passed} checks passed`);

package/scripts/check-entwurf-v2-production.ts

@@ -9,6 +9,10 @@
  *      (a pi-alive citizen → control-socket execute; acquireLock spy saw {dir: lockDir}).
  *   B. control `sendOverSocket` builds the RpcSendCommand (type/message/mode/wants_reply/
  *      sender) and maps response.success→outcome; the hand releases under `lockDir`.
+ *   B2. #115 — the SAME closure carries `response.error` onto the RpcSendResult, so a
+ *      completed-but-refused RPC reaches the caller as `rejected` WITH the receiver's
+ *      named reason. Dropping that one field renders a reasonless reject, which is the
+ *      field symptom; no other deterministic gate holds this wiring.
  *   D. the meta-mailbox hand enqueues onto the wired sessionsDir/mailboxDir.
  *   E. Q3 + Q5 — a dead control send re-resolves (claude-code citizen) to the mailbox and
  *      enqueues through the SAME sendViaMailbox instance (same enqueue spy) on the SAME dirs
@@ -60,6 +64,10 @@ const LOCK_DIR = "/fake/locks";
 const SESSIONS_DIR = "/fake/sessions";
 const MAILBOX_DIR = "/fake/mailbox";
 const CONTROL_DIR = "/fake/ctl";
+/** The named in-band refusal a real receiver answers with while it compacts (#115).
+ * It is a plain opaque string here on purpose: the production seam must carry WHATEVER
+ * reason the receiver named, not a vocabulary this gate recognises. */
+const IN_BAND_REJECT_REASON = "compacting";
 
 function identity(backend: MetaIdentity["backend"], gardenId = GID): MetaIdentity {
 	return {
@@ -184,7 +192,10 @@ function makeSpiedFactory(over: {
 	recordExists?: boolean;
 	inspectKind?: TargetSocketInspection["kind"];
 	probe?: "alive" | "dead" | "indeterminate";
-	rpc?: "success" | "dead-throw";
+	/** `in-band-reject` (#115): the RPC COMPLETES and the receiver refuses in band
+	 * (`{success:false,error:"compacting"}`) — distinct from `dead-throw`, which never
+	 * reaches a response at all. It is the only arm that carries `response.error`. */
+	rpc?: "success" | "dead-throw" | "in-band-reject";
 	classifyDead?: boolean;
 	/** #50 C3 — a caller with no authoritative sender (senderProvider → undefined). */
 	noSender?: boolean;
@@ -267,6 +278,11 @@ function makeSpiedFactory(over: {
 					e.code = "ECONNREFUSED";
 					throw e;
 				}
+				if (over.rpc === "in-band-reject") {
+					return {
+						response: { type: "response", command: command.type, success: false, error: IN_BAND_REJECT_REASON },
+					};
+				}
 				return { response: { type: "response", command: command.type, success: true } };
 			},
 			enqueue: (o) => {
@@ -531,6 +547,31 @@ async function main(): Promise<void> {
 		);
 	}
 
+	// ── B2: #115 — the production seam CARRIES the receiver's named in-band reason ─
+	// B above proves the success half of the map. This is the other half, and it is the
+	// half the field symptom lived in: a completed RPC answering `{success:false,
+	// error:"compacting"}`. The reason has to cross THREE production hops the fake cannot
+	// short-circuit — `response.error` → `RpcSendResult.error` (the factory's own
+	// `sendOverSocket` closure) → `driveSend`'s `inBandRejected` → the
+	// `executeControlSocketSend` result — so deleting the factory's `error:` wiring alone
+	// strands the reason and this cell goes red. `outcome` alone is NOT the assertion:
+	// a bare `rejected` is exactly what the defect rendered.
+	{
+		const { deps, spies } = makeSpiedFactory({ rpc: "in-band-reject" });
+		const res = await deps.executor.sendControl(CONTROL_PLAN, lockClaim());
+		ok("B2: in-band {success:false} → outcome 'rejected' (not failed, not sent)", res.outcome === "rejected");
+		ok(
+			"B2: [QK:V2PROD-INBAND-ERROR-WIRED] response.error reaches the send result verbatim",
+			res.rejectReason === IN_BAND_REJECT_REASON,
+		);
+		ok("B2: an in-band reject is a COMPLETED rpc — the socket hand ran once", spies.rpc.length === 1);
+		ok(
+			"B2: a rejected send still releases under the wired lockDir",
+			spies.release.length === 1 && spies.release[0].dir === LOCK_DIR,
+		);
+		ok("B2: an in-band reject never falls back to the mailbox", spies.enqueue.length === 0);
+	}
+
 	// ── C2: #50 C3 — the dormant rail carries the caller edge (<sender_info>) ──
 	// ── D: meta-mailbox hand enqueues onto the wired dirs ─────────────────────
 	{

package/scripts/check-entwurf-v2-send.ts

@@ -5,8 +5,8 @@
  *
  *   1. ack success            → outcome `sent`, release ×1, deadFallback NOT called.
  *   2. in-band reject (success:false) → outcome `rejected`, release ×1, NO fallback
- *      (deadFallback + mailbox NOT called — the receiver was reached and refused); NO
- *      rejectReason (an in-band refusal has no resolver taxonomy — N3 boundary).
+ *      (deadFallback + mailbox NOT called — the receiver was reached and refused); a
+ *      supplied receiver error is carried verbatim as `rejectReason` (N3 boundary).
  *   3. dead → re-resolve(control-socket) → success → `fallback-sent`, release ×1,
  *      deadFallback called EXACTLY once and UNDER the still-held lock (before release).
  *   4. dead → re-resolve reject → `rejected`, release ×1, and the resolver's reason is
@@ -193,16 +193,24 @@ async function main(): Promise<void> {
 
 	// ── 2: in-band reject → rejected, release once, NO fallback ───────────────
 	{
-		const { result, trace } = await run({ firstSend: { result: { success: false, error: "refused" } } });
+		const { result, trace } = await run({ firstSend: { result: { success: false, error: "compacting" } } });
 		ok("in-band reject → rejected", result.outcome === "rejected");
 		ok("in-band reject → release ×1", trace.releases.length === 1);
-		// N3 boundary: an in-band RPC refusal has NO resolver reason (only a dead-path
-		// re-resolve reject carries one) — the field stays undefined here.
-		ok("in-band reject → no rejectReason (in-band has no resolver taxonomy)", result.rejectReason === undefined);
+		ok(
+			"[QK:V2SEND-INBAND-REJECT-REASON] in-band control reject carries its receiver error",
+			result.rejectReason === "compacting",
+		);
 		ok(
 			"in-band reject → no deadFallback, no mailbox",
 			trace.deadFallbackCalls === 0 && trace.mailboxSends.length === 0,
 		);
+		const unnamed = await run({ firstSend: { result: { success: false } } });
+		ok("in-band reject without an error does not invent rejectReason", unnamed.result.rejectReason === undefined);
+		const empty = await run({ firstSend: { result: { success: false, error: "" } } });
+		ok(
+			"in-band reject with an empty error does not expose an empty rejectReason",
+			empty.result.rejectReason === undefined,
+		);
 	}
 
 	// ── 3: dead → re-resolve(control) success → fallback-sent, fallback before release
@@ -223,6 +231,16 @@ async function main(): Promise<void> {
 			"dead → deadFallback UNDER held lock (before release)",
 			trace.order.indexOf("deadFallback") < trace.order.indexOf("releaseLock"),
 		);
+
+		const refused = await run({
+			firstSend: { throwCode: "ECONNREFUSED" },
+			deadFallback: { kind: "execute", plan: RERESOLVED_CONTROL_PLAN },
+			fallbackSend: { result: { success: false, error: "retry-refused" } },
+		});
+		ok(
+			"dead → re-resolve(control) in-band reject carries the retry receiver error",
+			refused.result.outcome === "rejected" && refused.result.rejectReason === "retry-refused",
+		);
 	}
 
 	// ── 4: dead → re-resolve reject → rejected ────────────────────────────────
@@ -296,9 +314,10 @@ async function main(): Promise<void> {
 		const refused = await run({
 			firstSend: { throwCode: "ENOENT" },
 			deadFallback: { kind: "execute", plan: MAILBOX_PLAN },
-			fallbackSend: { result: { success: false } },
+			fallbackSend: { result: { success: false, error: "mailbox-refused" } },
 		});
 		ok("dead → mailbox enqueue success:false → rejected", refused.result.outcome === "rejected");
+		ok("dead → mailbox enqueue reject carries its receiver error", refused.result.rejectReason === "mailbox-refused");
 		// No file was written, so there is nothing to name — never echo a dep's stray path.
 		ok("dead → rejected enqueue carries NO messagePath", refused.result.messagePath === undefined);
 	}