agent-send.sh derived the sender label from the DESTINATION socket flag, so cross-socket messages were
stamped with an arbitrary session from the socket the sender was not attached to. One lead's messages
arrived for hours stamped as the recipient. Fixed on main; source now comes from the caller's own $TMUX.
The label was false and plausible simultaneously, which is the only dangerous kind — a garbled label
gets questioned, a label naming a real seat on a real socket does not. Same family as D-33's summary
that resembles an enumeration and D-48's boundary statement that reads as rigorous.
The transferable part is the fix's design choice: it now reports "?" rather than borrowing a plausible
name. That is the same discipline as NOT-MEASURED, adopted the same day on the credential thread —
absent must be rendered absent, not as a pass and not as a fail. An unknown rendered as a plausible
value is consumed as fact; an unknown rendered as unknown is consumed as a question. Two subsystems,
one day, same conclusion, independently.
Audited my ledger on receipt: clean, zero mis-attributed sources in TASKS.md or BOARD.md. The reason is
practice rather than luck — rulings were recorded from the message BODY, which carried its own
[mos-claude -> mos-remediation] header, not from the transport envelope. Where a message
self-identifies, the body is the claim and the envelope is metadata, and the envelope was the broken
part.
Routing defect now doctrine: the USC message was addressed to "orchestrator", a ROLE that exists on
each estate, and agent-send resolves a session NAME. Binding rule: address seats, not roles, and
estate-qualify any name that exists on both estates. The cost was bounded only because the recipient
declined to act on another estate's delivery while still checking whether any line of it constrained
its own — declining to act but silently letting a stale cross-estate constraint ride would have been
the actual failure.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
