@junghanacs/entwurf 0.13.0 → 0.14.0

package/scripts/check-entwurf-resume-args.ts

@@ -1,20 +1,23 @@
 /**
- * check-entwurf-resume-args — deterministic gate for the 5c-3b resume-argv SSOT
- * (`buildResumePiArgs`). It pins the RESIDENT citizen launch shape so it cannot drift.
- * This gate once carried a second `legacy` one-shot variant as a contrast; that launcher
- * and its enum member were removed 2026-07-27, and the half of A1 that still ships is
- * asserted directly instead — a resumed citizen stands its control socket up and never
- * emits the one-shot `--no-extensions`:
+ * check-entwurf-resume-args — deterministic gate for the resume-argv SSOT (`buildResumePiArgs`).
  *
- *   2. v2-control carries `--entwurf-control` and NO `--no-extensions`.
- *   3. The headless prefix `--mode json -p` stays and the prompt is the final positional
- *      (the prompt-as-turn authority is unchanged in v2 — `-p` is NOT dropped).
- *   4. `explicitExtensionArgs` is preserved verbatim, exactly once
- *      (load-bearing for a recorded `provider=entwurf` resume; #29 footgun).
- *   5. `plan.launchArgs` (`--approve` / empty) ride as flags BEFORE the prompt.
- *   6. a null/undefined provider emits NO `--provider` flag; `--model <m>` and `<prompt>`
- *      are the last three tokens.
- *   7. the resident posture is exact: `--entwurf-control` present, `--no-extensions` never.
+ * The contract this gate holds changed with S1, and the change is the point: the builder used to
+ * emit a HEADLESS child (`--mode json -p … <prompt>`) because its only caller was the detached
+ * `spawn-bg` watcher. That transport was withdrawn, and the argv was MEASURED against the runtime
+ * before the new consumer was written (2026-08-06, private tmux + fixture): dropped into a tmux
+ * window, `-p` is pi's own "non-interactive mode" and the operator gets a JSON stream instead of a
+ * session they can type into. The shape that actually reopens a visible citizen carries neither.
+ *
+ * So this gate pins the ONE shipped posture, and pins the absences as hard as the presences —
+ * a re-introduced `-p` would still open a window, still stand a socket up, and still look green
+ * to anything that only asserted `--entwurf-control`:
+ *
+ *   RESUMEARGS-CONTROL-FIRST     `--entwurf-control` leads, so the resumed session is addressable
+ *   RESUMEARGS-NO-HEADLESS       no `--mode`, no `-p` — the window is interactive
+ *   RESUMEARGS-NO-PROMPT-TAIL    no positional prompt — a resume runs no turn
+ *   RESUMEARGS-EXT-ONCE-BEFORE-SESSION  bridge args exactly once, between control and --session
+ *   RESUMEARGS-PROVIDER-OPTIONAL a recorded provider is emitted, an absent one emits no flag
+ *   RESUMEARGS-SESSION-IS-FILE   `--session <abs path>`, never `--session-id` (which MINTS)
  *
  * Pure string assembly — no IO, no spawn.
  */
@@ -29,89 +32,88 @@ function ok(label: string, cond: boolean): void {
 	passed++;
 }
 
-// The resume target is a session FILE now (#50 C2), not a garden id: the record owns
-// the address, so argv only has to name WHICH transcript to reopen. An absolute path
-// is the production shape (record.transcriptPath).
+// The resume target is a session FILE (#50 C2), not a garden id: the record owns the address, so
+// argv only has to name WHICH transcript to reopen.
 const SESSION_FILE =
 	"/home/op/.pi/agent/sessions/-home-op-repo/2026-06-13T09-10-00-000Z_019e8faa-04ea-7b73-bf2c-1465d525c2e8.jsonl";
-// Real production shape: getEntwurfExplicitExtensions emits `-e <path>` (entwurf-core.ts),
-// NOT `--extension`. The builder spreads verbatim, but the fixture mirrors production so the
-// "preserved exactly once" assertion exercises the token the launcher actually passes.
+// Production shape, measured: getEntwurfExplicitExtensions emits `-e <path>`, not `--extension`.
 const EXT = ["-e", "/path/to/entwurf/index.ts"] as const;
 
-// index of token `flag`'s VALUE (the token right after it), or -1 if the flag is absent.
 function valueAfter(args: readonly string[], flag: string): string | undefined {
 	const i = args.indexOf(flag);
 	return i === -1 ? undefined : args[i + 1];
 }
 
 function main(): void {
-	// ── v2-control variant ──────────────────────────────────────────────────────────
+	// ── The shipped posture, with a recorded ACP provider (the only shape whose ext args are
+	//    non-empty — measured as `["-e", "<bridge>"]` on a real recorded provider=entwurf record).
 	{
 		const args = buildResumePiArgs({
-			variant: "v2-control",
 			sessionFile: SESSION_FILE,
 			explicitExtensionArgs: EXT,
 			provider: "entwurf",
-			model: "claude-opus-5",
-			prompt: "resume now",
-			launchArgs: ["--approve"],
+			model: "claude-sonnet-5",
 		});
-		ok("2 v2 has --entwurf-control", args.includes("--entwurf-control"));
-		ok("2 v2 has NO --no-extensions", !args.includes("--no-extensions"));
-		ok("3 v2 keeps -p (prompt-as-turn NOT dropped)", args.includes("-p"));
-		ok("3 v2 headless prefix --mode json -p", args[0] === "--mode" && args[1] === "json" && args[2] === "-p");
-		ok("3 v2 prompt is the final positional", args[args.length - 1] === "resume now");
-		ok("4 v2 keeps ext args exactly once", args.filter((a) => a === "-e").length === 1);
-		ok("5 v2 includes launchArgs --approve", args.includes("--approve"));
-		ok("5 v2 --approve is before the prompt", args.indexOf("--approve") < args.length - 1);
-		ok("6 v2 provider laid out", valueAfter(args, "--provider") === "entwurf");
-		ok("6 v2 model laid out", valueAfter(args, "--model") === "claude-opus-5");
-		ok("6 v2 resumes by exact FILE (--session <abs path>)", valueAfter(args, "--session") === SESSION_FILE);
+
+		// Assertion order is a contract, not a reading preference: each claim must be the FIRST
+		// one a defect against it reaches, or a red would be reported under someone else's name.
+		// The absences come first because a re-introduced headless prefix also displaces the
+		// leading flag, and "the argv is headless again" is the truer diagnosis of that.
+		ok(
+			"[QK:RESUMEARGS-NO-HEADLESS] no --mode and no -p — `-p` is pi's non-interactive mode, so the headless prefix would open a window streaming JSON instead of a session the operator can use",
+			!args.includes("--mode") && !args.includes("-p") && !args.includes("--print"),
+		);
+		ok(
+			"[QK:RESUMEARGS-CONTROL-FIRST] --entwurf-control is the FIRST token — the resumed session stands its control socket up, which is the whole difference between a restored transcript and an addressable citizen",
+			args[0] === "--entwurf-control",
+		);
 		ok(
-			"6 v2 carries NO --session-id (a garden id would MINT a session, not resume one)",
-			!args.includes("--session-id"),
+			"[QK:RESUMEARGS-NO-PROMPT-TAIL] the argv ends at --model <m> with NO positional prompt — a resume reopens a conversation and runs no turn (measured: the transcript stayed byte-identical)",
+			args[args.length - 2] === "--model" && args[args.length - 1] === "claude-sonnet-5",
 		);
 		ok(
-			"6 v2 --model <m> <prompt> tail",
-			args[args.length - 3] === "--model" &&
-				args[args.length - 2] === "claude-opus-5" &&
-				args[args.length - 1] === "resume now",
+			"no --no-extensions either: the one-shot posture that let `pi -p` exit is exactly what a resident resume must not emit",
+			!args.includes("--no-extensions"),
+		);
+
+		// SESSION-IS-FILE precedes the ext-args claim because the ext claim is stated RELATIVE to
+		// `--session`: if that flag were renamed, the positional assertion below would go red about
+		// the extensions while the actual defect is the flag that MINTS a session.
+		ok(
+			"[QK:RESUMEARGS-SESSION-IS-FILE] the builder targets an exact FILE via --session and never --session-id, which would CREATE the id when missing and silently mint an empty session instead of resuming one",
+			valueAfter(args, "--session") === SESSION_FILE && !args.includes("--session-id"),
+		);
+		ok(
+			"[QK:RESUMEARGS-EXT-ONCE-BEFORE-SESSION] the bridge args appear EXACTLY once and sit between --entwurf-control and --session — dropping them re-opens the #29 'Unknown provider' footgun, and doubling them is a different broken argv",
+			args.filter((a) => a === "-e").length === 1 &&
+				args.indexOf("--entwurf-control") < args.indexOf("-e") &&
+				args.indexOf("-e") < args.indexOf("--session"),
+		);
+		ok("a recorded provider is laid out as two tokens", valueAfter(args, "--provider") === "entwurf");
+		ok("model is laid out as two tokens", valueAfter(args, "--model") === "claude-sonnet-5");
+		ok(
+			"the full measured argv is reproduced exactly",
+			args.join(" ") ===
+				`--entwurf-control -e /path/to/entwurf/index.ts --session ${SESSION_FILE} --provider entwurf --model claude-sonnet-5`,
 		);
 	}
 
-	// ── 6. null/undefined provider emits NO --provider flag ───────────────────────────
+	// ── The native shape: no recorded provider, no bridge. Measured as explicitExtensionArgs=[].
 	for (const provider of [null, undefined] as const) {
 		const args = buildResumePiArgs({
-			variant: "v2-control",
 			sessionFile: SESSION_FILE,
 			explicitExtensionArgs: [],
 			provider,
-			model: "m",
-			prompt: "p",
-			launchArgs: [],
-		});
-		ok(`6 provider=${provider}: no --provider flag`, !args.includes("--provider"));
-		ok(`6 provider=${provider}: --model <m> <prompt> still tail`, args.slice(-3).join(" ") === "--model m p");
-	}
-
-	// ── 7. the resident posture is exact: the one-shot flag never reappears ───────────
-	// The `legacy` variant was removed 2026-07-27, so the old cross-contamination pair is
-	// gone. What must NOT rot is the A1 half that still ships: a resumed citizen stands its
-	// control socket up, which means `--no-extensions` (the one-shot flag that let `pi -p`
-	// exit) can never be emitted here again.
-	{
-		const v2 = buildResumePiArgs({
-			sessionFile: SESSION_FILE,
-			explicitExtensionArgs: EXT,
-			provider: "entwurf",
-			model: "m",
-			prompt: "p",
-			launchArgs: ["--approve"],
-			variant: "v2-control",
+			model: "gpt-5.6-terra",
 		});
-		ok("7 resident posture never emits the one-shot --no-extensions", !v2.includes("--no-extensions"));
-		ok("7 resident posture stands the control socket up", v2.includes("--entwurf-control"));
+		ok(
+			`[QK:RESUMEARGS-PROVIDER-OPTIONAL] provider=${provider}: NO --provider flag is emitted — an empty flag value would be a different citizen's launch, not a missing one`,
+			!args.includes("--provider"),
+		);
+		ok(
+			`provider=${provider}: the argv is exactly the four tokens the native shape needs`,
+			args.join(" ") === `--entwurf-control --session ${SESSION_FILE} --model gpt-5.6-terra`,
+		);
 	}
 
 	console.log(`\ncheck-entwurf-resume-args: ${passed} checks passed`);

package/scripts/check-entwurf-session-identity.ts

@@ -3,8 +3,8 @@
  * identity contract. No backend, no API, no spawn. Pure-string + synthetic-fs.
  *
  *   - T-grammar    the garden-id grammar (session-id.js SSOT): validator +
- *                  generator uniqueness + timestamp format. This is the RECORD's
- *                  gardenId shape now, not pi's session id.
+ *                  generator shape + timestamp format, all on fixed inputs. This
+ *                  is the RECORD's gardenId shape now, not pi's session id.
  *   - T-identity   readSessionIdentity: first model_change is the model authority;
  *                  drift fail-fast; the session NAME is pi's and is never read
  *                  (#50 C3 — the old name-mirror/`requireEntwurf` refusals are
@@ -15,7 +15,8 @@
  * build-parse round-trip / T-no-logic / T-model-immut — the name is pi's and no
  * code assembles or parses one), the header-scan lookup (T-collision), the
  * transcript analyzer, and the remote scope-lock. The meta-record resolves a
- * garden id to its transcript now (see check-entwurf-v2-spawn-production §9).
+ * garden id to its transcript now (see check-resume-launch-identity, which inherited
+ * those cells from the deleted check-entwurf-v2-spawn-production §9).
  *
  * The sessions base is isolated to a temp dir BEFORE the module computes its
  * load-time paths, so the real ~/.pi/agent is never touched.
@@ -73,13 +74,16 @@ try {
 	ok(!isValidSessionId("20260603T191245-a3f09c "), "trailing space rejected");
 	ok(!isValidSessionId(123 as unknown), "non-string rejected");
 
-	// generateSessionId: format + uniqueness (same-second parallel spawn safety)
-	const ids = Array.from({ length: 256 }, () => generateSessionId());
-	ok(
-		ids.every((id) => isValidSessionId(id)),
-		"all generated ids valid",
-	);
-	eq(new Set(ids).size, 256, "256 generated ids unique (6-hex suffix)");
+	// generateSessionId on a FIXED Date: deterministic shape proof — the id is the
+	// formatted timestamp prefix + `-` + 6 lowercase hex, and it satisfies the
+	// validator. The suffix is 24 random bits, so batch uniqueness is PROBABILISTIC
+	// (256 ids collide ~0.19% of runs) and is deliberately NOT asserted here — a
+	// deterministic gate must not carry a birthday-bound flake. This gate proves
+	// generator grammar/validator wiring ONLY; the fail-closed production repair
+	// for a minted-gid collision at the record store is tracked in #66, not here.
+	const genId = generateSessionId(new Date(2026, 0, 9, 5, 6, 7));
+	ok(/^20260109T050607-[0-9a-f]{6}$/.test(genId), "generated id = fixed timestamp prefix + 6-hex suffix");
+	ok(isValidSessionId(genId), "generated id passes the validator");
 	eq(formatSessionTimestamp(new Date(2026, 5, 3, 19, 12, 45)), "20260603T191245", "timestamp value (local)");
 
 	// ---- T-identity: resume identity authority = FIRST model_change ----

package/scripts/check-entwurf-v2-contract.ts

@@ -11,19 +11,19 @@
  *   - R1 domain guard: the control-socket domain currently contains pi; claude-code / codex /
  *     antigravity are `unsupported` — NEVER folded into dead/indeterminate.
  *   - the 6-cell table is exhaustive and every cell is a SINGLE verdict (Q2):
- *     exactly two allow cells (ff+live=send, owned+dormant=resume), four reject.
+ *     ONE allow cell (ff+live=send) plus two rejects — the visible-first cut removed the
+ *     `owned-outcome` row, and with it the only resume/spawn verdict the table had.
  *   - N1/F3: an indeterminate target never spawns (both intents reject it).
- *   - Q2/F1: owned-outcome + live = reject (owned-live-no-autosend), not auto-send.
  *   - F-mailbox: an `unsupported` citizen routes through a SEPARATE intent-keyed
  *     mailbox mini-table (NOT the 6-cell table): ff+deliverable → meta-mailbox/
  *     ack-only, ff+undeliverable → mailbox-undeliverable (fail-closed),
- *     owned → backend-liveness-unsupported. Deliverability is a 2nd fact ignored
+ *     Deliverability is a 2nd fact ignored
  *     in-domain (pi). The N2 asymmetry (dormant-pi reject vs unsupported mailbox)
  *     is pinned side-by-side.
  *   - R3: resolveDispatch round-trip — receipt.observedLiveness === input AND
  *     action/transport/ownership/reason === the table cell, every (intent × liveness).
  *   - R5: taxonomy covers the table reasons + pre-claims bad-target /
- *     untrusted-fail-fast / target-locked (so bucket B F2 won't reopen it), and
+ *     target-locked (so bucket B F2 won't reopen it), and
  *     is PRE-DISPATCH only (no send-fail-fallback member).
  *   - schema ↔ types drift guard: the TypeBox input/receipt property keysets and
  *     the StringEnum members match the hand-written contract constants.
@@ -137,9 +137,9 @@ for (const intent of ENTWURF_INTENTS) {
 		}
 	}
 }
-eq("table has 6 cells (2 intents × 3 liveness)", allowCells + rejectCells, 6);
-eq("v2-initial: exactly 2 allow cells", allowCells, 2);
-eq("v2-initial: exactly 4 reject cells", rejectCells, 4);
+eq("table has 3 cells (1 intent × 3 liveness)", allowCells + rejectCells, 3);
+eq("post-cut: exactly 1 allow cell (fire-and-forget × live)", allowCells, 1);
+eq("post-cut: exactly 2 reject cells (dormant, indeterminate)", rejectCells, 2);
 
 // the two allow cells are exactly the intended ones
 eq("allow: fire-and-forget+live = send/control-socket/ack-only", DISPATCH_TABLE["fire-and-forget"].live, {
@@ -147,13 +147,8 @@ eq("allow: fire-and-forget+live = send/control-socket/ack-only", DISPATCH_TABLE[
 	transport: "control-socket",
 	ownership: "ack-only",
 });
-eq("allow: owned-outcome+dormant = resume/spawn-bg/owned", DISPATCH_TABLE["owned-outcome"].dormant, {
-	action: "resume",
-	transport: "spawn-bg",
-	ownership: "owned",
-});
 
-// ── N1/F3: indeterminate never spawns (both intents reject) ────────────────
+// ── N1/F3: an indeterminate target is never dispatched into ────────────────
 for (const intent of ENTWURF_INTENTS) {
 	const cell = DISPATCH_TABLE[intent].indeterminate;
 	eq(`N1: ${intent}+indeterminate = reject(indeterminate-no-spawn)`, cell, {
@@ -168,12 +163,6 @@ eq("N2: fire-and-forget+dormant = reject(dormant-fire-forget-unsupported)", DISP
 	reason: "dormant-fire-forget-unsupported",
 });
 
-// ── Q2/F1: owned-outcome+live = reject, never auto-send ────────────────────
-eq("Q2: owned-outcome+live = reject(owned-live-no-autosend)", DISPATCH_TABLE["owned-outcome"].live, {
-	action: "reject",
-	reason: "owned-live-no-autosend",
-});
-
 // ── R3: resolveDispatch round-trip — table cell ↔ receipt, every cell ──────
 // In-domain (pi) liveness is authoritative; the F-mailbox deliverability fact is
 // IGNORED here, so the verdict is identical for deliverable true/false.
@@ -207,7 +196,7 @@ for (const intent of ENTWURF_INTENTS) {
 // ── F-mailbox: unsupported mailbox mini-table — SEPARATE from the 6-cell table ──
 // The unsupported domain-guard routes through UNSUPPORTED_DISPATCH_TABLE (intent-
 // keyed), NOT the liveness table. Two cells, each a single verdict (Q2).
-eq("mini-table: 2 cells (one per intent)", Object.keys(UNSUPPORTED_DISPATCH_TABLE).length, 2);
+eq("mini-table: 1 cell (one per intent)", Object.keys(UNSUPPORTED_DISPATCH_TABLE).length, 1);
 eq(
 	"mini-table[fire-and-forget] = send/meta-mailbox/ack-only (deliverable path)",
 	UNSUPPORTED_DISPATCH_TABLE["fire-and-forget"],
@@ -217,10 +206,6 @@ eq(
 		ownership: "ack-only",
 	},
 );
-eq("mini-table[owned-outcome] = reject(backend-liveness-unsupported)", UNSUPPORTED_DISPATCH_TABLE["owned-outcome"], {
-	action: "reject",
-	reason: "backend-liveness-unsupported",
-});
 
 // ── F-mailbox: resolveDispatch over the deliverability axis ────────────────
 // fire-and-forget + deliverable → meta-mailbox send (NOT reject); ack-only +
@@ -248,19 +233,6 @@ eq(
 		observedLiveness: "unsupported",
 	},
 );
-// owned-outcome+unsupported still rejects regardless of deliverability — a
-// self-fetch backend has no real liveness for the caller to own (point 3).
-for (const deliverable of [true, false]) {
-	eq(
-		`F-mailbox: owned+unsupported (deliverable=${deliverable}) → reject(backend-liveness-unsupported)`,
-		resolveDispatch("owned-outcome", "unsupported" as FactLiveness, deliverable),
-		{
-			ok: false,
-			reason: "backend-liveness-unsupported",
-			observedLiveness: "unsupported",
-		},
-	);
-}
 
 // ── N2 asymmetry — the two tables are NOT contradictory ────────────────────
 // fire-and-forget+dormant-PI = reject (confirmed not-running → enqueue is silent
@@ -273,6 +245,13 @@ ok(
 		resolveDispatch("fire-and-forget", "unsupported" as FactLiveness, true).ok === true,
 );
 
+// ── Delivery transports: exact set; process launch is not a receipt rail ───
+eq(
+	"[QK:V2-DELIVERY-EXCLUDES-MUX] transport enum is the exact four delivery outcomes; mux launch handles stay out",
+	[...ENTWURF_V2_TRANSPORTS],
+	["control-socket", "meta-mailbox", "native-push"],
+);
+
 // ── F-mailbox: transport + taxonomy members present ────────────────────────
 ok(
 	"transport: meta-mailbox present (F-mailbox liveness-free delivery)",
@@ -350,9 +329,9 @@ for (const intent of ENTWURF_INTENTS) {
 			}
 		}
 	}
-	eq("native-push table has 6 cells (2 intents × 3 liveness)", allow + reject, 6);
+	eq("native-push table has 3 cells (1 intent × 3 liveness)", allow + reject, 3);
 	eq("native-push: exactly 1 allow cell (fire-and-forget × alive)", allow, 1);
-	eq("native-push: exactly 5 reject cells", reject, 5);
+	eq("native-push: exactly 2 reject cells (dead, indeterminate)", reject, 2);
 }
 // the one allow cell + the intended reject reasons.
 eq("native-push allow: ff+alive = send/native-push/ack-only", NATIVE_PUSH_DISPATCH_TABLE["fire-and-forget"].alive, {
@@ -369,21 +348,13 @@ eq(
 	NATIVE_PUSH_DISPATCH_TABLE["fire-and-forget"].indeterminate,
 	{ action: "reject", reason: "native-push-probe-indeterminate" },
 );
-// owned-outcome × * = single, state-independent no-resume-authority reject.
-for (const lv of NATIVE_PUSH_LIVENESSES) {
-	eq(
-		`native-push: owned+${lv} = reject(native-push-no-resume-authority)`,
-		NATIVE_PUSH_DISPATCH_TABLE["owned-outcome"][lv],
-		{
-			action: "reject",
-			reason: "native-push-no-resume-authority",
-		},
-	);
-}
-// `backend-liveness-unsupported` is NOT reused for a native-push backend (봉인 1).
+// The removed `owned-outcome` row rejected native-push-no-resume-authority on every
+// liveness. Its reason left the taxonomy with the intent, so assert it is gone rather
+// than leaving a cell that proves retired behavior.
 ok(
-	"native-push: reject reasons never reuse backend-liveness-unsupported (agy IS measured)",
-	!(NATIVE_PUSH_REJECT_REASONS as readonly string[]).includes("backend-liveness-unsupported"),
+	"native-push: the no-resume-authority reason left the taxonomy with the owned-outcome intent",
+	!(NATIVE_PUSH_REJECT_REASONS as readonly string[]).includes("native-push-no-resume-authority") &&
+		!(ENTWURF_V2_REJECT_REASONS as readonly string[]).includes("native-push-no-resume-authority"),
 );
 // resolveNativePushDispatch round-trip: observedLiveness === probed value, verdict === cell.
 for (const intent of ENTWURF_INTENTS) {
@@ -424,7 +395,7 @@ for (const r of NATIVE_PUSH_REJECT_REASONS) {
 for (const r of RESOLVER_REJECT_REASONS) {
 	ok(`taxonomy: resolver reason '${r}' is in the enum`, (ENTWURF_V2_REJECT_REASONS as readonly string[]).includes(r));
 }
-for (const pre of ["bad-target", "untrusted-fail-fast", "target-locked"]) {
+for (const pre of ["bad-target", "target-locked"]) {
 	ok(
 		`taxonomy: pre-claim '${pre}' present (R5 — bucket B won't reopen)`,
 		(ENTWURF_V2_REJECT_REASONS as readonly string[]).includes(pre),
@@ -472,9 +443,13 @@ for (const r of ENTWURF_V2_REJECT_REASONS) {
 for (const r of RESOLVER_REJECT_REASONS) {
 	ok(`？6: resolver reason '${r}' is post-probe (non-null observedLiveness required)`, !isPreProbeReject(r));
 }
-// untrusted-fail-fast is post-probe too (1B: it now runs AFTER lock+probe, only on
-// a resume verdict, so observedLiveness is the honest measured dormant).
-ok("？6: untrusted-fail-fast is post-probe (1B — runs after lock+probe)", !isPreProbeReject("untrusted-fail-fast"));
+// untrusted-fail-fast is GONE from the taxonomy: preflight ran only behind the resume
+// verdict, so the reject it produced left with that verdict. Asserting its absence keeps
+// the enum honest — a reason nothing can emit is not a reason.
+ok(
+	"taxonomy: untrusted-fail-fast is gone (its only producer was the removed resume verdict)",
+	!(ENTWURF_V2_REJECT_REASONS as readonly string[]).includes("untrusted-fail-fast"),
+);
 
 // #50 C4: record-less-socket — a gid-shaped non-symlink control socket with NO
 // meta-record. The record is the sole address authority, so this is refused for
@@ -506,7 +481,7 @@ for (const r of PRE_PROBE_REJECT_REASONS) {
 		);
 	}
 }
-for (const r of [...RESOLVER_REJECT_REASONS, ...NATIVE_PUSH_REJECT_REASONS, "untrusted-fail-fast" as const]) {
+for (const r of [...RESOLVER_REJECT_REASONS, ...NATIVE_PUSH_REJECT_REASONS]) {
 	ok(
 		`？6: well-formed('${r}', null) = false (post-probe must carry a value)`,
 		!rejectObservedLivenessWellFormed(r, null),
@@ -567,7 +542,7 @@ for (const r of PRE_PROBE_REJECT_REASONS) {
 		passed++;
 	}
 }
-for (const r of [...RESOLVER_REJECT_REASONS, ...NATIVE_PUSH_REJECT_REASONS, "untrusted-fail-fast" as const]) {
+for (const r of [...RESOLVER_REJECT_REASONS, ...NATIVE_PUSH_REJECT_REASONS]) {
 	assert.throws(
 		() => makeRejectReceipt(r, null),
 		/ill-formed reject/,