@junghanacs/entwurf 0.13.0 → 0.14.0

package/scripts/check-mux-resume-call.ts

@@ -0,0 +1,282 @@
+/**
+ * check-mux-resume-call — deterministic gate for the resume placement composition
+ * (`pi-extensions/lib/mux-resume-call.ts`).
+ *
+ * Same scope discipline as `check-mux-launch` and `check-mux-fresh-call`: only what is decidable
+ * without tmux. There is no fake tmux in this repo and this gate does not introduce one — the
+ * real-window axis belongs to the LIVE lifecycle smoke.
+ *
+ * Every cwd claim below is a MEASURED tmux 3.6a behaviour, not a precaution. They were taken on a
+ * private server on 2026-08-06, and each one is a way a resume would look successful while being
+ * wrong:
+ *
+ *   MUXRESUME-CWD-MISSING-REFUSED   a nonexistent `-c` does NOT fail: tmux exits 0, opens the
+ *                                   window, and the child lands in $HOME. Nothing downstream can
+ *                                   catch it — the launch receipt is well-formed either way.
+ *   MUXRESUME-CWD-FORMAT-REFUSED    `-c` is FORMAT-EXPANDED. `<dir>/#{pane_id}` became `<dir>/%0`,
+ *                                   and a `#(…)` value was observed running its command.
+ *   MUXRESUME-CWD-WHITESPACE-OK     whitespace is SAFE (argv is an array) — so the refusal set
+ *                                   stays at two rules and no quoting/escaping layer is owed.
+ *   MUXRESUME-ARGV-HAS-CWD          the `-c` actually reaches tmux, after the append shape
+ *   MUXRESUME-ARGV-RUNTIME-AFTER-DASHDASH  the runtime and its flags are exec'd, never parsed as
+ *                                   tmux options or run through a shell
+ *   MUXRESUME-ARGV-CARRIER-FREE     nothing beyond append + `-c` + runtime + the caller's flags
+ *   MUXRESUME-NO-IDENTITY           this module never learns which citizen it is reopening
+ *   MUXRESUME-SURFACE-SEAM          both surfaces hand the launcher IN; neither lets the v2
+ *                                   composition import mux
+ */
+
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import type { Placement } from "../pi-extensions/lib/mux-placement.ts";
+import {
+	buildResumeCallArgs,
+	classifyResumeCwd,
+	RESUME_CALL_REJECT_HINT,
+	RESUME_CALL_RUNTIME,
+	type ResumeCallRejectReason,
+	resumeCall,
+} from "../pi-extensions/lib/mux-resume-call.ts";
+
+let passed = 0;
+function ok(label: string, cond: boolean): void {
+	assert.ok(cond, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const read = (rel: string): string => fs.readFileSync(path.join(ROOT, rel), "utf8");
+
+const PLACEMENT: Placement = {
+	serverPid: "4242",
+	sessionId: "$0",
+	windowId: "@1",
+	windowIndex: "1",
+	paneId: "%1",
+	panePid: "4243",
+};
+
+function main(): void {
+	const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "check-mux-resume-call-"));
+	const realDir = path.join(tmp, "project");
+	const spaceDir = path.join(tmp, "with space");
+	const filePath = path.join(tmp, "a-file");
+	fs.mkdirSync(realDir);
+	fs.mkdirSync(spaceDir);
+	fs.writeFileSync(filePath, "");
+	// `assertLaunchTarget` proves the runtime is real BEFORE argv is built, so the argv
+	// assertions need an executable that exists rather than a plausible-looking path.
+	const runtimeDir = path.join(tmp, "bin");
+	fs.mkdirSync(runtimeDir);
+	const RUNTIME = path.join(runtimeDir, "pi");
+	fs.writeFileSync(RUNTIME, "#!/bin/sh\nexit 0\n", { mode: 0o755 });
+
+	try {
+		// ── cwd classification ────────────────────────────────────────────────────────
+		ok("an existing absolute directory is accepted", classifyResumeCwd(realDir) === null);
+
+		ok(
+			"[QK:MUXRESUME-CWD-MISSING-REFUSED] a cwd that no longer exists is refused HERE, because tmux would not refuse it — measured: rc=0, the window opens, and the child silently falls back to $HOME, so the resume would land a visible citizen in the wrong project and look successful",
+			classifyResumeCwd(path.join(tmp, "deleted-project")) === "cwd-missing",
+		);
+		ok(
+			"a path that exists but is a FILE is refused as its own cause, not as missing",
+			classifyResumeCwd(filePath) === "cwd-not-directory",
+		);
+		ok(
+			"[QK:MUXRESUME-CWD-FORMAT-REFUSED] a cwd containing '#' is refused unrun — measured: tmux FORMAT-EXPANDS the -c value, so `<dir>/#{pane_id}` silently became `<dir>/%0` and a `#(…)` value was observed executing its command; a path is data and tmux reads it as a format",
+			classifyResumeCwd(path.join(tmp, "#{pane_id}")) === "cwd-format-token" &&
+				classifyResumeCwd(path.join(tmp, "#(touch x)")) === "cwd-format-token",
+		);
+		ok(
+			"the '#' refusal precedes the filesystem question, whose answer would be about a path tmux is not going to use",
+			classifyResumeCwd(path.join(realDir, "#nope")) === "cwd-format-token",
+		);
+		ok(
+			"a relative cwd is refused before anything touches the filesystem",
+			classifyResumeCwd("project") === "cwd-not-absolute",
+		);
+		ok(
+			"[QK:MUXRESUME-CWD-WHITESPACE-OK] a cwd containing whitespace is ACCEPTED — measured: argv is an array, tmux does not re-split it, and the directory arrived intact; inventing a quoting grammar here would refuse real project paths for a danger that was measured not to exist",
+			classifyResumeCwd(spaceDir) === null,
+		);
+
+		// ── argv shape ────────────────────────────────────────────────────────────────
+		const runtimeArgs = ["--entwurf-control", "--session", "/s.jsonl", "--model", "m"] as const;
+		const args = buildResumeCallArgs(PLACEMENT, realDir, RUNTIME, runtimeArgs);
+
+		ok(
+			"[QK:MUXRESUME-ARGV-HAS-CWD] the recorded cwd reaches tmux as `-c <dir>` — without it the window inherits the CALLER's directory and the citizen comes back in someone else's project",
+			args.includes("-c") && args[args.indexOf("-c") + 1] === realDir,
+		);
+		ok(
+			"the append shape is the leaf's: detached, appended at {end} of the caller's own session, printing the shared handle format",
+			args[0] === "new-window" &&
+				args.includes("-d") &&
+				args.includes("-a") &&
+				args[args.indexOf("-t") + 1] === "$0:{end}",
+		);
+		ok(
+			"[QK:MUXRESUME-ARGV-RUNTIME-AFTER-DASHDASH] the runtime is preceded by `--` and every caller flag follows it, so tmux execs pi directly instead of reading `--session` as a tmux option or running the line through a shell",
+			args[args.indexOf("--") + 1] === RUNTIME &&
+				args.slice(args.indexOf("--") + 2).join(" ") === runtimeArgs.join(" "),
+		);
+		// Scoped to the TMUX prefix, before `--`. Everything after that belongs to pi, and a real
+		// resume argv legitimately carries `-e <bridge>` there — asserting `-e` is absent from the
+		// whole line would be green only because this fixture has no extensions, and would go red
+		// on the recorded-ACP shape that actually ships.
+		const tmuxPrefix = args.slice(0, args.indexOf("--"));
+		ok(
+			"[QK:MUXRESUME-ARGV-CARRIER-FREE] the TMUX half of the argv is exactly the append shape plus -c — no -n window name, no -e env carrier, no -b; the runtime's own flags live after `--` and are not tmux's business",
+			!tmuxPrefix.includes("-n") && !tmuxPrefix.includes("-e") && !tmuxPrefix.includes("-b"),
+		);
+		ok(
+			"a cwd that classification refuses can never be built into argv either — the builder re-checks rather than trusting its caller",
+			(() => {
+				try {
+					buildResumeCallArgs(PLACEMENT, path.join(tmp, "#x"), RUNTIME, runtimeArgs);
+					return false;
+				} catch {
+					return true;
+				}
+			})(),
+		);
+		ok(
+			"a non-native session selector is refused before tmux is invoked",
+			(() => {
+				try {
+					buildResumeCallArgs({ ...PLACEMENT, sessionId: "entwurf; kill-server" }, realDir, RUNTIME, []);
+					return false;
+				} catch {
+					return true;
+				}
+			})(),
+		);
+
+		// ── refusals happen BEFORE any mutation ───────────────────────────────────────
+		// No tmux context at all: a bad cwd must still be the reason, because it is decided first
+		// and nothing may reach tmux while it is wrong.
+		const noTmux = resumeCall({ cwd: path.join(tmp, "gone"), runtimeArgs: [] }, {});
+		ok(
+			"an unusable cwd refuses even outside tmux — the cwd question is settled before placement, so no window can exist by the time it is answered",
+			!noTmux.ok && noTmux.reason === "cwd-missing",
+		);
+		const outsideTmux = resumeCall({ cwd: realDir, runtimeArgs: [] }, { PATH: "/nonexistent" });
+		ok(
+			"with a good cwd and no runtime on PATH, the refusal is the runtime — preconditions are proven before placement is even read",
+			!outsideTmux.ok && outsideTmux.reason === "runtime-unresolved",
+		);
+
+		// ── every reason is answerable ────────────────────────────────────────────────
+		const reasons: ResumeCallRejectReason[] = [
+			"no-tmux-context",
+			"anchor-malformed",
+			"anchor-unresolved",
+			"anchor-mismatch",
+			"cwd-not-absolute",
+			"cwd-format-token",
+			"cwd-missing",
+			"cwd-not-directory",
+			"runtime-unresolved",
+			"runtime-not-absolute",
+			"runtime-path-whitespace",
+			"runtime-missing",
+			"runtime-not-regular-file",
+			"runtime-not-executable",
+		];
+		ok(
+			"every reject reason has a hint a caller can act on — a reason without one is a reason they will guess about",
+			reasons.every((r) => typeof RESUME_CALL_REJECT_HINT[r] === "string" && RESUME_CALL_REJECT_HINT[r].length > 0),
+		);
+		ok("the fixed runtime is pi — only a control-socket backend has a same-id resume", RESUME_CALL_RUNTIME === "pi");
+
+		// ── boundaries, asserted on source ────────────────────────────────────────────
+		const SRC = read("pi-extensions/lib/mux-resume-call.ts");
+		ok(
+			"[QK:MUXRESUME-NO-IDENTITY] the module never mentions a garden id, a record, a lock or a transcript — it opens a place at a directory and knows nothing about whose citizen it is",
+			!/gardenId|readAddressableMetaIdentity|acquireLock|transcriptPath/.test(SRC),
+		);
+		ok(
+			"it imports only the mux lane — no entwurf core, no delivery",
+			!/from "\.\/entwurf-/.test(SRC) && !/meta-session/.test(SRC),
+		);
+		ok(
+			"it uses the SHARED APPEND_FORMAT rather than adding a start-path field: `-P -F` prints its row BEFORE the child chdirs (measured — pane_current_path there still reports the CALLER's cwd), so a path field would be both free-form in a `|`-joined row and racy",
+			SRC.includes("APPEND_FORMAT") && !SRC.includes("pane_start_path"),
+		);
+
+		const PI_SURFACE = read("pi-extensions/entwurf-control.ts");
+		const MCP_SURFACE = read("mcp/entwurf-bridge/src/index.ts");
+		const V2_RESUME = read("pi-extensions/lib/entwurf-v2-visible-resume.ts");
+		// IMPORTS, not mentions: the module header names the mux side deliberately (that is the
+		// architecture being documented), so an assertion on prose would forbid the explanation
+		// rather than the dependency.
+		const v2ImportSpecifiers = [...V2_RESUME.matchAll(/from\s+"([^"]+)"/g)].map((m) => m[1]);
+		ok(
+			"[QK:MUXRESUME-SURFACE-SEAM] the v2 composition never IMPORTS mux — the launcher is passed IN, which is what keeps docs/mux-launch-rail.md §11 true in both directions",
+			v2ImportSpecifiers.length > 0 && !v2ImportSpecifiers.some((s) => /mux-/.test(s)),
+		);
+		ok(
+			"both surfaces are the composition root: each imports the mux launcher AND the v2 composition and joins them itself",
+			/mux-resume-call/.test(PI_SURFACE) &&
+				/entwurf-v2-visible-resume/.test(PI_SURFACE) &&
+				/mux-resume-call/.test(MCP_SURFACE) &&
+				/entwurf-v2-visible-resume/.test(MCP_SURFACE),
+		);
+
+		// ── the NATIVE PI registration, judged as a registration ─────────────────────
+		// The MCP half is judged on the real runtime tools/list by check-entwurf-bridge-boot.
+		// Native pi has no equivalent boot oracle here, so its registration is read from source —
+		// but narrowly, on the block itself, because "the module is imported" would stay true with
+		// the tool deleted.
+		const PI_BLOCK = (PI_SURFACE.split('name: "entwurf_resume_call",')[1] ?? "").split("\n}")[0];
+		ok(
+			"[QK:MUXRESUME-PI-SURFACE-REGISTERED] the native pi surface REGISTERS entwurf_resume_call and calls that registration during setup — an imported-but-unregistered verb is invisible to the operator while every import assertion stays green",
+			PI_SURFACE.includes('name: "entwurf_resume_call"') && /registerResumeCallTool\(pi\);/.test(PI_SURFACE),
+		);
+		ok(
+			"[QK:MUXRESUME-PI-SURFACE-TARGET-ONLY] the native schema is target-only and the handler passes params.target straight through — a model, task or prompt knob would be a second way to decide what a resumed citizen is, when the record already decided",
+			/Type\.Object\(\{\s*target: Type\.String\(/.test(PI_BLOCK) &&
+				/visibleResume\(params\.target,/.test(PI_BLOCK) &&
+				!/model|task|prompt/.test(PI_BLOCK.split("parameters:")[1]?.split("async execute")[0] ?? ""),
+		);
+
+		// ── the description contract, both surfaces ──────────────────────────────────
+		// Not prose parity — three claims an operator acts on, plus the host's own cap.
+		const PI_DESC = (PI_BLOCK.split("description: `")[1] ?? "").split("`,")[0];
+		const MCP_DESC = (MCP_SURFACE.split('"entwurf_resume_call",')[1] ?? "").split("{")[0];
+		const statesTheContract = (text: string): boolean =>
+			/dormant/i.test(text) && /no turn/i.test(text) && /observation/i.test(text) && /launch/i.test(text);
+
+		for (const [which, text] of [
+			["native pi", PI_DESC],
+			["MCP bridge", MCP_DESC],
+		] as const) {
+			ok(
+				`${which}: the resume description fits the host's 2048-char tool-description cap`,
+				text.length > 0 && text.length <= 2048,
+			);
+		}
+		// The two claim tokens are written OUT, not interpolated: qualification requires each
+		// `[QK:…]` to appear literally exactly once in its gate source, so a token assembled at
+		// runtime names a claim no manifest can bind to.
+		ok(
+			"[QK:MUXRESUME-DESC-CONTRACT-PI] native pi: the description states the three things a caller acts on — DORMANT targets only, no turn is run, and TWO receipts of which the observation is the one that says the citizen is back",
+			statesTheContract(PI_DESC),
+		);
+		ok(
+			"[QK:MUXRESUME-DESC-CONTRACT-MCP] MCP bridge: the description states the same three things — DORMANT targets only, no turn is run, and TWO receipts whose observation is the fact that matters",
+			statesTheContract(MCP_DESC),
+		);
+	} finally {
+		fs.rmSync(tmp, { recursive: true, force: true });
+	}
+
+	console.log(`\ncheck-mux-resume-call: ${passed} checks passed`);
+}
+
+main();

package/scripts/check-probe-cli-shim.ts

@@ -30,8 +30,11 @@
 // the native branch: no shell, piped stdio, inherited cwd), because half of what
 // this gate proves is process semantics that a unit call cannot reach.
 //
-// Kill-proof: scripts/mutants/probe-ordering.json carries one exact-once mutant
-// per [QK:...] signature below. THREE properties are SOURCE-pinned rather than
+// Kill-proof, current contract: this gate's claims are DIRECT [CHECK:<claim>]
+// assertions — enforced on every run, deliberately no longer replant-qualified
+// (issue #70 verification subtraction; the probe-ordering lane's one retained
+// [QK:] mutant is the product-subject prompt-cutoff claim consumed by
+// check-probe-ordering). THREE properties are SOURCE-pinned rather than
 // behaviour-pinned, and §12 states the measurement that sent each one there —
 // this is the same carve-out §11-7-c already records for the fixture's and the
 // shim's write-callback timing, not a softer bar invented here. The two callback
@@ -378,7 +381,7 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 			(statSync(SHIM_LAUNCHER).mode & 0o111) !== 0 &&
 			LAUNCHER_SRC.startsWith("#!/usr/bin/env node\n"),
 		"the shim launcher is extensionless, executable, and shebang-led — a script suffix would move it onto the SDK's " +
-			"`node|bun <path>` branch, which is NOT the branch the probe's target asserts [QK:SHIM-NATIVE-BRANCH-LAUNCHER]",
+			"`node|bun <path>` branch, which is NOT the branch the probe's target asserts [CHECK:SHIM-NATIVE-BRANCH-LAUNCHER]",
 	);
 	// The launcher must stay a launcher: behaviour belongs in the .ts SSOT, which
 	// is the only half tsc/biome/mutants can reach.
@@ -437,7 +440,7 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 		sha256(multiByte),
 		"a chunk boundary INSIDE a multi-byte UTF-8 sequence, delivered as two separate reads, still crosses the shim " +
 			"byte-for-byte — the scanner frames on bytes and only complete lines are ever decoded " +
-			"[QK:SHIM-BYTE-TRANSPARENCY]",
+			"[CHECK:SHIM-BYTE-TRANSPARENCY]",
 	);
 
 	// Bulk framing, on top: CRLF pairs, a 300 KB line, and a final line with no
@@ -470,7 +473,7 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 		forwarded.length === 1 && forwarded[0].ordinal === 1,
 		"the control-request frame is NOT a prompt: the SDK writes initialize control traffic on the same stdin, so " +
 			'counting lines would blow the exactly-one binding on every run — only `type:"user"` frames take an ' +
-			"ordinal [QK:SHIM-PROMPT-ORDINAL-USER-FRAMES-ONLY]",
+			"ordinal [CHECK:SHIM-PROMPT-ORDINAL-USER-FRAMES-ONLY]",
 	);
 
 	// The boot init was RECEIVED before the prompt frame was forwarded, so it is a
@@ -502,7 +505,7 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 		0,
 		"an init line with no `tools`, a non-array `tools`, or a `tools` holding a non-string yields NO snapshot: " +
 			"reporting it as an EMPTY name set would FABRICATE the absence reading the B-name-snapshot ladder promotes " +
-			"[QK:SHIM-INIT-REQUIRES-STRING-TOOL-ARRAY]",
+			"[CHECK:SHIM-INIT-REQUIRES-STRING-TOOL-ARRAY]",
 	);
 }
 
@@ -516,7 +519,7 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 		boots.length === 1 && boots[0].targetPath === STREAM_CLI && boots[0].targetSha256 === hashFileSha256(STREAM_CLI),
 		"the shim boots exactly once and reports the REAL path + content hash of what it exec'd — condition 5 has the " +
 			"classifier verify this against the roster's expected identity, so a fabricated or omitted hash would let a " +
-			"swapped binary vote in the pair [QK:SHIM-BOOT-TARGET-IDENTITY]",
+			"swapped binary vote in the pair [CHECK:SHIM-BOOT-TARGET-IDENTITY]",
 	);
 	assert.ok(
 		boots[0].seq < named(run, PROBE_EVENTS.shimInitSnapshot)[0].seq,
@@ -568,7 +571,7 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 		expectedChildEnv,
 		"the child's env is the launch env MINUS exactly the allowlist and nothing else — every remaining key and value " +
 			"byte-identical. A prefix scrub would eat the PROBE_-shaped operator variable this probe has no claim on, and " +
-			"an incidental deletion anywhere else would move this too [QK:SHIM-SCRUB-EXACT-ALLOWLIST]",
+			"an incidental deletion anywhere else would move this too [CHECK:SHIM-SCRUB-EXACT-ALLOWLIST]",
 	);
 
 	// The `claude auth logout` consumer: not a stream-json turn, so the only line
@@ -576,7 +579,7 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 	assert.ok(
 		run.events.length === 1 && run.events[0].event === PROBE_EVENTS.shimBoot,
 		"an invocation that is not a stream-json turn is PURE passthrough — `claudeCliPath()` has a second consumer " +
-			"(claude auth logout), and the shim must assume nothing about its argv [QK:SHIM-ARGV-AGNOSTIC-PASSTHROUGH]",
+			"(claude auth logout), and the shim must assume nothing about its argv [CHECK:SHIM-ARGV-AGNOSTIC-PASSTHROUGH]",
 	);
 }
 
@@ -600,7 +603,7 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 			!logText.includes("SECRET-PROMPT-TEXT") &&
 			!logText.includes("ENTWURF_SHIM_SECRET"),
 		"the shared log carries no argv, no env name or value, and no prompt body — only the allowlisted init fields, " +
-			"an ordinal, and timings [QK:SHIM-LOG-PRIVACY]",
+			"an ordinal, and timings [CHECK:SHIM-LOG-PRIVACY]",
 	);
 }
 
@@ -612,21 +615,21 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 	assert.ok(
 		nonzero.code === 42 && nonzero.signal === null,
 		"a nonzero CLI exit reaches the parent as the SAME code — a wrapper that reports 0 turns a crash into a " +
-			"measurement [QK:SHIM-EXIT-CODE-FIDELITY]",
+			"measurement [CHECK:SHIM-EXIT-CODE-FIDELITY]",
 	);
 
 	const signalled = await runShim({ target: SELF_SIGNAL_CLI, argv: ["SIGKILL"] });
 	assert.ok(
 		signalled.signal === "SIGKILL" && signalled.code === null,
 		"a CLI that dies on a signal makes the SHIM die on that same signal: the parent's wait status must carry the " +
-			"child's real disposition, not a synthesised 128+n exit code [QK:SHIM-SIGNAL-RERAISE]",
+			"child's real disposition, not a synthesised 128+n exit code [CHECK:SHIM-SIGNAL-RERAISE]",
 	);
 
 	const inbound = await runShim({ target: SLEEPER_CLI, signalShim: "SIGTERM" });
 	assert.ok(
 		inbound.signal === "SIGTERM",
 		"a signal sent to the shim is forwarded to the child, whose death then re-raises it here — otherwise the ACP " +
-			"child's teardown would leave the real CLI orphaned [QK:SHIM-INBOUND-SIGNAL-FORWARDED]",
+			"child's teardown would leave the real CLI orphaned [CHECK:SHIM-INBOUND-SIGNAL-FORWARDED]",
 	);
 
 	const stderrRun = await runShim({ target: STDERR_CLI });
@@ -649,7 +652,7 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 			missing.stderr.includes("[probe-cli-shim] cannot read exec target"),
 		"a target that vanished under the pair fails loud with the shell convention for not-found — the runner asserted " +
 			"it was present, so reaching this is a fact the operator needs in words, on ONE errno mapping shared by the " +
-			"unreadable-at-hash and unspawnable-at-exec paths [QK:SHIM-SPAWN-ERROR-NAMED]",
+			"unreadable-at-hash and unspawnable-at-exec paths [CHECK:SHIM-SPAWN-ERROR-NAMED]",
 	);
 	assert.equal(
 		named(missing, PROBE_EVENTS.shimBoot).length,
@@ -695,7 +698,7 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 		"a line past the framing bound loses its PARSE, never its BYTES: the oversized line is forwarded verbatim, the " +
 			"scanner recovers at the next newline so the following init still binds, and the skip is recorded in a " +
 			"forensic sidecar rather than as an unknown marker the log door would call MALFORMED " +
-			"[QK:SHIM-OVERSIZED-LINE-PARSE-SKIP]",
+			"[CHECK:SHIM-OVERSIZED-LINE-PARSE-SKIP]",
 	);
 	const diag = JSON.parse(readFileSync(run.diagPath, "utf8").trim()) as Record<string, unknown>;
 	assert.ok(
@@ -733,7 +736,7 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 		`framing a ${lineBytes / 1024} KiB line out of ${lineBytes} single-byte reads cost ` +
 			`${counted.retainedAllocations} allocations — the bound is a bound on OBJECTS as well as bytes, or a hostile ` +
 			"stream reaches the byte cap holding millions of buffer headers and the 'bounded in-memory line buffer' " +
-			"claim is false exactly where it matters [QK:SHIM-FRAMING-BOUNDED-IN-OBJECTS]",
+			"claim is false exactly where it matters [CHECK:SHIM-FRAMING-BOUNDED-IN-OBJECTS]",
 	);
 }
 
@@ -789,7 +792,7 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 			"tearing down on the error ends it in ~0.2 s, while merely IGNORING the error parks the source on a drain " +
 			"that can never arrive and it survives until something kills it — with the real CLI still alive behind it. " +
 			"Promptness is the discriminator; the exit disposition is not, because the ignore path can also die of its " +
-			"own unhandled error [QK:SHIM-DOWNSTREAM-DEATH-TEARS-DOWN]",
+			"own unhandled error [CHECK:SHIM-DOWNSTREAM-DEATH-TEARS-DOWN]",
 	);
 }
 
@@ -810,7 +813,7 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 		diag !== undefined && diag.stdoutLineParseSkipped === 1,
 		"a line that blew the framing bound and then hit EOF WITHOUT a newline is still counted: the scanner finalises at " +
 			"stream end, so the skip diagnostic cannot silently under-report the one shape that never meets a newline " +
-			"[QK:SHIM-OVERSIZE-COUNTED-AT-EOF]",
+			"[CHECK:SHIM-OVERSIZE-COUNTED-AT-EOF]",
 	);
 }
 
@@ -834,7 +837,7 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 		),
 		"under write backpressure on STDOUT the shim stops READING the CLI rather than letting the writable queue grow — " +
 			"peak memory is then set by the pipe buffers, not by the transcript size, which is what keeps an instrument " +
-			"on a live turn from becoming a memory hazard [QK:SHIM-STDOUT-BACKPRESSURE-PAUSES-SOURCE]",
+			"on a live turn from becoming a memory hazard [CHECK:SHIM-STDOUT-BACKPRESSURE-PAUSES-SOURCE]",
 	);
 	assert.ok(
 		SHIM_SRC.includes(
@@ -845,7 +848,7 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 		),
 		"the SAME discipline holds on the stdin side: a CLI slow to read its input must park the SDK's stream, not be " +
 			"absorbed into this process's memory. 11b proves the bytes and the EOF survive it; which side does the " +
-			"parking is what is pinned here [QK:SHIM-STDIN-BACKPRESSURE-PAUSES-SOURCE]",
+			"parking is what is pinned here [CHECK:SHIM-STDIN-BACKPRESSURE-PAUSES-SOURCE]",
 	);
 	assert.ok(
 		SHIM_SRC.includes(
@@ -857,7 +860,7 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 		"the snapshot append lives INSIDE the downstream write callback, so the one clock read that stamps the event IS " +
 			"the hand-off moment — the interval's single-SSOT end (§11-7-c condition 6). Timing cannot separate this " +
 			"placement from one just outside the callback, because the shim pauses its source under backpressure and " +
-			"couples the read to the write, so the shape is pinned here [QK:SHIM-SNAPSHOT-IN-WRITE-CALLBACK]",
+			"couples the read to the write, so the shape is pinned here [CHECK:SHIM-SNAPSHOT-IN-WRITE-CALLBACK]",
 	);
 	assert.ok(
 		SHIM_SRC.includes(
@@ -868,7 +871,7 @@ const CONTROL_FRAME = ndjson({ type: "control_request", request_id: "r1", reques
 		),
 		"the prompt anchor is stamped inside the CHILD-STDIN write callback — 'fully passed to the CLI's stdin', not " +
 			"'we saw a newline'; and an errored write never stamps a hand-off that did not happen " +
-			"[QK:SHIM-PROMPT-IN-WRITE-CALLBACK]",
+			"[CHECK:SHIM-PROMPT-IN-WRITE-CALLBACK]",
 	);
 	assert.ok(
 		SHIM_SRC.includes('stdio: ["pipe", "pipe", "inherit"],') && !/\bshell\s*:/.test(SHIM_SRC),