@junghanacs/entwurf 0.13.0 → 0.14.0

package/scripts/lib/claude-launcher-fence.ts

@@ -0,0 +1,322 @@
+/**
+ * claude-launcher-fence — the shared fail-closed protection for the operator's real `claude`
+ * launcher, owed by BOTH mux LIVE smokes (issue #67).
+ *
+ * The observed incident: a Claude child launched with the operator's real HOME but a fixture
+ * `XDG_DATA_HOME` self-updated INTO the fixture tree and rewrote the real launcher (the
+ * `~/.local/bin/claude` install shim) to point at `<fixture>/claude/versions/<v>`. Fixture
+ * teardown then deleted that tree and left the operator's launcher dangling. This module owns
+ * the three protections the smokes share, so neither carries its own copy:
+ *
+ *   1. PREFLIGHT (`snapshotClaudeLauncher`) — fail-closed. Before any Claude-capable child
+ *      starts, resolve the actual absolute launcher from the exact child PATH, require it and
+ *      its symlink/realpath-resolved target to be present, regular, executable and OUTSIDE the
+ *      fixture cleanup root, and capture enough identity/content evidence (kind, link text,
+ *      resolved path, content hash) to prove "unchanged" later. Any doubt throws — a smoke that
+ *      cannot pin the launcher's identity must not launch the child that could destroy it.
+ *   2. INTEGRITY ORACLE (`verifyClaudeLauncher`) — on success AND on every failure teardown,
+ *      before fixture removal, re-derive the same facts and report every mismatch by name.
+ *   3. CLEANUP GUARD (`launcherReferencesFixture`) — the one question that decides whether
+ *      `rm -rf <fixture>` is destructive: does the launcher, or what it currently resolves to,
+ *      live inside the fixture root? If yes, the smoke must BLOCK its own cleanup loudly and
+ *      leave the tree in place rather than dangle the operator's launcher.
+ *
+ * It also owns the env repair that removes the incident's trigger: `restoreOriginalXdg` gives a
+ * real-HOME Claude cell EXACT operator-env parity on the four XDG roots — each variable restored
+ * to its original value if it was set, and DELETED if it was originally absent. Filling a
+ * canonical default for an absent variable would be a guess about how the runtime reads its
+ * config; parity, not widening, is the contract. That parity covers the four PERSISTENT
+ * CONFIG/DATA/STATE/CACHE roots only: `XDG_RUNTIME_DIR` deliberately remains the smokes' private
+ * fixture runtime surface, so this is not a claim of total operator-env parity.
+ *
+ * This is a scripts-side harness module. It never inspects or alters anything unless the caller
+ * hands it an environment and a fixture root, and it must stay out of shipped production source.
+ */
+
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+
+/** The four XDG roots a real-HOME Claude cell must see with exact operator parity. */
+export const CLAUDE_CELL_XDG_VARS = ["XDG_CONFIG_HOME", "XDG_DATA_HOME", "XDG_STATE_HOME", "XDG_CACHE_HOME"] as const;
+
+/** Original presence/value of each XDG root: a string if it was set (even empty), null if absent. */
+export type OriginalXdg = Record<string, string | null>;
+
+/** Capture the four XDG roots BEFORE any fixture redirect touches the environment. */
+export function snapshotOriginalXdg(env: NodeJS.ProcessEnv): OriginalXdg {
+	const out: OriginalXdg = {};
+	for (const name of CLAUDE_CELL_XDG_VARS) out[name] = env[name] ?? null;
+	return out;
+}
+
+/**
+ * Restore EXACT original presence/value of the four XDG roots on a cell env. An originally
+ * absent variable is deleted, never filled with a canonical default — parity, not a guess.
+ */
+export function restoreOriginalXdg(env: NodeJS.ProcessEnv, originals: OriginalXdg): NodeJS.ProcessEnv {
+	for (const name of CLAUDE_CELL_XDG_VARS) {
+		const original = originals[name];
+		if (original === null || original === undefined) delete env[name];
+		else env[name] = original;
+	}
+	return env;
+}
+
+/** Everything the preflight pinned, and the oracle later re-derives. */
+export interface ClaudeLauncherSnapshot {
+	/** Absolute launcher path selected from the exact child PATH. */
+	launcherPath: string;
+	/** What the launcher IS at its own path: a symlink or a regular file. */
+	kind: "symlink" | "file";
+	/** Raw readlink text when the launcher is a symlink, else null. */
+	linkText: string | null;
+	/** Fully realpath-resolved target the launcher executes. */
+	resolvedPath: string;
+	/** sha256 of the resolved target's content — the one axis that catches a same-path, same-link in-place rewrite. */
+	sha256: string;
+	/** Realpath of the fixture cleanup root the launcher must stay outside of. */
+	fixtureRoot: string;
+}
+
+function isInside(parent: string, p: string): boolean {
+	const rel = path.relative(parent, p);
+	return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+
+function sha256File(file: string): string {
+	return createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+}
+
+function isExecutableFile(p: string): boolean {
+	try {
+		if (!fs.statSync(p).isFile()) return false;
+		fs.accessSync(p, fs.constants.X_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+/**
+ * Resolve `cmd` the way the child's exec will: first PATH entry holding an executable file.
+ * Returns the joined candidate path (not yet symlink-resolved), or null when nothing matches.
+ */
+export function resolveFromPath(cmd: string, env: NodeJS.ProcessEnv): string | null {
+	for (const dir of (env.PATH ?? "").split(path.delimiter)) {
+		if (!dir) continue;
+		const candidate = path.join(dir, cmd);
+		if (isExecutableFile(candidate)) return candidate;
+	}
+	return null;
+}
+
+/**
+ * FAIL-CLOSED PREFLIGHT. Pin the launcher's identity before any Claude-capable child starts,
+ * or throw. Every refusal names itself: a smoke that cannot prove the launcher is a real,
+ * executable, fixture-independent file must not launch the child that could rewrite it.
+ */
+export function snapshotClaudeLauncher(opts: { env: NodeJS.ProcessEnv; fixtureRoot: string }): ClaudeLauncherSnapshot {
+	const fixtureRoot = fs.realpathSync(opts.fixtureRoot);
+	const launcherPath = resolveFromPath("claude", opts.env);
+	if (!launcherPath) {
+		throw new Error(
+			"claude-launcher-fence: fail-closed — no executable `claude` on the exact child PATH, so the launcher's identity cannot be pinned before launch",
+		);
+	}
+	if (!path.isAbsolute(launcherPath)) {
+		throw new Error(
+			`claude-launcher-fence: fail-closed — \`claude\` resolved through a relative PATH entry (${launcherPath}); a cwd-dependent launcher cannot be pinned`,
+		);
+	}
+	if (isInside(fixtureRoot, launcherPath)) {
+		throw new Error(
+			`claude-launcher-fence: fail-closed — the selected launcher ${launcherPath} is INSIDE the fixture cleanup root ${fixtureRoot}`,
+		);
+	}
+	const lst = fs.lstatSync(launcherPath);
+	const kind: ClaudeLauncherSnapshot["kind"] = lst.isSymbolicLink() ? "symlink" : "file";
+	if (kind === "file" && !lst.isFile()) {
+		throw new Error(
+			`claude-launcher-fence: fail-closed — the launcher ${launcherPath} is neither a regular file nor a symlink`,
+		);
+	}
+	const linkText = kind === "symlink" ? fs.readlinkSync(launcherPath) : null;
+	let resolvedPath: string;
+	try {
+		resolvedPath = fs.realpathSync(launcherPath);
+	} catch (err) {
+		throw new Error(
+			`claude-launcher-fence: fail-closed — the launcher ${launcherPath} does not resolve to a real target: ${
+				err instanceof Error ? err.message : String(err)
+			}`,
+		);
+	}
+	if (!isExecutableFile(resolvedPath)) {
+		throw new Error(
+			`claude-launcher-fence: fail-closed — the launcher's resolved target ${resolvedPath} is not a regular executable file`,
+		);
+	}
+	if (isInside(fixtureRoot, resolvedPath)) {
+		throw new Error(
+			`claude-launcher-fence: fail-closed — the launcher's resolved target ${resolvedPath} is INSIDE the fixture cleanup root ${fixtureRoot}`,
+		);
+	}
+	return {
+		launcherPath,
+		kind,
+		linkText,
+		resolvedPath,
+		sha256: sha256File(resolvedPath),
+		fixtureRoot,
+	};
+}
+
+/**
+ * INTEGRITY ORACLE. Re-derive every pinned fact and return one problem string per mismatch —
+ * empty means the launcher, its link, its resolved target and that target's content are all
+ * exactly as the preflight saw them, and the target is still a regular executable. Runs on the
+ * success path AND on every failure teardown, BEFORE fixture removal.
+ */
+export function verifyClaudeLauncher(snapshot: ClaudeLauncherSnapshot): string[] {
+	const problems: string[] = [];
+	let lst: fs.Stats;
+	try {
+		lst = fs.lstatSync(snapshot.launcherPath);
+	} catch {
+		problems.push(`the launcher ${snapshot.launcherPath} no longer exists`);
+		return problems;
+	}
+	const kindNow: ClaudeLauncherSnapshot["kind"] = lst.isSymbolicLink() ? "symlink" : "file";
+	if (kindNow !== snapshot.kind) {
+		problems.push(`the launcher changed kind: was ${snapshot.kind}, is now ${kindNow}`);
+	}
+	if (kindNow === "symlink") {
+		// A raced-away link is an INTEGRITY PROBLEM, never an exception that could mask the run
+		// error this oracle runs alongside.
+		let linkNow: string | null = null;
+		try {
+			linkNow = fs.readlinkSync(snapshot.launcherPath);
+		} catch (err) {
+			problems.push(
+				`the launcher's link text could not be re-read: ${err instanceof Error ? err.message : String(err)}`,
+			);
+		}
+		if (linkNow !== null && linkNow !== snapshot.linkText) {
+			problems.push(`the launcher's link text changed: was ${snapshot.linkText ?? "(none)"}, is now ${linkNow}`);
+		}
+	}
+	let resolvedNow: string | null = null;
+	try {
+		resolvedNow = fs.realpathSync(snapshot.launcherPath);
+	} catch {
+		problems.push(`the launcher ${snapshot.launcherPath} no longer resolves to a real target`);
+	}
+	if (resolvedNow !== null) {
+		if (resolvedNow !== snapshot.resolvedPath) {
+			problems.push(`the launcher's resolved target moved: was ${snapshot.resolvedPath}, is now ${resolvedNow}`);
+		}
+		if (!isExecutableFile(resolvedNow)) {
+			problems.push(`the launcher's resolved target ${resolvedNow} is no longer a regular executable file`);
+		} else {
+			try {
+				if (sha256File(resolvedNow) !== snapshot.sha256) {
+					problems.push(`the launcher's resolved target ${resolvedNow} changed content (sha256 mismatch)`);
+				}
+			} catch (err) {
+				problems.push(
+					`the launcher's resolved target ${resolvedNow} could not be hashed: ${err instanceof Error ? err.message : String(err)}`,
+				);
+			}
+		}
+		if (isInside(snapshot.fixtureRoot, resolvedNow)) {
+			problems.push(
+				`the launcher's resolved target ${resolvedNow} now lies INSIDE the fixture cleanup root ${snapshot.fixtureRoot}`,
+			);
+		}
+	}
+	return problems;
+}
+
+/** What the cleanup guard could prove, stated honestly: a KNOWN fixture reference and an
+ * UNPROVABLE state both block removal, but each is named as itself in `problems`. */
+export interface LauncherCleanupVerdict {
+	/** True only when removal is PROVEN safe: the launcher demonstrably does not reference the fixture. */
+	safeToRemove: boolean;
+	/** Named reasons removal is blocked — a fixture reference, or a syscall that left safety unproven. */
+	problems: string[];
+}
+
+/**
+ * CLEANUP GUARD. Decides whether `rm -rf <fixture>` is destructive: does the launcher, its
+ * current link target, or its current resolved path lie inside the fixture cleanup root — the
+ * exact state in which removal would dangle the operator's launcher? FAIL-CLOSED on uncertainty:
+ * a readlink/lstat/realpath error blocks removal with a "not proven safe" problem rather than
+ * being laundered into either a false "references fixture" or a false all-clear. A launcher that
+ * is missing ENTIRELY is safe to clean around — nothing is left for removal to sever, and the
+ * integrity oracle reports that damage by name.
+ */
+export function assessLauncherCleanup(snapshot: ClaudeLauncherSnapshot): LauncherCleanupVerdict {
+	if (isInside(snapshot.fixtureRoot, snapshot.launcherPath)) {
+		return {
+			safeToRemove: false,
+			problems: [`the launcher ${snapshot.launcherPath} itself lies inside the fixture cleanup root`],
+		};
+	}
+	let lst: fs.Stats;
+	try {
+		lst = fs.lstatSync(snapshot.launcherPath);
+	} catch (err) {
+		if ((err as NodeJS.ErrnoException).code === "ENOENT") return { safeToRemove: true, problems: [] };
+		return {
+			safeToRemove: false,
+			problems: [
+				`the launcher ${snapshot.launcherPath} could not be inspected (${
+					err instanceof Error ? err.message : String(err)
+				}) — removal is not proven safe`,
+			],
+		};
+	}
+	if (lst.isSymbolicLink()) {
+		let hop: string;
+		try {
+			hop = path.resolve(path.dirname(snapshot.launcherPath), fs.readlinkSync(snapshot.launcherPath));
+		} catch (err) {
+			return {
+				safeToRemove: false,
+				problems: [
+					`the launcher's link text could not be read (${
+						err instanceof Error ? err.message : String(err)
+					}) — removal is not proven safe`,
+				],
+			};
+		}
+		if (isInside(snapshot.fixtureRoot, hop)) {
+			return {
+				safeToRemove: false,
+				problems: [`the launcher's link target ${hop} lies inside the fixture cleanup root`],
+			};
+		}
+	}
+	try {
+		const resolved = fs.realpathSync(snapshot.launcherPath);
+		if (isInside(snapshot.fixtureRoot, resolved)) {
+			return {
+				safeToRemove: false,
+				problems: [`the launcher's resolved target ${resolved} lies inside the fixture cleanup root`],
+			};
+		}
+	} catch (err) {
+		// A dangling or unresolvable chain: the first hop above was proven outside the fixture, but
+		// the FULL chain was not — fail closed rather than guess.
+		return {
+			safeToRemove: false,
+			problems: [
+				`the launcher ${snapshot.launcherPath} could not be fully resolved (${
+					err instanceof Error ? err.message : String(err)
+				}) — removal is not proven safe`,
+			],
+		};
+	}
+	return { safeToRemove: true, problems: [] };
+}

package/scripts/lib/live-skip.ts

@@ -0,0 +1,33 @@
+// The TypeScript half of the release-gate STEP OUTCOME protocol
+// (scripts/lib/step-outcome.sh owns the contract prose and the shell half).
+//
+// A LIVE smoke that lacks a prerequisite must be DISTINGUISHABLE from one that
+// ran and passed. Before P1 every smoke exited 0 on a skip, so `run_live_step`
+// counted it PASS and the release summary could not prove a required call had
+// happened at all. `skipLive` is the single exit any smoke takes when it
+// declines: one reserved code the aggregate classifies as SKIP, plus one marker
+// line so an operator reading the log sees WHICH prerequisite was missing
+// without decoding a number.
+//
+// The two halves must agree. `check-release-gate-outcomes` reads this constant
+// and the shell one and refuses a mismatch — a protocol that drifted between
+// languages would silently reclassify every skip as a failure (or worse).
+
+/** SKIP. Must equal `ENTWURF_STEP_SKIP_EXIT` in scripts/lib/step-outcome.sh. */
+export const LIVE_SKIP_EXIT = 97;
+
+/** The machine-greppable prefix every skip line carries. */
+export const LIVE_SKIP_MARKER = "[entwurf:skip]";
+
+/**
+ * Decline this smoke: print the marker + reason on stderr and exit with the
+ * protocol's SKIP code. Never returns.
+ *
+ * `label` is the smoke's own name (so a multi-step aggregate log stays
+ * attributable); `reason` states the missing prerequisite AND how to supply it —
+ * an operator who hits a SKIP in a cut run needs the fix, not the diagnosis.
+ */
+export function skipLive(label: string, reason: string): never {
+	console.error(`${LIVE_SKIP_MARKER} ${label} — ${reason}`);
+	process.exit(LIVE_SKIP_EXIT);
+}

package/scripts/lib/mutation-qualify.ts

@@ -78,6 +78,70 @@ export function signatureOnFailureLine(output: string, token: string): boolean {
 	return output.split("\n").some((line) => line.includes(token) && !/^\s*ok\b/.test(line));
 }
 
+/** run_vitest prints this line when the runner asked it for a structured report.
+ * Its PRESENCE — not the report's readability — is what declares the lane structured. */
+export const VITEST_STRUCTURED_MARKER = "__ENTWURF_VITEST_JSON__";
+
+/**
+ * What a gate run said about WHICH tests failed.
+ *
+ * - `"legacy"`: no structured marker — a hand-built node:assert/shell gate whose
+ *   `ok`-line oracle is unchanged.
+ * - `"unreadable"`: the marker was printed but the report is missing or malformed.
+ *   This NEVER falls back to token scanning: a structured lane that lost its report
+ *   has no attribution at all, so the mutant is WRONG-REASON, not KILLED.
+ * - a title array: the exact `fullName` of every FAILED test.
+ */
+export type FailedTestTitles = "legacy" | "unreadable" | string[];
+
+/** Read the failed-test titles a vitest gate wrote, if it declared itself structured. */
+export function readVitestFailedTitles(output: string, reportPath: string | null): FailedTestTitles {
+	if (!output.split("\n").some((line) => line.trim() === VITEST_STRUCTURED_MARKER)) return "legacy";
+	if (!reportPath) return "unreadable";
+	let raw: string;
+	try {
+		raw = fs.readFileSync(reportPath, "utf8");
+	} catch {
+		return "unreadable";
+	}
+	let report: {
+		testResults?: Array<{ assertionResults?: Array<{ status?: string; fullName?: string; title?: string }> }>;
+	};
+	try {
+		report = JSON.parse(raw);
+	} catch {
+		return "unreadable";
+	}
+	if (!Array.isArray(report.testResults)) return "unreadable";
+	const titles: string[] = [];
+	for (const suite of report.testResults) {
+		for (const assertion of suite.assertionResults ?? []) {
+			if (assertion.status !== "failed") continue;
+			titles.push(assertion.fullName ?? assertion.title ?? "");
+		}
+	}
+	return titles;
+}
+
+/**
+ * Attribute a kill to its claim. A Vitest failure's CODE FRAME quotes the source lines
+ * around the assertion — including an adjacent PASSING test's `it("[QK:…]" …)` title —
+ * so scanning output lines would certify a claim whose test never failed (measured:
+ * issue #62 review). Structured lanes therefore read only the failed-test title set.
+ */
+export function signatureAttributedToFailure(output: string, token: string, failed: FailedTestTitles): boolean {
+	if (failed === "legacy") return signatureOnFailureLine(output, token);
+	if (failed === "unreadable") return false;
+	return failed.some((title) => title.includes(token));
+}
+
+/** One legible word for the report line, so a WRONG-REASON says WHY it could not attribute. */
+export function describeAttribution(failed: FailedTestTitles): string {
+	if (failed === "legacy") return "failure-line";
+	if (failed === "unreadable") return "vitest-structured-but-unreadable";
+	return `vitest-failed-titles(${failed.length})`;
+}
+
 // ── manifest schema (fail-loud, exact keys) ─────────────────────────────────
 
 export interface MutantSpec {
@@ -430,6 +494,8 @@ export interface GateRunResult {
 	timedOut: boolean;
 	output: string;
 	seconds: number;
+	/** Structured failed-test attribution; `"legacy"` for every non-vitest gate. */
+	failedTitles: FailedTestTitles;
 }
 
 const OUTPUT_CAP = 4 * 1024 * 1024;
@@ -437,12 +503,23 @@ const OUTPUT_CAP = 4 * 1024 * 1024;
 /** Env prefixes the outer fence strips so a gate child starts from a neutral host. */
 const STRIP_ENV_PREFIXES = ["ENTWURF_", "AGY_", "PI_SESSION_ID", "PI_AGENT_ID"];
 
+/** Where a vitest-backed gate writes its machine report for this one invocation. */
+function vitestReportPath(invocationDir: string): string {
+	return path.join(invocationDir, "vitest-report.json");
+}
+
 function fencedEnv(invocationDir: string): NodeJS.ProcessEnv {
 	const env: NodeJS.ProcessEnv = {};
 	for (const [k, v] of Object.entries(process.env)) {
 		if (STRIP_ENV_PREFIXES.some((p) => k === p || k.startsWith(p))) continue;
 		env[k] = v;
 	}
+	// A vitest-backed gate writes its machine report HERE, inside the per-invocation dir
+	// (outside the snapshot repo, so the work-surface purity hash never sees it). The
+	// report is a FILE and not stdout on purpose: `output` merges stdout+stderr, so one
+	// vite warning ahead of the JSON would break the parse and silently downgrade a real
+	// kill to WRONG-REASON. Legacy gates ignore the variable.
+	env.ENTWURF_MUTATION_VITEST_REPORT = vitestReportPath(invocationDir);
 	for (const d of ["home", "xdg-data", "xdg-config", "xdg-cache", "xdg-state"]) {
 		fs.mkdirSync(path.join(invocationDir, d), { recursive: true });
 	}
@@ -499,7 +576,9 @@ export function runGateBounded(opts: {
 		});
 		child.on("close", (code) => {
 			clearTimeout(timer);
-			resolve({ exitCode: code, timedOut, output, seconds: (Date.now() - started) / 1000 });
+			// Read the report BEFORE the caller removes the invocation dir.
+			const failedTitles = readVitestFailedTitles(output, vitestReportPath(opts.invocationDir));
+			resolve({ exitCode: code, timedOut, output, failedTitles, seconds: (Date.now() - started) / 1000 });
 		});
 	});
 }
@@ -548,6 +627,29 @@ function countOccurrences(haystack: string, needle: string): number {
 	return count;
 }
 
+/** Tail of a red control run's captured output that gets echoed into the log. */
+const CONTROL_TAIL_LINES = 40;
+
+/**
+ * Echo a RED control run's captured output. Without this the runner reports the
+ * verdict (`RED (exit=1 …)`) and DROPS the reason it already holds, which makes a
+ * CONTROL-RED that only reproduces on one host — a CI runner, say — undiagnosable
+ * from its log: the same single line no matter how often it is re-run. A bounded
+ * tail is enough, because a gate names its failure on the way out. Silence is a
+ * finding too, so an empty capture is reported as empty rather than skipped.
+ */
+function logControlOutput(output: string, log: (line: string) => void): void {
+	const body = output.replace(/\s+$/, "");
+	if (body === "") {
+		log("    │ (the control run produced no output — the failure is upstream of the gate's own reporting)");
+		return;
+	}
+	const lines = body.split("\n");
+	const dropped = Math.max(0, lines.length - CONTROL_TAIL_LINES);
+	if (dropped > 0) log(`    │ … ${dropped} earlier line(s) omitted`);
+	for (const line of lines.slice(-CONTROL_TAIL_LINES)) log(`    │ ${line}`);
+}
+
 /**
  * Run every mutant grouped by its gate command, with the control-mutant-restore-
  * control state machine. A red CONTROL-PRE aborts the whole group (every mutant
@@ -593,6 +695,7 @@ export async function qualifyMutants(
 			`  control-pre ${gate.join(" ")}: ${controlPreOk ? "green" : `RED (exit=${pre.exitCode} timedOut=${pre.timedOut})`} in ${pre.seconds.toFixed(1)}s`,
 		);
 		if (!controlPreOk) {
+			logControlOutput(pre.output, log);
 			group.control = "pre-red";
 			for (const m of groupMutants) {
 				group.mutants.push({
@@ -678,7 +781,7 @@ export async function qualifyMutants(
 				matchCount: 1,
 				timedOut: run.timedOut,
 				exitCode: run.exitCode,
-				signatureOnFailureLine: signatureOnFailureLine(run.output, m.signature),
+				signatureOnFailureLine: signatureAttributedToFailure(run.output, m.signature, run.failedTitles),
 				restoredOk,
 			});
 			if (!restoredOk) groupImpure = true;
@@ -687,7 +790,9 @@ export async function qualifyMutants(
 				verdict,
 				seconds: run.seconds,
 				subjectSha256: originalSha,
-				detail: `exit=${run.exitCode} timedOut=${run.timedOut} signature=${m.signature}`,
+				detail:
+					`exit=${run.exitCode} timedOut=${run.timedOut} signature=${m.signature}` +
+					` attribution=${describeAttribution(run.failedTitles)}`,
 			});
 			log(
 				`  claim ${m.claim}: ${verdict} in ${run.seconds.toFixed(1)}s (subject ${m.subject} sha256=${originalSha.slice(0, 12)}…)`,
@@ -705,6 +810,7 @@ export async function qualifyMutants(
 		log(
 			`  control-post ${gate.join(" ")}: ${controlPostOk ? "green" : `RED (exit=${post.exitCode} timedOut=${post.timedOut}) — restore contamination or gate state leak`} in ${post.seconds.toFixed(1)}s`,
 		);
+		if (!controlPostOk) logControlOutput(post.output, log);
 	}
 
 	const postTree = computeTreeManifest(snapshot.repoDir);

package/scripts/lib/probe-acp-turn.ts

@@ -29,20 +29,29 @@ export interface ProbePhaseTimeouts {
 	initializeMs: number;
 	newSessionMs: number;
 	setModelMs: number;
-	promptMs: number;
 }
 
-// Phase timeouts — MUST equal backend.ts's INITIALIZE/NEW_SESSION/SET_MODEL/
-// PROMPT_TIMEOUT_MS (check-probe-ordering pins them against the source). §11-7:
-// a D verdict is only readable against these boundaries, so the probe may not
-// invent its own.
+// BOOTSTRAP phase timeouts — MUST equal backend.ts's INITIALIZE/NEW_SESSION/
+// SET_MODEL_TIMEOUT_MS (check-probe-ordering pins them against the source).
+// §11-7: a bootstrap-phase D verdict is only readable against production's own
+// boundaries, so the probe may not invent its own.
 export const PROBE_PHASE_TIMEOUTS: ProbePhaseTimeouts = {
 	initializeMs: 30_000,
 	newSessionMs: 30_000,
 	setModelMs: 30_000,
-	promptMs: 600_000,
 };
 
+// The prompt phase has NO production counterpart to match: backend.ts ends a
+// prompt on lifecycle events only (resolve / abort / child gone) and carries no
+// wall-clock cutoff, by policy — an active turn is not a failed turn for being
+// long. This value is therefore the MEASUREMENT HARNESS's own bounded
+// observation horizon: it stops a probe RUN from hanging forever. It is not a
+// production contract, not an equivalence, and not a deadline any §11-7 verdict
+// is read against. Horizon expiry means the run's prompt window is
+// INCONCLUSIVE — the artifact is preserved and read as "not measured", never as
+// a model of production killing a turn.
+export const PROBE_PROMPT_OBSERVATION_MS = 600_000;
+
 /** The two adapter methods the turn drives — satisfied by the REAL claudeAdapter
  *  (emitted) in the LIVE runner and by recording stubs in the gate. */
 export interface ProbeAdapterSeam {
@@ -108,7 +117,10 @@ export interface ProbeTurnParams {
 	adapter: ProbeAdapterSeam;
 	enrichMcpServers: ProbeMcpEnricher;
 	log: (event: ProbeEventName, payload?: Record<string, unknown>) => void;
+	/** Bootstrap boundaries (production-pinned). Defaults to PROBE_PHASE_TIMEOUTS. */
 	timeouts?: ProbePhaseTimeouts;
+	/** Harness observation horizon for the prompt phase — NOT a production deadline. */
+	promptObservationMs?: number;
 }
 
 export interface ProbeTurnResult {
@@ -158,7 +170,7 @@ export async function driveProbeTurn(connection: AcpConnectionLike, params: Prob
 		}),
 	);
 
-	// _meta + wire servers exactly as backend.ts assembles them (S2g/§9-4): the
+	// _meta + wire servers exactly as backend.ts assembles them (S2g / carrier-less shape): the
 	// injected production buildSessionMeta (omitted key when undefined) + the
 	// injected production envelope enrichment over the resolved config.
 	const sessionMeta = params.adapter.buildSessionMeta(
@@ -196,11 +208,20 @@ export async function driveProbeTurn(connection: AcpConnectionLike, params: Prob
 		}),
 	);
 
-	const promptResult = await runPhase("prompt", PROBE_EVENTS.promptStart, PROBE_EVENTS.promptEnd, log, t.promptMs, () =>
-		connection.prompt({
-			sessionId: acpSessionId,
-			prompt: [{ type: "text", text: params.promptText }],
-		}),
+	// The horizon below bounds THIS MEASUREMENT RUN, not the turn: production has
+	// no prompt deadline, so an expiry here is an inconclusive observation.
+	const promptObservationMs = params.promptObservationMs ?? PROBE_PROMPT_OBSERVATION_MS;
+	const promptResult = await runPhase(
+		"prompt",
+		PROBE_EVENTS.promptStart,
+		PROBE_EVENTS.promptEnd,
+		log,
+		promptObservationMs,
+		() =>
+			connection.prompt({
+				sessionId: acpSessionId,
+				prompt: [{ type: "text", text: params.promptText }],
+			}),
 	);
 
 	return { acpSessionId, stopReason: promptResult?.stopReason };