@junghanacs/entwurf 0.13.0 → 0.14.0

package/scripts/mutants/acp-stream-hooks.json

@@ -0,0 +1,158 @@
+{
+	"schemaVersion": 1,
+	"lane": "acp-stream-hooks",
+	"mutants": [
+		{
+			"claim": "ACPHOOK-PAYLOAD-EXACT-WIRE",
+			"title": "the new-turn send site bypasses the payload hook entirely — the pi-vertex defect: extensions hooking before_provider_request silently observe nothing",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\tconst wireParams = await applyProviderPayloadHook(options, { sessionId: acpSessionId, prompt }, model);"
+			],
+			"replace": ["\t\t\tconst wireParams = { sessionId: acpSessionId, prompt };"],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-PAYLOAD-EXACT-WIRE]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-REPLACEMENT-ON-WIRE",
+			"title": "the helper validates the replacement and then discards it — the original params always cross the wire, so a payload-rewriting extension silently does nothing",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\treturn replacement as T;"],
+			"replace": ["\treturn params;"],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-REPLACEMENT-ON-WIRE]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-REUSE-PARITY",
+			"title": "the reuse send site bypasses the hook, so resident-session requests become invisible to extensions while cold turns stay covered",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\tconst wireParams = await applyProviderPayloadHook(options, { sessionId: session.acpSessionId, prompt }, model);"
+			],
+			"replace": ["\t\t\tconst wireParams = { sessionId: session.acpSessionId, prompt };"],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-REUSE-PARITY]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-REJECTION-FAILS-LOUD",
+			"title": "the new-turn call site silently catches a hook rejection and falls back to the original params — a broken extension keeps 'working'",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\tconst wireParams = await applyProviderPayloadHook(options, { sessionId: acpSessionId, prompt }, model);"
+			],
+			"replace": [
+				"\t\t\tconst wireParams = await applyProviderPayloadHook(options, { sessionId: acpSessionId, prompt }, model).catch(",
+				"\t\t\t\t() => ({ sessionId: acpSessionId, prompt }),",
+				"\t\t\t);"
+			],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-REJECTION-FAILS-LOUD]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-INVALID-REPLACEMENT-REFUSED",
+			"title": "the non-null/non-array object shape check is dropped, so a scalar replacement is refused for the wrong reason (or not at all) instead of by name",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\tif (typeof replacement !== \"object\" || replacement === null || Array.isArray(replacement)) {",
+				"\t\tthrow new Error(",
+				"\t\t\t\"entwurf: before_provider_request returned a non-object replacement — the ACP prompt payload must stay a non-null, non-array object\",",
+				"\t\t);",
+				"\t}"
+			],
+			"replace": ["\t// a JS extension can return anything; the sessionId check below is the real guard"],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-INVALID-REPLACEMENT-REFUSED]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-EMPTY-PROMPT-REFUSED",
+			"title": "the non-empty prompt invariant is dropped from replacement validation, so an extension can rewrite the turn into an empty ACP send",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\tconst replacementPrompt = (replacement as { prompt?: unknown }).prompt;",
+				"\tif (!Array.isArray(replacementPrompt) || replacementPrompt.length === 0) {",
+				"\t\tthrow new Error(",
+				"\t\t\t\"entwurf: before_provider_request returned a replacement without a non-empty prompt array — an empty ACP prompt cannot be sent\",",
+				"\t\t);",
+				"\t}"
+			],
+			"replace": ["\t// the send sites already refuse an empty BUILT prompt; trust the replacement"],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-EMPTY-PROMPT-REFUSED]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-SESSIONID-TAMPER-REFUSED",
+			"title": "the sessionId invariant is dropped under a literal reading of 'use any returned replacement payload' — the prompt is delivered to a session entwurf never bootstrapped",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\tif ((replacement as { sessionId?: unknown }).sessionId !== params.sessionId) {",
+				"\t\tthrow new Error(",
+				"\t\t\t\"entwurf: before_provider_request changed the ACP sessionId — entwurf cannot truthfully deliver to a session it did not bootstrap; prompt rewriting is allowed, session identity is not\",",
+				"\t\t);",
+				"\t}"
+			],
+			"replace": ["\t// upstream says use any returned replacement payload verbatim"],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-SESSIONID-TAMPER-REFUSED]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-ABORT-DURING-HOOK-WINS",
+			"title": "the post-hook abort recheck is dropped, so an abort raised during a slow handler still sends the prompt to the wire",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\tconst wireParams = await applyProviderPayloadHook(options, { sessionId: acpSessionId, prompt }, model);",
+				"\t\t\tif (signal?.aborted) throw new Error(\"aborted during payload hook\");"
+			],
+			"replace": [
+				"\t\t\tconst wireParams = await applyProviderPayloadHook(options, { sessionId: acpSessionId, prompt }, model);"
+			],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-ABORT-DURING-HOOK-WINS]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-REUSE-ABORT-WINS",
+			"title": "the REUSE call site's post-hook abort recheck is dropped, so an abort raised during a slow handler still sends a second prompt to the resident session",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\tconst wireParams = await applyProviderPayloadHook(options, { sessionId: session.acpSessionId, prompt }, model);",
+				"\t\t\tif (signal?.aborted) throw new Error(\"aborted during payload hook\");"
+			],
+			"replace": [
+				"\t\t\tconst wireParams = await applyProviderPayloadHook(options, { sessionId: session.acpSessionId, prompt }, model);"
+			],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-REUSE-ABORT-WINS]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		},
+		{
+			"claim": "ACPHOOK-ONRESPONSE-NEVER-CALLED",
+			"title": "someone 'completes' the hook contract by fabricating an HTTP 200 response on turn success — exactly the false evidence the exemption exists to forbid",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\tfunction finishSuccess(promptResult: { stopReason?: string }): void {"],
+			"replace": [
+				"\tfunction finishSuccess(promptResult: { stopReason?: string }): void {",
+				"\t\tvoid options?.onResponse?.({ status: 200, headers: {} }, model);"
+			],
+			"gate": ["bash", "run.sh", "check-acp-stream-hooks"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACPHOOK-ONRESPONSE-NEVER-CALLED]",
+			"signatureSource": "scripts/check-acp-stream-hooks.ts"
+		}
+	]
+}

package/scripts/mutants/bridge-boot-resume.json

@@ -0,0 +1,45 @@
+{
+	"schemaVersion": 1,
+	"lane": "bridge-boot-resume",
+	"mutants": [
+		{
+			"claim": "BRIDGEBOOT-RESUME-CALL-REGISTERED",
+			"title": "the resume verb is imported but never registered — invisible to every host, while every import-level assertion stays green",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["server.tool(\n\t\"entwurf_resume_call\","],
+			"replace": [
+				"const _unregisteredResumeTool = (...a: unknown[]) => void a;\n_unregisteredResumeTool(\n\t\"entwurf_resume_call\","
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-bridge-boot"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BRIDGEBOOT-RESUME-CALL-REGISTERED]",
+			"signatureSource": "scripts/check-entwurf-bridge-boot.ts"
+		},
+		{
+			"claim": "BRIDGEBOOT-RESUME-CALL-TARGET-ONLY",
+			"title": "a model knob is added to the resume schema, giving the caller a second way to decide what a resumed citizen is after the record already decided",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["\t\t\t.describe(\"Garden id of the DORMANT pi citizen to reopen (discover with entwurf_peers).\"),"],
+			"replace": [
+				"\t\t\t.describe(\"Garden id of the DORMANT pi citizen to reopen (discover with entwurf_peers).\"),\n\t\tmodel: z.string().optional().describe(\"Override the recorded model.\"),"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-bridge-boot"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BRIDGEBOOT-RESUME-CALL-TARGET-ONLY]",
+			"signatureSource": "scripts/check-entwurf-bridge-boot.ts"
+		},
+		{
+			"claim": "BRIDGEBOOT-PUBLIC-SURFACE-EXACT-SET",
+			"title": "a verb no assertion happens to name (entwurf_fresh_call) is imported but never registered — the public surface silently shrinks while every named check stays green",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["server.tool(\n\t\"entwurf_fresh_call\","],
+			"replace": [
+				"const _unregisteredFreshCallTool = (...a: unknown[]) => void a;\n_unregisteredFreshCallTool(\n\t\"entwurf_fresh_call\","
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-bridge-boot"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BRIDGEBOOT-PUBLIC-SURFACE-EXACT-SET]",
+			"signatureSource": "scripts/check-entwurf-bridge-boot.ts"
+		}
+	]
+}

package/scripts/mutants/meta-facts.json

@@ -0,0 +1,50 @@
+{
+	"schemaVersion": 1,
+	"lane": "meta-facts",
+	"mutants": [
+		{
+			"claim": "MF-EXIT-UNREADABLE",
+			"title": "answering an unreadable store with exit 0 makes an unreadable host look like an empty one — the false-success class the exit contract exists to refuse (#65)",
+			"subject": "scripts/meta-facts.ts",
+			"find": ["\tprocess.exit(3); // see the EXIT CONTRACT above: 3 = unreadable store, never an empty one"],
+			"replace": ["\tprocess.exit(0); // see the EXIT CONTRACT above: 3 = unreadable store, never an empty one"],
+			"gate": ["bash", "run.sh", "check-meta-facts"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:MF-EXIT-UNREADABLE]",
+			"signatureSource": "scripts/check-meta-facts.ts"
+		},
+		{
+			"claim": "MF-FULL-V3-JOIN",
+			"title": "dropping the kept identities from the projection empties the join while still reporting a certified-looking store (#65 wrong fact)",
+			"subject": "scripts/meta-facts.ts",
+			"find": ["\t\t{ schemaVersion: 1, storeDir: facts.dir, citizens: facts.identities, defects: facts.errors },"],
+			"replace": ["\t\t{ schemaVersion: 1, storeDir: facts.dir, citizens: [], defects: facts.errors },"],
+			"gate": ["bash", "run.sh", "check-meta-facts"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:MF-FULL-V3-JOIN]",
+			"signatureSource": "scripts/check-meta-facts.ts"
+		},
+		{
+			"claim": "MF-DEFECTS-IN-BAND",
+			"title": "dropping the defect list shows a store the certification refuses as clean — the decayed-copy failure mode this surface exists to end (#65 wrong fact)",
+			"subject": "scripts/meta-facts.ts",
+			"find": ["\t\t{ schemaVersion: 1, storeDir: facts.dir, citizens: facts.identities, defects: facts.errors },"],
+			"replace": ["\t\t{ schemaVersion: 1, storeDir: facts.dir, citizens: facts.identities, defects: [] },"],
+			"gate": ["bash", "run.sh", "check-meta-facts"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:MF-DEFECTS-IN-BAND]",
+			"signatureSource": "scripts/check-meta-facts.ts"
+		},
+		{
+			"claim": "MF-USAGE",
+			"title": "disabling the argv guard makes extra positional args silently read the first as a store dir instead of refusing usage (#65)",
+			"subject": "scripts/meta-facts.ts",
+			"find": ["if (process.argv.length > 3 || (arg !== undefined && arg.startsWith(\"-\"))) {"],
+			"replace": ["if (false) {"],
+			"gate": ["bash", "run.sh", "check-meta-facts"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:MF-USAGE]",
+			"signatureSource": "scripts/check-meta-facts.ts"
+		}
+	]
+}

package/scripts/mutants/meta-identity.json

@@ -12,6 +12,42 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:META-FIFO-NONBLOCK]",
 			"signatureSource": "scripts/check-meta-identity-consumers.ts"
+		},
+		{
+			"claim": "META-CREATE-EXCLUSIVE",
+			"title": "reverting the exclusive CREATE publish link to rename silently replaces an existing citizen record on a garden-id collision (#66)",
+			"subject": "pi-extensions/lib/meta-session.ts",
+			"find": ["\t\tfs.linkSync(tmp, file);"],
+			"replace": ["\t\tfs.renameSync(tmp, file);"],
+			"gate": ["bash", "run.sh", "check-meta-session"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:META-CREATE-EXCLUSIVE]",
+			"signatureSource": "scripts/check-meta-session.ts"
+		},
+		{
+			"claim": "META-CREATE-WIRING",
+			"title": "routing the CREATE action back through the replacing attach write reopens the silent-overwrite path at the upsert choke point (#66)",
+			"subject": "pi-extensions/lib/meta-session.ts",
+			"find": [
+				"\tif (decision.action === \"create\") publishExclusiveIdentity(file, decision.record);",
+				"\telse atomicWriteIdentity(file, decision.record);"
+			],
+			"replace": ["\tatomicWriteIdentity(file, decision.record);"],
+			"gate": ["bash", "run.sh", "check-meta-session"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:META-CREATE-WIRING]",
+			"signatureSource": "scripts/check-meta-session.ts"
+		},
+		{
+			"claim": "META-CREATE-PUBLISHED-CLEANUP",
+			"title": "swallowing a post-publish temp-cleanup failure reports a clean create while a stale tmp lingers beside the record (#66 false success)",
+			"subject": "pi-extensions/lib/meta-session.ts",
+			"find": ["\t\tif ((err as { code?: unknown }).code === \"ENOENT\") return;"],
+			"replace": ["\t\treturn;"],
+			"gate": ["bash", "run.sh", "check-meta-session"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:META-CREATE-PUBLISHED-CLEANUP]",
+			"signatureSource": "scripts/check-meta-session.ts"
 		}
 	]
 }

package/scripts/mutants/mux-boundary.json

@@ -0,0 +1,196 @@
+{
+	"schemaVersion": 1,
+	"lane": "mux-boundary",
+	"mutants": [
+		{
+			"claim": "V2-DELIVERY-EXCLUDES-MUX",
+			"title": "a mux launch handle is reintroduced as an entwurf_v2 delivery receipt transport",
+			"subject": "pi-extensions/lib/entwurf-v2-contract.ts",
+			"find": [
+				"export const ENTWURF_V2_TRANSPORTS = [\"control-socket\", \"meta-mailbox\", \"native-push\"] as const;"
+			],
+			"replace": [
+				"export const ENTWURF_V2_TRANSPORTS = [",
+				"\t\"control-socket\",",
+				"\t\"tmux-live\",",
+				"\t\"meta-mailbox\",",
+				"\t\"native-push\",",
+				"] as const;"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-contract"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2-DELIVERY-EXCLUDES-MUX]",
+			"signatureSource": "scripts/check-entwurf-v2-contract.ts"
+		},
+		{
+			"claim": "MUX-ANCHOR-REQUIRED",
+			"title": "TMUX is no longer required, so a caller holding only a pane id makes a bare tmux resolve to the DEFAULT server",
+			"subject": "pi-extensions/lib/mux-placement.ts",
+			"find": [
+				"\tif (typeof server !== \"string\" || server.length === 0) return { ok: false, reason: \"no-tmux-context\" };"
+			],
+			"replace": ["\tvoid server;"],
+			"gate": ["bash", "run.sh", "check-mux-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:MUX-ANCHOR-REQUIRED]",
+			"signatureSource": "scripts/check-mux-placement.ts"
+		},
+		{
+			"claim": "MUX-SELECTOR-NATIVE-ID",
+			"title": "selector validation is disabled, so a forged `-t` value reaches tmux's own parser",
+			"subject": "pi-extensions/lib/mux-placement.ts",
+			"find": ["\tif (!okShape) {"],
+			"replace": ["\tif (false && !okShape) {"],
+			"gate": ["bash", "run.sh", "check-mux-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:MUX-SELECTOR-NATIVE-ID]",
+			"signatureSource": "scripts/check-mux-placement.ts"
+		},
+		{
+			"claim": "MUX-TMUX-FAILURE-LOUD",
+			"title": "a nonzero or signalled tmux run is swallowed, so `no server running` is laundered into a fact about the pane",
+			"subject": "pi-extensions/lib/mux-placement.ts",
+			"find": ["\tif (run.status === 0) return;"],
+			"replace": ["\tif (run.status === 0 || run.status !== 0) return;"],
+			"gate": ["bash", "run.sh", "check-mux-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:MUX-TMUX-FAILURE-LOUD]",
+			"signatureSource": "scripts/check-mux-placement.ts"
+		},
+		{
+			"claim": "MUX-ANCHOR-ECHO-BACK",
+			"title": "the pane-id echo-back is dropped, so tmux's rc=0 answer about ANOTHER pane is accepted as the caller's placement",
+			"subject": "pi-extensions/lib/mux-placement.ts",
+			"find": ["\tif (paneId !== anchor) return { ok: false, reason: \"anchor-mismatch\" };"],
+			"replace": ["\t// echo-back dropped"],
+			"gate": ["bash", "run.sh", "check-mux-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:MUX-ANCHOR-ECHO-BACK]",
+			"signatureSource": "scripts/check-mux-placement.ts"
+		},
+		{
+			"claim": "MUX-APPEND-END-DETACHED",
+			"title": "append drops -a/{end} and becomes a lowest-free-index new-window, a different verb from appending at the session end",
+			"subject": "pi-extensions/lib/mux-placement.ts",
+			"find": [
+				"\treturn [\"new-window\", \"-d\", \"-a\", \"-t\", `${sessionId}:{end}`, \"-P\", \"-F\", APPEND_FORMAT];"
+			],
+			"replace": ["\treturn [\"new-window\", \"-d\", \"-t\", `${sessionId}:`, \"-P\", \"-F\", APPEND_FORMAT];"],
+			"gate": ["bash", "run.sh", "check-mux-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:MUX-APPEND-END-DETACHED]",
+			"signatureSource": "scripts/check-mux-placement.ts"
+		},
+		{
+			"claim": "MUX-CLOSE-BY-WINDOW-ID",
+			"title": "a failed kill-window is reported as already-gone without proving absence, so a window that is still open reads as closed",
+			"subject": "pi-extensions/lib/mux-placement.ts",
+			"find": ["\treturn ids.includes(windowId) ? null : \"already-gone\";"],
+			"replace": ["\treturn \"already-gone\";"],
+			"gate": ["bash", "run.sh", "check-mux-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:MUX-CLOSE-BY-WINDOW-ID]",
+			"signatureSource": "scripts/check-mux-placement.ts"
+		},
+		{
+			"claim": "MUX-CONTEXT-BOUND-MUTATION",
+			"title": "context binding matches on the session id alone, so a restarted or foreign server with the same $N is accepted",
+			"subject": "pi-extensions/lib/mux-placement.ts",
+			"find": ["\treturn origin.serverPid === now.serverPid && origin.sessionId === now.sessionId;"],
+			"replace": ["\treturn origin.sessionId === now.sessionId;"],
+			"gate": ["bash", "run.sh", "check-mux-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:MUX-CONTEXT-BOUND-MUTATION]",
+			"signatureSource": "scripts/check-mux-placement.ts"
+		},
+		{
+			"claim": "MUX-LAUNCH-PRECONDITION-FIRST",
+			"title": "the runtime precondition is skipped, so a window is opened onto a runtime that cannot start and the receipt looks identical to a good launch",
+			"subject": "pi-extensions/lib/mux-launch.ts",
+			"find": ["\tif (!isAbsolute(runtimePath)) {"],
+			"replace": ["\tif (false && !isAbsolute(runtimePath)) {"],
+			"gate": ["bash", "run.sh", "check-mux-launch"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:MUX-LAUNCH-PRECONDITION-FIRST]",
+			"signatureSource": "scripts/check-mux-launch.ts"
+		},
+		{
+			"claim": "MUX-LAUNCH-PATH-NO-SPLIT",
+			"title": "the whitespace guard is dropped, so tmux re-splits a spaced runtime path and launches a truncated binary with the remainder as an argument",
+			"subject": "pi-extensions/lib/mux-launch.ts",
+			"find": ["\tif (WHITESPACE.test(runtimePath)) {"],
+			"replace": ["\tif (false && WHITESPACE.test(runtimePath)) {"],
+			"gate": ["bash", "run.sh", "check-mux-launch"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:MUX-LAUNCH-PATH-NO-SPLIT]",
+			"signatureSource": "scripts/check-mux-launch.ts"
+		},
+		{
+			"claim": "MUX-LAUNCH-PATH-HIT-NOT-SKIPPED",
+			"title": "the launchability proof is moved inside the PATH loop's catch, so an unlaunchable FIRST hit is silently skipped and a later entry launches a different install than the operator's own `pi`",
+			"subject": "pi-extensions/lib/mux-launch.ts",
+			"find": [
+				"\t\t} catch {",
+				"\t\t\tcontinue;",
+				"\t\t}",
+				"\t\tassertLaunchTarget(candidate);",
+				"\t\treturn candidate;"
+			],
+			"replace": [
+				"\t\t\tassertLaunchTarget(candidate);",
+				"\t\t} catch {",
+				"\t\t\tcontinue;",
+				"\t\t}",
+				"\t\treturn candidate;"
+			],
+			"gate": ["bash", "run.sh", "check-mux-launch"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:MUX-LAUNCH-PATH-HIT-NOT-SKIPPED]",
+			"signatureSource": "scripts/check-mux-launch.ts"
+		},
+		{
+			"claim": "MUX-LAUNCH-NO-SHELL-ARGV",
+			"title": "the `--` separator is dropped, so tmux takes the runtime as a shell-command string instead of exec'ing it directly",
+			"subject": "pi-extensions/lib/mux-launch.ts",
+			"find": [
+				"\treturn [\"new-window\", \"-d\", \"-a\", \"-t\", `${sessionId}:{end}`, \"-P\", \"-F\", APPEND_FORMAT, \"--\", runtimePath];"
+			],
+			"replace": [
+				"\treturn [\"new-window\", \"-d\", \"-a\", \"-t\", `${sessionId}:{end}`, \"-P\", \"-F\", APPEND_FORMAT, runtimePath];"
+			],
+			"gate": ["bash", "run.sh", "check-mux-launch"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:MUX-LAUNCH-NO-SHELL-ARGV]",
+			"signatureSource": "scripts/check-mux-launch.ts"
+		},
+		{
+			"claim": "MUX-LAUNCH-NO-CARRIER",
+			"title": "a window-name carrier is reintroduced into the launch argv, handing tmux's own parser a value this rail did not author",
+			"subject": "pi-extensions/lib/mux-launch.ts",
+			"find": [
+				"\treturn [\"new-window\", \"-d\", \"-a\", \"-t\", `${sessionId}:{end}`, \"-P\", \"-F\", APPEND_FORMAT, \"--\", runtimePath];"
+			],
+			"replace": [
+				"\treturn [\"new-window\", \"-d\", \"-a\", \"-n\", PI_RUNTIME_COMMAND, \"-t\", `${sessionId}:{end}`, \"-P\", \"-F\", APPEND_FORMAT, \"--\", runtimePath];"
+			],
+			"gate": ["bash", "run.sh", "check-mux-launch"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:MUX-LAUNCH-NO-CARRIER]",
+			"signatureSource": "scripts/check-mux-launch.ts"
+		},
+		{
+			"claim": "MUX-LAUNCH-CORE-IMPORT-FREE",
+			"title": "the launch composition is imported by the delivery core, making fresh launch a dependency of entwurf_v2 delivery",
+			"subject": "pi-extensions/lib/entwurf-v2-production.ts",
+			"find": ["import { isOutOfSocketDomainGardenIdConflict } from \"./entwurf-facts.ts\";"],
+			"replace": [
+				"import { isOutOfSocketDomainGardenIdConflict } from \"./entwurf-facts.ts\";",
+				"import { launchPi as _launchPi } from \"./mux-launch.ts\";"
+			],
+			"gate": ["bash", "run.sh", "check-mux-launch"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:MUX-LAUNCH-CORE-IMPORT-FREE]",
+			"signatureSource": "scripts/check-mux-launch.ts"
+		}
+	]
+}