@junghanacs/entwurf 0.13.0 → 0.14.0

package/scripts/mutants/probe-ordering.json

@@ -3,1029 +3,14 @@
 	"lane": "probe-ordering",
 	"mutants": [
 		{
-			"claim": "VERDICT-A-NEEDS-TWO-DELAYS",
-			"title": "letting a single nonzero delay reach an A verdict — one point cannot show latency scaling (§11-7)",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\tif (distinctDelays.size >= 2 && inBand && growsWithD) {"],
-			"replace": ["\tif (distinctDelays.size >= 1 && inBand && growsWithD) {"],
+			"claim": "NO-PRODUCTION-PROMPT-CUTOFF",
+			"title": "an absolute wall-clock cutoff re-planted on the prompt — active turns die for being long and pi replays the whole prompt as a transient error",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["const ABORT_CANCEL_GRACE_MS = 5_000;"],
+			"replace": ["const PROMPT_TIMEOUT_MS = 600_000;\nconst ABORT_CANCEL_GRACE_MS = 5_000;"],
 			"gate": ["bash", "run.sh", "check-probe-ordering"],
 			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-A-NEEDS-TWO-DELAYS]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-I0-NEVER-D",
-			"title": "reading an intervention initialize failure as D-newSession — the injected delay cannot reach initialize",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\t\t\tkind: \"I0\","],
-			"replace": ["\t\t\tkind: \"D-newSession\","],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-I0-NEVER-D]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-B-PROMOTION-RULES",
-			"title": "promoting any No-such-tool absence — alias/bare-name mismatches would enter the readiness ledger",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": [
-				"\t\t\tdeltas.promptRanAhead &&",
-				"\t\t\texpectedProviderToolId !== undefined &&",
-				"\t\t\tfacts.noSuchToolId === expectedProviderToolId"
-			],
-			"replace": ["\t\t\tdeltas.promptRanAhead &&", "\t\t\ttrue &&", "\t\t\tfacts.noSuchToolId !== undefined"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-B-PROMOTION-RULES]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-B-REQUIRES-RANAHEAD",
-			"title": "dropping the ran-ahead premise from B — an exact-id absence with ordering kept is not the delayed-window failure mode",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": [
-				"\t\t\tdeltas.promptRanAhead &&",
-				"\t\t\texpectedProviderToolId !== undefined &&",
-				"\t\t\tfacts.noSuchToolId === expectedProviderToolId"
-			],
-			"replace": [
-				"\t\t\ttrue &&",
-				"\t\t\texpectedProviderToolId !== undefined &&",
-				"\t\t\tfacts.noSuchToolId === expectedProviderToolId"
-			],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-B-REQUIRES-RANAHEAD]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-P0-CONTROL-FAIL",
-			"title": "waving a callable-less control through as a judgeable baseline (visible-and-callable is the P0 floor)",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": [
-				"\tif (!facts.fixtureToolCall) return \"tool-unavailable\";",
-				"\tif (facts.acpProviderToolId === undefined) return \"tool-unavailable\";"
-			],
-			"replace": [
-				"\tif (!facts.fixtureToolCall) return undefined;",
-				"\tif (facts.acpProviderToolId === undefined) return undefined;"
-			],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-P0-CONTROL-FAIL]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-TIMEOUTS-MATCH-PRODUCTION",
-			"title": "probe prompt boundary drifting from production (120s was the raw smoke's value) — D readings would measure the wrong timeout",
-			"subject": "scripts/lib/probe-acp-turn.ts",
-			"find": ["\tpromptMs: 600_000,"],
-			"replace": ["\tpromptMs: 120_000,"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-TIMEOUTS-MATCH-PRODUCTION]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-SEQ-ORDER",
-			"title": "probe-branded clientInfo — a different stimulus than production means the probe measures a lookalike",
-			"subject": "scripts/lib/probe-acp-turn.ts",
-			"find": ["\t\t\tclientInfo: { name: \"entwurf\", version: \"s2d\" },"],
-			"replace": ["\t\t\tclientInfo: { name: \"entwurf-probe\", version: \"s11-7\" },"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-SEQ-ORDER]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-FIXTURE-WIRE-MARKER",
-			"title": "dropping the tools_list_response_forwarded stamp — without the wire-availability marker A and C are indistinguishable",
-			"subject": "scripts/fixtures/probe-mcp-server.ts",
-			"find": ["\t\t\t\temit(PROBE_EVENTS.toolsListResponseForwarded, { jsonrpcId: msg.id, tools: toolNames });"],
-			"replace": ["\t\t\t\t// marker intentionally not emitted"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-FIXTURE-WIRE-MARKER]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-FIXTURE-RUNID-REQUIRED",
-			"title": "making probeRunId optional — without the required join key cross-layer correlation degrades to inference",
-			"subject": "scripts/fixtures/probe-mcp-server.ts",
-			"find": ["\t\t{ probeRunId: z.string().describe(\"The exact probeRunId string given in the prompt.\") },"],
-			"replace": ["\t\t{},"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-FIXTURE-RUNID-REQUIRED]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-NOWIRE-CANDIDATE",
-			"title": "reading a wire-marker-less absence as B — a fixture that never served would manufacture a sufficiency verdict (§11-7 promotion ladder)",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\t\tfailure = \"candidate-handshake\";"],
-			"replace": ["\t\tfailure = \"B\";"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-NOWIRE-CANDIDATE]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-SAMEMS-AMBIGUOUS",
-			"title": "reading ordering-kept off a same-ms cross-process tie — the shared axis cannot order equal-ms stamps from different pids",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\t\tnewSessionOrderingKept: w !== undefined && n !== undefined && w < n,"],
-			"replace": ["\t\tnewSessionOrderingKept: w !== undefined && n !== undefined && w <= n,"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-SAMEMS-AMBIGUOUS]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-A-TRACKING-BAND",
-			"title": "dropping the excess upper bound — a 10s stall at D=2s would count as \"latency tracks D\"",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\t\t\tr.newSessionExcessMs <= r.delayMs + A_LATENCY_SLACK_MS,"],
-			"replace": ["\t\t\tNumber.isFinite(r.newSessionExcessMs),"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-A-TRACKING-BAND]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-NO-PROSE-ERROR-SCAN",
-			"title": "scanning agent prose for No-such-tool — the model could mint the runtime marker by saying the sentence",
-			"subject": "scripts/smoke-acp-ordering-probe-live.ts",
-			"find": ["\t\t\t\t\tif (typeof t === \"string\") collectedText += t;"],
-			"replace": [
-				"\t\t\t\t\tif (typeof t === \"string\") {",
-				"\t\t\t\t\t\tcollectedText += t;",
-				"\t\t\t\t\t\tscanStructuredNoSuchTool({ content: [{ type: \"text\", text: t }] });",
-				"\t\t\t\t\t}"
-			],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-NO-PROSE-ERROR-SCAN]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-MALFORMED-INVALIDATES",
-			"title": "judging a log with malformed lines — the corrupted line could be the wire marker whose absence becomes \"evidence\"",
-			"subject": "scripts/smoke-acp-ordering-probe-live.ts",
-			"find": ["\tif (malformed.length > 0 || sequenceViolations.length > 0) {"],
-			"replace": ["\tif (malformed.length > 9999 || sequenceViolations.length > 9999) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-MALFORMED-INVALIDATES]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-LOG-EVENT-VOCABULARY",
-			"title": "accepting any string as an event name — a typo'd marker would read as a marker that never fired, and absence is what §11-7 judges",
-			"subject": "scripts/lib/probe-event-log.ts",
-			"find": ["\tif (!isProbeEventName(e.event)) return false;"],
-			"replace": ["\tif (typeof e.event !== \"string\") return false;"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-LOG-EVENT-VOCABULARY]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-LOG-ENVELOPE-SCHEMA",
-			"title": "letting a JSON-valid line with a broken sort axis in as an event — a non-numeric tsMs makes the comparator NaN and the ordering reads meaningless",
-			"subject": "scripts/lib/probe-event-log.ts",
-			"find": [
-				"\tif (!Number.isSafeInteger(e.seq) || (e.seq as number) < 0) return false;",
-				"\tif (!Number.isSafeInteger(e.pid) || (e.pid as number) <= 0) return false;",
-				"\tif (!Number.isSafeInteger(e.tsMs) || (e.tsMs as number) <= 0) return false;",
-				"\tif (typeof e.ts !== \"string\" || Date.parse(e.ts) !== e.tsMs) return false;"
-			],
-			"replace": ["\t// structural envelope checks intentionally removed"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-LOG-ENVELOPE-SCHEMA]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-LOG-ENVELOPE-AUTHORITY",
-			"title": "letting a caller's payload carry a reserved envelope key — the writer's own runId/marker/sort axis could be rewritten by the line it rides in",
-			"subject": "scripts/lib/probe-event-log.ts",
-			"find": ["\tfor (const key of RESERVED_EVENT_KEYS) {"],
-			"replace": ["\tfor (const key of [] as string[]) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-LOG-ENVELOPE-AUTHORITY]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-LOG-PAYLOAD-SCHEMA",
-			"title": "judging payload the parser never typed — a perfect envelope around ok:\"true\" reads as a phase FAILURE instead of invalidating the run",
-			"subject": "scripts/lib/probe-event-log.ts",
-			"find": ["\t\t\tif (!isWellFormedEnvelope(parsed) || !payloadHoldsContract(parsed)) {"],
-			"replace": ["\t\t\tif (!isWellFormedEnvelope(parsed)) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-LOG-PAYLOAD-SCHEMA]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-LOG-WIRE-MARKER-NAMES-TOOL",
-			"title": "accepting a wire marker that names no expected tool — a fixture that served nothing would still supply the wire-availability stamp that ran-ahead, C and B are read against",
-			"subject": "scripts/lib/probe-event-log.ts",
-			"find": ["\t\tArray.isArray(e.tools) && e.tools.every(isString) && e.tools.includes(PROBE_EXPECTED_TOOL),"],
-			"replace": ["\t\tArray.isArray(e.tools),"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-LOG-WIRE-MARKER-NAMES-TOOL]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-LOG-WINDOW-REASON-VOCAB",
-			"title": "opening the window-close vocabulary — an unknown reason would fall through to whatever branch consumes it",
-			"subject": "scripts/lib/probe-event-log.ts",
-			"find": ["\t\ttypeof e.reason === \"string\" && WINDOW_REASONS.has(e.reason) && isBoolean(e.markerSeen),"],
-			"replace": ["\t\ttypeof e.reason === \"string\" && isBoolean(e.markerSeen),"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-LOG-WINDOW-REASON-VOCAB]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-LOG-SEQ-STRICTLY-INCREASING",
-			"title": "allowing a repeated per-pid seq — two lines claiming one slot are unorderable within their millisecond",
-			"subject": "scripts/lib/probe-event-log.ts",
-			"find": ["\t\tif (priorSeq !== undefined && e.seq <= priorSeq) {"],
-			"replace": ["\t\tif (priorSeq !== undefined && e.seq < priorSeq) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-LOG-SEQ-STRICTLY-INCREASING]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-LOG-TS-NO-REGRESSION",
-			"title": "dropping the per-pid clock-regression check — rewritten stamps are exactly what the ordering reads are made of",
-			"subject": "scripts/lib/probe-event-log.ts",
-			"find": ["\t\tif (priorTsMs !== undefined && e.tsMs < priorTsMs) {"],
-			"replace": ["\t\tif (priorTsMs !== undefined && e.tsMs < 0) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-LOG-TS-NO-REGRESSION]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-LOG-RAW-ORDER-BEFORE-SORT",
-			"title": "validating per-writer order AFTER the sort — the comparator would have already rewritten the order being checked",
-			"subject": "scripts/lib/probe-event-log.ts",
-			"find": ["\tconst sequenceViolations = findSequenceViolations(events);"],
-			"replace": [
-				"\tconst sequenceViolations = findSequenceViolations([...events].sort((a, b) => a.tsMs - b.tsMs || a.pid - b.pid || a.seq - b.seq));"
-			],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-LOG-RAW-ORDER-BEFORE-SORT]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-RUNNER-EXACTLY-ONCE-INVENTORY",
-			"title": "retiring the observation-window close from the runner exactly-once set — a topology rule would lapse in silence",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\tPROBE_EVENTS.runStart,", "\tPROBE_EVENTS.observationWindowEnd,", "\tPROBE_EVENTS.runEnd,"],
-			"replace": ["\tPROBE_EVENTS.runStart,", "\tPROBE_EVENTS.runEnd,"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-RUNNER-EXACTLY-ONCE-INVENTORY]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-CENSORED-NOT-CANDIDATE",
-			"title": "filing a right-censored run as an MCP handshake/fixture/config candidate — the 2026-07-28 D2 misattribution",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\tif (!facts.windowMarkerSeen && facts.windowReason !== \"deadline\") {"],
-			"replace": ["\tif (!facts.windowMarkerSeen && facts.windowReason === \"run-failed\") {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-CENSORED-NOT-CANDIDATE]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-RUNNER-TOPOLOGY-EXACTLY-ONCE",
-			"title": "tolerating a duplicated runner-owned marker — the log would stop describing one run",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": [
-				"\t\tif (n !== 1) violations.push(`${name} appears ${n} times — the runner emits it exactly once per run`);"
-			],
-			"replace": [
-				"\t\tif (n > 2) violations.push(`${name} appears ${n} times — the runner emits it exactly once per run`);"
-			],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-RUNNER-TOPOLOGY-EXACTLY-ONCE]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-ORDERING-AXIS-REPORTED",
-			"title": "dropping no-wait from the (a) summary — a settled ordering observation would be hidden by an unsettled (b) axis",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": [
-				"\t\t\tr.ordering === \"wire-before-newSession-end\" ||",
-				"\t\t\tr.ordering === \"wire-before-prompt-request\" ||",
-				"\t\t\tr.ordering === \"prompt-request-ahead-of-wire\","
-			],
-			"replace": [
-				"\t\t\tr.ordering === \"wire-before-newSession-end\" ||",
-				"\t\t\tr.ordering === \"wire-before-prompt-request\","
-			],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-ORDERING-AXIS-REPORTED]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-EVIDENCE-EXPOSES-DELTAS",
-			"title": "hiding the post-wire turn time from the evidence — §11-7-b classified D1 correctly and still could not be read",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": [
-				"\tif (d.postWireTurnMs !== undefined) parts.push(`${d.postWireTurnMs}ms of turn remained after wire`);"
-			],
-			"replace": [
-				"\tif (d.postWireTurnMs === undefined) parts.push(`${d.postWireTurnMs}ms of turn remained after wire`);"
-			],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-EVIDENCE-EXPOSES-DELTAS]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-B-WINDOW-IS-PROMPT",
-			"title": "deciding B on the newSession axis — the causal window is the prompt request, where the turn is opened against the tool set that exists then",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": [
-				"\t\t\tdeltas.promptRanAhead &&",
-				"\t\t\texpectedProviderToolId !== undefined &&",
-				"\t\t\tfacts.noSuchToolId === expectedProviderToolId"
-			],
-			"replace": [
-				"\t\t\tdeltas.newSessionRanAhead &&",
-				"\t\t\texpectedProviderToolId !== undefined &&",
-				"\t\t\tfacts.noSuchToolId === expectedProviderToolId"
-			],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-B-WINDOW-IS-PROMPT]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-LOG-WRITER-KEY-PER-RUN",
-			"title": "keying the stream door on pid alone — a reused pid restarting its counter in a later run would be called corrupt",
-			"subject": "scripts/lib/probe-event-log.ts",
-			"find": ["\t\tconst key = `${e.runId}\\u0000${e.pid}`;"],
-			"replace": ["\t\tconst key = `${e.pid}`;"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-LOG-WRITER-KEY-PER-RUN]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-WINDOW-MARKER-COHERENCE",
-			"title": "believing the self-reported window flag — a close claiming markerSeen=true with no wire marker would enter the candidate branch",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\tif (markerSeen !== wireInLog) {"],
-			"replace": ["\tif (markerSeen !== wireInLog && wireInLog) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-WINDOW-MARKER-COHERENCE]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-PHASE-PRODUCTION-ORDER",
-			"title": "checking only start<end within each phase — a log whose phases ran out of production order would pass",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\tif (reachedNames.join(\">\") !== expectedPrefix.join(\">\")) {"],
-			"replace": ["\tif (reachedNames.length > 99) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-PHASE-PRODUCTION-ORDER]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-WINDOW-SLACK-IS-CONSTANT",
-			"title": "reopening the post-delay slack as an env knob — a shrunken window would call its own early close deadline-sufficient",
-			"subject": "scripts/smoke-acp-ordering-probe-live.ts",
-			"find": ["const POST_DELAY_SLACK_MS = 5_000;"],
-			"replace": ["const POST_DELAY_SLACK_MS = Number(process.env.PROBE_POST_DELAY_SLACK_MS ?? \"5000\") || 5000;"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-WINDOW-SLACK-IS-CONSTANT]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "RUNNER-EXIT-CONTRACT-SPLIT",
-			"title": "failing the run on the composite verdict alone — a pair that measured its ordering axis would be reported as a failed run",
-			"subject": "scripts/smoke-acp-ordering-probe-live.ts",
-			"find": [
-				"\tif (classification.status.validity !== \"valid\" && classification.status.validity !== \"partial\") {"
-			],
-			"replace": ["\tif (classification.verdict === \"never\") {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:RUNNER-EXIT-CONTRACT-SPLIT]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-PHASE-SEQUENTIAL",
-			"title": "dropping the phase-to-phase sequencing check — transposed phases with intact pairs would be judged as a run",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\t\tif (prevEnd !== undefined && thisStart !== undefined && !(prevEnd < thisStart)) {"],
-			"replace": ["\t\tif (prevEnd !== undefined && thisStart !== undefined && false) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-PHASE-SEQUENTIAL]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-CONTROL-HELD-TO-COHERENCE",
-			"title": "letting the control skip the run-validity bar — a baseline free to claim a wire marker it never logged is not a baseline",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\tif (controlFacts.validityViolations.length > 0) {"],
-			"replace": ["\tif (controlFacts.topologyViolations.length > 0) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-CONTROL-HELD-TO-COHERENCE]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-STATUS-NAMES-INVALID-RUNS",
-			"title": "dropping the discarded runs from a fatal status — the only record of what was thrown out, and why, would vanish",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\t\t\tstatus: runStatus(\"INVALIDATED\", ordering, \"not-judged\", readings),"],
-			"replace": ["\t\t\tstatus: runStatus(\"INVALIDATED\", ordering, \"not-judged\"),"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-STATUS-NAMES-INVALID-RUNS]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-TARGET-AMBIENT-REFUSED",
-			"title": "running under an ambient CLAUDE_CODE_EXECUTABLE — claudeCliPath() returns it verbatim and the pair measures an unpinned executable (§11-7-c)",
-			"subject": "scripts/lib/probe-cli-target.ts",
-			"find": ["\tif (env[AMBIENT_OVERRIDE_ENV] !== undefined) {"],
-			"replace": ["\tif (false) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-TARGET-AMBIENT-REFUSED]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-TARGET-NATIVE-BRANCH-ONLY",
-			"title": "accepting a script-suffixed target — the SDK would take the node|bun branch and the exec semantics the seam is specified against would silently change",
-			"subject": "scripts/lib/probe-cli-target.ts",
-			"find": ["\tif (SDK_SCRIPT_SUFFIXES.some((s) => path.endsWith(s))) {"],
-			"replace": ["\tif (false) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-TARGET-NATIVE-BRANCH-ONLY]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-SCRUB-EXACT-ALLOWLIST",
-			"title": "dropping the override itself from the shim scrub list — the override would re-propagate to grandchildren (recursion/env drift)",
-			"subject": "scripts/lib/probe-cli-target.ts",
-			"find": [
-				"export const SHIM_SCRUB_ENV_VARS: ReadonlyArray<string> = [",
-				"\tAMBIENT_OVERRIDE_ENV,",
-				"\tPROBE_SHIM_ENV.target,"
-			],
-			"replace": ["export const SHIM_SCRUB_ENV_VARS: ReadonlyArray<string> = [", "\tPROBE_SHIM_ENV.target,"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-SCRUB-EXACT-ALLOWLIST]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "RUNNER-TARGET-PRECONDITION-PINNED",
-			"title": "spawning the ACP child without asserting the COMPOSED env is override-free — launch defaults or overlay overrides could hijack which CLI the pair measures",
-			"subject": "scripts/smoke-acp-ordering-probe-live.ts",
-			"find": ["\t\tassertNoAmbientOverride(spawnEnv, `composed acp child env for ${runId}`);"],
-			"replace": ["\t\t// (composed-env assert removed by mutant)"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:RUNNER-TARGET-PRECONDITION-PINNED]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-SNAPSHOT-PROMOTES",
-			"title": "making the B-name-snapshot promotion unreachable — a full-floor absence reading would be reported as inconclusive",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\t\t} else if (wire < facts.snapshotReceivedAtMs) {"],
-			"replace": ["\t\t} else if (false && wire < facts.snapshotReceivedAtMs) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-SNAPSHOT-PROMOTES]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-SNAPSHOT-REQUIRES-RANAHEAD",
-			"title": "promoting a snapshot absence without promptRanAhead — absence outside the delayed-window failure mode would enter the ledger",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\t\t} else if (!deltas.promptRanAhead) {"],
-			"replace": ["\t\t} else if (false) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-SNAPSHOT-REQUIRES-RANAHEAD]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-SNAPSHOT-INTERVAL-UNORDERED",
-			"title": "reading a wire marker INSIDE the snapshot interval as ordered — an overlap would be promoted as an after-the-wire absence",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\t\t} else if (wire < facts.snapshotReceivedAtMs) {"],
-			"replace": ["\t\t} else if (wire <= facts.snapshotForwardedAtMs) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-SNAPSHOT-INTERVAL-UNORDERED]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-SNAPSHOT-ORDINAL-EXACTLY-ONE",
-			"title": "accepting several bound snapshots and reading the first — reinit/set-model re-emission would silently pick a snapshot for the binding",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\t\tif (candidates.length !== 1) {"],
-			"replace": ["\t\tif (candidates.length < 1) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-SNAPSHOT-ORDINAL-EXACTLY-ONE]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-SNAPSHOT-INSTRUMENT-ABSENT",
-			"title": "folding a missing shim into generic calibration — a hijacked/replaced override must be a NAMED absence",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\t\tif (facts.shimBootCount === 0) return \"snapshot-instrument-absent\";"],
-			"replace": ["\t\t// mutant: instrument-absence check removed"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-SNAPSHOT-INSTRUMENT-ABSENT]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-SNAPSHOT-CALIBRATION",
-			"title": "skipping the control-contains-the-id calibration — an instrument that cannot SEE presence would still be allowed to claim absence",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": [
-				"\t\tif (facts.snapshotTools === undefined || !facts.snapshotTools.includes(facts.acpProviderToolId)) {",
-				"\t\t\treturn \"snapshot-calibration\";",
-				"\t\t}"
-			],
-			"replace": ["\t\t// mutant: calibration containment check removed"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-SNAPSHOT-CALIBRATION]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-SNAPSHOT-NEEDS-INSTRUMENT-FLAG",
-			"title": "arming the snapshot channel off event PRESENCE instead of the roster — found-in-the-wild evidence would promote past the instrument declaration",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\t\t...snapshotChannelFacts(run, events),"],
-			"replace": [
-				"\t\t...snapshotChannelFacts(",
-				"\t\t\t{ ...run, snapshotInstrumented: run.snapshotInstrumented === true || events.some((e) => e.event === PROBE_EVENTS.shimBoot) },",
-				"\t\t\tevents,",
-				"\t\t),"
-			],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-SNAPSHOT-NEEDS-INSTRUMENT-FLAG]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "PROBE-LOG-SNAPSHOT-PAYLOAD",
-			"title": "accepting a receivedAtMs after the envelope stamp at the door — a corrupt interval would silently un-order the after-the-wire read",
-			"subject": "scripts/lib/probe-event-log.ts",
-			"find": ["\t\t(e.receivedAtMs as number) <= e.tsMs,"],
-			"replace": ["\t\ttrue,"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:PROBE-LOG-SNAPSHOT-PAYLOAD]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "RUNNER-TARGET-IDENTITY-IN-ROSTER",
-			"title": "dropping the expected target identity from the roster record — the classifier would have nothing to verify shim boots against",
-			"subject": "scripts/smoke-acp-ordering-probe-live.ts",
-			"find": [
-				"\t\tsnapshotInstrumented: true,",
-				"\t\tcliTargetPath: CLI_TARGET.path,",
-				"\t\tcliTargetSha256: CLI_TARGET.sha256,"
-			],
-			"replace": ["\t\tsnapshotInstrumented: true,", "\t\tprobeRunId,", "\t\tdelayMs,"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:RUNNER-TARGET-IDENTITY-IN-ROSTER]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "RUNNER-DRIFT-REHASH-PINNED",
-			"title": "neutering the post-pair re-hash — a target swapped mid-pair would pass as one stimulus",
-			"subject": "scripts/smoke-acp-ordering-probe-live.ts",
-			"find": ["\t\trehash = hashFileSha256(CLI_TARGET.path);"],
-			"replace": ["\t\trehash = CLI_TARGET.sha256;"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:RUNNER-DRIFT-REHASH-PINNED]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-RUNTIME-B-LADDER-OWNS",
-			"title": "disabling the runtime No-such-tool ladder — runtime-error runs would drift into other channels instead of reading B",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\t} else if (facts.noSuchToolId !== undefined) {"],
-			"replace": ["\t} else if (false && facts.noSuchToolId !== undefined) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-RUNTIME-B-LADDER-OWNS]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-SNAPSHOT-BINDING-RECEIVE-AXIS",
-			"title": "binding candidates on append order alone — under stdout backpressure a boot-time init would promote as the turn snapshot",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\t\t\t\t(e.receivedAtMs as number) > anchor.tsMs,"],
-			"replace": ["\t\t\t\ttrue,"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-SNAPSHOT-BINDING-RECEIVE-AXIS]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-SNAPSHOT-STRUCTURAL-INVALIDATES",
-			"title": "degrading a broken shim identity to a (b)-only reading — a run that did not execute the calibrated shim would keep voting on axis (a)",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\tif (facts.snapshotStructuralViolations.length > 0) {"],
-			"replace": ["\tif (false) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-SNAPSHOT-STRUCTURAL-INVALIDATES]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-SNAPSHOT-TARGET-IDENTITY",
-			"title": "recording the shim's boot target without verifying it — an env hijack swapping the executable would still promote",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": [
-				"\t} else if (boots.length === 1) {",
-				"\t\tif (boot.targetPath !== run.cliTargetPath || boot.targetSha256 !== run.cliTargetSha256) {"
-			],
-			"replace": ["\t} else if (boots.length === 1) {", "\t\tif (false) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-SNAPSHOT-TARGET-IDENTITY]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "VERDICT-SNAPSHOT-CONTAINS-ID-BLOCKS",
-			"title": "removing the contains-id rung — a snapshot that SHOWS the tool present would promote as absence",
-			"subject": "scripts/lib/probe-verdict.ts",
-			"find": ["\t\t} else if (facts.snapshotTools.includes(expectedProviderToolId)) {"],
-			"replace": ["\t\t} else if (false) {"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 120,
-			"signature": "[QK:VERDICT-SNAPSHOT-CONTAINS-ID-BLOCKS]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "SHIM-NATIVE-BRANCH-LAUNCHER",
-			"title": "moving the shim off the SDK's direct-spawn branch — a shebang the kernel cannot run makes the instrument unlaunchable",
-			"subject": "scripts/fixtures/probe-cli-shim",
-			"find": ["#!/usr/bin/env node"],
-			"replace": ["#!/bin/sh"],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-NATIVE-BRANCH-LAUNCHER]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-BYTE-TRANSPARENCY",
-			"title": "forwarding a DECODED string instead of the raw chunk — a chunk boundary inside a multi-byte sequence becomes U+FFFD on the CLI's real wire",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": ["\t\tconst flushed = process.stdout.write(chunk, (err) => {"],
-			"replace": ["\t\tconst flushed = process.stdout.write(chunk.toString(\"utf8\"), (err) => {"],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-BYTE-TRANSPARENCY]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-PROMPT-ORDINAL-USER-FRAMES-ONLY",
-			"title": "taking every stdin line as a prompt frame — the SDK's initialize control traffic would blow the exactly-one ordinal binding on every run",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": ["\t\t\tif (isPromptFrame(line)) ordinals.push(++promptOrdinal);"],
-			"replace": ["\t\t\tif (line.length > 0) ordinals.push(++promptOrdinal);"],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-PROMPT-ORDINAL-USER-FRAMES-ONLY]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-INIT-REQUIRES-STRING-TOOL-ARRAY",
-			"title": "defaulting a malformed init's name set to [] — an empty set is exactly what the B-name-snapshot ladder reads as absence, so this FABRICATES evidence",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": [
-				"\tif (!Array.isArray(obj.tools) || !obj.tools.every((t) => typeof t === \"string\")) return undefined;"
-			],
-			"replace": ["\tif (!Array.isArray(obj.tools)) return { tools: [], receivedAtMs };"],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-INIT-REQUIRES-STRING-TOOL-ARRAY]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-BOOT-TARGET-IDENTITY",
-			"title": "reporting a fabricated target hash at boot — the classifier verifies this against the roster, so a swapped binary would vote in the pair",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": ["\temit(PROBE_EVENTS.shimBoot, { targetPath, targetSha256 });"],
-			"replace": ["\temit(PROBE_EVENTS.shimBoot, { targetPath, targetSha256: \"0\".repeat(64) });"],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-BOOT-TARGET-IDENTITY]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-SCRUB-EXACT-ALLOWLIST",
-			"title": "deleting one ordinary operator variable alongside the allowlist — the child loses env this probe never had a claim on, and a sampled comparison would never see it",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": ["\tfor (const name of SHIM_SCRUB_ENV_VARS) delete childEnv[name];"],
-			"replace": ["\tfor (const name of [...SHIM_SCRUB_ENV_VARS, \"HOME\"]) delete childEnv[name];"],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-SCRUB-EXACT-ALLOWLIST]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-ARGV-AGNOSTIC-PASSTHROUGH",
-			"title": "treating a non-JSON stdout line as an init snapshot — the `claude auth logout` consumer would start emitting snapshot evidence",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": ["\tif (obj === undefined || obj.type !== \"system\" || obj.subtype !== \"init\") return undefined;"],
-			"replace": ["\tif (obj === undefined) return { tools: [], receivedAtMs };"],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-ARGV-AGNOSTIC-PASSTHROUGH]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-LOG-PRIVACY",
-			"title": "logging argv on the boot marker — operator command lines reach the shared evidence log",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": ["\temit(PROBE_EVENTS.shimBoot, { targetPath, targetSha256 });"],
-			"replace": ["\temit(PROBE_EVENTS.shimBoot, { targetPath, targetSha256, argv: process.argv.slice(2) });"],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-LOG-PRIVACY]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-EXIT-CODE-FIDELITY",
-			"title": "reporting exit 0 for every child exit — a CLI crash reads to the parent as a completed turn",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": ["\t\t\tprocess.exit(code ?? 0);"],
-			"replace": ["\t\t\tprocess.exit(0);"],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-EXIT-CODE-FIDELITY]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-SIGNAL-RERAISE",
-			"title": "synthesising an exit code where the child died on a signal — the parent's wait status loses the real disposition",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": ["\t\t\t\treRaise(signal);"],
-			"replace": ["\t\t\t\tprocess.exit(9);"],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-SIGNAL-RERAISE]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-INBOUND-SIGNAL-FORWARDED",
-			"title": "forwarding the wrong signal to the child — teardown semantics the ACP child relies on change under the instrument",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": ["\t\t\tif (!finished) child.kill(signal);"],
-			"replace": ["\t\t\tif (!finished) child.kill(\"SIGKILL\");"],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-INBOUND-SIGNAL-FORWARDED]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-SPAWN-ERROR-NAMED",
-			"title": "collapsing an unreadable exec target into an anonymous failure — the operator loses both the errno and the shell-convention status",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": [
-				"\t\tabort(`cannot read exec target ${targetPath}: ${code ?? (err as Error).message}`, exitStatusForErrno(code));"
-			],
-			"replace": ["\t\tabort(\"target unreadable\", 1);"],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-SPAWN-ERROR-NAMED]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-OVERSIZED-LINE-PARSE-SKIP",
-			"title": "unbounding the NDJSON framing buffer — a pathological line drives the instrument's memory and the skip stops being recorded",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": ["\t\tif (needed > SHIM_MAX_LINE_BYTES) {"],
-			"replace": ["\t\tif (needed > Number.MAX_SAFE_INTEGER) {"],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-OVERSIZED-LINE-PARSE-SKIP]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-SNAPSHOT-IN-WRITE-CALLBACK",
-			"title": "appending the snapshot BEFORE the downstream write — the envelope tsMs stops being the hand-off moment and the interval's end loses its SSOT",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": [
-				"\t\tconst flushed = process.stdout.write(chunk, (err) => {",
-				"\t\t\tif (err) return;",
-				"\t\t\tfor (const snapshot of snapshots) emit(PROBE_EVENTS.shimInitSnapshot, { ...snapshot });"
-			],
-			"replace": [
-				"\t\tfor (const snapshot of snapshots) emit(PROBE_EVENTS.shimInitSnapshot, { ...snapshot });",
-				"\t\tconst flushed = process.stdout.write(chunk, (err) => {",
-				"\t\t\tif (err) return;"
-			],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-SNAPSHOT-IN-WRITE-CALLBACK]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-PROMPT-IN-WRITE-CALLBACK",
-			"title": "stamping the prompt anchor BEFORE the bytes reach the CLI's stdin — 'we saw a newline' replaces 'fully passed to stdin'",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": [
-				"\t\tconst flushed = childStdin.write(chunk, (err) => {",
-				"\t\t\tif (err) return;",
-				"\t\t\tfor (const ordinal of ordinals) emit(PROBE_EVENTS.shimPromptForwarded, { ordinal });"
-			],
-			"replace": [
-				"\t\tfor (const ordinal of ordinals) emit(PROBE_EVENTS.shimPromptForwarded, { ordinal });",
-				"\t\tconst flushed = childStdin.write(chunk, (err) => {",
-				"\t\t\tif (err) return;"
-			],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-PROMPT-IN-WRITE-CALLBACK]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-STDOUT-BACKPRESSURE-PAUSES-SOURCE",
-			"title": "dropping the source pause under write backpressure — peak memory becomes the transcript size instead of the pipe buffers",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": [
-				"\t\tif (!flushed) {",
-				"\t\t\tchildStdout.pause();",
-				"\t\t\tprocess.stdout.once(\"drain\", () => childStdout.resume());",
-				"\t\t}"
-			],
-			"replace": ["\t\tif (!flushed) {", "\t\t\tvoid flushed;", "\t\t\tvoid flushed;", "\t\t}"],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-STDOUT-BACKPRESSURE-PAUSES-SOURCE]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-FRAMING-BOUNDED-IN-OBJECTS",
-			"title": "regrowing the framing buffer to the exact size on every read — the byte cap holds but the object cost becomes linear in reads, which is the bound a one-byte-at-a-time peer walks through",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": ["\t\t\twhile (capacity < needed) capacity *= 2;"],
-			"replace": ["\t\t\tcapacity = needed;"],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-FRAMING-BOUNDED-IN-OBJECTS]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-OVERSIZE-COUNTED-AT-EOF",
-			"title": "dropping the stream-end finalize — an oversized line that never meets a newline is skipped silently and the diagnostic under-reports it",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": ["\t\tif (this.overflowed) this.overflowCount += 1;", "\t\tthis.reset();", "\t}", "", "\tprivate absorb"],
-			"replace": ["\t\tthis.reset();", "\t}", "", "\tprivate absorb", ""],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-OVERSIZE-COUNTED-AT-EOF]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-STDIN-BACKPRESSURE-PAUSES-SOURCE",
-			"title": "dropping the source pause on the stdin side — a CLI slow to read its input gets absorbed into this process's memory instead of parking the SDK's stream",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": [
-				"\t\tif (!flushed) {",
-				"\t\t\tprocess.stdin.pause();",
-				"\t\t\tchildStdin.once(\"drain\", () => process.stdin.resume());",
-				"\t\t}"
-			],
-			"replace": ["\t\tif (!flushed) {", "\t\t\tvoid flushed;", "\t\t\tvoid flushed;", "\t\t}"],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-STDIN-BACKPRESSURE-PAUSES-SOURCE]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "SHIM-DOWNSTREAM-DEATH-TEARS-DOWN",
-			"title": "merely IGNORING a dead downstream — the source stays parked on a drain that can never arrive and the instrument hangs holding a live CLI open",
-			"subject": "scripts/lib/probe-cli-shim.ts",
-			"find": [
-				"\tprocess.stdout.on(\"error\", (): void => {",
-				"\t\tchildStdout.resume();",
-				"\t\tif (!finished) child.kill(\"SIGTERM\");",
-				"\t});"
-			],
-			"replace": ["\tprocess.stdout.on(\"error\", (): void => {});", "", "", ""],
-			"gate": ["bash", "run.sh", "check-probe-cli-shim"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:SHIM-DOWNSTREAM-DEATH-TEARS-DOWN]",
-			"signatureSource": "scripts/check-probe-cli-shim.ts"
-		},
-		{
-			"claim": "RUNNER-ARMING-ORDER",
-			"title": "injecting the probe's own override BEFORE the ambient-override refusal — the checkpoint then inspects the override the probe just installed and REFUSES every run, loudly but for the wrong reason, while the operator's ambient environment is never examined at all",
-			"subject": "scripts/smoke-acp-ordering-probe-live.ts",
-			"find": ["\t\tassertNoAmbientOverride(spawnEnv, `composed acp child env for ${runId}`);"],
-			"replace": [
-				"\t\tspawnEnv[AMBIENT_OVERRIDE_ENV] = SHIM_TARGET.path;",
-				"\t\tassertNoAmbientOverride(spawnEnv, `composed acp child env for ${runId}`);"
-			],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:RUNNER-ARMING-ORDER]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "RUNNER-SHIM-OVERRIDE-EXACT",
-			"title": "pointing the shim's exec target at itself instead of the resolved CLI — the instrument would recurse rather than measure",
-			"subject": "scripts/smoke-acp-ordering-probe-live.ts",
-			"find": ["\t\tspawnEnv[PROBE_SHIM_ENV.target] = CLI_TARGET.path;"],
-			"replace": ["\t\tspawnEnv[PROBE_SHIM_ENV.target] = SHIM_TARGET.path;"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:RUNNER-SHIM-OVERRIDE-EXACT]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "RUNNER-SHIM-PRECONDITION-PINNED",
-			"title": "arming a shim that never passed the native-branch/executable asserts — a script-suffixed or unrunnable instrument changes which launch branch the pair measures",
-			"subject": "scripts/smoke-acp-ordering-probe-live.ts",
-			"find": ["\t\tSHIM_TARGET = await resolveProbeCliTarget({ env: {}, resolveNative: async () => PROBE_SHIM });"],
-			"replace": ["\t\tSHIM_TARGET = { path: PROBE_SHIM, sha256: \"unverified\" };"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:RUNNER-SHIM-PRECONDITION-PINNED]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "RUNNER-SNAPSHOT-CHANNEL-ARMED",
-			"title": "leaving a run declaring the channel unarmed — shim-shaped evidence under an unarmed roster is ignored, so a run whose instrument never reported in reads as an ordinary absence",
-			"subject": "scripts/smoke-acp-ordering-probe-live.ts",
-			"find": ["\t\tsnapshotInstrumented: true,"],
-			"replace": ["\t\tsnapshotInstrumented: false,"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:RUNNER-SNAPSHOT-CHANNEL-ARMED]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "RUNNER-SHIM-ON-DISK-NATIVE",
-			"title": "arming a script-suffixed shim path — the SDK would run the instrument through `node|bun <path>`, the branch the pair's target is asserted NOT to be on",
-			"subject": "scripts/smoke-acp-ordering-probe-live.ts",
-			"find": ["const PROBE_SHIM = join(REPO_ROOT, \"scripts\", \"fixtures\", \"probe-cli-shim\");"],
-			"replace": ["const PROBE_SHIM = join(REPO_ROOT, \"scripts\", \"fixtures\", \"probe-cli-shim.mjs\");"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:RUNNER-SHIM-ON-DISK-NATIVE]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "RUNNER-SHIM-RUNTIME-PINNED",
-			"title": "neutralising the post-pair instrument rehash — an implementation edit landing between control and intervention leaves both runs voting as though they shared one shim",
-			"subject": "scripts/smoke-acp-ordering-probe-live.ts",
-			"find": ["\t\tshimRehash = hashShimRuntime();"],
-			"replace": ["\t\tshimRehash = SHIM_RUNTIME;"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:RUNNER-SHIM-RUNTIME-PINNED]",
-			"signatureSource": "scripts/check-probe-ordering.ts"
-		},
-		{
-			"claim": "RUNNER-SHIM-RUNTIME-GRAPH-EXACT",
-			"title": "dropping a module the shim actually reads from the pinned instrument graph — that file is then free to change mid-pair with nothing observing it",
-			"subject": "scripts/smoke-acp-ordering-probe-live.ts",
-			"find": ["\tjoin(REPO_ROOT, \"scripts\", \"lib\", \"probe-event-log.ts\"),"],
-			"replace": ["\t// pinned elsewhere"],
-			"gate": ["bash", "run.sh", "check-probe-ordering"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:RUNNER-SHIM-RUNTIME-GRAPH-EXACT]",
+			"signature": "[QK:NO-PRODUCTION-PROMPT-CUTOFF]",
 			"signatureSource": "scripts/check-probe-ordering.ts"
 		}
 	]