@junghanacs/entwurf 0.13.1 → 0.14.0

package/scripts/mutants/release-gate.json

@@ -100,6 +100,41 @@
 			"timeoutSeconds": 180,
 			"signature": "[QK:NO-SILENT-AGGREGATE-OMISSION]",
 			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "QUALIFICATION-SCHEDULING-REACHABLE",
+			"title": "release_gate stops invoking check-gate-qualification — the discriminating-power step moved out of the default chain silently vanishes from the cut while VERIFY still promises it",
+			"subject": "run.sh",
+			"find": ["  if (cd \"$REPO_DIR\" && bash \"$self\" check-gate-qualification); then"],
+			"replace": ["  if (cd \"$REPO_DIR\" && true); then"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:QUALIFICATION-SCHEDULING-REACHABLE]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "CI-FULL-FLOOR-QUALIFIED",
+			"title": "the CI check job is downgraded from the full deterministic floor back to the ≤60s everyday core — the #70 tier rename regression, where qualification still runs once on every push but now certifies kill-power over a floor no candidate ships on, and the hermetic/package tiers reach machine time nowhere",
+			"subject": ".github/workflows/ci.yml",
+			"find": ["      - run: pnpm run check:full"],
+			"replace": ["      - run: pnpm check"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CI-FULL-FLOOR-QUALIFIED]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "MUX-LIFECYCLE-IS-RELEASE-MUST",
+			"title": "the integrated mux lifecycle stays listed but bypasses run_live_step, so a missing prerequisite returns SKIP into a branch that never classifies it and the cut reads green",
+			"subject": "run.sh",
+			"find": [
+				"  run_live_step \"smoke-mux-lifecycle-live (mux public-harness lifecycle: fresh -> send -> dormant -> same-id visible resume -> recall)\" gate bash \"$self\" smoke-mux-lifecycle-live"
+			],
+			"replace": ["  bash \"$self\" smoke-mux-lifecycle-live"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:MUX-LIFECYCLE-IS-RELEASE-MUST]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
 		}
 	]
 }

package/scripts/mutants/resume-args.json

@@ -0,0 +1,76 @@
+{
+	"schemaVersion": 1,
+	"lane": "resume-args",
+	"mutants": [
+		{
+			"claim": "RESUMEARGS-NO-HEADLESS",
+			"title": "the headless prefix comes back — the shape that puts a JSON stream in the operator's window instead of a session",
+			"subject": "pi-extensions/lib/entwurf-resume-args.ts",
+			"find": ["\tconst args: string[] = [\"--entwurf-control\"];"],
+			"replace": ["\tconst args: string[] = [\"--mode\", \"json\", \"-p\", \"--entwurf-control\"];"],
+			"gate": ["bash", "run.sh", "check-entwurf-resume-args"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:RESUMEARGS-NO-HEADLESS]",
+			"signatureSource": "scripts/check-entwurf-resume-args.ts"
+		},
+		{
+			"claim": "RESUMEARGS-CONTROL-FIRST",
+			"title": "the control flag stops leading the argv, so the resumed session's socket posture depends on argv order",
+			"subject": "pi-extensions/lib/entwurf-resume-args.ts",
+			"find": ["\tconst args: string[] = [\"--entwurf-control\"];\n\targs.push(...input.explicitExtensionArgs);"],
+			"replace": [
+				"\tconst args: string[] = [];\n\targs.push(...input.explicitExtensionArgs);\n\targs.push(\"--entwurf-control\");"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-resume-args"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:RESUMEARGS-CONTROL-FIRST]",
+			"signatureSource": "scripts/check-entwurf-resume-args.ts"
+		},
+		{
+			"claim": "RESUMEARGS-EXT-ONCE-BEFORE-SESSION",
+			"title": "the bridge args are emitted twice — a different broken argv than dropping them, and just as invisible",
+			"subject": "pi-extensions/lib/entwurf-resume-args.ts",
+			"find": ["\targs.push(...input.explicitExtensionArgs);\n\targs.push(\"--session\", input.sessionFile);"],
+			"replace": [
+				"\targs.push(...input.explicitExtensionArgs);\n\targs.push(...input.explicitExtensionArgs);\n\targs.push(\"--session\", input.sessionFile);"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-resume-args"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:RESUMEARGS-EXT-ONCE-BEFORE-SESSION]",
+			"signatureSource": "scripts/check-entwurf-resume-args.ts"
+		},
+		{
+			"claim": "RESUMEARGS-SESSION-IS-FILE",
+			"title": "--session-id returns, which CREATES the id when missing and mints an empty session instead of resuming one",
+			"subject": "pi-extensions/lib/entwurf-resume-args.ts",
+			"find": ["\targs.push(\"--session\", input.sessionFile);"],
+			"replace": ["\targs.push(\"--session-id\", input.sessionFile);"],
+			"gate": ["bash", "run.sh", "check-entwurf-resume-args"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:RESUMEARGS-SESSION-IS-FILE]",
+			"signatureSource": "scripts/check-entwurf-resume-args.ts"
+		},
+		{
+			"claim": "RESUMEARGS-PROVIDER-OPTIONAL",
+			"title": "an absent provider is emitted as an empty flag value instead of no flag",
+			"subject": "pi-extensions/lib/entwurf-resume-args.ts",
+			"find": ["\tif (input.provider) args.push(\"--provider\", input.provider);"],
+			"replace": ["\targs.push(\"--provider\", input.provider ?? \"\");"],
+			"gate": ["bash", "run.sh", "check-entwurf-resume-args"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:RESUMEARGS-PROVIDER-OPTIONAL]",
+			"signatureSource": "scripts/check-entwurf-resume-args.ts"
+		},
+		{
+			"claim": "RESUMEARGS-NO-PROMPT-TAIL",
+			"title": "a positional rides after the model again — a resume that runs a turn instead of just reopening the window",
+			"subject": "pi-extensions/lib/entwurf-resume-args.ts",
+			"find": ["\targs.push(\"--model\", input.model);"],
+			"replace": ["\targs.push(\"--model\", input.model, \"continue\");"],
+			"gate": ["bash", "run.sh", "check-entwurf-resume-args"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:RESUMEARGS-NO-PROMPT-TAIL]",
+			"signatureSource": "scripts/check-entwurf-resume-args.ts"
+		}
+	]
+}

package/scripts/mutants/resume-launch-identity.json

@@ -0,0 +1,96 @@
+{
+	"schemaVersion": 1,
+	"lane": "resume-launch-identity",
+	"mutants": [
+		{
+			"claim": "RESUME-ID-HEADER-INTEGRITY",
+			"title": "the C3 integrity check is dropped, so a stale or foreign transcriptPath resumes another being's session",
+			"subject": "pi-extensions/lib/resume-launch-identity.ts",
+			"find": [
+				"\tif (identity.sessionId !== record.nativeSessionId) {",
+				"\t\tthrow new Error(",
+				"\t\t\t`resume-launch-identity: ${gardenId} transcript header id \"${identity.sessionId ?? \"(none)\"}\" ` +",
+				"\t\t\t\t`does not match the record's nativeSessionId \"${record.nativeSessionId}\" — the recorded transcriptPath ` +",
+				"\t\t\t\t`is stale or points at a foreign session file; refusing to resume another being's transcript.`,",
+				"\t\t);",
+				"\t}"
+			],
+			"replace": ["\t// integrity check removed"],
+			"gate": ["bash", "run.sh", "check-resume-launch-identity"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:RESUME-ID-HEADER-INTEGRITY]",
+			"signatureSource": "scripts/check-resume-launch-identity.ts"
+		},
+		{
+			"claim": "RESUME-ID-ADDRESSABLE-READ",
+			"title": "the leaf is \"simplified\" back to the plain targeted read, so two records sharing one native session both resolve and resume one transcript under two locks (#52)",
+			"subject": "pi-extensions/lib/resume-launch-identity.ts",
+			"find": ["import { readAddressableMetaIdentity } from \"./meta-session.ts\";"],
+			"replace": ["import { readMetaIdentityByGardenId as readAddressableMetaIdentity } from \"./meta-session.ts\";"],
+			"gate": ["bash", "run.sh", "check-resume-launch-identity"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:RESUME-ID-ADDRESSABLE-READ]",
+			"signatureSource": "scripts/check-resume-launch-identity.ts"
+		},
+		{
+			"claim": "RESUME-ID-MISSING-TRANSCRIPT-CAUSE",
+			"title": "the transcript existence guard is removed, so a deleted transcript falls through readSessionIdentity's ENOENT swallow and is reported as \"no recorded model\" (F7)",
+			"subject": "pi-extensions/lib/resume-launch-identity.ts",
+			"find": [
+				"\tif (!existsSync(sessionFile)) {",
+				"\t\tthrow new Error(",
+				"\t\t\t`resume-launch-identity: ${gardenId} recorded transcriptPath \"${sessionFile}\" ` +",
+				"\t\t\t\t`does not exist on disk — the transcript was deleted, or the record carries a phantom ` +",
+				"\t\t\t\t`path from a pre-guard birth; nothing to resume.`,",
+				"\t\t);",
+				"\t}"
+			],
+			"replace": ["\t// existence guard removed"],
+			"gate": ["bash", "run.sh", "check-resume-launch-identity"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:RESUME-ID-MISSING-TRANSCRIPT-CAUSE]",
+			"signatureSource": "scripts/check-resume-launch-identity.ts"
+		},
+		{
+			"claim": "RESUME-ID-GATE-SSOT",
+			"title": "the preserved leaf's header stops naming the gate that certifies it, so a consumer-zero identity module ships on prose again",
+			"subject": "pi-extensions/lib/resume-launch-identity.ts",
+			"find": [
+				" * So this leaf is preserved deliberately, with no consumer in the shipped tree today.",
+				" * `check-resume-launch-identity` holds its contract so the record-integrity rules below —"
+			],
+			"replace": [
+				" * So this leaf is preserved deliberately for the later visible lane.",
+				" * The record-integrity rules below —"
+			],
+			"gate": ["bash", "run.sh", "check-resume-launch-identity"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:RESUME-ID-GATE-SSOT]",
+			"signatureSource": "scripts/check-resume-launch-identity.ts"
+		},
+		{
+			"claim": "RESUME-ID-BACKEND-TYPED-REFUSAL",
+			"title": "the backend miss degrades to a bare Error, so callers must parse a sentence or read the record twice to learn it was a capability boundary",
+			"subject": "pi-extensions/lib/resume-launch-identity.ts",
+			"find": ["\t\tthrow new ResumeBackendUnsupportedError(gardenId, record.backend);"],
+			"replace": [
+				"\t\tthrow new Error(`resume-launch-identity: ${gardenId} is a ${record.backend} citizen — resume is pi-only.`);"
+			],
+			"gate": ["bash", "run.sh", "check-resume-launch-identity"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:RESUME-ID-BACKEND-TYPED-REFUSAL]",
+			"signatureSource": "scripts/check-resume-launch-identity.ts"
+		},
+		{
+			"claim": "RESUME-ID-SESSION-ABSOLUTE",
+			"title": "a relative recorded transcriptPath is accepted, so --session resolves inside the window's own cwd and a different transcript is reopened under a correct-looking receipt",
+			"subject": "pi-extensions/lib/resume-launch-identity.ts",
+			"find": ["\tif (!path.isAbsolute(sessionFile)) {"],
+			"replace": ["\tif (path.isAbsolute(sessionFile) && false) {"],
+			"gate": ["bash", "run.sh", "check-resume-launch-identity"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:RESUME-ID-SESSION-ABSOLUTE]",
+			"signatureSource": "scripts/check-resume-launch-identity.ts"
+		}
+	]
+}

package/scripts/mutants/v2-surface.json

@@ -7,14 +7,10 @@
 			"title": "MCP long description reverts to the false \"socket paths take a per-target lock\" claim",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\t\"native-push-no-resume-authority. LOCK: taken for a control-socket-DOMAIN dispatch — the live send AND \" +",
-				"\t\t\"the dormant cell's spawn-bg resume, a separate transport that still runs under that domain's lock. The \" +",
+				"\t\t\"LOCK: taken for a control-socket-DOMAIN dispatch. The \" +",
 				"\t\t\"mailbox and native-push rails are lock-free — deliverability and the adapter probe guard them. mode \" +"
 			],
-			"replace": [
-				"\t\t\"native-push-no-resume-authority. LOCK POLICY: socket paths take a per-target lock; the mailbox path \" +",
-				"\t\t\"does not. mode \" +"
-			],
+			"replace": ["\t\t\"LOCK POLICY: socket paths take a per-target lock; the mailbox path does not. mode \" +"],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-MCP-LOCK-DOMAIN]",
@@ -25,12 +21,10 @@
 			"title": "pi-native mode param reverts to \"Delivery mode for a live send\" (false for native-push)",
 			"subject": "pi-extensions/entwurf-control.ts",
 			"find": [
-				"\t\t\t\tdescription:",
 				"\t\t\t\t\t\"Injection style for a CONTROL-SOCKET send only: steer (immediate) or follow_up (after task). \" +",
-				"\t\t\t\t\t\"The mailbox, native-push, and spawn-bg plans carry no mode, so it has no effect on those rails.\","
+				"\t\t\t\t\t\"The mailbox and native-push plans carry no mode, so it has no effect on those rails.\","
 			],
 			"replace": [
-				"\t\t\t\tdescription:",
 				"\t\t\t\t\t\"Delivery mode for a live send: steer (immediate, interrupt the current turn) or follow_up \" +",
 				"\t\t\t\t\t\"(queued after the current task finishes running to completion).\","
 			],
@@ -61,22 +55,68 @@
 			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
 		},
 		{
-			"claim": "V2SURF-MERGED-REJECT",
-			"title": "MCP long description merges the two owned rejects back under backend-liveness-unsupported",
+			"claim": "V2SURF-DORMANT-HONESTY",
+			"title": "MCP long description advertises owned-outcome as a selectable dormant verb again and drops the reason a dormant target actually returns",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\t\"owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY — live target → \" +",
-				"\t\t\"owned-live-no-autosend, self-fetch → backend-liveness-unsupported, native-push → \" +",
-				"\t\t\"native-push-no-resume-authority. LOCK: taken for a control-socket-DOMAIN dispatch — the live send AND \" +"
+				"\t\t\"DORMANT IS UNREACHABLE: a socket-domain citizen that is not running gets dormant-fire-forget-unsupported \" +",
+				"\t\t\"— same receiver rule as the mailbox, no active drainer means no delivery. \" +",
+				"\t\t\"The intent that used to answer there, owned-outcome, resumed it by launching a hidden background child \" +",
+				"\t\t\"and was withdrawn under the visible-first rule — re-open the session yourself, then dispatch again. \" +"
 			],
 			"replace": [
-				"\t\t\"owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY — live target → \" +",
-				"\t\t\"owned-live-no-autosend, and on self-fetch and native-push alike it is rejected as \" +",
-				"\t\t\"backend-liveness-unsupported. LOCK: taken for a control-socket-DOMAIN dispatch — the live send AND \" +"
+				"\t\t\"owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY and is never auto-converted. \" +"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2SURF-DORMANT-HONESTY]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "V2SURF-INDETERMINATE-NO-START",
+			"title": "the indeterminate hint reverts to a socket that \"answered\" and drops the no-start facts — overclaiming a reply that a permission-refused or timed-out probe never got",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": [
+				"\t\tcase \"indeterminate-no-spawn\":",
+				"\t\t\t// The socket probe did not settle, so liveness is UNKNOWN — an unestablished probe",
+				"\t\t\t// is not a measured death, and dispatching into it could double-deliver. Say",
+				"\t\t\t// \"the PROBE was inconclusive\", never \"the socket answered inconclusively\":",
+				"\t\t\t// `indeterminate` also covers a probe that got no answer at all, was refused by",
+				"\t\t\t// permissions, or timed out, and \"answered\" claims a reply that may never have",
+				"\t\t\t// existed. The wire id is FROZEN and still spells \"-no-spawn\"; it names the rule",
+				"\t\t\t// (never dispatch into an indeterminate target), not a capability that still",
+				"\t\t\t// exists. So the hint's job is to say plainly what did NOT happen: nothing",
+				"\t\t\t// delivered, nothing started.",
+				"\t\t\treturn (",
+				"\t\t\t\t\"the control-socket probe was inconclusive, so the target's liveness is UNKNOWN — this is not a \" +",
+				"\t\t\t\t\"measured death. NOTHING was delivered and NO process was started (the reason id keeps its frozen \" +",
+				"\t\t\t\t\"'-no-spawn' wire spelling from an era when one could be; entwurf_v2 starts nothing on any rail). \" +",
+				"\t\t\t\t\"Re-run entwurf_peers to re-probe; if it stays indeterminate, check for a stale socket file left at \" +",
+				"\t\t\t\t\"that garden id by a session that died without cleaning up.\"",
+				"\t\t\t);"
+			],
+			"replace": [
+				"\t\tcase \"indeterminate-no-spawn\":",
+				"\t\t\treturn \"the target's control socket answered inconclusively; retry.\";"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2SURF-INDETERMINATE-NO-START]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "V2SURF-PEERS-DEAD-ROW",
+			"title": "entwurf_peers drops the dead-row sentence, so a dormant citizen is listed with nothing saying it is unreachable",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": [
+				"\t\t\"row. A `dead` row is a REPORTED FACT and nothing more: that citizen is dormant and is \" +",
+				"\t\t\"currently unreachable by any verb, so listing it grants no action — appearing here is not \" +",
+				"\t\t\"an invitation to dispatch. In particular `unsupported` does NOT mean mailbox: it means this backend has no \" +"
 			],
+			"replace": ["\t\t\"row. In particular `unsupported` does NOT mean mailbox: it means this backend has no \" +"],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
-			"signature": "[QK:V2SURF-MERGED-REJECT]",
+			"signature": "[QK:V2SURF-PEERS-DEAD-ROW]",
 			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
 		},
 		{

package/scripts/mutants/v2-visible-resume.json

@@ -0,0 +1,215 @@
+{
+	"schemaVersion": 1,
+	"lane": "v2-visible-resume",
+	"mutants": [
+		{
+			"claim": "V2RESUME-LIVE-REFUSED",
+			"title": "the live check inverts, so a running citizen gets a second window on its own transcript",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tif (mapped.liveness === \"alive\") {"],
+			"replace": ["\t\tif (mapped.liveness === \"dead\") {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-LIVE-REFUSED]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-INDETERMINATE-NO-START",
+			"title": "an inconclusive probe stops being a refusal, so a citizen that may be running is resumed anyway",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tif (mapped.liveness === \"indeterminate\") {"],
+			"replace": ["\t\tif (mapped.liveness === \"alive\") {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-INDETERMINATE-NO-START]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-CONFLICT-NO-START",
+			"title": "a corrupt control-socket address stops being a refusal and a citizen is stood up behind it",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tif (\"addressConflict\" in mapped) {"],
+			"replace": ["\t\tif (\"addressConflictNever\" in mapped) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CONFLICT-NO-START]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-LOCKED-NO-RESOLVE",
+			"title": "a lock conflict is read as success, so the record is opened behind another holder's lock",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (!acquired.ok) {"],
+			"replace": ["\tif (!acquired.ok && acquired.conflict.reason !== \"target-locked\") {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-LOCKED-NO-RESOLVE]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-NO-TRANSCRIPT-FAILS-LOUD",
+			"title": "the leaf's cause-rich throw is swallowed into a placeholder identity, so an unresumable citizen opens a window anyway",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": [
+				"\t\tlet identity: LaunchIdentity;",
+				"\t\ttry {",
+				"\t\t\tidentity = deps.resolveIdentity(targetGardenId);",
+				"\t\t} catch (err) {"
+			],
+			"replace": [
+				"\t\tlet identity: LaunchIdentity;",
+				"\t\ttry {",
+				"\t\t\tidentity = deps.resolveIdentity(targetGardenId);",
+				"\t\t} catch (err) {",
+				"\t\t\tif (!(err instanceof ResumeBackendUnsupportedError))",
+				"\t\t\t\treturn { ok: false, reason: \"target-invalid\", detail: String(err) };"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-NO-TRANSCRIPT-FAILS-LOUD]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-OBSERVE-IS-BOUNDED-WAIT",
+			"title": "the observation becomes a single immediate probe, which reports every real resume as unobserved (the socket answers ~2-4s later)",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tawait deps.sleep(intervalMs);"],
+			"replace": ["\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-OBSERVE-IS-BOUNDED-WAIT]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-UNOBSERVED-IS-REAL",
+			"title": "a timeout claims the socket answered, turning the one fact that says the citizen is back into a guess",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"],
+			"replace": ["\t\t\treturn { kind: \"socket-alive\", socketPath, waitedMs: deps.now() - started };"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-UNOBSERVED-IS-REAL]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-RELEASE-FAILURE-LOUD",
+			"title": "a release that did not release is folded into a green receipt, leaving a held lock nobody is told about",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tif (outcome !== \"released\") {"],
+			"replace": ["\t\tif (outcome !== \"released\" && outcome !== \"not-owned\" && outcome !== \"absent\") {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-RELEASE-FAILURE-LOUD]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-ARGV-FROM-RECORD",
+			"title": "the launcher is handed the caller's own directory instead of the record's, so the citizen returns in the wrong project",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tconst launched = deps.launch({ cwd: identity.cwd, runtimeArgs });"],
+			"replace": ["\t\tconst launched = deps.launch({ cwd: process.cwd(), runtimeArgs });"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-ARGV-FROM-RECORD]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-RECEIPTS-SEPARATE",
+			"title": "the launch receipt absorbs the observation, so 'a window opened' and 'the citizen is back' become one claim",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\tlaunch: { targetGardenId, sessionFile: identity.sessionFile, handle: launched.handle },"],
+			"replace": [
+				"\t\t\tlaunch: { targetGardenId, sessionFile: identity.sessionFile, handle: launched.handle, kind: observation.kind } as ResumeLaunchReceipt,"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-RECEIPTS-SEPARATE]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-RENDER-SEPARATES",
+			"title": "the rendered text merges the two receipts into one sentence, so a reader cannot tell which fact is missing",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": [
+				"\t\t\t`LAUNCH receipt: tmux created that window and was asked to start pi on the transcript above.\\n` +"
+			],
+			"replace": ["\t\t\t`Resume complete.\\n` +"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-RENDER-SEPARATES]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-IDENTITY-BEFORE-WINDOW",
+			"title": "the liveness preflight runs BEFORE the record is read, so dormancy is judged for a citizen whose transcript has not been proven resumable yet",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tlet identity: LaunchIdentity;"],
+			"replace": ["\t\tawait deps.inspectSocket(targetGardenId);", "\t\tlet identity: LaunchIdentity;"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-IDENTITY-BEFORE-WINDOW]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-TIMEOUT-RELEASES",
+			"title": "the timeout path launches a second time — the relaunch this rail refuses, hidden inside what reads as one bounded wait",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"],
+			"replace": [
+				"\t\t\t(deps as VisibleResumeDeps).launch({ cwd: \"/tmp\", runtimeArgs: [] });\n\t\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-TIMEOUT-RELEASES]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-LOCK-BEFORE-LIVENESS",
+			"title": "the lock stops being taken first, so a competing resume can pass its own dead check while this one is launching",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tconst acquired = deps.acquireLock(targetGardenId);"],
+			"replace": ["\tawait deps.inspectSocket(targetGardenId);\n\tconst acquired = deps.acquireLock(targetGardenId);"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-LOCK-BEFORE-LIVENESS]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-NOT-PI-REFUSED",
+			"title": "an out-of-domain backend is reported as an error instead of a named refusal, so a fine record reads as a broken one",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\tif (err instanceof ResumeBackendUnsupportedError) {"],
+			"replace": ["\t\t\tif (false && err instanceof ResumeBackendUnsupportedError) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-NOT-PI-REFUSED]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-NOT-PI-BY-FIELD",
+			"title": "the backend is re-derived instead of taken from the typed error, which is the second read this rail refuses",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": [
+				"\t\t\t\t\t\t`${targetGardenId} is a ${err.backend} citizen; only pi citizens stand a control socket up, ` +"
+			],
+			"replace": [
+				"\t\t\t\t\t\t`${targetGardenId} is a citizen of another backend; only pi citizens stand a control socket up, ` +"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-NOT-PI-BY-FIELD]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		},
+		{
+			"claim": "V2RESUME-SHARED-ID-GRAMMAR",
+			"title": "the address grammar is re-implemented locally, where it can drift from the record, the lock path and the socket filename it becomes",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (!isValidSessionId(targetGardenId)) {"],
+			"replace": ["\tif (!/^\\d{8}T\\d{6}-[0-9a-f]{6}$/.test(targetGardenId)) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-SHARED-ID-GRAMMAR]",
+			"signatureSource": "scripts/check-entwurf-v2-visible-resume.ts"
+		}
+	]
+}

package/scripts/new-session-id.ts

@@ -1,11 +1,16 @@
 /**
  * new-session-id — print one fresh garden-native sessionId and exit.
  *
- * The garden launcher (operator alias / wrapper) calls this so every
- * `--entwurf-control` session is born a garden citizen:
+ * NOT a launcher contract. #50 C2 retired the injection form
+ * (`pi --session-id "$(./run.sh new-session-id)" --entwurf-control …`): pi mints its
+ * own session id (a `uuidv7` is normal), `session_start` attaches that session to its
+ * meta-record, and the RECORD mints the garden id and keys the control socket on it.
+ * Injecting a garden-shaped id gives a session two address-shaped strings of which only
+ * one is an address. Launch is plain `pi --entwurf-control` (README §Garden launcher).
  *
- *   pi --session-id "$(./run.sh new-session-id)" --entwurf-control \
- *      --emacs-agent-socket server …
+ * What survives is this: the operator-facing generator for the same id grammar the
+ * record layer itself uses — one fresh id on stdout, for a caller that needs to mint a
+ * token deliberately, never as a launch argument.
  *
  * The id is `generateSessionId()` from entwurf-core — the single SSOT for the
  * locked `YYYYMMDDTHHMMSS-[0-9a-f]{6}` grammar. Do NOT reimplement the format in

package/scripts/smoke-acp-raw-turn-live.ts

@@ -3,7 +3,7 @@
 //   LIVE=1 ./run.sh smoke-acp-raw-turn-live
 //
 // What this proves (and ONLY this): the pinned Claude ACP adapter
-// (@agentclientprotocol/claude-agent-acp@0.64.0) spawns, speaks the ACP wire
+// (@agentclientprotocol/claude-agent-acp@0.66.0) spawns, speaks the ACP wire
 // protocol over stdio NDJSON, and returns one real model turn. It is the
 // bytes-flow proof that the S2a dep surface is not just installable but
 // actually drivable — before any provider/overlay/streamSimple code (S2b+).

package/scripts/smoke-agy-native-push-live.ts

@@ -4,11 +4,11 @@
  * adapter (pgrep/ss/`agentapi get-conversation-metadata`+`send-message`), the register core,
  * and `runEntwurfV2` with production deps — against a REAL, already-running agy conversation,
  * and asserts the rail end to end: probe finds the volatile route, register create/re-attach is
- * idempotent, a fire-and-forget dispatches over native-push (delivered), an owned-outcome is
- * rejected (no resume authority), and a bogus conversation is rejected (probe-indeterminate).
+ * idempotent, a fire-and-forget dispatches over native-push (delivered), and a bogus conversation
+ * is rejected (probe-indeterminate).
  *
  * This automates what the GPT manual L1~L5 pass proved by hand (register create/attach, v2
- * native-push delivered ×2, owned reject, mailbox/marker/pi-domain non-intrusion) — same
+ * native-push delivered ×2, mailbox/marker/pi-domain non-intrusion) — same
  * production MCP surface, now a repeatable gate.
  *
  * STORE ISOLATION (페블-approved): only the agy CONVERSATION round-trip is real (that is the
@@ -189,20 +189,9 @@ async function main(): Promise<void> {
 		const post = await antigravityAdapter.probe(conversationId);
 		ok("post-send re-probe still alive (delivery target reachable, D7 partial)", post.status === "alive");
 
-		// ── 5. owned-outcome → rejected: a native-push backend has no resume authority ──
-		const owned: EntwurfV2RunResult = await runEntwurfV2(
-			{ target: reg1.gardenId, intent: "owned-outcome", message: "should be rejected" },
-			prodDeps,
-		);
-		ok(
-			"owned-outcome rejected as native-push-no-resume-authority",
-			owned.kind === "rejected" && owned.receipt.reason === "native-push-no-resume-authority",
-		);
-		ok(
-			"owned reject stamped observedLiveness (post-probe, non-null)",
-			owned.kind === "rejected" && owned.receipt.observedLiveness !== null,
-		);
-
+		// ── 5. (retired) the owned-outcome × native-push refusal cell. The intent was removed
+		// from the contract in the visible-first cut, so there is no longer a call to make here:
+		// a caller cannot declare it, and the reason it produced left the taxonomy with it. ──
 		// ── 6. bogus conversation → rejected native-push-probe-indeterminate ──
 		// agy is alive but no LS port serves this fabricated conv id → INDETERMINATE (never coerced
 		// to dead). A meta-record is upserted DIRECTLY (register would refuse a non-live probe), so

package/scripts/smoke-entwurf-v2-matrix-live.ts

@@ -260,7 +260,7 @@ async function main(): Promise<void> {
 			const up = await waitForSocket(sockPath, BOOT_TIMEOUT_MS);
 			ok("C1b real record-less `pi --entwurf-control` stood up a control socket", up);
 
-			for (const intent of ["fire-and-forget", "owned-outcome"] as const) {
+			for (const intent of ["fire-and-forget"] as const) {
 				const result: EntwurfV2RunResult = await runEntwurfV2(
 					{ target: c1bGid, intent, message: `matrix-live C1b record-less probe (${intent})` },
 					prodDeps(smokeSender(c1bGid, tmp)),

package/scripts/smoke-meta-honesty.sh

@@ -17,7 +17,7 @@
 #     alarm), and must log sender-marker evidence so send-side replyable identity
 #     is not silently lost.
 #
-# Deterministic + offline (no `claude -p`, no network). Safe for pnpm check /
+# Deterministic + offline (no `claude -p`, no network). Safe for pnpm run check:full /
 # pre-commit. Isolates its store via PI_CODING_AGENT_DIR in a temp dir.
 #
 # RUNTIME DEPS: bash + node (the hook runs under `node --experimental-strip-types`)