@junghanacs/entwurf 0.14.0 → 0.14.1

package/pi-extensions/lib/classify-tmux-cwd.ts

@@ -0,0 +1,50 @@
+/**
+ * classify-tmux-cwd — the ONE classification of a start directory that is about to be handed
+ * to tmux as a `-c` value. Shared leaf of the resume and fresh launch compositions; it owns
+ * the classification and NOTHING else — no hints (each consumer phrases its own: resume says
+ * "recorded cwd", fresh says "requested cwd"), no argv, no tmux, no fallback directory.
+ *
+ * Every rule below is a MEASURED tmux 3.6a behaviour (2026-08-06, private server), and each
+ * one is a way a launch would look successful while being wrong:
+ *
+ *   1. a NONEXISTENT `-c` is silent. tmux exits 0, opens the window, and the child falls back
+ *      to `$HOME`. A launch whose directory has been deleted would therefore open a visible
+ *      window in the wrong project and look successful. Nothing downstream can catch that:
+ *      the launch receipt would be perfectly well-formed.
+ *   2. `-c` is FORMAT-EXPANDED. `#{pane_id}` inside the value silently rewrote the path
+ *      (`<dir>/#{pane_id}` → `<dir>/%0`), and a `#(…)` value was observed running its
+ *      command. A path is data; tmux reads it as a format. So `#` is refused outright.
+ *   3. whitespace is SAFE — argv is an array and nothing re-splits. A dir named `with space`
+ *      arrived intact. So there is no quoting grammar here, and none is owed.
+ *
+ * That is the entire defence: one existence check and one character. No escaping layer, no
+ * sanitiser, no trim, no realpath/symlink policy — a symlinked project dir is a normal thing
+ * to work in, and a value is classified exactly as given.
+ */
+
+import { statSync } from "node:fs";
+import path from "node:path";
+
+/** Why a candidate `-c` value was refused. Four stable literals — both consuming
+ * compositions widen their own reject unions with this type, so the strings are contract. */
+export type TmuxCwdRejectReason = "cwd-not-absolute" | "cwd-format-token" | "cwd-missing" | "cwd-not-directory";
+
+/**
+ * Classify a candidate start directory. Split into separate reasons rather than one because
+ * the operator's next move differs: an absolute-path bug is a caller defect, a missing
+ * directory is a moved/deleted project, and a `#` is a path tmux would rewrite under us.
+ */
+export function classifyTmuxCwd(cwd: string): TmuxCwdRejectReason | null {
+	if (!path.isAbsolute(cwd)) return "cwd-not-absolute";
+	// tmux expands formats inside the `-c` VALUE. `#{…}` rewrote the path silently and `#(…)`
+	// was observed executing; neither is something to escape our way out of.
+	if (cwd.includes("#")) return "cwd-format-token";
+	let st: ReturnType<typeof statSync>;
+	try {
+		st = statSync(cwd);
+	} catch {
+		// tmux would NOT report this — it opens the window and lands the child in $HOME.
+		return "cwd-missing";
+	}
+	return st.isDirectory() ? null : "cwd-not-directory";
+}

package/pi-extensions/lib/mux-fresh-call.ts

@@ -25,9 +25,28 @@
  *      caller's own inbound surface. Merging them would claim knowledge this module cannot have.
  *   4. A launch with no callback is a REAL outcome, not an error to retry. No watcher, no poll,
  *      no timeout supervisor. The window is visible; the operator can look.
+ *
+ * ── The optional REQUESTED cwd (issue #73) ──
+ *
+ * A fresh sibling starts wherever the caller happens to be — unless the caller names ONE
+ * literal start directory. That input exists so a cross-repo fresh consultation never has to
+ * ride `entwurf_resume_call` for a dormant record's recorded cwd: resume stays a continuity
+ * verb, and placement pressure stays here. The rules are deliberately narrow:
+ *
+ *   - `undefined` and the exact empty string mean OMIT: no `-c` reaches tmux and the argv is
+ *     byte-identical to the pre-#73 shape. Anything else is taken LITERALLY — no trim, no
+ *     realpath, no project-name resolution, no store/peers/record lookup. The caller is the
+ *     only cwd authority this module knows.
+ *   - the value is classified by the shared `classify-tmux-cwd.ts` leaf BEFORE any mutation
+ *     (same four stable reasons as resume; the measured tmux 3.6a facts live on that leaf).
+ *     This module's hints phrase them as the REQUESTED cwd; resume's say RECORDED.
+ *   - the receipt echoes what was REQUESTED, exactly as `runtimePath` does. It never reports
+ *     `pane_current_path`: proving where the pane actually landed belongs to acceptance, not
+ *     to the launch receipt.
  */
 
 import { randomBytes } from "node:crypto";
+import { classifyTmuxCwd, type TmuxCwdRejectReason } from "./classify-tmux-cwd.ts";
 import {
 	assertLaunchTarget,
 	LaunchPreconditionError,
@@ -142,10 +161,12 @@ export function buildFreshCallPrompt(params: {
 }
 
 /** A launch that was refused, or a placement that could not be established. Every value is a
- * NAMED refusal — this module has no fallback launch. */
+ * NAMED refusal — this module has no fallback launch and no fallback directory. The cwd members
+ * come from the shared classification leaf and their string values are stable contract. */
 export type FreshCallRejectReason =
 	| PlacementRejectReason
 	| LaunchRejectReason
+	| TmuxCwdRejectReason
 	| "caller-identity-unavailable"
 	| "model-empty"
 	| "model-invalid"
@@ -158,6 +179,10 @@ export type FreshCallRejectReason =
 export interface FreshCallReceipt extends WindowHandle {
 	backend: FreshCallBackend;
 	model: string;
+	/** The REQUESTED start directory — present only when the caller supplied one. The same kind
+	 * of fact as `runtimePath`: what tmux was asked for, never an observation of where the pane
+	 * landed. */
+	cwd?: string;
 	runtimePath: string;
 	nonce: string;
 }
@@ -174,20 +199,28 @@ function defaultRandomHex(): string {
 	return randomBytes(12).toString("hex");
 }
 
-/** Launch argv: the leaf's detached-append shape, the runtime, then the backend's dialect. */
+/** Launch argv: the leaf's detached-append shape, optionally `-c` at the resume-symmetric token
+ * position (after `-t`, before `-P -F`), the runtime, then the backend's dialect. An omitted cwd
+ * yields the exact pre-#73 argv — no carrier at all. */
 export function buildFreshCallArgs(
 	placement: Placement,
 	runtimePath: string,
 	backendArgs: readonly string[],
+	cwd?: string,
 ): string[] {
 	assertSelector("session", placement.sessionId);
 	assertLaunchTarget(runtimePath);
+	if (cwd !== undefined) {
+		const bad = classifyTmuxCwd(cwd);
+		if (bad) throw new Error(`mux-fresh-call: refusing to build argv with an unusable cwd (${bad}): ${cwd}`);
+	}
 	return [
 		"new-window",
 		"-d",
 		"-a",
 		"-t",
 		`${placement.sessionId}:{end}`,
+		...(cwd === undefined ? [] : ["-c", cwd]),
 		"-P",
 		"-F",
 		APPEND_FORMAT,
@@ -207,7 +240,7 @@ export function buildFreshCallArgs(
  * against a store, or guesses it: an empty value is a named refusal, not a lookup.
  */
 export function freshCall(
-	params: { backend: FreshCallBackend; model: string; task: string; callerGardenId: string | null },
+	params: { backend: FreshCallBackend; model: string; task: string; cwd?: string; callerGardenId: string | null },
 	env: NodeJS.ProcessEnv = process.env,
 	nonce: string = mintNonce(),
 ): FreshCallResult {
@@ -220,6 +253,14 @@ export function freshCall(
 	const task = params.task.trim();
 	if (task.length === 0) return { ok: false, reason: "task-empty" };
 	if (task.length > TASK_MAX_CHARS) return { ok: false, reason: "task-too-long" };
+	// ONLY `undefined` and the exact empty string mean "no cwd". Everything else is the literal
+	// value — deliberately untrimmed, so a whitespace-mangled path is refused loudly by the
+	// classification below instead of being silently repaired into a different directory.
+	const cwd = params.cwd === undefined || params.cwd === "" ? undefined : params.cwd;
+	if (cwd !== undefined) {
+		const badCwd = classifyTmuxCwd(cwd);
+		if (badCwd) return { ok: false, reason: badCwd };
+	}
 
 	let runtimePath: string;
 	try {
@@ -240,7 +281,10 @@ export function freshCall(
 		callerGardenId: params.callerGardenId,
 		nonce,
 	});
-	const run = runTmux(buildFreshCallArgs(placement, runtimePath, buildBackendArgs(params.backend, prompt, model)), env);
+	const run = runTmux(
+		buildFreshCallArgs(placement, runtimePath, buildBackendArgs(params.backend, prompt, model), cwd),
+		env,
+	);
 	assertTmuxOk("new-window", run);
 
 	let fields: ReturnType<typeof parseWindowFields>;
@@ -265,6 +309,7 @@ export function freshCall(
 			...fields,
 			backend: params.backend,
 			model,
+			...(cwd === undefined ? {} : { cwd }),
 			runtimePath,
 			nonce,
 		},
@@ -280,6 +325,13 @@ const REJECT_HINT: Record<FreshCallRejectReason, string> = {
 	"anchor-mismatch": "tmux answered about a different pane than the one asked about",
 	"caller-identity-unavailable":
 		"this surface has no record-backed garden id for the caller, so the sibling would have no address to call back to",
+	"cwd-not-absolute":
+		"the requested cwd is not an absolute path (the value is taken literally — nothing trims or resolves it)",
+	"cwd-format-token":
+		"the requested cwd contains '#', which tmux expands as a format inside -c — it would silently rewrite the path or run a command",
+	"cwd-missing":
+		"the requested cwd does not exist; tmux would not report this, it would open the window in $HOME and look successful",
+	"cwd-not-directory": "the requested cwd exists but is not a directory",
 	"model-empty": "model is empty after trimming; fresh calls require an explicit model",
 	"model-invalid": `model must be one ${MODEL_MAX_CHARS}-character argv-safe id/alias without whitespace or tmux syntax`,
 	"task-empty": "task is empty after trimming",
@@ -314,6 +366,7 @@ export function renderFreshCall(result: FreshCallResult): { text: string; isErro
 			`[entwurf fresh call →]\n` +
 			`  backend:  ${r.backend} (${r.runtimePath})\n` +
 			`  model:    ${r.model} (requested on the runtime CLI)\n` +
+			(r.cwd === undefined ? "" : `  cwd:      ${r.cwd} (requested start directory — not an observation)\n`) +
 			`  window:   ${r.windowId} (index ${r.windowIndex}) in session ${r.sessionId}\n` +
 			`  pane:     ${r.paneId} pid ${r.panePid}\n` +
 			`  nonce:    ${r.nonce}\n` +

package/pi-extensions/lib/mux-resume-call.ts

@@ -4,12 +4,13 @@
  *
  * ── Why this is a module and not a parameter on fresh-call ──
  *
- * `mux-fresh-call` carries a TASK to a runtime it names; the sibling starts wherever the caller
- * happens to be. A resume carries neither: the argv comes from the record (`entwurf-v2-visible-
- * resume` builds it) and the cwd comes from the record too — it is the directory the citizen's
- * own transcript header remembers. Those are different inputs with a different risk, so they get
- * a different module rather than a fourth parameter on a composition whose contract is
- * "identity is an OUTPUT".
+ * `mux-fresh-call` carries a TASK to a runtime it names, and starts the sibling wherever the
+ * caller happens to be unless the caller REQUESTS one literal start directory (#73). A resume
+ * carries neither a task nor a caller choice: the argv comes from the record (`entwurf-v2-
+ * visible-resume` builds it) and the cwd comes from the record too — it is the directory the
+ * citizen's own transcript header remembers, never something the caller picks. Those are
+ * different inputs with a different risk, so they get a different module rather than a fourth
+ * parameter on a composition whose contract is "identity is an OUTPUT".
  *
  *   visible-resume composition → resume-call → placement leaf (unchanged, carrier-free)
  *   resume-call               -X-> garden identity, records, locks, delivery
@@ -20,22 +21,15 @@
  *
  * `mux-placement`'s `buildAppendArgs` deliberately emits no `-c` ("default shell only"), and it
  * stays that way — a resume must not widen the leaf's grammar for the three other callers. So
- * the `-c` shape lives here, with the three refusals MEASURED on tmux 3.6a (2026-08-06, private
- * server):
+ * the `-c` SHAPE lives here, while the classification of the value lives in the shared
+ * `classify-tmux-cwd.ts` leaf (fresh-call hands tmux the same flag, and a twin copy of the
+ * measured rules would rot apart on the next tmux hazard). The measured tmux 3.6a facts —
+ * a nonexistent `-c` silently lands the child in `$HOME`, `#` is format-expanded, whitespace
+ * is safe — are documented on that leaf. `|` is fine too: the cwd never enters the `-F` row
+ * (see `APPEND_FORMAT` below).
  *
- *   1. a NONEXISTENT `-c` is silent. tmux exits 0, opens the window, and the child falls back to
- *      `$HOME`. A resume whose recorded cwd has been deleted would therefore open a visible
- *      window in the wrong project and look successful. Nothing downstream can catch that: the
- *      launch receipt would be perfectly well-formed.
- *   2. `-c` is FORMAT-EXPANDED. `#{pane_id}` inside the value silently rewrote the path
- *      (`<dir>/#{pane_id}` → `<dir>/%0`), and a `#(…)` value was observed running its command.
- *      A path is data; tmux reads it as a format. So `#` is refused outright.
- *   3. whitespace is SAFE — argv is an array and nothing re-splits. A dir named `with space`
- *      arrived intact. So there is no quoting grammar here, and none is owed. `|` is fine too:
- *      the cwd never enters the `-F` row (see `APPEND_FORMAT` below).
- *
- * That is the entire defence: one existence check and one character. No escaping layer, no
- * sanitiser, no symlink policy — a symlinked project dir is a normal thing to work in.
+ * What stays HERE is the phrasing: this module's hints say "recorded cwd", because a resume's
+ * directory comes from the record — fresh-call's say "requested cwd" for the same reasons.
  *
  * ── What the receipt does NOT say ──
  *
@@ -47,8 +41,7 @@
  * to acceptance, not to the product's launch receipt.
  */
 
-import { statSync } from "node:fs";
-import path from "node:path";
+import { classifyTmuxCwd, type TmuxCwdRejectReason } from "./classify-tmux-cwd.ts";
 import {
 	assertLaunchTarget,
 	LaunchPreconditionError,
@@ -74,14 +67,9 @@ import {
 export const RESUME_CALL_RUNTIME = "pi";
 
 /** Why a resume window could not be opened. Every value is a NAMED refusal; this module has no
- * fallback launch and no fallback directory. */
-export type ResumeCallRejectReason =
-	| PlacementRejectReason
-	| LaunchRejectReason
-	| "cwd-not-absolute"
-	| "cwd-format-token"
-	| "cwd-missing"
-	| "cwd-not-directory";
+ * fallback launch and no fallback directory. The cwd members come from the shared classification
+ * leaf and their string values are stable contract. */
+export type ResumeCallRejectReason = PlacementRejectReason | LaunchRejectReason | TmuxCwdRejectReason;
 
 /** Coordinates plus what was handed to tmux. `cwd` is the REQUESTED start directory — the same
  * kind of fact as `runtimePath`, namely what tmux was asked for, not an observation. */
@@ -92,26 +80,6 @@ export interface ResumeCallReceipt extends WindowHandle {
 
 export type ResumeCallResult = { ok: true; receipt: ResumeCallReceipt } | { ok: false; reason: ResumeCallRejectReason };
 
-/**
- * Classify a candidate start directory. Split into three reasons rather than one because the
- * operator's next move differs: an absolute-path bug is a caller defect, a missing directory is
- * a moved/deleted project, and a `#` is a path tmux would rewrite under us.
- */
-export function classifyResumeCwd(cwd: string): ResumeCallRejectReason | null {
-	if (!path.isAbsolute(cwd)) return "cwd-not-absolute";
-	// tmux expands formats inside the `-c` VALUE. `#{…}` rewrote the path silently and `#(…)`
-	// was observed executing; neither is something to escape our way out of.
-	if (cwd.includes("#")) return "cwd-format-token";
-	let st: ReturnType<typeof statSync>;
-	try {
-		st = statSync(cwd);
-	} catch {
-		// tmux would NOT report this — it opens the window and lands the child in $HOME.
-		return "cwd-missing";
-	}
-	return st.isDirectory() ? null : "cwd-not-directory";
-}
-
 /**
  * Launch argv: the leaf's detached-append shape plus `-c`, the runtime, then the caller's flags.
  * `--` is what keeps tmux from reading the runtime or its flags as tmux options.
@@ -124,7 +92,7 @@ export function buildResumeCallArgs(
 ): string[] {
 	assertSelector("session", placement.sessionId);
 	assertLaunchTarget(runtimePath);
-	const bad = classifyResumeCwd(cwd);
+	const bad = classifyTmuxCwd(cwd);
 	if (bad) throw new Error(`mux-resume-call: refusing to build argv with an unusable cwd (${bad}): ${cwd}`);
 	return [
 		"new-window",
@@ -154,7 +122,7 @@ export function resumeCall(
 	params: { cwd: string; runtimeArgs: readonly string[] },
 	env: NodeJS.ProcessEnv = process.env,
 ): ResumeCallResult {
-	const badCwd = classifyResumeCwd(params.cwd);
+	const badCwd = classifyTmuxCwd(params.cwd);
 	if (badCwd) return { ok: false, reason: badCwd };
 
 	let runtimePath: string;

package/scripts/check-gate-qualification.ts

@@ -807,8 +807,9 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 		"bridge-boot-resume": 3,
 		"meta-facts": 4,
 		"meta-identity": 4,
+		"meta-retire": 3,
 		"mux-boundary": 14,
-		"mux-fresh-call": 15,
+		"mux-fresh-call": 19,
 		"mux-launcher-fence": 7,
 		"mux-parent-artifact": 3,
 		"mux-resume-call": 12,

package/scripts/check-mux-resume-call.ts

@@ -8,7 +8,8 @@
  *
  * Every cwd claim below is a MEASURED tmux 3.6a behaviour, not a precaution. They were taken on a
  * private server on 2026-08-06, and each one is a way a resume would look successful while being
- * wrong:
+ * wrong. Since #73 the classification itself lives in the shared `classify-tmux-cwd.ts` leaf
+ * (fresh-call consumes the same rules), so the CWD claims here are asserted against that leaf:
  *
  *   MUXRESUME-CWD-MISSING-REFUSED   a nonexistent `-c` does NOT fail: tmux exits 0, opens the
  *                                   window, and the child lands in $HOME. Nothing downstream can
@@ -31,10 +32,10 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { classifyTmuxCwd } from "../pi-extensions/lib/classify-tmux-cwd.ts";
 import type { Placement } from "../pi-extensions/lib/mux-placement.ts";
 import {
 	buildResumeCallArgs,
-	classifyResumeCwd,
 	RESUME_CALL_REJECT_HINT,
 	RESUME_CALL_RUNTIME,
 	type ResumeCallRejectReason,
@@ -77,32 +78,32 @@ function main(): void {
 
 	try {
 		// ── cwd classification ────────────────────────────────────────────────────────
-		ok("an existing absolute directory is accepted", classifyResumeCwd(realDir) === null);
+		ok("an existing absolute directory is accepted", classifyTmuxCwd(realDir) === null);
 
 		ok(
 			"[QK:MUXRESUME-CWD-MISSING-REFUSED] a cwd that no longer exists is refused HERE, because tmux would not refuse it — measured: rc=0, the window opens, and the child silently falls back to $HOME, so the resume would land a visible citizen in the wrong project and look successful",
-			classifyResumeCwd(path.join(tmp, "deleted-project")) === "cwd-missing",
+			classifyTmuxCwd(path.join(tmp, "deleted-project")) === "cwd-missing",
 		);
 		ok(
 			"a path that exists but is a FILE is refused as its own cause, not as missing",
-			classifyResumeCwd(filePath) === "cwd-not-directory",
+			classifyTmuxCwd(filePath) === "cwd-not-directory",
 		);
 		ok(
 			"[QK:MUXRESUME-CWD-FORMAT-REFUSED] a cwd containing '#' is refused unrun — measured: tmux FORMAT-EXPANDS the -c value, so `<dir>/#{pane_id}` silently became `<dir>/%0` and a `#(…)` value was observed executing its command; a path is data and tmux reads it as a format",
-			classifyResumeCwd(path.join(tmp, "#{pane_id}")) === "cwd-format-token" &&
-				classifyResumeCwd(path.join(tmp, "#(touch x)")) === "cwd-format-token",
+			classifyTmuxCwd(path.join(tmp, "#{pane_id}")) === "cwd-format-token" &&
+				classifyTmuxCwd(path.join(tmp, "#(touch x)")) === "cwd-format-token",
 		);
 		ok(
 			"the '#' refusal precedes the filesystem question, whose answer would be about a path tmux is not going to use",
-			classifyResumeCwd(path.join(realDir, "#nope")) === "cwd-format-token",
+			classifyTmuxCwd(path.join(realDir, "#nope")) === "cwd-format-token",
 		);
 		ok(
 			"a relative cwd is refused before anything touches the filesystem",
-			classifyResumeCwd("project") === "cwd-not-absolute",
+			classifyTmuxCwd("project") === "cwd-not-absolute",
 		);
 		ok(
 			"[QK:MUXRESUME-CWD-WHITESPACE-OK] a cwd containing whitespace is ACCEPTED — measured: argv is an array, tmux does not re-split it, and the directory arrived intact; inventing a quoting grammar here would refuse real project paths for a danger that was measured not to exist",
-			classifyResumeCwd(spaceDir) === null,
+			classifyTmuxCwd(spaceDir) === null,
 		);
 
 		// ── argv shape ────────────────────────────────────────────────────────────────

package/scripts/meta-bridge-state.py

@@ -74,7 +74,6 @@ MANAGED_SETTINGS_SCALARS: list[tuple[str, list[str], Any]] = [
     ("promptSuggestionEnabled", ["promptSuggestionEnabled"], False),
     ("awaySummaryEnabled", ["awaySummaryEnabled"], False),
     ("autoMemoryEnabled", ["autoMemoryEnabled"], False),
-    ("skipDangerousModePermissionPrompt", ["skipDangerousModePermissionPrompt"], True),
     ("verbose", ["verbose"], False),
     ("autoCompactEnabled", ["autoCompactEnabled"], False),
     ("showTurnDuration", ["showTurnDuration"], False),
@@ -84,6 +83,19 @@ MANAGED_SETTINGS_SCALARS: list[tuple[str, list[str], Any]] = [
     ("workflowKeywordTriggerEnabled", ["workflowKeywordTriggerEnabled"], False),
 ]
 
+# Keys entwurf used to own but now returns to the operator. An old install-state
+# entry is the only authority to undo our prior write; a bare matching value is
+# not provenance and is never changed. apply() consumes each proven old entry
+# exactly once, then uninstall can no longer restore over the operator's choice.
+RETIRED_SETTINGS_SCALARS: list[tuple[str, list[str], Any]] = [
+    ("skipDangerousModePermissionPrompt", ["skipDangerousModePermissionPrompt"], True),
+]
+
+_managed_scalar_names = {name for name, _path, _desired in MANAGED_SETTINGS_SCALARS}
+_retired_scalar_names = {name for name, _path, _last in RETIRED_SETTINGS_SCALARS}
+if overlap := _managed_scalar_names & _retired_scalar_names:
+    raise RuntimeError(f"settings scalar cannot be both managed and retired: {sorted(overlap)}")
+
 
 class StateError(RuntimeError):
     pass
@@ -391,6 +403,9 @@ def apply(repo: Path, asm: Path) -> None:
     if not isinstance(root, dict):
         die(f"{claude_root_config_path()} root must be a JSON object")
 
+    for name, path_, last_managed_value in RETIRED_SETTINGS_SCALARS:
+        relinquish_retired_scalar(state, settings, name, path_, last_managed_value)
+
     set_nested(settings, ["enabledPlugins", PLUGIN_REF], True)
     set_nested(settings, ["extraKnownMarketplaces", MARKETPLACE], desired_marketplace(asm))
     for path_, desired in [(["permissions", "allow"], PERMISSION_ALLOW), (["permissions", "deny"], PERMISSION_DENY)]:
@@ -446,6 +461,53 @@ def restore_entry(obj: dict[str, Any], entry: dict[str, Any]) -> None:
     die(f"unknown state entry kind: {kind}")
 
 
+def settings_state_keys(state: dict[str, Any]) -> dict[str, Any]:
+    """The settings key ledger, or a loud failure.
+
+    `load_state` validates only the envelope (schemaVersion/owner), so a consumer
+    that indexes straight into files.settings.keys turns a corrupt state file into
+    a bare KeyError traceback instead of an operator diagnostic. Ownership
+    decisions read this ledger, so an unreadable one must stop before any write.
+    """
+    files = state.get("files")
+    entry = files.get("settings") if isinstance(files, dict) else None
+    keys = entry.get("keys") if isinstance(entry, dict) else None
+    if not isinstance(keys, dict):
+        die(f"install state {state_path()} has no files.settings.keys ledger; re-run install-meta-bridge")
+    return keys
+
+
+def relinquish_retired_scalar(
+    state: dict[str, Any], settings: dict[str, Any], name: str, path: list[str], last_managed_value: Any
+) -> None:
+    """Return one formerly managed scalar to operator ownership.
+
+    Only a preserved install-state entry proves entwurf wrote this path. If the
+    current value still has the exact JSON scalar type+value we last managed,
+    restore the snapshot. A changed or absent current value is already the
+    operator's and stays untouched. Malformed provenance fails before any file
+    write; silently discarding it would make a still-dangerous value look clean.
+    """
+    keys = settings_state_keys(state)
+    entry = keys.get(name)
+    if entry is None:
+        return
+    if not isinstance(entry, dict) or entry.get("kind") != "scalar" or entry.get("path") != path:
+        die(f"retired scalar state entry {name} is malformed; refusing to discard ownership evidence")
+    original = entry.get("original")
+    if (
+        not isinstance(original, dict)
+        or set(original) != {"existed", "value"}
+        or type(original.get("existed")) is not bool
+    ):
+        die(f"retired scalar state entry {name} has malformed original; refusing to guess")
+
+    existed, value = get_nested(settings, path)
+    if existed and type(value) is type(last_managed_value) and value == last_managed_value:
+        restore_entry(settings, entry)
+    keys.pop(name)
+
+
 def preflight_uninstall() -> None:
     load_state(required=True)
     print(f"[meta-bridge-state] uninstall preflight ok ({state_path()})")
@@ -536,6 +598,18 @@ def check(repo: Path, asm: Path) -> None:
         if recorded_asm
         else desired_marketplace(asm)
     )
+    state_settings_keys = settings_state_keys(state)
+    for name, path_, last_managed_value in RETIRED_SETTINGS_SCALARS:
+        if name in state_settings_keys:
+            failures.append(f"install-state still owns retired scalar {name}; re-run install-meta-bridge to relinquish it")
+            continue
+        existed, value = get_nested(settings, path_)
+        if existed and type(value) is type(last_managed_value) and value == last_managed_value:
+            print(
+                f"NOTE: settings {name}={json.dumps(last_managed_value)} is operator-owned; "
+                f"entwurf no longer suppresses or restores this warning choice"
+            )
+
     checks = [
         (["enabledPlugins", PLUGIN_REF], True, "enabled plugin"),
         (["extraKnownMarketplaces", MARKETPLACE], marketplace_expected, "known marketplace"),

package/scripts/mutants/meta-retire.json

@@ -0,0 +1,47 @@
+{
+	"schemaVersion": 1,
+	"lane": "meta-retire",
+	"mutants": [
+		{
+			"claim": "META-RETIRE-COMPARE-TYPE",
+			"title": "comparing the current value without its JSON scalar type lets a truthy 1 pass as the true entwurf wrote, so relinquishment overwrites a value that was never ours (#71)",
+			"subject": "scripts/meta-bridge-state.py",
+			"find": [
+				"    existed, value = get_nested(settings, path)",
+				"    if existed and type(value) is type(last_managed_value) and value == last_managed_value:"
+			],
+			"replace": ["    existed, value = get_nested(settings, path)", "    if existed and value == last_managed_value:"],
+			"gate": ["bash", "run.sh", "smoke-meta-install-state"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:META-RETIRE-COMPARE-TYPE]",
+			"signatureSource": "scripts/smoke-meta-install-state.sh"
+		},
+		{
+			"claim": "META-RETIRE-MALFORMED-SILENT",
+			"title": "skipping a malformed retired entry instead of failing discards the only evidence that entwurf owns the key, leaving a still-dangerous value looking operator-clean (#71)",
+			"subject": "scripts/meta-bridge-state.py",
+			"find": [
+				"        die(f\"retired scalar state entry {name} is malformed; refusing to discard ownership evidence\")"
+			],
+			"replace": ["        return"],
+			"gate": ["bash", "run.sh", "smoke-meta-install-state"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:META-RETIRE-MALFORMED-SILENT]",
+			"signatureSource": "scripts/smoke-meta-install-state.sh"
+		},
+		{
+			"claim": "META-RETIRE-FRESH-TOUCH",
+			"title": "synthesising provenance when install-state carries none lets relinquishment rewrite a value the operator set themselves, the exact ownership violation #71 exists to stop",
+			"subject": "scripts/meta-bridge-state.py",
+			"find": ["    if entry is None:", "        return"],
+			"replace": [
+				"    if entry is None:",
+				"        entry = {\"kind\": \"scalar\", \"path\": path, \"original\": {\"existed\": False, \"value\": None}}"
+			],
+			"gate": ["bash", "run.sh", "smoke-meta-install-state"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:META-RETIRE-FRESH-TOUCH]",
+			"signatureSource": "scripts/smoke-meta-install-state.sh"
+		}
+	]
+}

package/scripts/mutants/mux-fresh-call.json

@@ -78,15 +78,59 @@
 			"claim": "FRESHCALL-RECEIPT-WITHOUT-CORRELATION",
 			"title": "the launch receipt grows a sibling garden-id field, making an async correlation look like a synchronous return",
 			"subject": "pi-extensions/lib/mux-fresh-call.ts",
-			"find": ["\tbackend: FreshCallBackend;\n\tmodel: string;\n\truntimePath: string;\n\tnonce: string;\n}"],
-			"replace": [
-				"\tbackend: FreshCallBackend;\n\tmodel: string;\n\truntimePath: string;\n\tnonce: string;\n\tgardenId?: string;\n}"
-			],
+			"find": ["\truntimePath: string;\n\tnonce: string;\n}"],
+			"replace": ["\truntimePath: string;\n\tnonce: string;\n\tgardenId?: string;\n}"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:FRESHCALL-RECEIPT-WITHOUT-CORRELATION]",
 			"signatureSource": "test/mux-fresh-call.test.ts"
 		},
+		{
+			"claim": "FRESHCALL-CWD-ARGV",
+			"title": "the requested cwd stops reaching tmux, so a cross-repo fresh sibling silently opens in the CALLER's repo and the launch looks successful",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t...(cwd === undefined ? [] : [\"-c\", cwd]),\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-CWD-ARGV]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-CWD-REFUSED-PREMUTATION",
+			"title": "the pre-mutation cwd classification is ignored, so a relative/'#'/deleted/file path rides on toward tmux instead of refusing by name",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\tif (badCwd) return { ok: false, reason: badCwd };"],
+			"replace": ["\t\tvoid badCwd;"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-CWD-REFUSED-PREMUTATION]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-CWD-RECEIPT-REQUESTED",
+			"title": "production freshCall stops assembling the requested cwd into its receipt, so the operator-visible answer silently loses the one placement fact the caller asked for",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t\t...(cwd === undefined ? {} : { cwd }),\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-CWD-RECEIPT-REQUESTED]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-CWD-SURFACE-PARITY",
+			"title": "one surface drops the optional cwd from its schema, so cross-repo fresh works from pi and silently cannot exist from the MCP bridge",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": [
+				"\t\tcwd: z\n\t\t\t.string()\n\t\t\t.optional()\n\t\t\t.describe(\n\t\t\t\t\"Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \\\"\\\" to start in this agent's own cwd. Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). The receipt echoes what was REQUESTED, never an observation.\",\n\t\t\t),\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-CWD-SURFACE-PARITY]",
+			"signatureSource": "test/fresh-call-surfaces.contract.test.ts"
+		},
 		{
 			"claim": "FRESHCALL-PI-SURFACE-IDENTITY",
 			"title": "native pi takes the caller garden id from the environment instead of its own resident closure — the uuidv7 confusion, reintroduced",

package/scripts/mutants/mux-resume-call.json

@@ -5,7 +5,7 @@
 		{
 			"claim": "MUXRESUME-CWD-MISSING-REFUSED",
 			"title": "a deleted recorded cwd is accepted — tmux then opens the window in $HOME and the wrong-project resume looks successful",
-			"subject": "pi-extensions/lib/mux-resume-call.ts",
+			"subject": "pi-extensions/lib/classify-tmux-cwd.ts",
 			"find": ["\t\treturn \"cwd-missing\";"],
 			"replace": ["\t\treturn null;"],
 			"gate": ["bash", "run.sh", "check-mux-resume-call"],
@@ -16,7 +16,7 @@
 		{
 			"claim": "MUXRESUME-CWD-FORMAT-REFUSED",
 			"title": "the '#' refusal stops matching, so tmux format-expands the path it was handed",
-			"subject": "pi-extensions/lib/mux-resume-call.ts",
+			"subject": "pi-extensions/lib/classify-tmux-cwd.ts",
 			"find": ["\tif (cwd.includes(\"#\")) return \"cwd-format-token\";"],
 			"replace": ["\tif (cwd.includes(\"\\u0000\")) return \"cwd-format-token\";"],
 			"gate": ["bash", "run.sh", "check-mux-resume-call"],
@@ -27,7 +27,7 @@
 		{
 			"claim": "MUXRESUME-CWD-WHITESPACE-OK",
 			"title": "a quoting fear is added back as a whitespace refusal, which would reject real project directories tmux handles fine",
-			"subject": "pi-extensions/lib/mux-resume-call.ts",
+			"subject": "pi-extensions/lib/classify-tmux-cwd.ts",
 			"find": ["\tif (cwd.includes(\"#\")) return \"cwd-format-token\";"],
 			"replace": ["\tif (cwd.includes(\"#\") || /\\s/.test(cwd)) return \"cwd-format-token\";"],
 			"gate": ["bash", "run.sh", "check-mux-resume-call"],