@junghanacs/entwurf 0.17.2 → 0.18.1

package/scripts/check-release-gate-outcomes.ts

@@ -25,7 +25,15 @@
 //      "internal prerequisite" case, Cortex being the one that was measured).
 //   7. every LIVE smoke is either wired into the aggregate or excluded for a
 //      reason the docs actually state — the protocol cannot vouch for a step the
-//      gate never lists.
+//      gate never lists;
+//   8. the moved check-gate-qualification stays reachable on its owners, and the
+//      CI step qualifies the FULL floor;
+//   9. every gate a committed mutant NAMES also runs inside `check:full` (or says
+//      in its own prose why it deliberately does not) — a gate reachable only
+//      through qualification's control-pre puts a whole defect class behind the
+//      28-minute body;
+//  10. the CI push trigger is filtered to BRANCH refs, so pushing a release tag
+//      does not rebuild a SHA its branch run already built.
 //
 // Cells 5-6 SPAWN the real subcommands rather than reasoning about them: the
 // whole defect was an assumption about what a step would do, so an assumption is
@@ -329,7 +337,7 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 //    check-gate-qualification left the default check chains (operator
 //    inner-loop cost, 2026-08 subtraction). That move is a gate/release
 //    contract: the step must stay REACHABLE on the axes that now own it — the
-//    CI check job on every push and release_gate as its own MUST step — and
+//    CI check job on every branch push and release_gate as its own MUST step — and
 //    must not silently return to the default chain. Without this cell,
 //    deleting the release_gate qualification block or the CI line leaves every
 //    focused gate green while a cut quietly loses its discriminating-power
@@ -374,7 +382,7 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 		!qualGateBody.includes('results+=("FAIL  check-gate-qualification")')
 	)
 		holes.push("the release_gate qualification step does not wire PASS/FAIL into the MUST counters");
-	if (!verifyDoc.includes("in the CI `check` job on every push, and as a release-gate MUST step"))
+	if (!verifyDoc.includes("in the CI `check` job on every branch push, and as a release-gate MUST step"))
 		holes.push("VERIFY.md no longer names the owners of the moved qualification step");
 	assert.ok(
 		holes.length === 0,
@@ -406,6 +414,153 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 	);
 }
 
+// ===========================================================================
+// 9. Every gate a mutant manifest NAMES runs inside `pnpm run check:full`
+//
+//    The measurement behind this (#99 B-3/B-4): across 549 CI runs the mutant-
+//    EXECUTION half of qualification never once produced a SURVIVED / WRONG-REASON /
+//    MUTANT-STALE / HANG. What it did catch twice was a gate that was already red on a
+//    clean tree — CONTROL-PRE — and that class is caught 5.4 minutes earlier, and for
+//    free, by any gate the deterministic floor already runs. So a mutant-named gate
+//    that sits OUTSIDE `check:full` is the one place where a baseline break can only
+//    be found by paying the 28-minute body. `check-omp-birth-hook` was exactly that
+//    gate, reachable in the whole repo only through qualification's control-pre.
+//
+//    The exclusion arm is not a loophole: `scripts/check-setup-qualification.sh` is a
+//    mutation-attribution oracle the manifests invoke DIRECTLY and its own header says
+//    it is deliberately outside every tier. Like cell 7, the excuse is checked against
+//    the text an operator can read, never against a list only this gate believes in.
+//
+//    ONE PREMISE, stated because it is invisible from here: the script-path join below
+//    ignores MODE FLAGS in a gate argv. The `--attribution-self-test` gate therefore
+//    counts as covered by the `check-gate-manifests` arm only because
+//    `checkVitestAttribution()` runs UNCONDITIONALLY, before that flag is read
+//    (`scripts/check-gate-qualification.ts`). Move that call behind a flag and this
+//    cell stays green while saying something false.
+// ===========================================================================
+{
+	const pkg = JSON.parse(readFileSync(join(REPO_DIR, "package.json"), "utf8")) as { scripts: Record<string, string> };
+	// The floor is composed (#70): `check:full` names group scripts, and a group script
+	// may name further ones. Expand transitively rather than hard-coding the tier list.
+	const expand = (name: string, seen: Set<string>): string => {
+		if (seen.has(name)) return "";
+		seen.add(name);
+		const body = pkg.scripts[name] ?? "";
+		let out = body;
+		for (const ref of body.matchAll(/pnpm run ([\w:.-]+)/g)) out += ` ${expand(ref[1], seen)}`;
+		const elapsed = /check-elapsed\.sh\s+[\w:.-]+\s+(.+)$/.exec(body);
+		if (elapsed) for (const g of elapsed[1].trim().split(/\s+/)) out += ` ${expand(g, seen)}`;
+		return out;
+	};
+	const floorText = expand("check:full", new Set());
+	const floorSubcommands = new Set([...floorText.matchAll(/\.\/run\.sh ([\w:.-]+)/g)].map((m) => m[1]));
+
+	// run.sh case arms, so a gate invoked by SCRIPT PATH can be joined to the floor
+	// subcommand that runs that same script.
+	const arms = new Map<string, string>();
+	{
+		let names: string[] = [];
+		let body: string[] = [];
+		for (const line of readFileSync(join(REPO_DIR, "run.sh"), "utf8").split("\n")) {
+			const head = /^ {2}([\w|:.-]+)\)$/.exec(line);
+			if (head) {
+				names = head[1].split("|");
+				body = [];
+				continue;
+			}
+			if (line === "    ;;") {
+				for (const n of names) arms.set(n, body.join("\n"));
+				names = [];
+				continue;
+			}
+			if (names.length > 0) body.push(line);
+		}
+	}
+
+	const gates = new Map<string, string[]>();
+	for (const rel of globSync("scripts/mutants/*.json", { cwd: REPO_DIR }).sort()) {
+		const doc = JSON.parse(readFileSync(join(REPO_DIR, rel), "utf8")) as { mutants: Array<{ gate: string[] }> };
+		for (const m of doc.mutants) gates.set(m.gate.join(" "), m.gate);
+	}
+	assert.ok(gates.size >= 40, `expected the committed mutant gate set, found ${gates.size} distinct gate argvs`);
+
+	// argv → the file that states, in prose an operator reads, why it is outside the floor.
+	const DOCUMENTED_OUTSIDE: Record<string, [file: string, sentence: string]> = {
+		"bash scripts/check-setup-qualification.sh": [
+			"scripts/check-setup-qualification.sh",
+			"run.sh subcommand and NOT in any check tier",
+		],
+	};
+
+	const unreached: string[] = [];
+	for (const [key, argv] of gates) {
+		if (argv[0] === "bash" && argv[1] === "run.sh") {
+			if (!floorSubcommands.has(argv[2])) unreached.push(`${key} — run.sh ${argv[2]} is in no check:full group`);
+			continue;
+		}
+		const scriptPath = argv.find((t) => /^scripts\/.+\.(sh|ts|py)$/.test(t));
+		if (scriptPath !== undefined && [...floorSubcommands].some((sub) => (arms.get(sub) ?? "").includes(scriptPath))) {
+			continue;
+		}
+		const excused = DOCUMENTED_OUTSIDE[key];
+		if (excused === undefined) {
+			unreached.push(`${key} — no check:full subcommand invokes ${scriptPath ?? "(no script path in its argv)"}`);
+			continue;
+		}
+		const [file, sentence] = excused;
+		if (!readFileSync(join(REPO_DIR, file), "utf8").includes(sentence)) {
+			unreached.push(`${key} claims a documented exclusion, but ${file} no longer says "${sentence}"`);
+		}
+	}
+	assert.ok(
+		unreached.length === 0,
+		"[QK:MUTANT-GATES-INSIDE-FULL-FLOOR] every gate a committed mutant names must also run inside `pnpm run " +
+			"check:full`, or state its exclusion where an operator reads it. A gate reachable ONLY through " +
+			"qualification's control-pre makes the 28-minute mutant body the only thing that can notice it going red on " +
+			"a clean tree — the one CI class that body has actually caught, and the one the 5.4-minute floor catches for " +
+			`free everywhere else. Unreached: ${unreached.join("; ")}`,
+	);
+}
+
+// ===========================================================================
+// 10. A TAG push rebuilds nothing
+//
+//     Measured over this repo's whole history (#99 B-1): 66 of 66 semver tag-push runs
+//     rebuilt a SHA some other run had already built, and no tag run ever reported a
+//     fact its branch run did not — the single non-green one failed at the same step as
+//     its main run, two seconds later. That is 28% of a release window's runner minutes
+//     buying a badge on a ref. The exact-SHA evidence a release quotes is the BRANCH
+//     run, which is also the run `entwurf-release` land mode reports.
+//
+//     So `on.push` must carry a REF FILTER that selects branches. `branches:` alone is
+//     what makes a tag push create no run at all; a `tags:` key would put them back.
+// ===========================================================================
+{
+	const ciYml = readFileSync(join(REPO_DIR, ".github/workflows/ci.yml"), "utf8");
+	const onAt = ciYml.indexOf("\non:\n");
+	const envAt = ciYml.indexOf("\nenv:\n");
+	assert.ok(onAt !== -1 && envAt > onAt, "located the workflow `on:` block");
+	const onLines = ciYml.slice(onAt, envAt).split("\n");
+	const pushAt = onLines.findIndex((l) => /^ {2}push:\s*$/.test(l));
+	const nextKeyAt = onLines.findIndex((l, i) => i > pushAt && /^ {2}\S/.test(l));
+	const pushBody = onLines
+		.slice(pushAt + 1, nextKeyAt === -1 ? undefined : nextKeyAt)
+		.filter((l) => l.trim() !== "" && !/^\s*#/.test(l));
+	const gaps: string[] = [];
+	if (pushAt === -1) gaps.push("the `on:` block has no `push:` trigger");
+	if (!pushBody.some((l) => /^ {4}branches(-ignore)?:/.test(l)))
+		gaps.push(`the push trigger carries no branch ref filter (body: ${JSON.stringify(pushBody)})`);
+	if (pushBody.some((l) => /^ {4}tags(-ignore)?:/.test(l)))
+		gaps.push("the push trigger names tags — a tag push would create a second run for a SHA already built");
+	assert.ok(
+		gaps.length === 0,
+		"[QK:CI-TAG-PUSH-NOT-REBUILT] the CI `push` trigger must be filtered to BRANCH refs, so pushing a release tag " +
+			"creates no run: 66/66 semver tag runs in this repo's history rebuilt an already-built SHA and none ever " +
+			"reported a fact its branch run had not, while costing 28% of a release window's runner minutes. Dropping " +
+			`the filter does not add evidence, it duplicates it. Broken: ${gaps.join("; ")}`,
+	);
+}
+
 // ===========================================================================
 // The integrated mux lifecycle is a MUST, and the focused fresh-call LIVE is not
 //
@@ -501,5 +656,7 @@ console.log(
 		"LIVE smoke is either wired into release_gate or excluded by a sentence the docs still carry; and the moved " +
 		"check-gate-qualification stays reachable on its owners (absent from the default chain, exactly once in CI, " +
 		"exactly once as a release-gate MUST step) and the CI step qualifies the FULL floor, which runs before it; and " +
+		"every gate a committed mutant names is itself inside check:full or states its exclusion in prose an operator " +
+		"reads; and the CI push trigger is filtered to branch refs, so a release tag creates no duplicate run; and " +
 		"the operator's CONFIGURED bridge invocation is booted exactly once through run_step, before the ACP LIVE tier",
 );

package/scripts/meta-bridge-doctor.sh

@@ -736,19 +736,43 @@ writeMetaReceiverMarker({
   receiversDir,
 });
 
-// RECEIVER — a DIFFERENT citizen, armed by a live owner pid (this process). An unarmed
-// target is correctly fail-closed as mailbox-undeliverable, so an unarmed probe could
-// never separate "the artifact cannot read its registry" from "nobody is listening".
+// RECEIVER — a DIFFERENT citizen, armed by a DIFFERENT live owner pid. An unarmed target
+// is correctly fail-closed as mailbox-undeliverable, so an unarmed probe could never
+// separate "the artifact cannot read its registry" from "nobody is listening".
+//
+// The owner is a spawned idle process, not this one (#101): a claude-code watch owner
+// serves exactly one garden at a time, and deliverability asks whether that owner's sender
+// marker still names the garden being addressed. This probe's own pid already carries the
+// SENDER citizen's marker, so arming the receiver under it would model a session switch —
+// a retired watch — and the probe would report a delivery failure that is really the
+// fixture. It cannot be the probe's parent either: the bridge resolves its own sender
+// identity through its ancestry, and an ancestor holding two gardens is the "ambiguous
+// sender identity" refusal. A live pid outside that ancestry is what a second native CLI
+// actually looks like.
+const receiverOwner = spawn(process.execPath, ['-e', 'setTimeout(() => {}, 300000)'], { stdio: 'ignore' });
+const receiverOwnerPid = receiverOwner.pid;
+if (typeof receiverOwnerPid !== 'number') {
+  console.error('could not spawn the stand-in receiver owner process');
+  process.exit(1);
+}
 const receiver = upsertMetaSession({
   input: { backend: 'claude-code', nativeSessionId: `doctor-delivery-receiver-${process.pid}`, cwd: tmp },
   dir: sessionsDir,
 });
 const gid = receiver.record.gardenId;
+writeMetaSenderMarker({
+  backend: 'claude-code',
+  gardenId: gid,
+  nativeSessionId: receiver.record.nativeSessionId,
+  cwd: tmp,
+  ownerPid: receiverOwnerPid,
+  sendersDir,
+});
 writeMetaReceiverMarker({
   gardenId: gid,
   backend: 'claude-code',
   nativeSessionId: receiver.record.nativeSessionId,
-  ownerPid: process.pid,
+  ownerPid: receiverOwnerPid,
   armProvenance: 'session-start',
   receiversDir,
 });
@@ -845,6 +869,7 @@ try {
   bail(String(e instanceof Error ? e.message : e));
 } finally {
   try { child?.kill('SIGTERM'); } catch {}
+  try { receiverOwner.kill('SIGTERM'); } catch {}
   await fsp.rm(tmp, { recursive: true, force: true });
 }
 if (verdict === 0) console.log('delivered: one .msg landed + doorbell poked; seeded meta-sender identity joined');

package/scripts/mutants/bridge-command-boot.json

@@ -19,7 +19,7 @@
 			"subject": "scripts/agy-bridge.sh",
 			"find": ["      if command_boots \"$invocation\"; then"],
 			"replace": ["      if true; then"],
-			"gate": ["bash", "scripts/smoke-agy-install-state.sh"],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:AGY-DOCTOR-BOOT-NEGATIVE]",
 			"signatureSource": "scripts/smoke-agy-install-state.sh"
@@ -43,7 +43,7 @@
 			"subject": "scripts/agy-bridge-config.py",
 			"find": ["    args = server.get(\"args\", [])"],
 			"replace": ["    args = []"],
-			"gate": ["bash", "scripts/smoke-agy-install-state.sh"],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:AGY-DOCTOR-PROBES-ARGS]",
 			"signatureSource": "scripts/smoke-agy-install-state.sh"
@@ -54,7 +54,7 @@
 			"subject": "scripts/agy-bridge-config.py",
 			"find": ["    env = server.get(\"env\", {})"],
 			"replace": ["    env = {}"],
-			"gate": ["bash", "scripts/smoke-agy-install-state.sh"],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:AGY-DOCTOR-PROBES-ENV]",
 			"signatureSource": "scripts/smoke-agy-install-state.sh"

package/scripts/mutants/gate-qualification.json

@@ -0,0 +1,28 @@
+{
+	"schemaVersion": 1,
+	"lane": "gate-qualification",
+	"mutants": [
+		{
+			"claim": "MANIFEST-SET-INTEGRITY-REFUSED",
+			"title": "a committed manifest points a claim at a gate source that does not carry its token — the cross-manifest contract that makes a KILLED verdict mean anything is broken, and the run must refuse rather than certify kills whose signature nothing can attribute (the 08-20 CI catch, run 32421631735, which died in validateManifestSet in 5s)",
+			"subject": "scripts/mutants/probe-ordering.json",
+			"find": ["\"signatureSource\": \"scripts/check-probe-ordering.ts\""],
+			"replace": ["\"signatureSource\": \"run.sh\""],
+			"gate": ["bash", "run.sh", "check-gate-manifests"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:MANIFEST-SET-INTEGRITY-REFUSED]",
+			"signatureSource": "scripts/check-gate-qualification.ts"
+		},
+		{
+			"claim": "LANE-INVENTORY-DECLARED",
+			"title": "a lane is renamed in its manifest and the declared inventory is not moved with it — the vacuous-green shape where the run reports n/n killed over whatever set happened to be on disk (the 08-21 and 08-28 CI catches, runs 32450955048 and 33154263432, both dead at the inventory assertion in under 5s)",
+			"subject": "scripts/mutants/capability-cache.json",
+			"find": ["\"lane\": \"capability-cache\","],
+			"replace": ["\"lane\": \"capability-cache-renamed\","],
+			"gate": ["bash", "run.sh", "check-gate-manifests"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:LANE-INVENTORY-DECLARED]",
+			"signatureSource": "scripts/check-gate-qualification.ts"
+		}
+	]
+}

package/scripts/mutants/meta-hook-session-switch.json

@@ -0,0 +1,223 @@
+{
+	"schemaVersion": 1,
+	"lane": "meta-hook-session-switch",
+	"mutants": [
+		{
+			"claim": "MHSS-RETIRE-PREV-GARDEN",
+			"title": "a hook that never retires the garden its pid stopped serving leaves the abandoned startup session advertising a doorbell nobody holds — the abandoned-session registration measured on oracle, where a real message sat unread in its mailbox for an hour",
+			"subject": "pi-extensions/meta-bridge-hook.ts",
+			"find": ["\t\tif (previous && previous.gardenId !== gardenId) {"],
+			"replace": ["\t\tif (false && previous && previous.gardenId !== gardenId) {"],
+			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MHSS-RETIRE-PREV-GARDEN]",
+			"signatureSource": "scripts/check-meta-hook-session-switch.ts"
+		},
+		{
+			"claim": "MHSS-RETIRE-KEEPS-CURRENT",
+			"title": "retiring on ANY previous sender marker instead of a CHANGED one disarms the live session's own inbox on its next keystroke — the repair eating the citizen it exists to protect, which is worse than the defect",
+			"subject": "pi-extensions/meta-bridge-hook.ts",
+			"find": ["\t\tif (previous && previous.gardenId !== gardenId) {"],
+			"replace": ["\t\tif (previous) {"],
+			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MHSS-RETIRE-KEEPS-CURRENT]",
+			"signatureSource": "scripts/check-meta-hook-session-switch.ts"
+		},
+		{
+			"claim": "MHSS-RETIRE-ONLY-OWN-OWNER",
+			"title": "dropping the owner-pid guard lets one session's SessionStart delete a marker another LIVE process holds — a silent cross-session disarm, not a stale-marker cleanup",
+			"subject": "pi-extensions/lib/meta-session.ts",
+			"find": ["\t\tif (!marker || marker.ownerPid !== opts.ownerPid) return false;"],
+			"replace": ["\t\tif (!marker) return false;"],
+			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MHSS-RETIRE-ONLY-OWN-OWNER]",
+			"signatureSource": "scripts/check-meta-hook-session-switch.ts"
+		},
+		{
+			"claim": "MHSS-SOURCE-LOGGED",
+			"title": "dropping the vendor's `source` from the log leaves this host with no receipt for WHY a SessionStart fired — the exact evidence the #101 diagnosis had to inherit from vendor docs because nothing here recorded it",
+			"subject": "pi-extensions/meta-bridge-hook.ts",
+			"find": [
+				"\tconst source = typeof env.source === \"string\" && env.source.length > 0 ? env.source : \"(unset)\";"
+			],
+			"replace": ["\tconst source = \"(unset)\";"],
+			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MHSS-SOURCE-LOGGED]",
+			"signatureSource": "scripts/check-meta-hook-session-switch.ts"
+		},
+		{
+			"claim": "MHSS-SENDER-JOIN-MEASURED",
+			"title": "a join that always answers yes turns the receiver marker back into proof of something it never proved — that the process holding it is still serving THIS garden",
+			"subject": "pi-extensions/lib/entwurf-deliverability.ts",
+			"find": [
+				"\treturn !!senderMarker && senderMarker.gardenId === marker.gardenId && senderMarker.backend === marker.backend;"
+			],
+			"replace": ["\treturn true;"],
+			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MHSS-SENDER-JOIN-MEASURED]",
+			"signatureSource": "scripts/check-meta-hook-session-switch.ts"
+		},
+		{
+			"claim": "MHSS-SEAM-USES-JOIN",
+			"title": "restoring `watchArmed` as a copy of the identity match at the production seam re-ships the false deliverable even with the join intact — the shipped line that let a message be enqueued into a void",
+			"subject": "pi-extensions/lib/entwurf-v2-production.ts",
+			"find": [
+				"\t\tconst { ownerAlive, watchArmed } = resolveMailboxReceiverFacts(identity, {\n\t\t\treadReceiverMarker: io.readReceiverMarker,\n\t\t\treadSenderMarker: io.readSenderMarker,\n\t\t});"
+			],
+			"replace": [
+				"\t\tconst { ownerAlive } = resolveMailboxReceiverFacts(identity, {\n\t\t\treadReceiverMarker: io.readReceiverMarker,\n\t\t\treadSenderMarker: io.readSenderMarker,\n\t\t});\n\t\tconst watchArmed = ownerAlive;"
+			],
+			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MHSS-SEAM-USES-JOIN]",
+			"signatureSource": "scripts/check-meta-hook-session-switch.ts"
+		},
+		{
+			"claim": "MHSS-REJECT-CARRIES-REASON",
+			"title": "dropping the deliverability reason at the decider boundary hands the caller a verdict with no cause — the bare `mailbox-undeliverable` that sent a sibling looking for a dead session when the session was alive and had moved",
+			"subject": "pi-extensions/lib/entwurf-v2-decider.ts",
+			"find": [
+				"\t\t\treturn deliverability.deliverable\n\t\t\t\t? reject(receipt)\n\t\t\t\t: reject(receipt, { kind: \"mailbox-undeliverable\", reason: deliverability.reason });"
+			],
+			"replace": ["\t\t\treturn reject(receipt);"],
+			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MHSS-REJECT-CARRIES-REASON]",
+			"signatureSource": "scripts/check-meta-hook-session-switch.ts"
+		},
+		{
+			"claim": "MHSS-REASON-RENDERED",
+			"title": "a surface that carries the diagnostic and prints nothing is the same silence one layer up — the operator still reads only `mailbox-undeliverable`",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": ["\t\t\t\ttext += `\\n  mailbox-undeliverable: ${result.diagnostic.reason}`;"],
+			"replace": ["\t\t\t\ttext += \"\";"],
+			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MHSS-REASON-RENDERED]",
+			"signatureSource": "scripts/check-meta-hook-session-switch.ts"
+		},
+		{
+			"claim": "MHSS-PEERS-RECEIVER-OBSERVED",
+			"title": "collapsing `inactive` into `none` erases the distinction a reader needs — a watch that was armed and is no longer valid looks exactly like one that was never armed, which is the listing telling a caller nothing again",
+			"subject": "pi-extensions/lib/entwurf-peer-observe.ts",
+			"find": ["\treturn fs.existsSync(metaReceiverMarkerPath(identity.gardenId)) ? \"inactive\" : \"none\";"],
+			"replace": ["\treturn \"none\";"],
+			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MHSS-PEERS-RECEIVER-OBSERVED]",
+			"signatureSource": "scripts/check-meta-hook-session-switch.ts"
+		},
+		{
+			"claim": "MHSS-PEERS-TRANSCRIPT-OBSERVED",
+			"title": "reporting every transcript as present hides exactly the phantom this column exists to show: a registration minted at SessionStart with no conversation ever written behind it",
+			"subject": "pi-extensions/lib/entwurf-peer-observe.ts",
+			"find": [
+				"\t\treturn identity.transcriptPath && fs.existsSync(identity.transcriptPath) ? \"exists\" : \"absent\";"
+			],
+			"replace": ["\t\treturn \"exists\";"],
+			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MHSS-PEERS-TRANSCRIPT-OBSERVED]",
+			"signatureSource": "scripts/check-meta-hook-session-switch.ts"
+		},
+		{
+			"claim": "MHSS-PEERS-COLUMNS-RENDERED",
+			"title": "measuring both axes and printing neither returns the listing to two identical rows for a live citizen and a phantom — the surface gap that made a sibling dispatch into a void",
+			"subject": "pi-extensions/lib/entwurf-peers-render.ts",
+			"find": [
+				"\t\t`- ${p.gardenId}  backend=${p.backend}  liveness=${p.liveness}  receiver=${p.receiver}  ` +\n\t\t`transcript=${p.transcript}  cwd=${p.cwd}  model=${model}`"
+			],
+			"replace": [
+				"\t\t`- ${p.gardenId}  backend=${p.backend}  liveness=${p.liveness}  ` + `cwd=${p.cwd}  model=${model}`"
+			],
+			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MHSS-PEERS-COLUMNS-RENDERED]",
+			"signatureSource": "scripts/check-meta-hook-session-switch.ts"
+		},
+		{
+			"claim": "MHSS-RETIRE-ARM-CAPABLE-ONLY",
+			"title": "retiring from an event that cannot arm subtracts a doorbell with nothing in the same run able to restore one — UserPromptSubmit cannot emit watchPaths, so a retirement reached from there is a one-way disarm",
+			"subject": "pi-extensions/meta-bridge-hook.ts",
+			"find": [
+				"\t\tconst previous =\n\t\t\tarmProvenanceFor(eventName) !== null\n\t\t\t\t? readMetaSenderMarker({ backend: \"claude-code\", ownerPid, verifyOwner: false })\n\t\t\t\t: null;"
+			],
+			"replace": [
+				"\t\tconst previous = readMetaSenderMarker({ backend: \"claude-code\", ownerPid, verifyOwner: false });"
+			],
+			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MHSS-RETIRE-ARM-CAPABLE-ONLY]",
+			"signatureSource": "scripts/check-meta-hook-session-switch.ts"
+		},
+		{
+			"claim": "MHSS-RECORDS-SURVIVE",
+			"title": "a retirement that takes the RECORD with the marker deletes identity to clean up presence — the store-certification and fresh-cut rules exist because a record is the only address a citizen has",
+			"subject": "pi-extensions/meta-bridge-hook.ts",
+			"find": ["\t\t\tconst retired = removeMetaReceiverMarker({ gardenId: previous.gardenId, ownerPid });"],
+			"replace": [
+				"\t\t\tconst retired = removeMetaReceiverMarker({ gardenId: previous.gardenId, ownerPid });\n\t\t\tfs.rmSync(path.join(defaultMetaSessionsDir(), `${previous.gardenId}.meta.json`), { force: true });"
+			],
+			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MHSS-RECORDS-SURVIVE]",
+			"signatureSource": "scripts/check-meta-hook-session-switch.ts"
+		},
+		{
+			"claim": "MHSS-EXACTLY-ONE-DELIVERABLE",
+			"title": "forcing the watch fact closed refuses the citizen the operator is actually in — fail-closed is not free when it closes on every live session too",
+			"subject": "pi-extensions/lib/entwurf-v2-production.ts",
+			"find": ["\t\t\townerAlive,\n\t\t\twatchArmed,\n\t\t});"],
+			"replace": ["\t\t\townerAlive,\n\t\t\twatchArmed: false,\n\t\t});"],
+			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MHSS-EXACTLY-ONE-DELIVERABLE]",
+			"signatureSource": "scripts/check-meta-hook-session-switch.ts"
+		},
+		{
+			"claim": "MHSS-JOIN-SCOPE-OWNERKIND",
+			"title": "admitting copilot-extension into the sender-marker join makes every Copilot citizen permanently mailbox-undeliverable: its watch owner is a forked child whose pid never carries a sender marker, so the join can only ever answer no",
+			"subject": "pi-extensions/lib/entwurf-deliverability.ts",
+			"find": ["export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\"];"],
+			"replace": [
+				"export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\", \"copilot-extension\"];"
+			],
+			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MHSS-JOIN-SCOPE-OWNERKIND]",
+			"signatureSource": "scripts/check-meta-hook-session-switch.ts"
+		},
+		{
+			"claim": "MHSS-SENDER-START-KEY-VERIFIED",
+			"title": "reading the sender marker without the pid-reuse guard lets a dead session's leftover file answer \"which garden does this pid serve now?\" — the join then vouches for a watch nobody holds",
+			"subject": "pi-extensions/lib/entwurf-v2-production.ts",
+			"find": [
+				"\t\t\t((backend: string, ownerPid: number) => readMetaSenderMarker({ backend: requireBackend(backend), ownerPid })),"
+			],
+			"replace": [
+				"\t\t\t((backend: string, ownerPid: number) =>\n\t\t\t\treadMetaSenderMarker({ backend: requireBackend(backend), ownerPid, verifyOwner: false })),"
+			],
+			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MHSS-SENDER-START-KEY-VERIFIED]",
+			"signatureSource": "scripts/check-meta-hook-session-switch.ts"
+		},
+		{
+			"claim": "MHSS-JOIN-BACKEND-EQUALITY",
+			"title": "comparing only the garden id lets a marker written by another backend under the same pid vouch for this receiver — two harnesses can key markers under one process",
+			"subject": "pi-extensions/lib/entwurf-deliverability.ts",
+			"find": [
+				"\treturn !!senderMarker && senderMarker.gardenId === marker.gardenId && senderMarker.backend === marker.backend;"
+			],
+			"replace": ["\treturn !!senderMarker && senderMarker.gardenId === marker.gardenId;"],
+			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:MHSS-JOIN-BACKEND-EQUALITY]",
+			"signatureSource": "scripts/check-meta-hook-session-switch.ts"
+		}
+	]
+}

package/scripts/mutants/pack-install.json

@@ -4,14 +4,25 @@
 	"mutants": [
 		{
 			"claim": "PACK-INSTALL-PIN-MATCHER-BOUNDED",
-			"title": "the pin-leak matcher loses its version boundary and blesses substring lookalikes — @0.84.30 reads as the pinned 0.84.3 and the gate announces a verified tree it never verified (independent review, 2026-08-25)",
+			"title": "the pin-leak matcher loses its version boundary and blesses substring lookalikes — @0.85.10 reads as the pinned 0.85.1 and the gate announces a verified tree it never verified (independent review, 2026-08-25)",
 			"subject": "run.sh",
-			"find": ["  grep '^@earendil-works+pi-' | grep -Ev '@0\\.84\\.4(_|$)' || true"],
-			"replace": ["  grep '^@earendil-works+pi-' | grep -v '@0\\.84\\.4' || true"],
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@0\\.85\\.1(_|$)' || true"],
+			"replace": ["  grep '^@earendil-works+' | grep -v '@0\\.85\\.1' || true"],
 			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED]",
 			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE",
+			"title": "the pin-leak matcher narrows back to the pi-* families and goes blind to a non-pi member of the same runtime closure — @earendil-works/chord (new in pi 0.85.0, a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol) floats unpinned while the gate prints a verified pin (measured 2026-09-06 on a real 0.85.1 install tree)",
+			"subject": "run.sh",
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@0\\.85\\.1(_|$)' || true"],
+			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@0\\.85\\.1(_|$)' || true"],
+			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE]",
+			"signatureSource": "run.sh"
 		}
 	]
 }

package/scripts/mutants/release-gate.json

@@ -136,6 +136,28 @@
 			"signature": "[QK:MUX-LIFECYCLE-IS-RELEASE-MUST]",
 			"signatureSource": "scripts/check-release-gate-outcomes.ts"
 		},
+		{
+			"claim": "MUTANT-GATES-INSIDE-FULL-FLOOR",
+			"title": "a gate a committed mutant names drops out of check:full — the #99 B-4 shape, where check-omp-birth-hook was reachable in the whole repo only through qualification's control-pre, so the one CI class that half has ever caught (a gate already red on a clean tree) could be found only by paying the 28-minute mutant body",
+			"subject": "package.json",
+			"find": [" && ./run.sh check-omp-birth-hook"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:MUTANT-GATES-INSIDE-FULL-FLOOR]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "CI-TAG-PUSH-NOT-REBUILT",
+			"title": "the CI push trigger loses its branch ref filter, so every release tag rebuilds a SHA its branch run already built — 66/66 historically, 28% of a release window's runner minutes, and not once a fact the branch run had not already reported",
+			"subject": ".github/workflows/ci.yml",
+			"find": ["    branches: ['**']"],
+			"replace": ["    # the branch ref filter was dropped, so a tag push rebuilds the SHA again"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CI-TAG-PUSH-NOT-REBUILT]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
 		{
 			"claim": "PI-DOCTOR-IS-RELEASE-MUST",
 			"title": "the pi-provider boot doctor is quietly dropped from the gate — the operator's CONFIGURED bridge invocation is never booted, so a 127 launcher (the #81 relocated cmd-shim class) stays invisible until smoke-acp-bundled-mcp-live sixteen LIVE steps and real model spend later",