@junghanacs/entwurf 0.18.0 → 0.18.2

package/scripts/check-gate-qualification.ts

@@ -1,6 +1,18 @@
 /**
  * check-gate-qualification — kill-proof qualification of the shipped gates.
  *
+ * TWO ENTRYPOINTS, ONE FILE. `--manifests-only` (shipped as `run.sh
+ * check-gate-manifests`) stops after the HEAD — the runner self-test plus the real
+ * manifests' validation and lane inventory — having executed ZERO mutants from
+ * `scripts/mutants/` and having made NO snapshot of this repo. The default
+ * entrypoint is unchanged: it runs the same head first and then the body. The head
+ * is separable because of what it has actually caught: across 549 CI runs the
+ * qualification step went red five times, and three of those died in the head in
+ * 4-5 seconds, before a single mutant gate was invoked (#99 B-3). The head costs
+ * ~8s, so it belongs in the deterministic floor every push already pays for; the
+ * body's contract — which mutants run, how they are classified, what it prints —
+ * is untouched by the split.
+ *
  * Two phases, in a fixed order:
  *
  *   1. RUNNER SELF-TEST. The runner is itself a SUT: a qualification harness that
@@ -58,6 +70,10 @@ import {
 const REPO_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const MUTANTS_DIR = path.join(REPO_DIR, "scripts", "mutants");
 
+/** Head-only mode: validate, count, and stop — no mutant is executed, no repo snapshot is made. */
+const MANIFESTS_ONLY = process.argv.includes("--manifests-only");
+const SURFACE = MANIFESTS_ONLY ? "check-gate-manifests" : "gate-qualification";
+
 let passed = 0;
 function ok(label: string, cond: boolean): void {
 	assert.ok(cond, label);
@@ -775,10 +791,16 @@ const quiet = (): void => {};
 	}
 }
 
-console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
+console.log(`\n[${SURFACE}] self-test: ${passed} checks passed`);
 
-// ═══ Phase 2 — the real manifests against a snapshot of THIS repo ═══════════
+// ═══ Phase 1d — the real manifests, VALIDATED but not yet run ═══════════════
+//
+// The HEAD ends here. Everything above and in this block is pure reading and
+// checking: no mutant from `scripts/mutants/` is executed and no snapshot of THIS
+// repo exists yet. `--manifests-only` returns from exactly this point.
 
+let selected: MutantSpec[];
+let manifestCount: number;
 {
 	const manifests: MutantManifest[] = fs
 		.readdirSync(MUTANTS_DIR)
@@ -813,6 +835,7 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 		"copilot-launch": 14,
 		"copilot-receive": 18,
 		"fresh-cut": 1,
+		"gate-qualification": 2,
 		"meta-facts": 4,
 		"meta-hook-session-switch": 17,
 		"meta-identity": 4,
@@ -821,14 +844,14 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 		"mux-fresh-call": 37,
 		"mux-launcher-fence": 7,
 		"mux-parent-artifact": 3,
-		"pack-install": 1,
+		"pack-install": 2,
 		"pi-package-ownership": 6,
 		"mux-resume-call": 12,
 		"omp-birth": 11,
 		"omp-fresh": 24,
 		"omp-receive": 11,
 		"probe-ordering": 1,
-		"release-gate": 12,
+		"release-gate": 18,
 		"resume-args": 6,
 		"resume-launch-identity": 6,
 		"self-address": 5,
@@ -839,17 +862,44 @@ console.log(`\n[gate-qualification] self-test: ${passed} checks passed`);
 	};
 	const laneTally: Record<string, number> = {};
 	for (const man of manifests) laneTally[man.lane] = (laneTally[man.lane] ?? 0) + man.mutants.length;
-	assert.deepEqual(
-		laneTally,
-		EXPECTED_LANE_MUTANTS,
-		"mutant lane inventory drifted from the declared contract — extend EXPECTED_LANE_MUTANTS and the manifests together, never silently",
-	);
-	const allMutants = validateManifestSet(manifests, makeOriginChecks(REPO_DIR));
-	const selected = allMutants;
+	try {
+		assert.deepEqual(laneTally, EXPECTED_LANE_MUTANTS);
+	} catch {
+		assert.fail(
+			"[QK:LANE-INVENTORY-DECLARED] the mutant lane inventory drifted from the declared contract — extend " +
+				"EXPECTED_LANE_MUTANTS and the manifests together, never silently. A lane that lost its manifest in a " +
+				"merge, or gained mutants nobody declared, would otherwise pass as `n/n killed` over whatever set " +
+				`happened to be on disk. declared=${JSON.stringify(EXPECTED_LANE_MUTANTS)} onDisk=${JSON.stringify(laneTally)}`,
+		);
+	}
+	try {
+		selected = validateManifestSet(manifests, makeOriginChecks(REPO_DIR));
+	} catch (err) {
+		assert.fail(
+			"[QK:MANIFEST-SET-INTEGRITY-REFUSED] the committed manifest set broke its cross-manifest contract (global " +
+				"claim uniqueness, subject tracked + lstat-regular in the ORIGIN index, signatureSource on the origin work " +
+				"surface, claim token present exactly once in its gate source). Every one of those is what makes a KILLED " +
+				"verdict mean something, so the set is refused rather than run. Refusal: " +
+				(err instanceof Error ? err.message : String(err)),
+		);
+	}
+	manifestCount = manifests.length;
+	console.log(`[${SURFACE}] ${selected.length} mutants across ${manifestCount} lanes (no tiers — full set every run)`);
+}
+
+if (MANIFESTS_ONLY) {
 	console.log(
-		`[gate-qualification] ${selected.length} mutants across ${manifests.length} lanes (no tiers — full set every run)`,
+		`[check-gate-manifests] ok — runner self-test green, ${selected.length} committed mutants across ` +
+			`${manifestCount} lanes validated against the origin index, and the lane inventory matches its declared ` +
+			"contract. ZERO mutants were executed and this repo was never snapshotted: the body " +
+			"(check-gate-qualification) owns that, unchanged.",
 	);
+	process.exit(0);
+}
+
+// ═══ Phase 2 — the real manifests against a snapshot of THIS repo ═══════════
 
+{
 	const headBefore = originHead(REPO_DIR);
 	const workSurfaceBefore = originWorkSurfaceSha(REPO_DIR);
 

package/scripts/check-release-gate-outcomes.ts

@@ -25,7 +25,15 @@
 //      "internal prerequisite" case, Cortex being the one that was measured).
 //   7. every LIVE smoke is either wired into the aggregate or excluded for a
 //      reason the docs actually state — the protocol cannot vouch for a step the
-//      gate never lists.
+//      gate never lists;
+//   8. the moved check-gate-qualification stays reachable on its owners, and the
+//      CI step qualifies the FULL floor;
+//   9. every gate a committed mutant NAMES also runs inside `check:full` (or says
+//      in its own prose why it deliberately does not) — a gate reachable only
+//      through qualification's control-pre puts a whole defect class behind the
+//      28-minute body;
+//  10. the CI push trigger is filtered to BRANCH refs, so pushing a release tag
+//      does not rebuild a SHA its branch run already built.
 //
 // Cells 5-6 SPAWN the real subcommands rather than reasoning about them: the
 // whole defect was an assumption about what a step would do, so an assumption is
@@ -36,7 +44,8 @@
 
 import { strict as assert } from "node:assert";
 import { execFileSync } from "node:child_process";
-import { globSync, readFileSync } from "node:fs";
+import { copyFileSync, globSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { basename, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { LIVE_SKIP_EXIT, LIVE_SKIP_MARKER } from "./lib/live-skip.ts";
@@ -329,17 +338,20 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 //    check-gate-qualification left the default check chains (operator
 //    inner-loop cost, 2026-08 subtraction). That move is a gate/release
 //    contract: the step must stay REACHABLE on the axes that now own it — the
-//    CI check job on every push and release_gate as its own MUST step — and
+//    CI check job (on the pushes #103's filter still sends it) and release_gate
+//    as its own MUST step — and
 //    must not silently return to the default chain. Without this cell,
 //    deleting the release_gate qualification block or the CI line leaves every
 //    focused gate green while a cut quietly loses its discriminating-power
 //    step.
 //
-//    TWO claims, because #70 added a second independent contract here. 8a is
-//    REACHABILITY (absent from the default chain; present exactly once in CI and
-//    exactly once as a wired release_gate MUST step; named in VERIFY). 8b is what
-//    the CI step qualifies (the FULL floor, before the qualification run). Each
-//    carries its own replant — one mutant must never stand in for both.
+//    THREE claims, because each is an independent contract. 8a is REACHABILITY
+//    (absent from the default chain; present exactly once in CI and exactly once
+//    as a wired release_gate MUST step; named in VERIFY). 8b is what the CI step
+//    qualifies (the FULL floor, before the qualification run), added by #70. 8c is
+//    what the RELEASE path ACCEPTS as evidence for one SHA — that the body step
+//    actually ran there (#103). Each carries its own replant — one mutant must
+//    never stand in for another.
 // ===========================================================================
 {
 	// The default chain is tiered (#70): `check` (core) and `check:full` compose the
@@ -374,7 +386,11 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 		!qualGateBody.includes('results+=("FAIL  check-gate-qualification")')
 	)
 		holes.push("the release_gate qualification step does not wire PASS/FAIL into the MUST counters");
-	if (!verifyDoc.includes("in the CI `check` job on every push, and as a release-gate MUST step"))
+	if (
+		!verifyDoc.includes(
+			"in the CI `check` job on a branch push that touched the qualification surface, and as a release-gate MUST step",
+		)
+	)
 		holes.push("VERIFY.md no longer names the owners of the moved qualification step");
 	assert.ok(
 		holes.length === 0,
@@ -404,6 +420,357 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 			"downgrade/omission axis; ordering is directly asserted by this same oracle. " +
 			`Broken: check:full at index ${ciFloorAt}, qualification at index ${ciQualAt}.`,
 	);
+
+	// 8c. The RELEASE oracle requires that body to have actually run at the release
+	//     SHA -- its own contract, not a branch of 8a. 8a is REACHABILITY (the step
+	//     exists in the CI job and in release_gate); this is about what the release
+	//     path ACCEPTS as evidence for one SHA. `verify-exact-ci.sh` read only three
+	//     job names, and a job conclusion says nothing about whether the step inside
+	//     it ran: the moment ci.yml can skip that step (#103 piece 2), a green oracle
+	//     would certify a SHA whose qualification body never executed. That is the
+	//     "green with no evidence" class this repo fails closed on, which is why the
+	//     oracle gets the fourth axis BEFORE the skip exists.
+	//
+	//     This is a TEXT oracle, the same grade as check-install-surface S7g. A
+	//     behavioural oracle would need either a second file (S7a/S7g bind the
+	//     release surface to one script read from the index) or an injectable
+	//     RUN_JSON seam -- and that seam would be a way to launder release evidence
+	//     past gh. Both cost more than the axis is worth here.
+	const ciOracle = readFileSync(join(REPO_DIR, ".claude/skills/entwurf-release/scripts/verify-exact-ci.sh"), "utf8");
+	const axis: string[] = [];
+	if (!ciOracle.includes('QUAL_JOB = "check"') || !ciOracle.includes('"Run ./run.sh check-gate-qualification"'))
+		axis.push("the oracle does not name the check job's check-gate-qualification step");
+	if (!ciOracle.includes('qual != "success"'))
+		axis.push("the oracle does not guard that step's conclusion against 'success'");
+	if (!ciOracle.includes('qual == "skipped"'))
+		axis.push("the oracle does not classify a SKIPPED body as a failure of its own");
+	assert.ok(
+		axis.length === 0,
+		"[QK:RELEASE-SHA-QUALIFIED-IN-CI] the exact-SHA CI oracle must require the qualification BODY to have run " +
+			"at the release SHA -- the `check` job's `Run ./run.sh check-gate-qualification` step concluding 'success', " +
+			"with skipped named as its own failure. Three green job names do not prove the step inside one of them " +
+			`executed. Broken: ${axis.join("; ")}`,
+	);
+}
+
+// ===========================================================================
+// 8d. The qualification filter COVERS every mutant subject (#103 piece 2)
+//
+//     The body no longer runs on every branch push; a decision script reads the
+//     push range and answers. Its whole safety argument is that the path set is
+//     DERIVED from the committed manifests rather than copied into a list, so a
+//     new mutant subject cannot land outside the filter and quietly stop being
+//     re-proven in CI. This asserts that property behaviourally: every subject
+//     and signatureSource in scripts/mutants/*.json, fed to the script as a
+//     one-file change, must decide `run_body=true`. The oracle is the manifests
+//     themselves, read here independently of the script.
+// ===========================================================================
+{
+	const decider = join(REPO_DIR, "scripts/ci-qualify-decide.sh");
+	const paths = new Set<string>();
+	for (const file of globSync("scripts/mutants/*.json", { cwd: REPO_DIR })) {
+		const manifest = JSON.parse(readFileSync(join(REPO_DIR, file), "utf8")) as {
+			mutants?: { subject?: string; signatureSource?: string }[];
+		};
+		for (const mutant of manifest.mutants ?? []) {
+			if (mutant.subject) paths.add(mutant.subject);
+			if (mutant.signatureSource) paths.add(mutant.signatureSource);
+		}
+	}
+	assert.ok(paths.size > 50, `read only ${paths.size} mutant paths from the manifests`);
+	const uncovered = [...paths].filter((path) => {
+		const out = execFileSync("bash", [decider, "--files-from", "-"], {
+			cwd: REPO_DIR,
+			encoding: "utf8",
+			input: `${path}\n`,
+			stdio: ["pipe", "pipe", "ignore"],
+		});
+		return out.trim() !== "run_body=true";
+	});
+	assert.ok(
+		uncovered.length === 0,
+		"[QK:QUALIFY-FILTER-COVERS-SUBJECTS] the CI qualification filter must run the body for a change to ANY " +
+			"committed mutant subject or signature source — it derives that set from scripts/mutants/*.json for " +
+			"exactly this reason, so a path it cannot see is a claim that silently stops being re-proven in CI. " +
+			`Uncovered (${uncovered.length} of ${paths.size}): ${uncovered.slice(0, 8).join(", ")}`,
+	);
+}
+
+// ===========================================================================
+// 8e. The filter still runs the body for every RED the body has ever produced
+//
+//     Five reds in 549 runs (#99 stage-2). The first reading of them used the
+//     tip COMMIT and concluded the filter would have missed four; replaying the
+//     real two-dot push range — what GitHub actually compares — showed all five
+//     hit. That reversal is the whole evidentiary basis for this filter.
+//
+//     It is asserted from RECORDED file lists, not from live history, and that
+//     is a constraint rather than a convenience: check-gate-qualification runs
+//     every gate inside a snapshot with its own fresh git baseline, where these
+//     2026-07/08 commits do not exist. A cell that read history there would be
+//     CONTROL-RED for the whole lane — measured, not predicted (this cell did
+//     exactly that on 2026-09-06 and cost the release-gate lane its 17 kills).
+//     The fixture carries what history said, measured once, in a repo where the
+//     objects are present.
+//
+//     It has its own replant, and the reason is the SHAPE of the input: 8d feeds
+//     ONE path per call, this feeds a whole push at once. A matcher that only
+//     looked at the first entry would leave 8d green — every single-file call is
+//     its own first entry — while every one of these five pushes opens with a
+//     non-surface path (DELIVERY.md, AGENTS.md, NEXT.md, AGENTS.md,
+//     demo/demo-baseline.sh). Invisible to 8d, fatal here.
+//
+//     The two-dot READING itself is proven separately, below.
+// ===========================================================================
+{
+	const decider = join(REPO_DIR, "scripts/ci-qualify-decide.sh");
+	const fixture = JSON.parse(readFileSync(join(REPO_DIR, "scripts/fixtures/qualify-replay.json"), "utf8")) as {
+		runs: { runId: string; before: string; head: string; files: string[]; tipOnlyFiles: string[] }[];
+	};
+	assert.equal(fixture.runs.length, 5, "the replay fixture holds all five historical qualification reds");
+	const wrong: string[] = [];
+	for (const run of fixture.runs) {
+		assert.ok(run.files.length > 0, `run ${run.runId} has no recorded push range`);
+		const out = execFileSync("bash", [decider, "--files-from", "-"], {
+			cwd: REPO_DIR,
+			encoding: "utf8",
+			input: `${run.files.join("\n")}\n`,
+			stdio: ["pipe", "pipe", "ignore"],
+		}).trim();
+		if (out !== "run_body=true") wrong.push(`run ${run.runId} (${run.files.length} files) decided ${out}`);
+	}
+	assert.ok(
+		wrong.length === 0,
+		"[QK:QUALIFY-FILTER-REPLAYS-PAST-CATCHES] every qualification RED in this repo's CI history must still " +
+			"run the body under the filter, over the two-dot push range GitHub compares — the measurement that " +
+			"overturned the tip-commit reading and justified filtering at all. This reads a whole push at once, " +
+			"which 8d cannot: each of these five opens with a non-surface path, so a matcher that stopped after " +
+			"the first entry would pass every single-file check 8d makes and fail here. " +
+			`Broken: ${wrong.join("; ")}`,
+	);
+}
+
+// ===========================================================================
+// 8f. The filter reads the two-dot PUSH RANGE, not the tip commit
+//
+//     The fixture above proves the matcher's verdict on recorded file lists; it
+//     cannot prove which git range produced them, because it calls no git. This
+//     does, hermetically: a throwaway repo shaped like the real defect — a push
+//     of two commits whose TIP is docs-only while the commit under it touched a
+//     mutant subject. The two-dot range sees the code; the tip alone does not.
+//     That is the exact misreading #99 corrected, and it is what four of the
+//     five recorded pushes look like when read the wrong way.
+//
+//     Hermetic on purpose: no repo history, so it runs identically inside the
+//     qualification snapshot.
+// ===========================================================================
+{
+	const decider = join(REPO_DIR, "scripts/ci-qualify-decide.sh");
+	const tmp = mkdtempSync(join(tmpdir(), "entwurf-qualify-range-"));
+	// core.hooksPath is set globally on this operator's machine; a fixture repo
+	// must not run their hooks.
+	const git = (...args: string[]) =>
+		execFileSync("git", ["-c", "core.hooksPath=/dev/null", "-c", "user.email=g@e", "-c", "user.name=g", ...args], {
+			cwd: tmp,
+			stdio: "ignore",
+		});
+	try {
+		git("init", "-q", "-b", "main");
+		// The decider reads the repo it SITS IN, so the fixture gets a real copy
+		// of it and its own one-entry manifest: no seam, no env override, and the
+		// manifest-reading path is exercised too.
+		mkdirSync(join(tmp, "scripts/mutants"), { recursive: true });
+		mkdirSync(join(tmp, "pi-extensions/lib"), { recursive: true });
+		copyFileSync(decider, join(tmp, "scripts/ci-qualify-decide.sh"));
+		writeFileSync(
+			join(tmp, "scripts/mutants/fixture.json"),
+			`${JSON.stringify(
+				{
+					schemaVersion: 1,
+					lane: "fixture",
+					mutants: [{ claim: "FIXTURE", subject: "pi-extensions/lib/fixture-subject.ts" }],
+				},
+				null,
+				"\t",
+			)}\n`,
+		);
+		writeFileSync(join(tmp, "seed.txt"), "seed\n");
+		git("add", "-A");
+		git("commit", "-qm", "seed");
+		const base = execFileSync("git", ["rev-parse", "HEAD"], { cwd: tmp, encoding: "utf8" }).trim();
+		writeFileSync(join(tmp, "pi-extensions/lib/fixture-subject.ts"), "// a mutant subject\n");
+		git("add", "-A");
+		git("commit", "-qm", "code commit (mid-push)");
+		writeFileSync(join(tmp, "README.md"), "docs only\n");
+		git("add", "-A");
+		git("commit", "-qm", "docs commit (tip)");
+		const head = execFileSync("git", ["rev-parse", "HEAD"], { cwd: tmp, encoding: "utf8" }).trim();
+		const decide = (from: string) =>
+			execFileSync("bash", [join(tmp, "scripts/ci-qualify-decide.sh"), from, head], {
+				cwd: tmp,
+				encoding: "utf8",
+				env: { ...process.env, CI_EVENT_NAME: "push", CI_FORCED: "false" },
+				stdio: ["ignore", "pipe", "ignore"],
+			}).trim();
+		const overRange = decide(base);
+		const overTip = decide(`${head}~1`);
+		assert.ok(
+			overRange === "run_body=true" && overTip === "run_body=false",
+			"[QK:QUALIFY-FILTER-READS-PUSH-RANGE] the filter must diff the whole two-dot push range, not the tip " +
+				"commit: a push whose tip is docs-only can still carry a mutant subject underneath it, which is how " +
+				"four of the five historical reds look like docs pushes when read tip-first. " +
+				`Broken: range=${overRange}, tip-only=${overTip} (tip-only must be false, or this fixture proves nothing).`,
+		);
+	} finally {
+		rmSync(tmp, { recursive: true, force: true });
+	}
+}
+
+// ===========================================================================
+// 9. Every gate a mutant manifest NAMES runs inside `pnpm run check:full`
+//
+//    The measurement behind this (#99 B-3/B-4): across 549 CI runs the mutant-
+//    EXECUTION half of qualification never once produced a SURVIVED / WRONG-REASON /
+//    MUTANT-STALE / HANG. What it did catch twice was a gate that was already red on a
+//    clean tree — CONTROL-PRE — and that class is caught 5.4 minutes earlier, and for
+//    free, by any gate the deterministic floor already runs. So a mutant-named gate
+//    that sits OUTSIDE `check:full` is the one place where a baseline break can only
+//    be found by paying the 28-minute body. `check-omp-birth-hook` was exactly that
+//    gate, reachable in the whole repo only through qualification's control-pre.
+//
+//    The exclusion arm is not a loophole: `scripts/check-setup-qualification.sh` is a
+//    mutation-attribution oracle the manifests invoke DIRECTLY and its own header says
+//    it is deliberately outside every tier. Like cell 7, the excuse is checked against
+//    the text an operator can read, never against a list only this gate believes in.
+//
+//    ONE PREMISE, stated because it is invisible from here: the script-path join below
+//    ignores MODE FLAGS in a gate argv. The `--attribution-self-test` gate therefore
+//    counts as covered by the `check-gate-manifests` arm only because
+//    `checkVitestAttribution()` runs UNCONDITIONALLY, before that flag is read
+//    (`scripts/check-gate-qualification.ts`). Move that call behind a flag and this
+//    cell stays green while saying something false.
+// ===========================================================================
+{
+	const pkg = JSON.parse(readFileSync(join(REPO_DIR, "package.json"), "utf8")) as { scripts: Record<string, string> };
+	// The floor is composed (#70): `check:full` names group scripts, and a group script
+	// may name further ones. Expand transitively rather than hard-coding the tier list.
+	const expand = (name: string, seen: Set<string>): string => {
+		if (seen.has(name)) return "";
+		seen.add(name);
+		const body = pkg.scripts[name] ?? "";
+		let out = body;
+		for (const ref of body.matchAll(/pnpm run ([\w:.-]+)/g)) out += ` ${expand(ref[1], seen)}`;
+		const elapsed = /check-elapsed\.sh\s+[\w:.-]+\s+(.+)$/.exec(body);
+		if (elapsed) for (const g of elapsed[1].trim().split(/\s+/)) out += ` ${expand(g, seen)}`;
+		return out;
+	};
+	const floorText = expand("check:full", new Set());
+	const floorSubcommands = new Set([...floorText.matchAll(/\.\/run\.sh ([\w:.-]+)/g)].map((m) => m[1]));
+
+	// run.sh case arms, so a gate invoked by SCRIPT PATH can be joined to the floor
+	// subcommand that runs that same script.
+	const arms = new Map<string, string>();
+	{
+		let names: string[] = [];
+		let body: string[] = [];
+		for (const line of readFileSync(join(REPO_DIR, "run.sh"), "utf8").split("\n")) {
+			const head = /^ {2}([\w|:.-]+)\)$/.exec(line);
+			if (head) {
+				names = head[1].split("|");
+				body = [];
+				continue;
+			}
+			if (line === "    ;;") {
+				for (const n of names) arms.set(n, body.join("\n"));
+				names = [];
+				continue;
+			}
+			if (names.length > 0) body.push(line);
+		}
+	}
+
+	const gates = new Map<string, string[]>();
+	for (const rel of globSync("scripts/mutants/*.json", { cwd: REPO_DIR }).sort()) {
+		const doc = JSON.parse(readFileSync(join(REPO_DIR, rel), "utf8")) as { mutants: Array<{ gate: string[] }> };
+		for (const m of doc.mutants) gates.set(m.gate.join(" "), m.gate);
+	}
+	assert.ok(gates.size >= 40, `expected the committed mutant gate set, found ${gates.size} distinct gate argvs`);
+
+	// argv → the file that states, in prose an operator reads, why it is outside the floor.
+	const DOCUMENTED_OUTSIDE: Record<string, [file: string, sentence: string]> = {
+		"bash scripts/check-setup-qualification.sh": [
+			"scripts/check-setup-qualification.sh",
+			"run.sh subcommand and NOT in any check tier",
+		],
+	};
+
+	const unreached: string[] = [];
+	for (const [key, argv] of gates) {
+		if (argv[0] === "bash" && argv[1] === "run.sh") {
+			if (!floorSubcommands.has(argv[2])) unreached.push(`${key} — run.sh ${argv[2]} is in no check:full group`);
+			continue;
+		}
+		const scriptPath = argv.find((t) => /^scripts\/.+\.(sh|ts|py)$/.test(t));
+		if (scriptPath !== undefined && [...floorSubcommands].some((sub) => (arms.get(sub) ?? "").includes(scriptPath))) {
+			continue;
+		}
+		const excused = DOCUMENTED_OUTSIDE[key];
+		if (excused === undefined) {
+			unreached.push(`${key} — no check:full subcommand invokes ${scriptPath ?? "(no script path in its argv)"}`);
+			continue;
+		}
+		const [file, sentence] = excused;
+		if (!readFileSync(join(REPO_DIR, file), "utf8").includes(sentence)) {
+			unreached.push(`${key} claims a documented exclusion, but ${file} no longer says "${sentence}"`);
+		}
+	}
+	assert.ok(
+		unreached.length === 0,
+		"[QK:MUTANT-GATES-INSIDE-FULL-FLOOR] every gate a committed mutant names must also run inside `pnpm run " +
+			"check:full`, or state its exclusion where an operator reads it. A gate reachable ONLY through " +
+			"qualification's control-pre makes the 28-minute mutant body the only thing that can notice it going red on " +
+			"a clean tree — the one CI class that body has actually caught, and the one the 5.4-minute floor catches for " +
+			`free everywhere else. Unreached: ${unreached.join("; ")}`,
+	);
+}
+
+// ===========================================================================
+// 10. A TAG push rebuilds nothing
+//
+//     Measured over this repo's whole history (#99 B-1): 66 of 66 semver tag-push runs
+//     rebuilt a SHA some other run had already built, and no tag run ever reported a
+//     fact its branch run did not — the single non-green one failed at the same step as
+//     its main run, two seconds later. That is 28% of a release window's runner minutes
+//     buying a badge on a ref. The exact-SHA evidence a release quotes is the BRANCH
+//     run, which is also the run `entwurf-release` land mode reports.
+//
+//     So `on.push` must carry a REF FILTER that selects branches. `branches:` alone is
+//     what makes a tag push create no run at all; a `tags:` key would put them back.
+// ===========================================================================
+{
+	const ciYml = readFileSync(join(REPO_DIR, ".github/workflows/ci.yml"), "utf8");
+	const onAt = ciYml.indexOf("\non:\n");
+	const envAt = ciYml.indexOf("\nenv:\n");
+	assert.ok(onAt !== -1 && envAt > onAt, "located the workflow `on:` block");
+	const onLines = ciYml.slice(onAt, envAt).split("\n");
+	const pushAt = onLines.findIndex((l) => /^ {2}push:\s*$/.test(l));
+	const nextKeyAt = onLines.findIndex((l, i) => i > pushAt && /^ {2}\S/.test(l));
+	const pushBody = onLines
+		.slice(pushAt + 1, nextKeyAt === -1 ? undefined : nextKeyAt)
+		.filter((l) => l.trim() !== "" && !/^\s*#/.test(l));
+	const gaps: string[] = [];
+	if (pushAt === -1) gaps.push("the `on:` block has no `push:` trigger");
+	if (!pushBody.some((l) => /^ {4}branches(-ignore)?:/.test(l)))
+		gaps.push(`the push trigger carries no branch ref filter (body: ${JSON.stringify(pushBody)})`);
+	if (pushBody.some((l) => /^ {4}tags(-ignore)?:/.test(l)))
+		gaps.push("the push trigger names tags — a tag push would create a second run for a SHA already built");
+	assert.ok(
+		gaps.length === 0,
+		"[QK:CI-TAG-PUSH-NOT-REBUILT] the CI `push` trigger must be filtered to BRANCH refs, so pushing a release tag " +
+			"creates no run: 66/66 semver tag runs in this repo's history rebuilt an already-built SHA and none ever " +
+			"reported a fact its branch run had not, while costing 28% of a release window's runner minutes. Dropping " +
+			`the filter does not add evidence, it duplicates it. Broken: ${gaps.join("; ")}`,
+	);
 }
 
 // ===========================================================================
@@ -500,6 +867,11 @@ console.log(
 		"a run.sh wrapper declining its own prerequisite (including the measured LIVE=1 no-cortex-connection cell); and every " +
 		"LIVE smoke is either wired into release_gate or excluded by a sentence the docs still carry; and the moved " +
 		"check-gate-qualification stays reachable on its owners (absent from the default chain, exactly once in CI, " +
-		"exactly once as a release-gate MUST step) and the CI step qualifies the FULL floor, which runs before it; and " +
+		"exactly once as a release-gate MUST step) and the CI step qualifies the FULL floor, which runs before it, " +
+		"while the exact-SHA release oracle requires that BODY step to have concluded success at the release SHA, " +
+		"and the CI filter that decides when that body runs covers every mutant subject and still runs it for all " +
+		"five historical reds; and " +
+		"every gate a committed mutant names is itself inside check:full or states its exclusion in prose an operator " +
+		"reads; and the CI push trigger is filtered to branch refs, so a release tag creates no duplicate run; and " +
 		"the operator's CONFIGURED bridge invocation is booted exactly once through run_step, before the ACP LIVE tier",
 );