@junghanacs/entwurf 0.18.1 → 0.18.2

package/AGENTS.md

@@ -157,7 +157,7 @@ implement → affected focused gates → independent review → one amendment bu
 
 - **Inner loop:** run only the gates whose subject changed. Do not open the full floor to learn what a focused gate already answers.
 - **Review before floor:** independent review and its corrections close as one bundle before the full floor runs.
-- **Qualification is scheduled, not ambient — but its HEAD is not.** The mutant-EXECUTING body, `check-gate-qualification`, is not in the default check chains (core or full), so the operator inner loop never re-pays the full mutant inventory. It runs standalone once when a lane changed a gate, mutant, or matrix; machine time re-proves it everywhere else — the CI `check` job runs it on every branch push, and release-gate carries it as a MUST step. Its head — runner self-test, manifest-set validation, declared lane inventory — is `check-gate-manifests`, which executes no mutant and never snapshots the repo, and it IS in `check:hermetic`: three of the five reds qualification has ever produced in CI died there in under five seconds. A tag push runs no CI at all; the same SHA's branch run already carries every job, and that branch run is the exact-SHA evidence a release quotes.
+- **Qualification is scheduled, not ambient — but its HEAD is not.** The mutant-EXECUTING body, `check-gate-qualification`, is not in the default check chains (core or full), so the operator inner loop never re-pays the full mutant inventory. It runs standalone once when a lane changed a gate, mutant, or matrix; machine time re-proves it everywhere else — the CI `check` job runs it on a branch push whose two-dot range touched the qualification surface (`scripts/ci-qualify-decide.sh` derives that path set from the manifests themselves), unconditionally on `workflow_dispatch -f qualify=true` and a weekly schedule, and release-gate carries it as a MUST step. The exact-SHA release oracle refuses a SHA whose body step did not conclude success, so a filtered-out release commit is a named failure with a documented dispatch recovery, never a quiet pass. Its head — runner self-test, manifest-set validation, declared lane inventory — is `check-gate-manifests`, which executes no mutant and never snapshots the repo, and it IS in `check:hermetic`: three of the five reds qualification has ever produced in CI died there in under five seconds. A tag push runs no CI at all, and the exact-SHA evidence a release quotes is whichever run at that commit carries the body concluding success — the branch run when the push moved the qualification surface, else the dispatch run the release skill's recovery creates.
 - **Full floor once** (`pnpm run check:full`), on the frozen commit candidate. While it runs, nothing edits the worktree or index — including the NEXT boot sectors; a moved candidate voids the run's evidence.
 - **pre-commit is not the floor.** `.husky/pre-commit` carries only fast static checks (whitespace, lint, typecheck); the full floor is owned by this protocol, not by the hook. Do not grow the hook back, and do not build receipt/cache machinery to prove the protocol was followed.
 - **Release/LIVE acceptance is untouched.** VERIFY.md floors keep full strength; a shorter inner loop never lowers release evidence.

package/CHANGELOG.md

@@ -4,6 +4,75 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.18.2 - 2026-09-07
+
+One lane: #103, the second stage of the CI evidence budget (#99). The mutant body — 373 replants,
+~30 minutes — stops running on every branch push, and the release oracle stops accepting a run that
+did not carry it. Nothing in the runtime surface moves.
+
+### Changed
+
+- **The exact-SHA release oracle requires the qualification BODY, not three green job names (#103
+  piece 1).** `verify-exact-ci.sh` reads a fourth axis over one guard: the `check` job's
+  `Run ./run.sh check-gate-qualification` step must conclude `success`, with absent, skipped and
+  failed each named separately in the refusal. It also stops filtering to `--event push`, so a
+  `workflow_dispatch` run at the same SHA is admissible evidence — which is exactly when the
+  always-present `headSha` check starts carrying load, because `gh workflow run --ref` takes a
+  branch and never a SHA. A skipped body is not evidence: the oracle refuses that SHA and prints the
+  dispatch command that fixes it. This landed BEFORE the skip could exist.
+- **The body runs only on a branch push that moved the qualification surface (#103 piece 2).**
+  `scripts/ci-qualify-decide.sh` diffs the two-dot push range GitHub itself compares and intersects
+  it with a path set **derived from `scripts/mutants/*.json` at runtime** — no copy in YAML, so a new
+  mutant subject cannot land outside the filter. Five numbered fail-opens, each naming itself in the
+  log: an all-zero base, a forced push (whose base GitHub does not document), a dispatch without
+  `qualify=true` or a schedule, an unreadable range, and `pull_request`. `workflow_dispatch -f
+  qualify=true` and a weekly schedule run the body unconditionally; `fetch-depth: 0` on the check job
+  is what keeps the base readable, and it measured free (2s checkout, the same as depth 1).
+- **Measured on real runs, not argued.** A code push ran the body and took 36m24s
+  ([34047559085](https://github.com/junghan0611/entwurf/actions/runs/34047559085)); a docs-only push
+  skipped it and took 6m13s
+  ([34065841309](https://github.com/junghan0611/entwurf/actions/runs/34065841309)); the four-axis
+  oracle **refused** that second SHA while all three of its jobs were green, and the documented
+  dispatch recovery turned the refusal back into a pass
+  ([34066181211](https://github.com/junghan0611/entwurf/actions/runs/34066181211)). The historical
+  justification is replayed rather than remembered: all five qualification reds this repo's CI has
+  ever produced still run the body under the filter.
+
+### Added
+
+- Three kill-qualified claims and their exact-once replants, inventory 370 → 373:
+  `RELEASE-SHA-QUALIFIED-IN-CI` (the fourth axis), `QUALIFY-FILTER-COVERS-SUBJECTS` (every manifest
+  subject and signatureSource decides `run_body=true`, asserted behaviourally against the shipped
+  script), and `QUALIFY-FILTER-READS-PUSH-RANGE` (a hermetic throwaway repo with a docs-only tip over
+  a commit that touched a subject — the two-dot reading, proven without repo history).
+  `QUALIFY-FILTER-REPLAYS-PAST-CATCHES` replays the five reds from recorded file lists.
+- `scripts/fixtures/qualify-replay.json` — the five historical reds as the push ranges GitHub
+  compared, measured once here because history is not readable everywhere the gate runs.
+
+### Verification
+
+All on oracle (Linux, node 24.18.1, pi 0.85.1, omp 18.1.12 — updated from 18.0.0 during this lane).
+
+- **`LIVE=1 ./run.sh release-gate /tmp/entwurf-release-gate-0.18.2.JlEU88 --cut` → `cut: OK`.**
+  **MUST: PASS=23 FAIL=0 SKIP=0**, BEHAVIOR: PASS=1 FAIL=0 SKIP=0, exit 0, 3305s (55m05s).
+  `check-gate-qualification` as its MUST step: **373/373 KILLED**.
+- `pnpm run check:full` on the prepared tree: exit 0, 504s.
+- Pre-version landing run for `0f6667d`: CI run
+  [34070192960](https://github.com/junghan0611/entwurf/actions/runs/34070192960), all three jobs
+  success — and this is the first release landing judged by the fourth axis the same release adds:
+  the oracle read that run's qualification step, not just its job names.
+
+### Notes
+
+- **A gate that reads repo history cannot live in the qualification snapshot.** The replay cell first
+  read live git objects and went CONTROL-RED inside the snapshot's fresh baseline, costing the whole
+  release-gate lane its 17 kills. That is why the fixture carries file lists and the range semantics
+  are proven hermetically instead.
+- **Key order in `ci.yml` is a contract.** The body step keeps `run:` as its leading key: cell 8a
+  counts that sequence-item form exactly once, and the oracle matches GitHub's rendered
+  `Run <command>` step name, so an `if:` placed first — or any `name:` — would break both. Confirmed
+  on a real run after the filter landed.
+
 ## 0.18.1 - 2026-09-06
 
 Two lanes, both landing on `main` after `v0.18.0`: the CI evidence-budget stage 1 (#102, from

package/CONTRIBUTING.md

@@ -30,7 +30,7 @@ pnpm check              # everyday core (prints wall time; <=60s on the referenc
 pnpm run check:full     # full deterministic floor — the required PR gate
 ```
 
-The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory, zero mutants executed, ~8s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on every branch push and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling").
+The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory, zero mutants executed, ~8s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on a branch push whose diff touched the qualification surface (and unconditionally on dispatch or the weekly schedule) and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling").
 
 For changes that touch backend launch, session lifecycle, or `_meta` shape, also run
 the live ACP smokes that cover the touched rail — at minimum:

package/README.md

@@ -454,9 +454,11 @@ LIVE=1 ENTWURF_ACP_CORTEX_CONNECTION=<conn> ./run.sh smoke-acp-cortex-live  # Co
 `pnpm run check:full` includes the AGY permission contract matrix and the qualification
 HEAD (`check-gate-manifests` — runner self-test, manifest-set validation, declared lane
 inventory, zero mutants executed); the committed-mutant EXECUTION is scheduled separately
-(`./run.sh check-gate-qualification` — the CI `check` job runs it on every branch push,
-and release-gate carries it as a MUST step; a tag push runs no CI, since the same SHA's
-branch run already carries every job). A gate a
+(`./run.sh check-gate-qualification` — the CI `check` job runs it on a branch push that touched the qualification surface,
+unconditionally on `workflow_dispatch -f qualify=true` and a weekly schedule, and release-gate
+carries it as a MUST step; a tag push runs no CI at all). A branch run whose body was filtered out
+is not release evidence: the exact-SHA oracle requires the run it reads to carry that step
+concluding success. A gate a
 release touches must kill its known defect for the claimed `[QK:<claim>]` reason —
 the descriptions above name what each smoke covers, and no check count is quality
 evidence on its own. Gate qualification needs the git work surface, while the matrix

package/VERIFY.md

@@ -41,7 +41,7 @@ Verification here is not a benchmark. In production we exchange short turns and
 ### The canonical floor — two entry points
 
 - **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. The FULL tier carries the qualification HEAD (`check-gate-manifests`, through `check:hermetic`); the everyday core does not, and neither tier carries the separately scheduled mutant-executing body (`check-gate-qualification`).
-- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on every branch push, and as a release-gate MUST step — no longer inside the default check chains; a semver TAG push triggers no CI at all, because the same SHA's branch run already carries every job and is the exact-SHA evidence a release quotes) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT). The gate's HEAD is separable and IS in the floor: `check-gate-manifests` runs the runner self-test, validates the committed manifest set against the origin index, and asserts the declared lane inventory, while executing zero mutants and never snapshotting the repo — three of the five reds qualification has ever produced in CI died in that head, in under five seconds.
+- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: standalone when a lane changes a gate/mutant/matrix, in the CI `check` job on a branch push that touched the qualification surface, and as a release-gate MUST step — no longer inside the default check chains; a semver TAG push triggers no CI at all, and the exact-SHA evidence a release quotes is whichever run at that commit CARRIES the body — the branch run when the push touched the qualification surface, else a dispatch run; a push that touched none of the qualification surface skips the body, and `workflow_dispatch -f qualify=true` plus a weekly `schedule` run it unconditionally — the exact-SHA release oracle refuses a SHA whose body step did not conclude success) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT). The gate's HEAD is separable and IS in the floor: `check-gate-manifests` runs the runner self-test, validates the committed manifest set against the origin index, and asserts the declared lane inventory, while executing zero mutants and never snapshotting the repo — three of the five reds qualification has ever produced in CI died in that head, in under five seconds.
 - **Live floor:** `LIVE=1 ./run.sh release-gate <scratch-project-dir> --cut` — `pnpm run check:full` + the v2-native live gates + the ACP plugin acceptance floor. It reports a **two-tier summary**:
   - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `check-gate-qualification`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, `doctor-pi-provider` (#81 — `check-bridge` proves the launcher this checkout SHIPS; this proves the invocation the operator's pi provider actually EXECS, by booting it and requiring the entwurf verb set back, because `command -v` answers yes for a command that exits 127; wired as a step on 2026-08-19 after a relocated pnpm cmd-shim cost a cut sixteen LIVE steps before the same fact surfaced at `smoke-acp-bundled-mcp-live`), the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end — the integrated `smoke-mux-lifecycle-live` (its own note below), and the two OMP steps 0.16.0 wired: `smoke-omp-receive-live` (the addressed roundtrip into a live omp citizen; it reads the capability registry and decides its own outcome rather than passing by default) and `smoke-omp-fresh-live` (the clause 7 receipt the release stop now requires). (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
   - **BEHAVIOR tier** (advisory, non-blocking): the resident-garden-guard positive (a model-in-loop `entwurf_self` turn). A BEHAVIOR FAIL is surfaced with its artifact path but **never blocks the cut**. The lane holds what the model *chooses*, never what our wiring fails to deliver — a gate that TELLS the model which tool to call stays MUST, because its failure is ours — measured 2026-07-24, when the tool turned out to be absent from the session schema in both observed failures (the bundled-MCP readiness gap recorded in `scripts/smoke-acp-v2-send-live.ts`).
@@ -76,7 +76,7 @@ Do not collapse source, package, fixture, and native-host evidence into one “g
 | Source | `pnpm run check:full` + `./run.sh check-gate-qualification` | Does not prove an installed consumer. |
 | Packed install | `check-pack-install` | Real tarball, but checkout-visible. |
 | Linux artifact consumer | required `check-install-container` CI job against one preserved candidate | Fixtures prove package/oracle shape, not a real Claude lifecycle. |
-| Exact release commit | all required CI jobs green at the exact SHA | A different green SHA is not transferable evidence. |
+| Exact release commit | all required CI jobs green, and the `check` job's qualification body step concluded success, at the exact SHA | A different green SHA is not transferable evidence. |
 | LIVE runtime | `LIVE=1 ./run.sh release-gate <scratch> --cut` plus any shipped on-demand backend axis | `--cut` enforces `SKIP=0`; a red wired gate blocks the cut. |
 | Native Claude host | installed strict doctor against a new real session | Missing live join is `NOT CERTIFIED`, not a fixture PASS. |
 | Native agy host | three doctors plus conversation-id-gated native-push round trip | Aggregate release-gate does not own an agy conversation id. |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.18.1",
+	"version": "0.18.2",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for Claude Code, Codex, Antigravity, and pi harnesses.",
 	"license": "MIT",
 	"author": {

package/scripts/check-gate-qualification.ts

@@ -851,7 +851,7 @@ let manifestCount: number;
 		"omp-fresh": 24,
 		"omp-receive": 11,
 		"probe-ordering": 1,
-		"release-gate": 14,
+		"release-gate": 18,
 		"resume-args": 6,
 		"resume-launch-identity": 6,
 		"self-address": 5,

package/scripts/check-release-gate-outcomes.ts

@@ -44,7 +44,8 @@
 
 import { strict as assert } from "node:assert";
 import { execFileSync } from "node:child_process";
-import { globSync, readFileSync } from "node:fs";
+import { copyFileSync, globSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { basename, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { LIVE_SKIP_EXIT, LIVE_SKIP_MARKER } from "./lib/live-skip.ts";
@@ -337,17 +338,20 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 //    check-gate-qualification left the default check chains (operator
 //    inner-loop cost, 2026-08 subtraction). That move is a gate/release
 //    contract: the step must stay REACHABLE on the axes that now own it — the
-//    CI check job on every branch push and release_gate as its own MUST step — and
+//    CI check job (on the pushes #103's filter still sends it) and release_gate
+//    as its own MUST step — and
 //    must not silently return to the default chain. Without this cell,
 //    deleting the release_gate qualification block or the CI line leaves every
 //    focused gate green while a cut quietly loses its discriminating-power
 //    step.
 //
-//    TWO claims, because #70 added a second independent contract here. 8a is
-//    REACHABILITY (absent from the default chain; present exactly once in CI and
-//    exactly once as a wired release_gate MUST step; named in VERIFY). 8b is what
-//    the CI step qualifies (the FULL floor, before the qualification run). Each
-//    carries its own replant — one mutant must never stand in for both.
+//    THREE claims, because each is an independent contract. 8a is REACHABILITY
+//    (absent from the default chain; present exactly once in CI and exactly once
+//    as a wired release_gate MUST step; named in VERIFY). 8b is what the CI step
+//    qualifies (the FULL floor, before the qualification run), added by #70. 8c is
+//    what the RELEASE path ACCEPTS as evidence for one SHA — that the body step
+//    actually ran there (#103). Each carries its own replant — one mutant must
+//    never stand in for another.
 // ===========================================================================
 {
 	// The default chain is tiered (#70): `check` (core) and `check:full` compose the
@@ -382,7 +386,11 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 		!qualGateBody.includes('results+=("FAIL  check-gate-qualification")')
 	)
 		holes.push("the release_gate qualification step does not wire PASS/FAIL into the MUST counters");
-	if (!verifyDoc.includes("in the CI `check` job on every branch push, and as a release-gate MUST step"))
+	if (
+		!verifyDoc.includes(
+			"in the CI `check` job on a branch push that touched the qualification surface, and as a release-gate MUST step",
+		)
+	)
 		holes.push("VERIFY.md no longer names the owners of the moved qualification step");
 	assert.ok(
 		holes.length === 0,
@@ -412,6 +420,210 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 			"downgrade/omission axis; ordering is directly asserted by this same oracle. " +
 			`Broken: check:full at index ${ciFloorAt}, qualification at index ${ciQualAt}.`,
 	);
+
+	// 8c. The RELEASE oracle requires that body to have actually run at the release
+	//     SHA -- its own contract, not a branch of 8a. 8a is REACHABILITY (the step
+	//     exists in the CI job and in release_gate); this is about what the release
+	//     path ACCEPTS as evidence for one SHA. `verify-exact-ci.sh` read only three
+	//     job names, and a job conclusion says nothing about whether the step inside
+	//     it ran: the moment ci.yml can skip that step (#103 piece 2), a green oracle
+	//     would certify a SHA whose qualification body never executed. That is the
+	//     "green with no evidence" class this repo fails closed on, which is why the
+	//     oracle gets the fourth axis BEFORE the skip exists.
+	//
+	//     This is a TEXT oracle, the same grade as check-install-surface S7g. A
+	//     behavioural oracle would need either a second file (S7a/S7g bind the
+	//     release surface to one script read from the index) or an injectable
+	//     RUN_JSON seam -- and that seam would be a way to launder release evidence
+	//     past gh. Both cost more than the axis is worth here.
+	const ciOracle = readFileSync(join(REPO_DIR, ".claude/skills/entwurf-release/scripts/verify-exact-ci.sh"), "utf8");
+	const axis: string[] = [];
+	if (!ciOracle.includes('QUAL_JOB = "check"') || !ciOracle.includes('"Run ./run.sh check-gate-qualification"'))
+		axis.push("the oracle does not name the check job's check-gate-qualification step");
+	if (!ciOracle.includes('qual != "success"'))
+		axis.push("the oracle does not guard that step's conclusion against 'success'");
+	if (!ciOracle.includes('qual == "skipped"'))
+		axis.push("the oracle does not classify a SKIPPED body as a failure of its own");
+	assert.ok(
+		axis.length === 0,
+		"[QK:RELEASE-SHA-QUALIFIED-IN-CI] the exact-SHA CI oracle must require the qualification BODY to have run " +
+			"at the release SHA -- the `check` job's `Run ./run.sh check-gate-qualification` step concluding 'success', " +
+			"with skipped named as its own failure. Three green job names do not prove the step inside one of them " +
+			`executed. Broken: ${axis.join("; ")}`,
+	);
+}
+
+// ===========================================================================
+// 8d. The qualification filter COVERS every mutant subject (#103 piece 2)
+//
+//     The body no longer runs on every branch push; a decision script reads the
+//     push range and answers. Its whole safety argument is that the path set is
+//     DERIVED from the committed manifests rather than copied into a list, so a
+//     new mutant subject cannot land outside the filter and quietly stop being
+//     re-proven in CI. This asserts that property behaviourally: every subject
+//     and signatureSource in scripts/mutants/*.json, fed to the script as a
+//     one-file change, must decide `run_body=true`. The oracle is the manifests
+//     themselves, read here independently of the script.
+// ===========================================================================
+{
+	const decider = join(REPO_DIR, "scripts/ci-qualify-decide.sh");
+	const paths = new Set<string>();
+	for (const file of globSync("scripts/mutants/*.json", { cwd: REPO_DIR })) {
+		const manifest = JSON.parse(readFileSync(join(REPO_DIR, file), "utf8")) as {
+			mutants?: { subject?: string; signatureSource?: string }[];
+		};
+		for (const mutant of manifest.mutants ?? []) {
+			if (mutant.subject) paths.add(mutant.subject);
+			if (mutant.signatureSource) paths.add(mutant.signatureSource);
+		}
+	}
+	assert.ok(paths.size > 50, `read only ${paths.size} mutant paths from the manifests`);
+	const uncovered = [...paths].filter((path) => {
+		const out = execFileSync("bash", [decider, "--files-from", "-"], {
+			cwd: REPO_DIR,
+			encoding: "utf8",
+			input: `${path}\n`,
+			stdio: ["pipe", "pipe", "ignore"],
+		});
+		return out.trim() !== "run_body=true";
+	});
+	assert.ok(
+		uncovered.length === 0,
+		"[QK:QUALIFY-FILTER-COVERS-SUBJECTS] the CI qualification filter must run the body for a change to ANY " +
+			"committed mutant subject or signature source — it derives that set from scripts/mutants/*.json for " +
+			"exactly this reason, so a path it cannot see is a claim that silently stops being re-proven in CI. " +
+			`Uncovered (${uncovered.length} of ${paths.size}): ${uncovered.slice(0, 8).join(", ")}`,
+	);
+}
+
+// ===========================================================================
+// 8e. The filter still runs the body for every RED the body has ever produced
+//
+//     Five reds in 549 runs (#99 stage-2). The first reading of them used the
+//     tip COMMIT and concluded the filter would have missed four; replaying the
+//     real two-dot push range — what GitHub actually compares — showed all five
+//     hit. That reversal is the whole evidentiary basis for this filter.
+//
+//     It is asserted from RECORDED file lists, not from live history, and that
+//     is a constraint rather than a convenience: check-gate-qualification runs
+//     every gate inside a snapshot with its own fresh git baseline, where these
+//     2026-07/08 commits do not exist. A cell that read history there would be
+//     CONTROL-RED for the whole lane — measured, not predicted (this cell did
+//     exactly that on 2026-09-06 and cost the release-gate lane its 17 kills).
+//     The fixture carries what history said, measured once, in a repo where the
+//     objects are present.
+//
+//     It has its own replant, and the reason is the SHAPE of the input: 8d feeds
+//     ONE path per call, this feeds a whole push at once. A matcher that only
+//     looked at the first entry would leave 8d green — every single-file call is
+//     its own first entry — while every one of these five pushes opens with a
+//     non-surface path (DELIVERY.md, AGENTS.md, NEXT.md, AGENTS.md,
+//     demo/demo-baseline.sh). Invisible to 8d, fatal here.
+//
+//     The two-dot READING itself is proven separately, below.
+// ===========================================================================
+{
+	const decider = join(REPO_DIR, "scripts/ci-qualify-decide.sh");
+	const fixture = JSON.parse(readFileSync(join(REPO_DIR, "scripts/fixtures/qualify-replay.json"), "utf8")) as {
+		runs: { runId: string; before: string; head: string; files: string[]; tipOnlyFiles: string[] }[];
+	};
+	assert.equal(fixture.runs.length, 5, "the replay fixture holds all five historical qualification reds");
+	const wrong: string[] = [];
+	for (const run of fixture.runs) {
+		assert.ok(run.files.length > 0, `run ${run.runId} has no recorded push range`);
+		const out = execFileSync("bash", [decider, "--files-from", "-"], {
+			cwd: REPO_DIR,
+			encoding: "utf8",
+			input: `${run.files.join("\n")}\n`,
+			stdio: ["pipe", "pipe", "ignore"],
+		}).trim();
+		if (out !== "run_body=true") wrong.push(`run ${run.runId} (${run.files.length} files) decided ${out}`);
+	}
+	assert.ok(
+		wrong.length === 0,
+		"[QK:QUALIFY-FILTER-REPLAYS-PAST-CATCHES] every qualification RED in this repo's CI history must still " +
+			"run the body under the filter, over the two-dot push range GitHub compares — the measurement that " +
+			"overturned the tip-commit reading and justified filtering at all. This reads a whole push at once, " +
+			"which 8d cannot: each of these five opens with a non-surface path, so a matcher that stopped after " +
+			"the first entry would pass every single-file check 8d makes and fail here. " +
+			`Broken: ${wrong.join("; ")}`,
+	);
+}
+
+// ===========================================================================
+// 8f. The filter reads the two-dot PUSH RANGE, not the tip commit
+//
+//     The fixture above proves the matcher's verdict on recorded file lists; it
+//     cannot prove which git range produced them, because it calls no git. This
+//     does, hermetically: a throwaway repo shaped like the real defect — a push
+//     of two commits whose TIP is docs-only while the commit under it touched a
+//     mutant subject. The two-dot range sees the code; the tip alone does not.
+//     That is the exact misreading #99 corrected, and it is what four of the
+//     five recorded pushes look like when read the wrong way.
+//
+//     Hermetic on purpose: no repo history, so it runs identically inside the
+//     qualification snapshot.
+// ===========================================================================
+{
+	const decider = join(REPO_DIR, "scripts/ci-qualify-decide.sh");
+	const tmp = mkdtempSync(join(tmpdir(), "entwurf-qualify-range-"));
+	// core.hooksPath is set globally on this operator's machine; a fixture repo
+	// must not run their hooks.
+	const git = (...args: string[]) =>
+		execFileSync("git", ["-c", "core.hooksPath=/dev/null", "-c", "user.email=g@e", "-c", "user.name=g", ...args], {
+			cwd: tmp,
+			stdio: "ignore",
+		});
+	try {
+		git("init", "-q", "-b", "main");
+		// The decider reads the repo it SITS IN, so the fixture gets a real copy
+		// of it and its own one-entry manifest: no seam, no env override, and the
+		// manifest-reading path is exercised too.
+		mkdirSync(join(tmp, "scripts/mutants"), { recursive: true });
+		mkdirSync(join(tmp, "pi-extensions/lib"), { recursive: true });
+		copyFileSync(decider, join(tmp, "scripts/ci-qualify-decide.sh"));
+		writeFileSync(
+			join(tmp, "scripts/mutants/fixture.json"),
+			`${JSON.stringify(
+				{
+					schemaVersion: 1,
+					lane: "fixture",
+					mutants: [{ claim: "FIXTURE", subject: "pi-extensions/lib/fixture-subject.ts" }],
+				},
+				null,
+				"\t",
+			)}\n`,
+		);
+		writeFileSync(join(tmp, "seed.txt"), "seed\n");
+		git("add", "-A");
+		git("commit", "-qm", "seed");
+		const base = execFileSync("git", ["rev-parse", "HEAD"], { cwd: tmp, encoding: "utf8" }).trim();
+		writeFileSync(join(tmp, "pi-extensions/lib/fixture-subject.ts"), "// a mutant subject\n");
+		git("add", "-A");
+		git("commit", "-qm", "code commit (mid-push)");
+		writeFileSync(join(tmp, "README.md"), "docs only\n");
+		git("add", "-A");
+		git("commit", "-qm", "docs commit (tip)");
+		const head = execFileSync("git", ["rev-parse", "HEAD"], { cwd: tmp, encoding: "utf8" }).trim();
+		const decide = (from: string) =>
+			execFileSync("bash", [join(tmp, "scripts/ci-qualify-decide.sh"), from, head], {
+				cwd: tmp,
+				encoding: "utf8",
+				env: { ...process.env, CI_EVENT_NAME: "push", CI_FORCED: "false" },
+				stdio: ["ignore", "pipe", "ignore"],
+			}).trim();
+		const overRange = decide(base);
+		const overTip = decide(`${head}~1`);
+		assert.ok(
+			overRange === "run_body=true" && overTip === "run_body=false",
+			"[QK:QUALIFY-FILTER-READS-PUSH-RANGE] the filter must diff the whole two-dot push range, not the tip " +
+				"commit: a push whose tip is docs-only can still carry a mutant subject underneath it, which is how " +
+				"four of the five historical reds look like docs pushes when read tip-first. " +
+				`Broken: range=${overRange}, tip-only=${overTip} (tip-only must be false, or this fixture proves nothing).`,
+		);
+	} finally {
+		rmSync(tmp, { recursive: true, force: true });
+	}
 }
 
 // ===========================================================================
@@ -655,7 +867,10 @@ console.log(
 		"a run.sh wrapper declining its own prerequisite (including the measured LIVE=1 no-cortex-connection cell); and every " +
 		"LIVE smoke is either wired into release_gate or excluded by a sentence the docs still carry; and the moved " +
 		"check-gate-qualification stays reachable on its owners (absent from the default chain, exactly once in CI, " +
-		"exactly once as a release-gate MUST step) and the CI step qualifies the FULL floor, which runs before it; and " +
+		"exactly once as a release-gate MUST step) and the CI step qualifies the FULL floor, which runs before it, " +
+		"while the exact-SHA release oracle requires that BODY step to have concluded success at the release SHA, " +
+		"and the CI filter that decides when that body runs covers every mutant subject and still runs it for all " +
+		"five historical reds; and " +
 		"every gate a committed mutant names is itself inside check:full or states its exclusion in prose an operator " +
 		"reads; and the CI push trigger is filtered to branch refs, so a release tag creates no duplicate run; and " +
 		"the operator's CONFIGURED bridge invocation is booted exactly once through run_step, before the ACP LIVE tier",

package/scripts/ci-qualify-decide.sh

@@ -0,0 +1,159 @@
+#!/usr/bin/env bash
+# Decide whether a push needs the qualification BODY (#103 piece 2).
+#
+# The body re-proves every committed mutant's kill-power and costs ~28 minutes.
+# Across 549 CI runs it produced five reds, and replaying the real push ranges
+# shows this filter would have run the body for all five (#99 stage-2 §1). So a
+# push that cannot have touched the qualification surface skips it -- and the
+# surface is READ FROM THE MANIFESTS, never copied into a list that can drift.
+#
+# TWO ENTRYPOINTS, ONE MATCHER:
+#   ci-qualify-decide.sh <before-sha> <head-sha>   # CI and replay: a git range
+#   ci-qualify-decide.sh --files-from <file|->     # a literal changed-file list
+# Both print `run_body=true|false` on stdout and their reasoning on stderr.
+#
+# Pure local git plus python3 for the manifest read: no gh, no network, so the
+# replay fixture gate runs offline and exercises this exact code.
+set -euo pipefail
+
+REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+# Fail-open is numbered so a log line says WHICH one fired. Every one of these
+# means "we cannot compute an honest diff", and the honest answer to that is to
+# run the body, never to skip it.
+fail_open() {
+	echo "ci-qualify-decide: fail-open $1 ($2) -> run_body=true" >&2
+	echo "run_body=true"
+	exit 0
+}
+
+collect_paths_from_manifests() {
+	python3 - "$REPO_DIR" <<'PY'
+import glob
+import json
+import os
+import sys
+
+repo = sys.argv[1]
+out = set()
+for path in sorted(glob.glob(os.path.join(repo, "scripts/mutants/*.json"))):
+	with open(path, encoding="utf-8") as handle:
+		manifest = json.load(handle)
+	for mutant in manifest.get("mutants", []):
+		subject = mutant.get("subject")
+		if subject:
+			out.add(subject)
+		signature_source = mutant.get("signatureSource")
+		if signature_source:
+			out.add(signature_source)
+for entry in sorted(out):
+	print(entry)
+PY
+}
+
+# A changed path matters when it is a mutant's subject or signature source, or
+# when it sits in the machinery that decides what those mutants prove.
+matches_qualification_surface() {
+	local file="$1"
+	local subject
+	while IFS= read -r subject; do
+		[ "$file" = "$subject" ] && { echo "manifest-subject"; return 0; }
+	done <<< "$MANIFEST_PATHS"
+	case "$file" in
+		scripts/mutants/*) echo "glob:scripts/mutants/**"; return 0 ;;
+		scripts/check-*) echo "glob:scripts/check-*"; return 0 ;;
+		scripts/lib/*) echo "glob:scripts/lib/**"; return 0 ;;
+		# The replay fixture is the independent oracle input cell 8e reads. Once a
+		# claim rests on it, changing it changes what the body is qualified against.
+		scripts/fixtures/*) echo "glob:scripts/fixtures/**"; return 0 ;;
+		.github/workflows/*) echo "glob:.github/workflows/**"; return 0 ;;
+		run.sh) echo "exact:run.sh"; return 0 ;;
+		package.json) echo "exact:package.json"; return 0 ;;
+		# The decider itself: change the filter and the body runs, so a filter
+		# that stopped covering something cannot hide behind its own change.
+		scripts/ci-qualify-decide.sh) echo "exact:scripts/ci-qualify-decide.sh"; return 0 ;;
+	esac
+	return 1
+}
+
+decide_from_files() {
+	local files="$1"
+	local count=0
+	local hits=0
+	local file rule
+	while IFS= read -r file; do
+		[ -n "$file" ] || continue
+		count=$((count + 1))
+		if rule="$(matches_qualification_surface "$file")"; then
+			hits=$((hits + 1))
+			[ "$hits" -le 5 ] && echo "ci-qualify-decide: hit $file ($rule)" >&2
+		fi
+	done <<< "$files"
+	if [ "$hits" -gt 0 ]; then
+		echo "ci-qualify-decide: $hits of $count changed files touch the qualification surface -> run_body=true" >&2
+		echo "run_body=true"
+	else
+		echo "ci-qualify-decide: no qualification-surface path among $count changed files -> run_body=false" >&2
+		echo "run_body=false"
+	fi
+}
+
+MANIFEST_PATHS="$(collect_paths_from_manifests)"
+[ -n "$MANIFEST_PATHS" ] || { echo "ABORT: no mutant manifests read from $REPO_DIR/scripts/mutants" >&2; exit 1; }
+
+if [ "${1:-}" = "--files-from" ]; then
+	SRC="${2:-}"
+	[ -n "$SRC" ] || { echo "ABORT: --files-from needs a path or -" >&2; exit 1; }
+	if [ "$SRC" = "-" ]; then FILES="$(cat)"; else FILES="$(cat "$SRC")"; fi
+	decide_from_files "$FILES"
+	exit 0
+fi
+
+BEFORE="${1:-}"
+HEAD_SHA="${2:-}"
+EVENT="${CI_EVENT_NAME:-push}"
+FORCED="${CI_FORCED:-false}"
+
+# 3. A human or the schedule asked for this run; there is no push range to read.
+#    `qualify` is what makes the dispatch an explicit request for the BODY. A
+#    dispatch WITHOUT it is a floor-only rerun, so it must not silently satisfy
+#    the release oracle's fourth axis -- the input would be dead configuration if
+#    every dispatch ran the body regardless of its value.
+case "$EVENT" in
+	workflow_dispatch)
+		[ "${CI_QUALIFY:-false}" = "true" ] && fail_open 3 "event=workflow_dispatch with qualify=true asked for the body"
+		echo "ci-qualify-decide: dispatch without qualify=true is a floor-only rerun; the release oracle will still refuse this SHA until the body runs -> run_body=false" >&2
+		echo "run_body=false"
+		exit 0
+		;;
+	schedule) fail_open 3 "event=schedule runs the body unconditionally (drift ceiling)" ;;
+	# 5. A pull_request event carries no `before`, and GitHub compares it
+	#    three-dot. Narrowing PRs would need a second comparison rule for an
+	#    event this repo barely uses, so PRs always run the body.
+	pull_request) fail_open 5 "event=pull_request has no two-dot push range" ;;
+esac
+
+[ -n "$BEFORE" ] && [ -n "$HEAD_SHA" ] || { echo "ABORT: usage: $0 <before-sha> <head-sha>" >&2; exit 1; }
+
+# 1. A new branch's first push: GitHub sends all-zeros, and its own documented
+#    base ("the parent of the ancestor of the deepest commit pushed") is not
+#    what a two-dot diff from zeros would give.
+case "$BEFORE" in
+	*[!0]*) ;;
+	*) fail_open 1 "before=$BEFORE is the all-zero SHA (new branch)" ;;
+esac
+
+# 2. Force push. What `before` even means here is UNDOCUMENTED (#99 stage-2,
+#    "measured not"): if it is the old head, the two-dot diff runs backwards and
+#    the verdict can invert. Never guess -- run the body.
+[ "$FORCED" = "true" ] && fail_open 2 "the push was forced; its two-dot base is undocumented"
+
+# 4. The range is unreadable on this checkout -- a shallow clone, or an object
+#    the remote no longer has (which is also how a force push's old base
+#    disappears, so 2 and 4 can both be true and each still names itself).
+git -C "$REPO_DIR" cat-file -e "$BEFORE^{commit}" 2>/dev/null || fail_open 4 "before=$BEFORE is not a commit object in this checkout"
+git -C "$REPO_DIR" cat-file -e "$HEAD_SHA^{commit}" 2>/dev/null || fail_open 4 "head=$HEAD_SHA is not a commit object in this checkout"
+
+CHANGED="$(git -C "$REPO_DIR" diff --name-only "$BEFORE".."$HEAD_SHA" 2>/dev/null)" || fail_open 4 "git diff $BEFORE..$HEAD_SHA failed"
+
+decide_from_files "$CHANGED"

package/scripts/fixtures/qualify-replay.json

@@ -0,0 +1,149 @@
+{
+	"note": "Every qualification RED this repo's CI has ever produced (#99 stage-2 SS1), with the file list of the two-dot push range GitHub actually compared. `before` is the head of the previous ci.yml run on the same branch. `files` was measured from this clone's history on 2026-09-06 and is committed BECAUSE history is not readable everywhere the gate runs: check-gate-qualification executes gates inside a snapshot with its own fresh git baseline, where these commits do not exist. `tipOnlyFiles` is the same push read the wrong way -- the tip commit alone -- which is how four of these five once looked like docs-only pushes; it is kept as the record of the misreading, not as an input.",
+	"runs": [
+		{
+			"runId": "32421631735",
+			"branch": "issue-82-copilot-citizen",
+			"before": "1da40c9994d5",
+			"head": "dff731d415d5",
+			"diedAt": "manifest validation (head)",
+			"files": [
+				"DELIVERY.md",
+				"NEXT--issue-82-copilot-citizen.md",
+				"ROADMAP.md",
+				"mcp/entwurf-bridge/tsconfig.build.json",
+				"package.json",
+				"pi-extensions/lib/meta-session.ts",
+				"pi-extensions/meta-bridge-hook-copilot.ts",
+				"pi/entwurf-capabilities.json",
+				"pi/meta-bridge-copilot/.claude-plugin/marketplace.json",
+				"pi/meta-bridge-copilot/entwurf-meta-receive-copilot/.claude-plugin/plugin.json",
+				"pi/meta-bridge-copilot/entwurf-meta-receive-copilot/hooks/hooks.json",
+				"pi/meta-bridge-copilot/entwurf-meta-receive-copilot/scripts/copilot-hook-launch.sh",
+				"run.sh",
+				"scripts/check-copilot-birth-hook.ts",
+				"scripts/check-entwurf-capabilities.ts",
+				"scripts/check-gate-qualification.ts",
+				"scripts/check-meta-doctor-oracle.sh",
+				"scripts/check-meta-manifest-schema.py",
+				"scripts/copilot-bridge-doctor.sh",
+				"scripts/copilot-bridge-install.sh",
+				"scripts/meta-bridge-hook-log.sh",
+				"scripts/mutants/copilot-birth.json",
+				"scripts/tsconfig.json",
+				"tsconfig.json"
+			],
+			"tipOnlyFiles": ["NEXT--issue-82-copilot-citizen.md"]
+		},
+		{
+			"runId": "32450955048",
+			"branch": "issue-82-copilot-citizen",
+			"before": "0aed67df2f22",
+			"head": "88d0641b001e",
+			"diedAt": "lane inventory (head)",
+			"files": [
+				"AGENTS.md",
+				"NEXT--issue-82-copilot-citizen.md",
+				"VERIFY.md",
+				"docs/adding-a-harness.md",
+				"docs/external-mcp-host.md",
+				"package.json",
+				"pi-extensions/lib/meta-sender-identity.ts",
+				"pi-extensions/lib/meta-session.ts",
+				"pi-extensions/meta-bridge-hook-copilot.ts",
+				"pi/meta-bridge-copilot/entwurf-meta-receive-copilot/.claude-plugin/plugin.json",
+				"pi/meta-bridge-copilot/entwurf-meta-receive-copilot/scripts/copilot-hook-launch.sh",
+				"run.sh",
+				"scripts/check-copilot-birth-hook.ts",
+				"scripts/check-meta-session.ts",
+				"scripts/copilot-bridge-doctor.sh",
+				"scripts/copilot-mcp-bridge.sh",
+				"scripts/copilot-mcp-config.py",
+				"scripts/copilot-statusline-bridge.sh",
+				"scripts/copilot-statusline-config.py",
+				"scripts/mutants/copilot-birth.json",
+				"scripts/smoke-copilot-mcp-state.sh",
+				"scripts/smoke-copilot-statusline-state.sh"
+			],
+			"tipOnlyFiles": [
+				"AGENTS.md",
+				"NEXT--issue-82-copilot-citizen.md",
+				"docs/adding-a-harness.md",
+				"docs/external-mcp-host.md",
+				"pi-extensions/lib/meta-sender-identity.ts",
+				"pi-extensions/meta-bridge-hook-copilot.ts",
+				"pi/meta-bridge-copilot/entwurf-meta-receive-copilot/.claude-plugin/plugin.json",
+				"pi/meta-bridge-copilot/entwurf-meta-receive-copilot/scripts/copilot-hook-launch.sh",
+				"run.sh",
+				"scripts/check-copilot-birth-hook.ts",
+				"scripts/copilot-bridge-doctor.sh",
+				"scripts/mutants/copilot-birth.json"
+			]
+		},
+		{
+			"runId": "33154263432",
+			"branch": "issue-87-omp-vendor-measurement",
+			"before": "7c414f55bd69",
+			"head": "9b70a4938fd0",
+			"diedAt": "lane inventory (head)",
+			"files": [
+				"NEXT.md",
+				"mcp/entwurf-bridge/src/index.ts",
+				"package.json",
+				"pi-extensions/lib/entwurf-self-address.ts",
+				"run.sh",
+				"scripts/check-entwurf-self-address.ts",
+				"scripts/mutants/self-address.json",
+				"scripts/omp-mcp-bridge.sh",
+				"scripts/omp-tool-surface.py",
+				"scripts/smoke-omp-mcp-state.sh"
+			],
+			"tipOnlyFiles": ["NEXT.md"]
+		},
+		{
+			"runId": "30991752256",
+			"branch": "mux-placement",
+			"before": "e5689808c9ba",
+			"head": "e05af7294724",
+			"diedAt": "CONTROL pre-red",
+			"files": [
+				"AGENTS.md",
+				"NEXT--mux-placement.md",
+				"README.md",
+				"ROADMAP.md",
+				"VERIFY.md",
+				"docs/mux-launch-rail.md",
+				"mcp/entwurf-bridge/src/index.ts",
+				"package.json",
+				"pi-extensions/entwurf-control.ts",
+				"pi-extensions/lib/entwurf-v2-contract.ts",
+				"pi-extensions/lib/mux-fresh-call.ts",
+				"pi-extensions/lib/mux-launch.ts",
+				"pi-extensions/lib/mux-placement.ts",
+				"run.sh",
+				"scripts/check-gate-qualification.ts",
+				"scripts/check-mux-fresh-call.ts",
+				"scripts/check-mux-launch.ts",
+				"scripts/check-release-gate-outcomes.ts",
+				"scripts/mutants/mux-fresh-call.json",
+				"scripts/smoke-mux-fresh-call-live.ts",
+				"tsconfig.json"
+			],
+			"tipOnlyFiles": ["NEXT--mux-placement.md"]
+		},
+		{
+			"runId": "31062287903",
+			"branch": "mux-placement",
+			"before": "e05af7294724",
+			"head": "79edfe7738a4",
+			"diedAt": "CONTROL pre-red",
+			"files": [
+				"demo/demo-baseline.sh",
+				"demo/demo.sh",
+				"scripts/lib/mutation-qualify.ts",
+				"scripts/new-session-id.ts"
+			],
+			"tipOnlyFiles": ["demo/demo-baseline.sh", "demo/demo.sh", "scripts/new-session-id.ts"]
+		}
+	]
+}

package/scripts/mutants/release-gate.json

@@ -114,7 +114,7 @@
 		},
 		{
 			"claim": "CI-FULL-FLOOR-QUALIFIED",
-			"title": "the CI check job is downgraded from the full deterministic floor back to the ≤60s everyday core — the #70 tier rename regression, where qualification still runs once on every push but now certifies kill-power over a floor no candidate ships on, and the hermetic/package tiers reach machine time nowhere",
+			"title": "the CI check job is downgraded from the full deterministic floor back to the ≤60s everyday core — the #70 tier rename regression, where qualification still runs once on the pushes the filter sends it but now certifies kill-power over a floor no candidate ships on, and the hermetic/package tiers reach machine time nowhere",
 			"subject": ".github/workflows/ci.yml",
 			"find": ["      - run: pnpm run check:full"],
 			"replace": ["      - run: pnpm check"],
@@ -123,6 +123,50 @@
 			"signature": "[QK:CI-FULL-FLOOR-QUALIFIED]",
 			"signatureSource": "scripts/check-release-gate-outcomes.ts"
 		},
+		{
+			"claim": "RELEASE-SHA-QUALIFIED-IN-CI",
+			"title": "the exact-SHA CI oracle stops requiring the qualification BODY step, so a release SHA whose body never executed is certified by three green job names",
+			"subject": ".claude/skills/entwurf-release/scripts/verify-exact-ci.sh",
+			"find": ["if qual != \"success\":"],
+			"replace": ["if False:"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:RELEASE-SHA-QUALIFIED-IN-CI]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "QUALIFY-FILTER-COVERS-SUBJECTS",
+			"title": "the CI qualification filter stops collecting signatureSource paths, so a change to a gate that owns a claim's signature no longer re-proves it in CI",
+			"subject": "scripts/ci-qualify-decide.sh",
+			"find": ["\t\tsignature_source = mutant.get(\"signatureSource\")"],
+			"replace": ["\t\tsignature_source = None"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:QUALIFY-FILTER-COVERS-SUBJECTS]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "QUALIFY-FILTER-READS-PUSH-RANGE",
+			"title": "the filter reads the tip commit instead of the two-dot push range - the exact misreading that once concluded four of the five historical qualification reds would have been skipped",
+			"subject": "scripts/ci-qualify-decide.sh",
+			"find": ["CHANGED=\"$(git -C \"$REPO_DIR\" diff --name-only \"$BEFORE\"..\"$HEAD_SHA\" 2>/dev/null)\""],
+			"replace": ["CHANGED=\"$(git -C \"$REPO_DIR\" diff --name-only \"$HEAD_SHA~1\"..\"$HEAD_SHA\" 2>/dev/null)\""],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:QUALIFY-FILTER-READS-PUSH-RANGE]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "QUALIFY-FILTER-REPLAYS-PAST-CATCHES",
+			"title": "the matcher stops after the first changed path, so a push whose first file is outside the qualification surface decides false no matter what rides behind it - invisible to every single-file check, fatal to all five historical ranges",
+			"subject": "scripts/ci-qualify-decide.sh",
+			"find": ["\tdone <<< \"$files\""],
+			"replace": ["\tdone <<< \"${files%%$'\\n'*}\""],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:QUALIFY-FILTER-REPLAYS-PAST-CATCHES]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
 		{
 			"claim": "MUX-LIFECYCLE-IS-RELEASE-MUST",
 			"title": "the integrated mux lifecycle stays listed but bypasses run_live_step, so a missing prerequisite returns SKIP into a branch that never classifies it and the cut reads green",