@junghanacs/entwurf 0.18.1 → 0.19.0

package/scripts/check-mux-launch-tmux.ts

@@ -24,6 +24,9 @@
  *     is still listed on an immediate re-read — which is why no post-launch presence check is
  *     performed and why the precondition runs before the window exists
  *   - a precondition refusal opens NO window at all
+ *   - the #105 seat, through the real `freshCall`: an absent seat refuses and creates nothing,
+ *     an existing one puts the window in THAT session with a receipt naming the resolved
+ *     target, and the resulting handle closes through `closeWindow` from outside that session
  */
 
 import assert from "node:assert/strict";
@@ -97,7 +100,7 @@ function alive(pid: string): boolean {
 	}
 }
 
-function main(): void {
+async function main(): Promise<void> {
 	if (spawnSync("tmux", ["-V"], { encoding: "utf8" }).status !== 0) {
 		skipLive(LABEL, "tmux is not installed — install tmux to run the launch acceptance");
 	}
@@ -298,6 +301,78 @@ function main(): void {
 			originalPanes.every((p) => panes().includes(p)),
 		);
 		ok("restored: focus never moved", windows().find((w) => w.endsWith("|1")) === activeBefore);
+
+		// ── the fresh-call composition, against a real server (#105) ──────────────────
+		// The seat's deterministic gate can prove the argv, the leaf and the refusals, but the
+		// two things that only exist once tmux has answered — WHICH session the window landed
+		// in, and what the receipt says about it — had no oracle independent of the production
+		// source. This cell is that oracle: the same hermetic runtime above, a SECOND session
+		// on this same private server, and the real `freshCall`, read through its return value
+		// and the server's own inventory.
+		{
+			const { freshCall } = await import("../pi-extensions/lib/mux-fresh-call.ts");
+			const { closeWindow } = await import("../pi-extensions/lib/mux-placement.ts");
+			const call = (placementInput?: { tmuxSession: string }) =>
+				freshCall(
+					{
+						backend: "pi",
+						model: "fixture/model",
+						task: "fixture task",
+						placement: placementInput,
+						callerGardenId: "20260101T000000-fixture",
+					},
+					inherited,
+				);
+			const inventory = (): string => fxLines("list-windows", "-a", "-F", "#{session_id}|#{window_id}").join(" ");
+
+			// (i) an ABSENT seat: named refusal, and the server is byte-identical afterwards.
+			const beforeAbsent = inventory();
+			const absent = call({ tmuxSession: "nosuchseat" });
+			ok(
+				"seat: an absent seat refuses as tmux-session-missing and creates NOTHING — no window, no session",
+				!absent.ok && absent.reason === "tmux-session-missing" && inventory() === beforeAbsent,
+			);
+
+			// (ii) an EXISTING seat on the same server: the window lands THERE, the caller's own
+			// session is untouched, and the receipt names the resolved target rather than the caller.
+			assert.equal(fx("new-session", "-d", "-s", `${SESSION}-seat`).status, 0, "fixture seat session");
+			const seatId = fxLines("list-windows", "-t", `=${SESSION}-seat`, "-F", "#{session_id}")[0];
+			const callerWindowsBefore = fxLines("list-windows", "-t", placement.sessionId, "-F", "#{window_id}").join(" ");
+			const seated = call({ tmuxSession: `${SESSION}-seat` });
+			assert.ok(seated.ok, `the seated fresh call must succeed: ${seated.ok ? "" : seated.reason}`);
+			const receipt = seated.receipt;
+			ok(
+				"seat: the receipt reports the RESOLVED target session and echoes the REQUESTED name — not the caller's session",
+				receipt.sessionId === seatId &&
+					receipt.sessionId !== placement.sessionId &&
+					receipt.tmuxSession === `${SESSION}-seat`,
+			);
+			ok(
+				"seat: tmux agrees — the window is in the seat, and the caller's own session is byte-identical",
+				fxLines("list-windows", "-t", seatId, "-F", "#{window_id}").includes(receipt.windowId) &&
+					fxLines("list-windows", "-t", placement.sessionId, "-F", "#{window_id}").join(" ") === callerWindowsBefore,
+			);
+			ok(
+				"seat: an omitted seat still lands in the caller's own session and the receipt names none",
+				(() => {
+					const own = call();
+					if (!own.ok) return false;
+					const here = own.receipt.sessionId === placement.sessionId && own.receipt.tmuxSession === undefined;
+					process.kill(Number(own.receipt.panePid), "SIGKILL");
+					return here;
+				})(),
+			);
+
+			// (iii) the close side: that handle closes through the production verb, in a session
+			// that is NOT the caller's — the reason close binds to the server half.
+			ok(
+				"seat: the placed window closes through its own handle and tmux stops listing it",
+				closeWindow(receipt, inherited) === "closed" &&
+					!fxLines("list-windows", "-a", "-F", "#{window_id}").includes(receipt.windowId),
+			);
+			fx("kill-session", "-t", seatId);
+			ok("seat: the fixture is back to one session", sessionCount() === 1);
+		}
 	} finally {
 		fx("kill-server");
 		if (fs.existsSync(SOCKET)) fs.rmSync(SOCKET, { force: true });
@@ -313,4 +388,4 @@ function main(): void {
 	console.log(`\n${LABEL}: ${passed} checks passed`);
 }
 
-main();
+await main();

package/scripts/check-mux-launch.ts

@@ -19,6 +19,7 @@
  *   MUX-LAUNCH-NO-SHELL-ARGV       the fixed runtime is passed after `--`, never as a string
  *   MUX-LAUNCH-NO-CARRIER          argv is the append shape plus the runtime, nothing else
  *   MUX-LAUNCH-CORE-IMPORT-FREE    the launch module and entwurf delivery never import each other
+ *   RESOLVE-TMUX-SESSION-IMPORT-FREE  the session-lookup leaf imports nothing at all
  */
 
 import assert from "node:assert/strict";
@@ -270,6 +271,22 @@ function main(): void {
 			"boundary: the placement leaf does not import the launch module — the leaf stays deletable on its own",
 			!importsLaunch("pi-extensions/lib/mux-placement.ts"),
 		);
+		// ── the session-lookup leaf imports NOTHING (docs §11, #105) ─────────────────
+		// It is the one leaf whose entire safety argument is that it cannot acquire an
+		// opinion: no tmux of its own (the runner is injected), no mux module, no entwurf
+		// core, and not even a node builtin. §11 states that; nothing held it, and the first
+		// `import { runTmux } from "./mux-placement.ts"` would quietly turn a decision leaf
+		// into a second place that can run tmux.
+		ok(
+			"[QK:RESOLVE-TMUX-SESSION-IMPORT-FREE] the session-lookup leaf imports nothing at all — not mux, not entwurf core, not even a node builtin — so the only power it has is the runner its caller injects",
+			importsOf(fs.readFileSync("pi-extensions/lib/resolve-tmux-session.ts", "utf8")).length === 0,
+		);
+		ok(
+			"boundary: the fresh-call composition is the ONLY shipped source that imports that leaf",
+			PRODUCTION_SOURCES.filter((m) =>
+				importsOf(fs.readFileSync(m, "utf8")).some((spec) => spec.includes("resolve-tmux-session")),
+			).join(",") === FRESH_CALL_MODULE,
+		);
 		// Prose is not behaviour: the module header names identity vocabulary precisely to say
 		// it owns none of it, so this assertion reads CODE with the comments stripped. A check
 		// that failed on its own documentation would push the boundary out of the docs.

package/scripts/check-mux-placement-tmux.ts

@@ -27,6 +27,8 @@
  *   - handles are stable @window/%pane
  *   - the rc=0 trap is real, and inspectPlacement refuses it instead of guessing
  *   - close reports `closed` for a live window and `already-gone` after a natural exit
+ *   - a window placed in ANOTHER session of the same server closes through its own handle,
+ *     while a handle from another SERVER is still refused (#105 close-side binding)
  */
 
 import assert from "node:assert/strict";
@@ -259,9 +261,10 @@ function main(): void {
 			/context changed/,
 			"appendWindow must refuse a placement from another session",
 		);
+		// Close binds to the SERVER half (#105), so its refusal names that half by its own word.
 		assert.throws(
 			() => closeWindow({ ...w4, serverPid: "999999" }, inherited),
-			/context changed/,
+			/server changed/,
 			"closeWindow must refuse a handle from another server",
 		);
 		ok("binding: append/close refuse a foreign server or session before mutating", windows().length === 4);
@@ -305,6 +308,63 @@ function main(): void {
 			originalPanes.every((p) => panes().includes(p)),
 		);
 		ok("restored: focus never moved", windows().find((w) => w.endsWith("|1")) === activeBefore);
+
+		// ── close binds to the SERVER, not the session (#105) ─────────────────────────
+		// Since #105 a launched window may live in a session that is not the caller's, so the
+		// close side had to stop requiring the session half. This is that decision judged
+		// against a real server: a SECOND session, a window opened into it from the caller's
+		// pane the way the fresh-call composition does, and a close through the same handle.
+		// Both foreign-server refusal and the two close outcomes above stay exactly as they
+		// were — the session half is what changed, and only for close.
+		assert.equal(fx("new-session", "-d", "-s", `${SESSION}-b`).status, 0, "fixture second session");
+		ok("cross-session: the fixture now holds two sessions", sessionCount() === 2);
+		const otherSessionId = fxLines("list-windows", "-t", `=${SESSION}-b`, "-F", "#{session_id}")[0];
+		ok("cross-session: the second session resolves to a native id by exact name", /^\$[0-9]+$/.test(otherSessionId));
+		const placedRow = fxLines(
+			"new-window",
+			"-d",
+			"-a",
+			"-t",
+			`${otherSessionId}:{end}`,
+			"-P",
+			"-F",
+			"#{window_id}|#{window_index}|#{pane_id}|#{pane_pid}",
+		)[0].split("|");
+		const placed = {
+			serverPid: placement.serverPid,
+			sessionId: otherSessionId,
+			windowId: placedRow[0],
+			windowIndex: placedRow[1],
+			paneId: placedRow[2],
+			panePid: placedRow[3],
+		};
+		ok(
+			"cross-session: the window really landed in the OTHER session, and the caller's session is untouched",
+			fxLines("list-windows", "-t", otherSessionId, "-F", "#{window_id}").includes(placed.windowId) &&
+				!fxLines("list-windows", "-t", placement.sessionId, "-F", "#{window_id}").includes(placed.windowId),
+		);
+		ok(
+			"cross-session: the caller's own session still shows windows 1,2 and its focus is unmoved",
+			fxLines("list-windows", "-t", placement.sessionId, "-F", "#{window_id}").length === 2 &&
+				windows().find((w) => w.endsWith("|1")) === activeBefore,
+		);
+		// The predicate change, stated as the two facts that had to move together.
+		assert.throws(
+			() => closeWindow({ ...placed, serverPid: "999999" }, inherited),
+			/server changed/,
+			"closeWindow must still refuse a handle from another server",
+		);
+		ok(
+			"cross-session: a window in another session of the SAME server closes through its own handle — the release lifecycle smoke's close path reaches a placed window",
+			closeWindow(placed, inherited) === "closed",
+		);
+		ok(
+			"cross-session: it is gone from the other session, and nothing else moved",
+			!fxLines("list-windows", "-a", "-F", "#{window_id}").includes(placed.windowId) &&
+				fxLines("list-windows", "-t", placement.sessionId, "-F", "#{window_id}").length === 2,
+		);
+		fx("kill-session", "-t", otherSessionId);
+		ok("cross-session: the fixture is back to one session", sessionCount() === 1);
 	} finally {
 		fx("kill-server");
 		if (fs.existsSync(SOCKET)) fs.rmSync(SOCKET, { force: true });

package/scripts/check-mux-placement.ts

@@ -22,6 +22,7 @@
  *   MUX-TMUX-FAILURE-LOUD    a nonzero/signalled tmux run is raised, never read as a fact
  *   MUX-APPEND-END-DETACHED  append is `-d -a -t <session_id>:{end}`, no carrier
  *   MUX-CONTEXT-BOUND-MUTATION a mutation matches the server pid AND the session id
+ *   MUX-CLOSE-SERVER-BOUND   a close binds to the server half only — same server, any session
  *   MUX-CLOSE-BY-WINDOW-ID   close targets `@window`, and absence needs positive proof
  */
 
@@ -38,6 +39,7 @@ import {
 	isDecimal,
 	isPaneId,
 	isSameContext,
+	isSameServer,
 	isSessionId,
 	isWindowId,
 	parsePlacement,
@@ -254,6 +256,37 @@ function main(): void {
 			);
 		})(),
 	);
+	// ── a close binds to the server, and the session half is covered by id uniqueness ────
+	// `appendWindow` and `closeWindow` are answering different questions, so they bind to
+	// different halves of the same fact. Append asks "is this target still the caller's own
+	// seat?" and needs both. Close asks "is this handle still the window it was born as?" —
+	// and since #105 a launched window may legitimately live in a session that is not the
+	// caller's, so requiring the session half would refuse a legitimate close. `[측정
+	// 2026-09-07]` window ids are handed out monotonically and never recycled within one
+	// server's life (after `@2` was killed the next was `@3`; after a whole session holding
+	// `@4`/`@5` was killed the next was `@6`), so on a matching server the `@id` alone
+	// identifies the window. What must still be refused is a handle from a DIFFERENT or
+	// restarted server, where the same id names something else.
+	ok(
+		"[QK:MUX-CLOSE-SERVER-BOUND] a close-side context matches on the server pid ALONE — another session on the same server is accepted, and every foreign server is refused however familiar its session id looks",
+		(() => {
+			const origin = { serverPid: "8150", sessionId: "$11" };
+			return (
+				isSameServer(origin, { serverPid: "8150", sessionId: "$11" }) &&
+				isSameServer(origin, { serverPid: "8150", sessionId: "$12" }) &&
+				!isSameServer(origin, { serverPid: "9999", sessionId: "$11" }) &&
+				!isSameServer(origin, { serverPid: "9999", sessionId: "$12" })
+			);
+		})(),
+	);
+	ok(
+		"binding: the two predicates are different contracts — append's refuses a foreign session that close's accepts, so neither may be expressed in terms of the other",
+		(() => {
+			const origin = { serverPid: "8150", sessionId: "$11" };
+			const otherSession = { serverPid: "8150", sessionId: "$12" };
+			return !isSameContext(origin, otherSession) && isSameServer(origin, otherSession);
+		})(),
+	);
 	ok(
 		"binding: a window handle carries the context it was born in",
 		(() => {

package/scripts/check-release-gate-outcomes.ts

@@ -44,7 +44,8 @@
 
 import { strict as assert } from "node:assert";
 import { execFileSync } from "node:child_process";
-import { globSync, readFileSync } from "node:fs";
+import { copyFileSync, globSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
 import { basename, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { LIVE_SKIP_EXIT, LIVE_SKIP_MARKER } from "./lib/live-skip.ts";
@@ -337,17 +338,20 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 //    check-gate-qualification left the default check chains (operator
 //    inner-loop cost, 2026-08 subtraction). That move is a gate/release
 //    contract: the step must stay REACHABLE on the axes that now own it — the
-//    CI check job on every branch push and release_gate as its own MUST step — and
+//    CI check job (on the pushes #103's filter still sends it) and release_gate
+//    as its own MUST step — and
 //    must not silently return to the default chain. Without this cell,
 //    deleting the release_gate qualification block or the CI line leaves every
 //    focused gate green while a cut quietly loses its discriminating-power
 //    step.
 //
-//    TWO claims, because #70 added a second independent contract here. 8a is
-//    REACHABILITY (absent from the default chain; present exactly once in CI and
-//    exactly once as a wired release_gate MUST step; named in VERIFY). 8b is what
-//    the CI step qualifies (the FULL floor, before the qualification run). Each
-//    carries its own replant — one mutant must never stand in for both.
+//    THREE claims, because each is an independent contract. 8a is REACHABILITY
+//    (absent from the default chain; present exactly once in CI and exactly once
+//    as a wired release_gate MUST step; named in VERIFY). 8b is what the CI step
+//    qualifies (the FULL floor, before the qualification run), added by #70. 8c is
+//    what the RELEASE path ACCEPTS as evidence for one SHA — that the body step
+//    actually ran there (#103). Each carries its own replant — one mutant must
+//    never stand in for another.
 // ===========================================================================
 {
 	// The default chain is tiered (#70): `check` (core) and `check:full` compose the
@@ -382,7 +386,11 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 		!qualGateBody.includes('results+=("FAIL  check-gate-qualification")')
 	)
 		holes.push("the release_gate qualification step does not wire PASS/FAIL into the MUST counters");
-	if (!verifyDoc.includes("in the CI `check` job on every branch push, and as a release-gate MUST step"))
+	if (
+		!verifyDoc.includes(
+			"in the CI `check` job on a branch push that touched the qualification surface, and as a release-gate MUST step",
+		)
+	)
 		holes.push("VERIFY.md no longer names the owners of the moved qualification step");
 	assert.ok(
 		holes.length === 0,
@@ -412,6 +420,210 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 			"downgrade/omission axis; ordering is directly asserted by this same oracle. " +
 			`Broken: check:full at index ${ciFloorAt}, qualification at index ${ciQualAt}.`,
 	);
+
+	// 8c. The RELEASE oracle requires that body to have actually run at the release
+	//     SHA -- its own contract, not a branch of 8a. 8a is REACHABILITY (the step
+	//     exists in the CI job and in release_gate); this is about what the release
+	//     path ACCEPTS as evidence for one SHA. `verify-exact-ci.sh` read only three
+	//     job names, and a job conclusion says nothing about whether the step inside
+	//     it ran: the moment ci.yml can skip that step (#103 piece 2), a green oracle
+	//     would certify a SHA whose qualification body never executed. That is the
+	//     "green with no evidence" class this repo fails closed on, which is why the
+	//     oracle gets the fourth axis BEFORE the skip exists.
+	//
+	//     This is a TEXT oracle, the same grade as check-install-surface S7g. A
+	//     behavioural oracle would need either a second file (S7a/S7g bind the
+	//     release surface to one script read from the index) or an injectable
+	//     RUN_JSON seam -- and that seam would be a way to launder release evidence
+	//     past gh. Both cost more than the axis is worth here.
+	const ciOracle = readFileSync(join(REPO_DIR, ".claude/skills/entwurf-release/scripts/verify-exact-ci.sh"), "utf8");
+	const axis: string[] = [];
+	if (!ciOracle.includes('QUAL_JOB = "check"') || !ciOracle.includes('"Run ./run.sh check-gate-qualification"'))
+		axis.push("the oracle does not name the check job's check-gate-qualification step");
+	if (!ciOracle.includes('qual != "success"'))
+		axis.push("the oracle does not guard that step's conclusion against 'success'");
+	if (!ciOracle.includes('qual == "skipped"'))
+		axis.push("the oracle does not classify a SKIPPED body as a failure of its own");
+	assert.ok(
+		axis.length === 0,
+		"[QK:RELEASE-SHA-QUALIFIED-IN-CI] the exact-SHA CI oracle must require the qualification BODY to have run " +
+			"at the release SHA -- the `check` job's `Run ./run.sh check-gate-qualification` step concluding 'success', " +
+			"with skipped named as its own failure. Three green job names do not prove the step inside one of them " +
+			`executed. Broken: ${axis.join("; ")}`,
+	);
+}
+
+// ===========================================================================
+// 8d. The qualification filter COVERS every mutant subject (#103 piece 2)
+//
+//     The body no longer runs on every branch push; a decision script reads the
+//     push range and answers. Its whole safety argument is that the path set is
+//     DERIVED from the committed manifests rather than copied into a list, so a
+//     new mutant subject cannot land outside the filter and quietly stop being
+//     re-proven in CI. This asserts that property behaviourally: every subject
+//     and signatureSource in scripts/mutants/*.json, fed to the script as a
+//     one-file change, must decide `run_body=true`. The oracle is the manifests
+//     themselves, read here independently of the script.
+// ===========================================================================
+{
+	const decider = join(REPO_DIR, "scripts/ci-qualify-decide.sh");
+	const paths = new Set<string>();
+	for (const file of globSync("scripts/mutants/*.json", { cwd: REPO_DIR })) {
+		const manifest = JSON.parse(readFileSync(join(REPO_DIR, file), "utf8")) as {
+			mutants?: { subject?: string; signatureSource?: string }[];
+		};
+		for (const mutant of manifest.mutants ?? []) {
+			if (mutant.subject) paths.add(mutant.subject);
+			if (mutant.signatureSource) paths.add(mutant.signatureSource);
+		}
+	}
+	assert.ok(paths.size > 50, `read only ${paths.size} mutant paths from the manifests`);
+	const uncovered = [...paths].filter((path) => {
+		const out = execFileSync("bash", [decider, "--files-from", "-"], {
+			cwd: REPO_DIR,
+			encoding: "utf8",
+			input: `${path}\n`,
+			stdio: ["pipe", "pipe", "ignore"],
+		});
+		return out.trim() !== "run_body=true";
+	});
+	assert.ok(
+		uncovered.length === 0,
+		"[QK:QUALIFY-FILTER-COVERS-SUBJECTS] the CI qualification filter must run the body for a change to ANY " +
+			"committed mutant subject or signature source — it derives that set from scripts/mutants/*.json for " +
+			"exactly this reason, so a path it cannot see is a claim that silently stops being re-proven in CI. " +
+			`Uncovered (${uncovered.length} of ${paths.size}): ${uncovered.slice(0, 8).join(", ")}`,
+	);
+}
+
+// ===========================================================================
+// 8e. The filter still runs the body for every RED the body has ever produced
+//
+//     Five reds in 549 runs (#99 stage-2). The first reading of them used the
+//     tip COMMIT and concluded the filter would have missed four; replaying the
+//     real two-dot push range — what GitHub actually compares — showed all five
+//     hit. That reversal is the whole evidentiary basis for this filter.
+//
+//     It is asserted from RECORDED file lists, not from live history, and that
+//     is a constraint rather than a convenience: check-gate-qualification runs
+//     every gate inside a snapshot with its own fresh git baseline, where these
+//     2026-07/08 commits do not exist. A cell that read history there would be
+//     CONTROL-RED for the whole lane — measured, not predicted (this cell did
+//     exactly that on 2026-09-06 and cost the release-gate lane its 17 kills).
+//     The fixture carries what history said, measured once, in a repo where the
+//     objects are present.
+//
+//     It has its own replant, and the reason is the SHAPE of the input: 8d feeds
+//     ONE path per call, this feeds a whole push at once. A matcher that only
+//     looked at the first entry would leave 8d green — every single-file call is
+//     its own first entry — while every one of these five pushes opens with a
+//     non-surface path (DELIVERY.md, AGENTS.md, NEXT.md, AGENTS.md,
+//     demo/demo-baseline.sh). Invisible to 8d, fatal here.
+//
+//     The two-dot READING itself is proven separately, below.
+// ===========================================================================
+{
+	const decider = join(REPO_DIR, "scripts/ci-qualify-decide.sh");
+	const fixture = JSON.parse(readFileSync(join(REPO_DIR, "scripts/fixtures/qualify-replay.json"), "utf8")) as {
+		runs: { runId: string; before: string; head: string; files: string[]; tipOnlyFiles: string[] }[];
+	};
+	assert.equal(fixture.runs.length, 5, "the replay fixture holds all five historical qualification reds");
+	const wrong: string[] = [];
+	for (const run of fixture.runs) {
+		assert.ok(run.files.length > 0, `run ${run.runId} has no recorded push range`);
+		const out = execFileSync("bash", [decider, "--files-from", "-"], {
+			cwd: REPO_DIR,
+			encoding: "utf8",
+			input: `${run.files.join("\n")}\n`,
+			stdio: ["pipe", "pipe", "ignore"],
+		}).trim();
+		if (out !== "run_body=true") wrong.push(`run ${run.runId} (${run.files.length} files) decided ${out}`);
+	}
+	assert.ok(
+		wrong.length === 0,
+		"[QK:QUALIFY-FILTER-REPLAYS-PAST-CATCHES] every qualification RED in this repo's CI history must still " +
+			"run the body under the filter, over the two-dot push range GitHub compares — the measurement that " +
+			"overturned the tip-commit reading and justified filtering at all. This reads a whole push at once, " +
+			"which 8d cannot: each of these five opens with a non-surface path, so a matcher that stopped after " +
+			"the first entry would pass every single-file check 8d makes and fail here. " +
+			`Broken: ${wrong.join("; ")}`,
+	);
+}
+
+// ===========================================================================
+// 8f. The filter reads the two-dot PUSH RANGE, not the tip commit
+//
+//     The fixture above proves the matcher's verdict on recorded file lists; it
+//     cannot prove which git range produced them, because it calls no git. This
+//     does, hermetically: a throwaway repo shaped like the real defect — a push
+//     of two commits whose TIP is docs-only while the commit under it touched a
+//     mutant subject. The two-dot range sees the code; the tip alone does not.
+//     That is the exact misreading #99 corrected, and it is what four of the
+//     five recorded pushes look like when read the wrong way.
+//
+//     Hermetic on purpose: no repo history, so it runs identically inside the
+//     qualification snapshot.
+// ===========================================================================
+{
+	const decider = join(REPO_DIR, "scripts/ci-qualify-decide.sh");
+	const tmp = mkdtempSync(join(tmpdir(), "entwurf-qualify-range-"));
+	// core.hooksPath is set globally on this operator's machine; a fixture repo
+	// must not run their hooks.
+	const git = (...args: string[]) =>
+		execFileSync("git", ["-c", "core.hooksPath=/dev/null", "-c", "user.email=g@e", "-c", "user.name=g", ...args], {
+			cwd: tmp,
+			stdio: "ignore",
+		});
+	try {
+		git("init", "-q", "-b", "main");
+		// The decider reads the repo it SITS IN, so the fixture gets a real copy
+		// of it and its own one-entry manifest: no seam, no env override, and the
+		// manifest-reading path is exercised too.
+		mkdirSync(join(tmp, "scripts/mutants"), { recursive: true });
+		mkdirSync(join(tmp, "pi-extensions/lib"), { recursive: true });
+		copyFileSync(decider, join(tmp, "scripts/ci-qualify-decide.sh"));
+		writeFileSync(
+			join(tmp, "scripts/mutants/fixture.json"),
+			`${JSON.stringify(
+				{
+					schemaVersion: 1,
+					lane: "fixture",
+					mutants: [{ claim: "FIXTURE", subject: "pi-extensions/lib/fixture-subject.ts" }],
+				},
+				null,
+				"\t",
+			)}\n`,
+		);
+		writeFileSync(join(tmp, "seed.txt"), "seed\n");
+		git("add", "-A");
+		git("commit", "-qm", "seed");
+		const base = execFileSync("git", ["rev-parse", "HEAD"], { cwd: tmp, encoding: "utf8" }).trim();
+		writeFileSync(join(tmp, "pi-extensions/lib/fixture-subject.ts"), "// a mutant subject\n");
+		git("add", "-A");
+		git("commit", "-qm", "code commit (mid-push)");
+		writeFileSync(join(tmp, "README.md"), "docs only\n");
+		git("add", "-A");
+		git("commit", "-qm", "docs commit (tip)");
+		const head = execFileSync("git", ["rev-parse", "HEAD"], { cwd: tmp, encoding: "utf8" }).trim();
+		const decide = (from: string) =>
+			execFileSync("bash", [join(tmp, "scripts/ci-qualify-decide.sh"), from, head], {
+				cwd: tmp,
+				encoding: "utf8",
+				env: { ...process.env, CI_EVENT_NAME: "push", CI_FORCED: "false" },
+				stdio: ["ignore", "pipe", "ignore"],
+			}).trim();
+		const overRange = decide(base);
+		const overTip = decide(`${head}~1`);
+		assert.ok(
+			overRange === "run_body=true" && overTip === "run_body=false",
+			"[QK:QUALIFY-FILTER-READS-PUSH-RANGE] the filter must diff the whole two-dot push range, not the tip " +
+				"commit: a push whose tip is docs-only can still carry a mutant subject underneath it, which is how " +
+				"four of the five historical reds look like docs pushes when read tip-first. " +
+				`Broken: range=${overRange}, tip-only=${overTip} (tip-only must be false, or this fixture proves nothing).`,
+		);
+	} finally {
+		rmSync(tmp, { recursive: true, force: true });
+	}
 }
 
 // ===========================================================================
@@ -655,7 +867,10 @@ console.log(
 		"a run.sh wrapper declining its own prerequisite (including the measured LIVE=1 no-cortex-connection cell); and every " +
 		"LIVE smoke is either wired into release_gate or excluded by a sentence the docs still carry; and the moved " +
 		"check-gate-qualification stays reachable on its owners (absent from the default chain, exactly once in CI, " +
-		"exactly once as a release-gate MUST step) and the CI step qualifies the FULL floor, which runs before it; and " +
+		"exactly once as a release-gate MUST step) and the CI step qualifies the FULL floor, which runs before it, " +
+		"while the exact-SHA release oracle requires that BODY step to have concluded success at the release SHA, " +
+		"and the CI filter that decides when that body runs covers every mutant subject and still runs it for all " +
+		"five historical reds; and " +
 		"every gate a committed mutant names is itself inside check:full or states its exclusion in prose an operator " +
 		"reads; and the CI push trigger is filtered to branch refs, so a release tag creates no duplicate run; and " +
 		"the operator's CONFIGURED bridge invocation is booted exactly once through run_step, before the ACP LIVE tier",