@junghanacs/entwurf 0.18.2 → 0.19.0

package/scripts/mutants/fresh-cut.json

@@ -12,6 +12,32 @@
 			"timeoutSeconds": 180,
 			"signature": "[QK:FRESH-CUT-COLLISION-NO-MOVE]",
 			"signatureSource": "scripts/check-fresh-cut-gate.sh"
+		},
+		{
+			"claim": "FRESHCUT-SYNCAUTH-TRIPWIRE-FIRES",
+			"title": "the retired-credential tripwire goes blind again. This replants the ACTUAL defect rather than a stand-in: under pipefail a `-q` grep exits at the first match and SIGPIPEs the awk still writing ~200KB of a 433KB run.sh, so the pipeline reports 141 and the `if` takes the CLEAN branch — the cell reported no sync_auth surface EXACTLY when one existed. It was deterministic here (100/100 measured) because the producer dwarfs the pipe buffer, which is why the self-test plants its surface near the TOP of the real run.sh: a small synthetic fixture would pass under this mutant and prove nothing",
+			"subject": "scripts/check-fresh-cut-gate.sh",
+			"find": ["  awk '!/^[[:space:]]*#/' \"$1\" | grep -c 'sync_auth' || true"],
+			"replace": ["  awk '!/^[[:space:]]*#/' \"$1\" | grep -q 'sync_auth' && echo 1 || echo 0"],
+			"gate": ["bash", "run.sh", "check-fresh-cut-gate"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCUT-SYNCAUTH-TRIPWIRE-FIRES]",
+			"signatureSource": "scripts/check-fresh-cut-gate.sh"
+		},
+		{
+			"claim": "FRESHCUT-PREFLIGHT-CUT-DETECTED",
+			"title": "the cell forbidding an install from cutting a generation by itself stops SEEING the call it forbids — the context window silently narrows to the matched line, so a fresh-cut invocation one line into preflight_v3_store() reads as absent and D7 stays green. A forbidding cell that is green on a clean tree cannot tell blindness from compliance, which is what the self-test exists to separate",
+			"subject": "scripts/check-fresh-cut-gate.sh",
+			"find": [
+				"  grep -n 'preflight_v3_store()' -A 40 \"$1\" | grep -cE 'run_ts scripts/meta-bridge-fresh-cut\\.ts' || true"
+			],
+			"replace": [
+				"  grep -n 'preflight_v3_store()' -A 0 \"$1\" | grep -cE 'run_ts scripts/meta-bridge-fresh-cut\\.ts' || true"
+			],
+			"gate": ["bash", "run.sh", "check-fresh-cut-gate"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCUT-PREFLIGHT-CUT-DETECTED]",
+			"signatureSource": "scripts/check-fresh-cut-gate.sh"
 		}
 	]
 }

package/scripts/mutants/mux-boundary.json

@@ -191,6 +191,30 @@
 			"timeoutSeconds": 60,
 			"signature": "[QK:MUX-LAUNCH-CORE-IMPORT-FREE]",
 			"signatureSource": "scripts/check-mux-launch.ts"
+		},
+		{
+			"claim": "MUX-CLOSE-SERVER-BOUND",
+			"title": "the close-side predicate accepts a foreign SERVER — a restarted server hands out the same `@id`, and a close would kill whatever window now wears it",
+			"subject": "pi-extensions/lib/mux-placement.ts",
+			"find": ["\treturn origin.serverPid === now.serverPid;\n}"],
+			"replace": ["\treturn true;\n}"],
+			"gate": ["bash", "run.sh", "check-mux-placement"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:MUX-CLOSE-SERVER-BOUND]",
+			"signatureSource": "scripts/check-mux-placement.ts"
+		},
+		{
+			"claim": "RESOLVE-TMUX-SESSION-IMPORT-FREE",
+			"title": "the session-lookup leaf reaches into the placement leaf for runTmux — the one decision leaf that must not be able to run tmux acquires exactly that power, and the injected-runner seam its whole safety argument rests on stops being the only way in",
+			"subject": "pi-extensions/lib/resolve-tmux-session.ts",
+			"find": ["export type TmuxSessionRejectReason = \"tmux-session-name-invalid\" | \"tmux-session-missing\";"],
+			"replace": [
+				"import { runTmux } from \"./mux-placement.ts\";\nvoid runTmux;\nexport type TmuxSessionRejectReason = \"tmux-session-name-invalid\" | \"tmux-session-missing\";"
+			],
+			"gate": ["bash", "run.sh", "check-mux-launch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RESOLVE-TMUX-SESSION-IMPORT-FREE]",
+			"signatureSource": "scripts/check-mux-launch.ts"
 		}
 	]
 }

package/scripts/mutants/mux-fresh-call.json

@@ -438,6 +438,87 @@
 			"timeoutSeconds": 180,
 			"signature": "[QK:FRESHCALL-BACKEND-SET-SURFACE-PARITY-PI]",
 			"signatureSource": "test/fresh-call-surfaces.contract.test.ts"
+		},
+		{
+			"claim": "TMUXSESSION-LOOKUP-ENGINE",
+			"title": "the seat lookup goes back to the `-f` filter engine, which was measured to match EVERY session when the name contains a '}' — a fresh sibling then opens in whichever session tmux listed first",
+			"subject": "pi-extensions/lib/resolve-tmux-session.ts",
+			"find": ["\treturn [\"list-windows\", \"-t\", `=${name}`, \"-F\", \"#{session_id}\"];"],
+			"replace": ["\treturn [\"list-sessions\", \"-f\", `#{==:#{session_name},${name}}`, \"-F\", \"#{session_id}\"];"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:TMUXSESSION-LOOKUP-ENGINE]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "TMUXSESSION-NAME-GRAMMAR",
+			"title": "the seat name grammar is widened to 'anything non-empty' — tmux then stores a DIFFERENT name than the one requested (or splits it on '.'/':') and the seat can never be found, reported as 'missing' instead of as a shape this rail does not address",
+			"subject": "pi-extensions/lib/resolve-tmux-session.ts",
+			"find": ["const SESSION_NAME = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;"],
+			"replace": ["const SESSION_NAME = /^.+$/;"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:TMUXSESSION-NAME-GRAMMAR]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PLACEMENT-MISSING-REJECTS",
+			"title": "an absent seat is read as success — tmux's exit code is ignored, so a missing session falls through to the caller's own session and the launch looks like the seat worked. Proof is in two halves: this mutant dies on the leaf's injected-runner assert plus the source-text ordering assert in the fast lane, and the behavioural oracle independent of that source is the real-tmux seat cell in check-mux-launch-tmux (refusal by name with a byte-identical list-windows -a before and after)",
+			"subject": "pi-extensions/lib/resolve-tmux-session.ts",
+			"find": ["\tif (result.status !== 0) return { ok: false, reason: \"tmux-session-missing\" };"],
+			"replace": [
+				"\tif (result.status !== 0 && result.stdout.length > 0) return { ok: false, reason: \"tmux-session-missing\" };"
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-PLACEMENT-MISSING-REJECTS]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PLACEMENT-TARGET-ARGV",
+			"title": "the launch argv targets the caller's own session again — a seated fresh call silently opens beside the caller instead of in the operator's project session, and the receipt still looks right",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t`${targetSessionId}:{end}`,"],
+			"replace": ["\t\t`$0:{end}`,"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-PLACEMENT-TARGET-ARGV]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PLACEMENT-BACKEND-PARITY",
+			"title": "the project seat becomes a pi capability — the grammar refusal is gated on the backend, so claude-code, copilot and omp fall past the seat check into runtime resolution and answer with the wrong reason. Every seat assertion that existed when #105 landed was written against backend pi alone, so nothing would have noticed",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\tif (badSeat) return { ok: false, reason: badSeat };"],
+			"replace": ["\t\tif (badSeat && params.backend === \"pi\") return { ok: false, reason: badSeat };"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-PLACEMENT-BACKEND-PARITY]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PLACEMENT-RECEIPT-TARGET",
+			"title": "the receipt copies the CALLER's session id again — the window is in the seat, the receipt names the caller's session, and every later close/lookup built on that receipt addresses the wrong session. Proof is in two halves: this mutant dies on the source-text assembly assert in the fast lane, and the behavioural oracle independent of that source is the real-tmux seat cell in check-mux-launch-tmux (receipt.sessionId === seatId !== callerId, read from the server's own inventory)",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t\tsessionId: targetSessionId,"],
+			"replace": ["\t\t\tsessionId: placement.sessionId,"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-PLACEMENT-RECEIPT-TARGET]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PLACEMENT-SURFACE-PARITY",
+			"title": "one surface drops the optional seat from its schema, so opening a sibling in the operator's project session works from pi and silently cannot exist from the MCP bridge",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": [
+				"\t\tplacement: z\n\t\t\t.object({\n\t\t\t\ttmuxSession: z\n\t\t\t\t\t.string()\n\t\t\t\t\t.describe(\n\t\t\t\t\t\t\"EXACT name of an EXISTING session on this agent's own tmux server. Nothing is created: an absent session is refused as tmux-session-missing, and a name outside [A-Za-z0-9][A-Za-z0-9_-]* as tmux-session-name-invalid.\",\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.optional()\n\t\t\t.describe(\n\t\t\t\t\"Optional project seat: open the sibling in ONE EXISTING tmux session of this agent's own server instead of the caller's session. Nothing is ever created — an absent session is a refusal, not a new session. Independent of cwd; neither is inferred from the other. The receipt echoes the REQUESTED name and reports the resolved target session id.\",\n\t\t\t),\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-PLACEMENT-SURFACE-PARITY]",
+			"signatureSource": "test/fresh-call-surfaces.contract.test.ts"
 		}
 	]
 }

package/scripts/mutants/omp-birth.json

@@ -158,16 +158,29 @@
 		},
 		{
 			"claim": "OMP-DOCTOR-CARRIER-TRIMS",
-			"title": "treating an empty or whitespace-only PI carrier as an inherited identity makes Bundle C's deliberate tmux `-e NAME=` scrub fail the deterministic floor whenever a visible fresh omp citizen is alive",
+			"title": "treating an empty or whitespace-only PI carrier as an inherited identity makes Bundle C's deliberate tmux `-e NAME=` scrub fail the deterministic floor whenever a visible fresh omp citizen is alive. Re-anchored when the carrier scan moved from an early-exiting `grep -q` to `grep -c` (the SIGPIPE/pipefail repair); the replanted defect is unchanged — only the line it attaches to moved",
 			"subject": "scripts/omp-bridge-doctor.sh",
 			"find": [
-				"    if tr '\\0' '\\n' < \"$ENVIRON\" 2>/dev/null | grep -qE '^(PI_SESSION_ID|PI_AGENT_ID)=.*[^[:space:]]'; then"
+				"    HITS=\"$(tr '\\0' '\\n' < \"$ENVIRON\" 2>/dev/null | grep -cE '^(PI_SESSION_ID|PI_AGENT_ID)=.*[^[:space:]]' || true)\""
+			],
+			"replace": [
+				"    HITS=\"$(tr '\\0' '\\n' < \"$ENVIRON\" 2>/dev/null | grep -cE '^(PI_SESSION_ID|PI_AGENT_ID)=' || true)\""
 			],
-			"replace": ["    if tr '\\0' '\\n' < \"$ENVIRON\" 2>/dev/null | grep -qE '^(PI_SESSION_ID|PI_AGENT_ID)='; then"],
 			"gate": ["bash", "run.sh", "smoke-omp-bridge-state"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:OMP-DOCTOR-CARRIER-TRIMS]",
 			"signatureSource": "scripts/smoke-omp-bridge-state.sh"
+		},
+		{
+			"claim": "OMP-DOCTOR-CARRIER-NONBLANK-IS-RED",
+			"title": "the doctor stops flagging a live omp process that carries a NONBLANK inherited PI_SESSION_ID/PI_AGENT_ID, so a session whose MCP children would speak under the parent pi garden id reads as clean and the doctor prints PASS. The real defect was subtler than this replant, which is why the replant is written this way: `grep -q` exited at the first match, SIGPIPEd `tr` mid-environ, and pipefail turned a MATCH into a failed pipeline — a race on how far `tr` got, misreading ~15% of runs, so a `-q` replant would SURVIVE most of the time and prove nothing. This one makes the same false-clean deterministic",
+			"subject": "scripts/omp-bridge-doctor.sh",
+			"find": ["    if [ \"${HITS:-0}\" -gt 0 ]; then"],
+			"replace": ["    if [ \"${HITS:-0}\" -gt 99 ]; then"],
+			"gate": ["bash", "run.sh", "smoke-omp-bridge-state"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:OMP-DOCTOR-CARRIER-NONBLANK-IS-RED]",
+			"signatureSource": "scripts/smoke-omp-bridge-state.sh"
 		}
 	]
 }

package/scripts/omp-bridge-doctor.sh

@@ -266,7 +266,17 @@ if [ -d /proc ]; then
     case "$pid" in *[!0-9]*) continue ;; esac
     ENVIRON="/proc/$pid/environ"
     [ -r "$ENVIRON" ] || continue
-    if tr '\0' '\n' < "$ENVIRON" 2>/dev/null | grep -qE '^(PI_SESSION_ID|PI_AGENT_ID)=.*[^[:space:]]'; then
+    # `grep -c`, never `grep -q`. This file runs under `set -o pipefail` (line 26), and a
+    # `-q` grep EXITS AT THE FIRST MATCH, closing the pipe while `tr` is still writing the
+    # rest of an ~12KB environ. `tr` dies of SIGPIPE (141), pipefail promotes that to the
+    # pipeline's status, and the `if` takes the CLEAN branch — so a genuinely contaminated
+    # process was reported as clean, and the doctor printed PASS. It is a RACE on how far
+    # `tr` got, which is why it read as flakiness: measured on this host, 6 misses in 40
+    # reads of one live fixture carrying PI_SESSION_ID=foreign-garden. `-c` consumes all of
+    # stdin, so there is no early close and nothing to race. The same lesson is already
+    # written at smoke-omp-mcp-state.sh:91 — it had not reached this reader.
+    HITS="$(tr '\0' '\n' < "$ENVIRON" 2>/dev/null | grep -cE '^(PI_SESSION_ID|PI_AGENT_ID)=.*[^[:space:]]' || true)"
+    if [ "${HITS:-0}" -gt 0 ]; then
       CONTAMINATED="$CONTAMINATED $pid"
     fi
   done

package/scripts/smoke-mux-fresh-call-live.ts

@@ -2,7 +2,9 @@
  * smoke-mux-fresh-call-live — the ONE axis a deterministic gate cannot reach: a real window, a
  * real runtime, a real first turn, and a real callback arriving on a real inbound surface.
  *
- * OUT of `pnpm check`. Needs `LIVE=1`. Costs two model turns (one pi, one Claude Code).
+ * OUT of `pnpm check`. Needs `LIVE=1`. Costs FOUR model turns (three pi, one Claude Code): two
+ * open in the caller's own session, and #105 added two more in a second SEAT session on the same
+ * private server so the seat x cwd matrix is read on real panes rather than argued about.
  *
  * ── Isolate the WRITES, keep the runtimes real ──
  *
@@ -59,6 +61,17 @@ const REAL_CONTROL_DIR = path.join(REAL_HOME, ".pi", "entwurf-control");
 // so the real-HOME Claude cell can be given exact operator-env parity (issue #67).
 const ORIGINAL_XDG = snapshotOriginalXdg(process.env);
 
+// The #105 seat fixture. A second session on the SAME private server, its own session_path, and
+// two distinct requested cwds — three directories that must never be confusable with each other.
+const SEAT_SESSION = "seat";
+const SEAT_HOME = (root: string): string => path.join(root, "seat-home");
+const CROSS_REPO_A = (root: string): string => path.join(root, "cross-repo-a");
+const CROSS_REPO_B = (root: string): string => path.join(root, "cross-repo-b");
+/** tmux fills `#{pane_current_path}` with the SERVER's cwd at creation time and only becomes
+ * true 0.2–0.6s later (measured ×2, #105 R1) — so acceptance reads it after a delay, never from
+ * the launch receipt. */
+const PANE_CWD_SETTLE_SECONDS = "3";
+
 let passed = 0;
 function ok(label: string, cond: boolean): void {
 	if (!cond) throw new Error(`${LABEL}: FAILED — ${label}`);
@@ -89,6 +102,13 @@ function tmux(socket: string, args: string[], env: NodeJS.ProcessEnv): { status:
 	return { status: r.status, stdout: (r.stdout ?? "").trim() };
 }
 
+/** The session the caller's own anchor pane sits in — tmux's answer, never a name we assembled. */
+function inspectedSessionId(socket: string, env: NodeJS.ProcessEnv): string {
+	return tmux(socket, ["display-message", "-p", "-t", String(env.TMUX_PANE), "#{session_id}"], env).stdout.split(
+		"\n",
+	)[0];
+}
+
 function pidIsAlive(pid: number): boolean {
 	try {
 		process.kill(pid, 0);
@@ -150,6 +170,10 @@ async function main(): Promise<void> {
 	};
 	for (const dir of Object.values(fenced)) fs.mkdirSync(dir, { recursive: true });
 	fs.mkdirSync(scratch, { recursive: true });
+	// The #105 seat cells need three directories that are all DIFFERENT from each other and from
+	// the scratch cwd, so "the pane landed here" can only be true for one reason. `seatHome` is
+	// the second session's own `session_path` — the candidate the cwd must NOT come from.
+	for (const dir of [SEAT_HOME(root), CROSS_REPO_A(root), CROSS_REPO_B(root)]) fs.mkdirSync(dir, { recursive: true });
 	// A runtime dir is a private surface by convention and tmux checks it.
 	fs.chmodSync(fenced.XDG_RUNTIME_DIR, 0o700);
 	for (const [k, v] of Object.entries(fenced)) process.env[k] = v;
@@ -160,7 +184,7 @@ async function main(): Promise<void> {
 	// Import the meta layer only AFTER the redirects — a module that resolved its roots at import
 	// time would have captured the operator's.
 	const meta = await import("../pi-extensions/lib/meta-session.ts");
-	const { freshCall } = await import("../pi-extensions/lib/mux-fresh-call.ts");
+	const { freshCall, renderFreshCall } = await import("../pi-extensions/lib/mux-fresh-call.ts");
 
 	const siblingGids = new Set<string>();
 	const siblingPids = new Set<number>();
@@ -223,6 +247,11 @@ async function main(): Promise<void> {
 		// onboarding instead of exercising the configured runtime. Separate servers preserve
 		// those backend-native environments without adding an env carrier to the product.
 		const nonces = new Map<string, string>();
+		/** Every launched cell's pane, with the directory the pane is REQUIRED to have settled in
+		 * — read after a delay, which is the only honest way to observe it (see the constant). */
+		const cwdCells: Array<{ label: string; socket: string; env: NodeJS.ProcessEnv; paneId: string; expect: string }> =
+			[];
+		const servers = new Map<string, { socket: string; inherited: NodeJS.ProcessEnv }>();
 		// Intentional: pi + claude-code only. Copilot clause-7 LIVE is operator-metered
 		// and is not a release MUST — do not add `copilot` to this loop (VERIFY.md).
 		for (const backend of ["pi", "claude-code"] as const) {
@@ -248,12 +277,17 @@ async function main(): Promise<void> {
 			const anchorPane = tmux(socket, ["display-message", "-p", "-t", "fixture:anchor", "#{pane_id}"], env).stdout;
 			const inherited: NodeJS.ProcessEnv = { ...env, TMUX: `${socket},0,0`, TMUX_PANE: anchorPane };
 			ok(`${backend}: tmux server is a private socket, never the operator's`, String(inherited.TMUX).startsWith(root));
+			servers.set(backend, { socket, inherited });
 
+			// The caller-session half of the #105 cwd matrix: pi omits the cwd, claude-code names
+			// one. Both open in the CALLER's own session, which is the pre-#105 behaviour.
+			const requestedCwd = backend === "claude-code" ? CROSS_REPO_A(root) : undefined;
 			const result = freshCall(
 				{
 					backend,
 					model: LIVE_MODEL[backend],
 					task: "Reply with the single word ACK and then stop. Do not read files.",
+					cwd: requestedCwd,
 					callerGardenId: callerGid,
 				},
 				inherited,
@@ -262,6 +296,13 @@ async function main(): Promise<void> {
 			if (!result.ok) return;
 			nonces.set(backend, result.receipt.nonce);
 			siblingPids.add(Number(result.receipt.panePid));
+			cwdCells.push({
+				label: `${backend} @caller-session cwd=${requestedCwd === undefined ? "(omitted)" : "requested"}`,
+				socket,
+				env: inherited,
+				paneId: result.receipt.paneId,
+				expect: requestedCwd ?? scratch,
+			});
 			ok(
 				`${backend}: the receipt carries tmux coordinates, requested model and nonce, and nothing about delivery`,
 				Boolean(
@@ -271,6 +312,113 @@ async function main(): Promise<void> {
 						result.receipt.nonce,
 				) && !("gardenId" in result.receipt),
 			);
+			ok(
+				`${backend}: with no seat requested the window is in the CALLER's own session and the receipt names no seat`,
+				result.receipt.sessionId === inspectedSessionId(socket, inherited) && result.receipt.tmuxSession === undefined,
+			);
+		}
+
+		// ── #105 acceptance: the optional project seat ───────────────────────────
+		// One extra session on the SAME private pi server (R6: a second session is one line and
+		// costs no extra server). Its own `-c` gives it a session_path that is neither the
+		// caller's cwd nor either requested cwd, so the cwd matrix below can only pass for one
+		// reason.
+		const pi = servers.get("pi");
+		if (!pi) throw new Error(`${LABEL}: the pi fixture server was not captured`);
+		const callerSessionId = inspectedSessionId(pi.socket, pi.inherited);
+		if (
+			tmux(pi.socket, ["new-session", "-d", "-s", SEAT_SESSION, "-c", SEAT_HOME(root), "-n", "anchor"], pi.inherited)
+				.status !== 0
+		) {
+			throw new Error(`${LABEL}: could not create the second fixture session ${SEAT_SESSION}`);
+		}
+		const seatSessionId = tmux(
+			pi.socket,
+			["list-windows", "-t", `=${SEAT_SESSION}`, "-F", "#{session_id}"],
+			pi.inherited,
+		).stdout.split("\n")[0];
+		ok(
+			"seat: the fixture now holds two sessions on ONE server, and the seat is not the caller's",
+			/^\$[0-9]+$/.test(seatSessionId) && seatSessionId !== callerSessionId,
+		);
+
+		// Acceptance 2 FIRST, because it is the one that must leave nothing behind. Both refusals
+		// are read against a byte-identical session/window inventory.
+		const inventory = (): string =>
+			tmux(pi.socket, ["list-windows", "-a", "-F", "#{session_id}|#{window_id}"], pi.inherited).stdout;
+		const beforeRefusals = inventory();
+		for (const [label, seat, reason] of [
+			["absent", "nosuchseat", "tmux-session-missing"],
+			["unresolvable", "no.such.seat", "tmux-session-name-invalid"],
+		] as const) {
+			const refused = freshCall(
+				{
+					backend: "pi",
+					model: LIVE_MODEL.pi,
+					task: "This task must never run.",
+					placement: { tmuxSession: seat },
+					callerGardenId: callerGid,
+				},
+				pi.inherited,
+			);
+			ok(
+				`seat: an ${label} seat is refused as ${reason}, and NOTHING was created`,
+				!refused.ok && refused.reason === reason && inventory() === beforeRefusals,
+			);
+			const rendered = renderFreshCall(refused);
+			ok(
+				`seat: the ${label} refusal says so in the operator's words`,
+				rendered.isError && rendered.text.includes("No window was opened"),
+			);
+		}
+
+		// Acceptance 1 + the other half of the cwd matrix: two seated pi siblings, one with the
+		// cwd omitted and one with a requested cwd.
+		for (const [label, requestedCwd] of [
+			["seat cwd=(omitted)", undefined],
+			["seat cwd=requested", CROSS_REPO_B(root)],
+		] as const) {
+			const callerWindowsBefore = tmux(
+				pi.socket,
+				["list-windows", "-t", callerSessionId, "-F", "#{window_id}"],
+				pi.inherited,
+			).stdout;
+			const seated = freshCall(
+				{
+					backend: "pi",
+					model: LIVE_MODEL.pi,
+					task: "Reply with the single word ACK and then stop. Do not read files.",
+					cwd: requestedCwd,
+					placement: { tmuxSession: SEAT_SESSION },
+					callerGardenId: callerGid,
+				},
+				pi.inherited,
+			);
+			ok(`${label}: launch receipt is ok`, seated.ok);
+			if (!seated.ok) return;
+			nonces.set(label, seated.receipt.nonce);
+			siblingPids.add(Number(seated.receipt.panePid));
+			cwdCells.push({
+				label: `pi @${label}`,
+				socket: pi.socket,
+				env: pi.inherited,
+				paneId: seated.receipt.paneId,
+				expect: requestedCwd ?? scratch,
+			});
+			ok(
+				`${label}: the receipt echoes the REQUESTED seat name and reports the RESOLVED target session, not the caller's`,
+				seated.receipt.tmuxSession === SEAT_SESSION &&
+					seated.receipt.sessionId === seatSessionId &&
+					seated.receipt.sessionId !== callerSessionId,
+			);
+			ok(
+				`${label}: the window really landed in the seat, and the caller's session is byte-identical`,
+				tmux(pi.socket, ["list-windows", "-t", seatSessionId, "-F", "#{window_id}"], pi.inherited).stdout.includes(
+					seated.receipt.windowId,
+				) &&
+					tmux(pi.socket, ["list-windows", "-t", callerSessionId, "-F", "#{window_id}"], pi.inherited).stdout ===
+						callerWindowsBefore,
+			);
 		}
 
 		// The sender envelope rides INSIDE the mailbox body (`  session:     <gid> (…)`) — that line
@@ -295,9 +443,33 @@ async function main(): Promise<void> {
 			if (sender) siblingGids.add(sender);
 		}
 		ok(
-			"correlation: the two siblings reported DIFFERENT garden ids — the envelope identifies each one, not the launcher",
+			"correlation: every sibling reported a DIFFERENT garden id — the envelope identifies each one, not the launcher",
 			siblingGids.size === arrived.size && !siblingGids.has(callerGid),
 		);
+
+		// ── #105 acceptance 3: the seat and the cwd are ORTHOGONAL ───────────────
+		// Read AFTER a delay and from the stable %pane, never from the launch receipt: at
+		// creation time `#{pane_current_path}` reports the tmux SERVER's cwd in every cell
+		// (measured ×2), which is why the receipt reports the REQUESTED cwd and this is the
+		// acceptance that reports the observed one. The 2×2 is {cwd omitted, cwd requested} ×
+		// {caller session, seat}, and the seat's own `session_path` is a fourth directory that
+		// no cell may ever land in.
+		spawnSync("sleep", [PANE_CWD_SETTLE_SECONDS]);
+		for (const cell of cwdCells) {
+			const observed = tmux(
+				cell.socket,
+				["display-message", "-p", "-t", cell.paneId, "#{pane_current_path}"],
+				cell.env,
+			).stdout;
+			ok(
+				`cwd x seat: ${cell.label} settled in ${cell.expect} — never the target session's path, never the other cell's`,
+				observed === cell.expect && observed !== SEAT_HOME(root),
+			);
+		}
+		ok(
+			"cwd x seat: all four cells ran — {cwd omitted, cwd requested} x {caller session, seat}",
+			cwdCells.length === 4 && new Set(cwdCells.map((c) => c.expect)).size === 3,
+		);
 		ok(
 			"fence: those sibling records live in the FIXTURE store",
 			[...siblingGids].every(

package/scripts/smoke-omp-bridge-state.sh

@@ -22,7 +22,10 @@ wait_carrier() {
   local pid="$1" key="$2" i=0
   while [ "$i" -lt 50 ]; do
     if kill -0 "$pid" 2>/dev/null && [ -r "/proc/$pid/environ" ]; then
-      if tr '\0' '\n' < "/proc/$pid/environ" 2>/dev/null | grep -q "^${key}"; then
+      # `-c` not `-q`, for the reason in omp-bridge-doctor.sh's carrier scan: under
+      # pipefail an early-exiting grep SIGPIPEs `tr` and the pipeline reports failure even
+      # on a match. Here that only costs a retry, but the hazard is the same one.
+      if [ "$(tr '\0' '\n' < "/proc/$pid/environ" 2>/dev/null | grep -cE "^${key}" || true)" -gt 0 ]; then
         return 0
       fi
     fi
@@ -103,7 +106,7 @@ CARRIER_PID=$!
 wait_carrier "$CARRIER_PID" "PI_SESSION_ID=foreign-garden"
 if OUT="$(ENTWURF_OMP_CARRIER_PIDS="$CARRIER_PID" "$RUN" doctor-omp-bridge 2>&1)"; then
   printf '%s\n' "$OUT" >&2
-  die "doctor accepted the live omp fixture with nonblank inherited PI carriers"
+  die "[QK:OMP-DOCTOR-CARRIER-NONBLANK-IS-RED] doctor accepted the live omp fixture with nonblank inherited PI carriers"
 fi
 printf '%s\n' "$OUT" | grep -q "live omp process(es).* $CARRIER_PID" || die "doctor red without naming the nonblank-carrier fixture"
 ok "a nonblank inherited PI carrier on a live omp process remains red"