@junghanacs/entwurf 0.18.2 → 0.20.0

package/scripts/lib/reclaim-on-exit.ts

@@ -0,0 +1,86 @@
+// Reclaim a gate's OWN process resources when that gate exits — however it exits.
+//
+// WHY THIS EXISTS (test-infra, not a product capability):
+// A gate ends red by THROWING (`ok()` is `assert.ok`), and ^C or a runner's SIGTERM
+// ends it with no statement running at all. Teardown written as the last line of the
+// file is therefore skipped on every path except the green one, and the mutant runner
+// makes that the COMMON path: qualification runs each committed mutant expecting the
+// gate to go red. Measured on `oracle` 2026-09-08, before this leaf existed: ~9,200
+// stale temp roots and 3.8G under `/tmp`, plus 360 reparented fixture Node processes
+// from `check-copilot-receive-arm` alone. `pnpm check` was still minting a fresh one
+// per run at that point.
+//
+// WHAT IT IS NOT. It is not error handling and it does not soften a failure: the exit
+// code is untouched (a red gate stays red, a signal still ends as 128+n), nothing is
+// logged, and no failure is converted into a warning (Hard Rule 15). It reclaims
+// process resources only — never a record, transcript or operator artifact (Hard Rule
+// 8). A SIGKILL of the gate still runs nothing here, by construction; that residue is
+// the release protocol's `P9. Reclaim the host` step, and a fixture child that must
+// outlive nothing needs its own parent-death watchdog.
+
+import type { ChildProcess } from "node:child_process";
+import { rmSync } from "node:fs";
+
+const roots: string[] = [];
+const children: ChildProcess[] = [];
+let wired = false;
+let done = false;
+
+/** Sync-only, idempotent: an `exit` handler may not await anything. */
+function reclaim(): void {
+	if (done) return;
+	done = true;
+	for (const c of children) {
+		try {
+			c.kill("SIGKILL");
+		} catch {
+			// kill() throws ESRCH on an already-reaped pid — gone either way
+		}
+	}
+	for (const dir of roots) {
+		try {
+			rmSync(dir, { recursive: true, force: true });
+		} catch {
+			// Best-effort teardown must never become the reason a GREEN gate exits
+			// non-zero: a throw inside an `exit` handler would flip the verdict of a
+			// run that had already passed every assertion it makes.
+		}
+	}
+}
+
+function wire(): void {
+	if (wired) return;
+	wired = true;
+	process.on("exit", reclaim);
+	// A signal is not an exit: without these, `exit` never fires. Re-raising as
+	// 128+n keeps the shell's own convention rather than inventing a code.
+	for (const [signal, n] of [
+		["SIGINT", 2],
+		["SIGTERM", 15],
+		["SIGHUP", 1],
+	] as const) {
+		process.on(signal, () => {
+			reclaim();
+			process.exit(128 + n);
+		});
+	}
+}
+
+/** Register a temp root to remove on exit. Returns it, so it wraps `mkdtempSync`. */
+export function reclaimOnExit(dir: string): string {
+	wire();
+	roots.push(dir);
+	return dir;
+}
+
+/** Register a spawned child to SIGKILL on exit. Returns it, so it wraps `spawn`. */
+export function killOnExit<T extends ChildProcess>(child: T): T {
+	wire();
+	children.push(child);
+	return child;
+}
+
+/** Run the registered teardown now (the green tail); later exits become no-ops. */
+export function reclaimNow(): void {
+	reclaim();
+}

package/scripts/meta-bridge-doctor.sh

@@ -66,13 +66,18 @@ echo "meta-bridge doctor"
 echo "config=$CLAUDE_CFG  agent-dir=$AGENT"
 
 echo "[platform]"
-# The #51 repair contract is Linux-only because certification requires discovery of
-# each live bridge process's environment through /proc. Darwin is not an install lane
-# for this cut and must stay nonzero here too — never downgrade unsupported to a
-# static/synthetic PASS.
+# WHAT THIS FENCE IS ABOUT, NARROWLY. It is not "GNU tools" and it is not the
+# start-key: the python join below now mints the SAME `ps:` string the TS core mints
+# (audit Q2), so start-key and ppid are portable in this doctor too and that half of
+# the old reason is retired. What is left is bridge DISCOVERY — finding the live
+# entwurf MCP children by their per-process ENVIRONMENT — which has no measured
+# portable equivalent, so the live-owner tier is unreachable rather than merely
+# unobserved (the rc=3 branch below is the same verdict, stated where it fires).
+# Darwin therefore stays nonzero here: a doctor that cannot measure its central axis
+# must never downgrade "unsupported" to a static/synthetic PASS.
 case "$(uname -s)" in
   Linux)  ok "Linux supported — the certified live axis (live owner join is instrumentable)" ;;
-  Darwin) bad "macOS is NOT YET VERIFIED/CERTIFIED for this repair cut: strict live-owner certification currently requires /proc. The installer refuses Darwin; this doctor remains nonzero for diagnosis/legacy cleanup. Future validation may reopen the lane." ;;
+  Darwin) bad "macOS is NOT CERTIFIED for this cut: the live-owner join needs per-process ENVIRONMENT discovery of the live bridge children, and no portable Darwin equivalent has been MEASURED yet (start-key/ppid are portable here now — that half of the old reason is retired). This doctor stays nonzero on Darwin for diagnosis and legacy cleanup until a physical Darwin receipt exists." ;;
   *) bad "$(uname -s) unsupported (Claude meta-bridge repair cut is Linux-only)" ;;
 esac
 
@@ -982,7 +987,7 @@ fi
 echo "[live Claude MCP owner join]"
 if command -v python3 >/dev/null; then
   if JOIN_OUT="$(python3 - "$AGENT" "$META_SESSIONS" <<'PY' 2>&1
-import json, os, sys
+import json, re, subprocess, sys
 from pathlib import Path
 
 agent = Path(sys.argv[1]).expanduser().resolve()
@@ -990,23 +995,52 @@ store = Path(sys.argv[2]).expanduser().resolve()
 proc = Path("/proc")
 if not proc.is_dir():
     # rc=3 is a PLATFORM verdict, distinct from rc=2 ("no session open right now").
-    # The runtime this doctor verifies has a `ps` fallback for start-key/ppid, but
-    # bridge DISCOVERY needs per-process environ, which has no portable equivalent
-    # here — so the live tier is unreachable, not merely unobserved.
-    print("live owner join is NOT INSTRUMENTABLE on this platform: /proc is unavailable, so entwurf MCP children cannot be discovered")
+    # NARROWLY: start-key and ppid are NOT the reason — `parent()`/`start_key()` below
+    # carry the same two-tier `/proc`-then-`ps` fallback the runtime writer has, so they
+    # answer on any platform with a `ps`. Bridge DISCOVERY is the reason: it needs each
+    # candidate's per-process ENVIRONMENT, which has no measured portable equivalent, so
+    # the live tier is unreachable here rather than merely unobserved.
+    print("live owner join is NOT INSTRUMENTABLE on this platform: what holds the lane closed is per-process environment DISCOVERY alone — start-key and ppid are portable there (`ps` fallback, same string the TS core mints), but no measured Darwin equivalent exists for reading each live bridge child's environment")
     raise SystemExit(3)
 
 def stat_fields(pid):
     text = Path(f"/proc/{pid}/stat").read_text()
     return text[text.rfind(")") + 2:].split()
 
+def ps_field(pid, fmt):
+    # The SAME argv vector the writer uses (meta-session.ts parentPid/processStartKey),
+    # so the two writers cannot disagree by construction.
+    try:
+        out = subprocess.run(["ps", "-o", fmt, "-p", str(pid)], capture_output=True, text=True).stdout
+    except Exception:
+        return ""
+    return out.strip()
+
 def parent(pid):
+    if not isinstance(pid, int) or pid <= 0: return None
     try: return int(stat_fields(pid)[1])
-    except Exception: return None
+    except Exception: pass
+    # `ps -o ppid=` — literally the fallback parentPid() already ships.
+    ppid = ps_field(pid, "ppid=")
+    return int(ppid) if ppid.isdigit() and int(ppid) > 0 else None
 
 def start_key(pid):
-    try: return "linux:" + stat_fields(pid)[19]
-    except Exception: return ""
+    # TWO WRITERS, ONE STRING. The runtime mints this key (meta-session.ts
+    # processStartKey) and this doctor RE-mints it to compare against the marker; if the
+    # two ever mint different strings for the same live pid the join fails for a reason
+    # that has nothing to do with the install. So this is not "a portable start key" —
+    # it is the same two tiers in the same order with the same prefixes: `/proc/<pid>/stat`
+    # field 22 as `linux:<ticks>`, else `ps -o lstart= -p <pid>` trimmed as `ps:<lstart>`.
+    # python `.strip()` and JS `.trim()` both strip ASCII whitespace from this single-line
+    # output, and the argv vector is identical, so the bytes are identical (audit Q2).
+    # "" stays the UNKNOWN answer and never matches a marker — fail-closed, unchanged.
+    if not isinstance(pid, int) or pid <= 0: return ""
+    try:
+        starttime = stat_fields(pid)[19]
+        if re.fullmatch(r"\d+", starttime): return "linux:" + starttime
+    except Exception: pass
+    lstart = ps_field(pid, "lstart=")
+    return "ps:" + lstart if lstart else ""
 
 def process_agent(env):
     raw = env.get("PI_CODING_AGENT_DIR")
@@ -1088,7 +1122,7 @@ PY
     # send an operator to completely different places.
     case "$JOIN_RC" in
       2) bad "NOT CERTIFIED — $JOIN_OUT. Nothing here says the install is broken: the evidence simply does not exist yet. Open a Claude Code session (or restart the affected one) and run this doctor again." ;;
-      3) bad "NOT CERTIFIED on this platform — $JOIN_OUT. This repair cut currently certifies the Claude meta-bridge on Linux only; static/synthetic evidence cannot certify $(uname -s), and future native validation may reopen that lane." ;;
+      3) bad "NOT CERTIFIED on this platform — $JOIN_OUT. This repair cut certifies the Claude meta-bridge on Linux only; static/synthetic evidence cannot certify $(uname -s), and only a physical native run can reopen that lane." ;;
       *) bad "$JOIN_OUT. Re-run install-meta-bridge, restart the affected Claude session(s), then run doctor again." ;;
     esac
   fi
@@ -1121,7 +1155,14 @@ livewrite_schema() { # $1=meta-session.<ext> → v3|v2|v1|absent
   elif grep -q "serializeMetaIdentity" "$1"; then echo "v2"
   else echo "v1"; fi
 }
-hash12() { [ -f "$1" ] && sha256sum "$1" | cut -c1-12 || echo "------------"; }
+# 12-hex digest, portable. NOT `sha256sum` (coreutils, absent on macOS) and NOT
+# `shasum -a 256` — that would be a second digest convention, while python3 is already
+# a hard prerequisite of this whole doctor (line 31 reads install-state through it). So
+# this reuses the python3 hashlib form omp-receive-doctor.sh:99 already ships. An absent
+# file still yields `------------`, and a hashing failure now falls into that same
+# placeholder instead of an empty string — either way the parity rows below read it as
+# drift and go red, which is the fail-closed side.
+hash12() { [ -f "$1" ] && python3 -c 'import hashlib,sys;print(hashlib.sha256(open(sys.argv[1],"rb").read()).hexdigest()[:12])' "$1" 2>/dev/null || echo "------------"; }
 registry_for_ms() { # $1=bundle meta-session.ts → sibling plugin-root registry path
   [ -f "$1" ] || { echo ""; return; }
   dirname "$(dirname "$1")"

package/scripts/meta-bridge-install.sh

@@ -25,9 +25,13 @@
 # Idempotent: re-running removes the prior marketplace/plugin first, so a
 # `nix rebuild` that moved node just re-bakes and re-installs cleanly.
 #
-# Platform: Linux only for the #51 repair cut. macOS cannot reach the strict
-# live-owner certification tier, so accepting an install there would advertise a
-# surface this release can never certify. Windows and every other platform fail fast.
+# Platform: Linux and Darwin. This installer's own platform dependency is python3 +
+# node + the claude CLI (all checked below); it touches no /proc, no systemd, no
+# GNU-only tool. Windows and every other platform fail fast. Live-owner rail
+# certification is a SEPARATE evidence axis owned by doctor-meta-bridge (Hard Rule 17:
+# installation portability and rail/runtime support are separate evidence axes) — a
+# green install here does not certify the Darwin rail; run ./run.sh doctor-meta-bridge
+# for that verdict.
 set -euo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -64,11 +68,13 @@ esac
 
 die() { echo "meta-bridge-install: $*" >&2; exit 1; }
 
-# --- platform gate (Linux-only repair contract) -----------------------------
+# --- platform gate (installer's own dependency, not rail certification) -----
+# Darwin is open on the same precedent as meta-bridge-uninstall.sh:20-23: this
+# installer touches no /proc and no GNU-only tool, so its own mechanism is portable
+# even while the live-owner rail (doctor-meta-bridge) stays a separate, unproven axis.
 case "$(uname -s)" in
-  Linux) ;;
-  Darwin) die "macOS is not yet verified/certified for this repair cut. Strict live-owner certification currently requires /proc, so Darwin install is refused rather than left NOT CERTIFIED; future validation may reopen this lane." ;;
-  *) die "unsupported platform '$(uname -s)'. The Claude meta-bridge repair cut supports Linux only (no unverified fallback)." ;;
+  Linux | Darwin) ;;
+  *) die "unsupported platform '$(uname -s)'. This installer requires Linux or Darwin." ;;
 esac
 
 # --- toolchain gate, part 1: this machine's own runtime ---------------------

package/scripts/meta-bridge-uninstall.sh

@@ -14,12 +14,14 @@ PLUGIN="entwurf-meta-receive"
 
 die() { echo "meta-bridge-uninstall: $*" >&2; exit 1; }
 
-# Darwin stays here intentionally even though NEW installs are Linux-only in the #51
-# repair cut. Removing the inverse would strand an older macOS install precisely when
-# support narrows; uninstall is a legacy-cleanup capability, not install certification.
+# Darwin is accepted on both halves as of 0.20.0. It was accepted HERE first, while new
+# installs were still refused, because removing the inverse would strand an older macOS
+# install precisely when support narrows. That asymmetry is now gone — the installer
+# refuses on its real dependency instead of the platform name — so the two halves agree
+# and this fence only turns away platforms neither half has ever run on.
 case "$(uname -s)" in
   Linux | Darwin) ;;
-  *) die "unsupported platform '$(uname -s)'. This repair cut certifies new Claude meta-bridge installs on Linux only; uninstall additionally permits Darwin so legacy state can be removed honestly." ;;
+  *) die "unsupported platform '$(uname -s)'. Both halves of the Claude meta-bridge repair cut run on Linux and Darwin only. Rail certification is a separate axis owned by doctor-meta-bridge." ;;
 esac
 
 command -v python3 >/dev/null || die "'python3' not on PATH. It is required for stateful uninstall."

package/scripts/mutants/acp-cortex.json

@@ -26,6 +26,19 @@
 			"signature": "[QK:CORTEX-CURATED-FOUR-ROWS]",
 			"signatureSource": "scripts/check-acp-cortex.ts"
 		},
+		{
+			"claim": "CLAUDE-CURATED-THREE-ROWS",
+			"title": "dropping a curated CLAUDE row shrinks the operator's model list while the exact-set comparison stays green — expected derives from the same constant, so only the independent count catches it",
+			"subject": "pi-extensions/lib/acp/models.ts",
+			"find": [
+				"export const SUPPORTED_ANTHROPIC_MODEL_IDS = [\"claude-sonnet-5\", \"claude-opus-5\", \"claude-fable-5-1\"] as const;"
+			],
+			"replace": ["export const SUPPORTED_ANTHROPIC_MODEL_IDS = [\"claude-sonnet-5\", \"claude-opus-5\"] as const;"],
+			"gate": ["bash", "run.sh", "check-acp-provider-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CLAUDE-CURATED-THREE-ROWS]",
+			"signatureSource": "scripts/check-acp-provider-surface.ts"
+		},
 		{
 			"claim": "CORTEX-AUTH-NARROW-CREDENTIAL-CACHE",
 			"title": "widening the auth passthrough to the whole cortex/cache leaks operator tool_outputs/tip_history into the child",
@@ -56,6 +69,17 @@
 			"signature": "[QK:CORTEX-AUTOUPDATE-OFF]",
 			"signatureSource": "scripts/check-acp-cortex.ts"
 		},
+		{
+			"claim": "CORTEX-REALHOME-PLATFORM-NEUTRAL",
+			"title": "re-deriving realHome absoluteness from the POSIX flavor alone makes a drive/UNC HOME read as relative — the guard would state the host it runs on instead of the contract (PR #77, @yizixu)",
+			"subject": "pi-extensions/lib/acp/overlay.ts",
+			"find": ["\tif (!params.realHome || !(isAbsolute(params.realHome) || win32.isAbsolute(params.realHome))) {"],
+			"replace": ["\tif (!params.realHome || !params.realHome.startsWith(\"/\")) {"],
+			"gate": ["bash", "run.sh", "check-acp-cortex"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CORTEX-REALHOME-PLATFORM-NEUTRAL]",
+			"signatureSource": "scripts/check-acp-cortex.ts"
+		},
 		{
 			"claim": "CORTEX-BRIDGE-DUAL-HOME",
 			"title": "dropping the bridge-only real-HOME restore leaves the garden store cut off — tools reach the model but see an empty garden (D10)",
@@ -182,14 +206,14 @@
 			"signatureSource": "scripts/check-acp-session-reuse.ts"
 		},
 		{
-			"claim": "CORTEX-PROVIDER-SIX-ROW-SURFACE",
+			"claim": "CORTEX-PROVIDER-EXACT-ROW-SURFACE",
 			"title": "filtering the cortex rows out of the REAL provider entry drops the whole backend from the operator's model list while models.ts and check-acp-cortex stay green",
 			"subject": "pi-extensions/acp-provider.ts",
 			"find": ["\t\tmodels: allCuratedModels(),"],
 			"replace": ["\t\tmodels: allCuratedModels().filter((m) => !m.id.startsWith(\"cortex-\")),"],
 			"gate": ["bash", "run.sh", "check-acp-provider-surface"],
 			"timeoutSeconds": 300,
-			"signature": "[QK:CORTEX-PROVIDER-SIX-ROW-SURFACE]",
+			"signature": "[QK:CORTEX-PROVIDER-EXACT-ROW-SURFACE]",
 			"signatureSource": "scripts/check-acp-provider-surface.ts"
 		}
 	]

package/scripts/mutants/copilot-receive.json

@@ -233,6 +233,17 @@
 			"signature": "[QK:COPILOT-RECEIVE-DOCTOR-UNREADABLE-ENVIRON-IS-RED]",
 			"signatureSource": "scripts/check-copilot-receive-arm.ts"
 		},
+		{
+			"claim": "COPILOT-RECEIVE-DOCTOR-UNREADABLE-ARGV-IS-UNVERIFIABLE",
+			"title": "collapsing every OSError on `/proc/<pid>/cmdline` back to None makes a REFUSED identity read indistinguishable from a process that left: the candidate is skipped before identity is decided, all counters stay zero, and the doctor prints the benign `no live GitHub Copilot CLI process` note — claiming ABSENCE while a live CLI it was never allowed to identify may be sitting there inert. The environ claim above cannot cover this one: that branch is reachable only AFTER a successful argv match",
+			"subject": "scripts/copilot-receive-bridge.sh",
+			"find": ["\t\tif exc.errno in (errno.ENOENT, errno.ESRCH):", "\t\t\treturn None", "\t\treturn UNREADABLE"],
+			"replace": ["\t\treturn None"],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-DOCTOR-UNREADABLE-ARGV-IS-UNVERIFIABLE]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
 		{
 			"claim": "COPILOT-RECEIVE-DOCTOR-OWNS-SCANNER-FAILURE",
 			"title": "letting the scanner's exit status reach the assignment under `set -e` kills the doctor mid-section: no verdict line is printed at all, so the operator cannot tell a healthy host from a broken doctor — the same silent-death shape this lane already fixed once in the log grep",
@@ -258,6 +269,21 @@
 			"timeoutSeconds": 300,
 			"signature": "[QK:COPILOT-RECEIVE-DOCTOR-PI-CARRIER-IS-RED]",
 			"signatureSource": "scripts/check-copilot-receive-arm.ts"
+		},
+		{
+			"claim": "COPILOT-RECEIVE-STUB-CHILD-DIES-WITH-PARENT",
+			"title": "a stub child with no parent-death watchdog outlives the gate forever — measured on `oracle` as 360 reparented Node receivers, because a red gate exits by THROWING and never reaches any teardown written below it",
+			"subject": "scripts/check-copilot-receive-arm.ts",
+			"find": [
+				"if (parentAtStart === 1) process.exit(0);",
+				"setInterval(() => {",
+				"\tif (process.ppid !== parentAtStart) process.exit(0);"
+			],
+			"replace": ["void parentAtStart;", "setInterval(() => {", "\t/* the vendor bootstrap's parent check, removed */"],
+			"gate": ["bash", "run.sh", "check-copilot-receive-arm"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:COPILOT-RECEIVE-STUB-CHILD-DIES-WITH-PARENT]",
+			"signatureSource": "scripts/check-copilot-receive-arm.ts"
 		}
 	]
 }

package/scripts/mutants/fresh-cut.json

@@ -12,6 +12,32 @@
 			"timeoutSeconds": 180,
 			"signature": "[QK:FRESH-CUT-COLLISION-NO-MOVE]",
 			"signatureSource": "scripts/check-fresh-cut-gate.sh"
+		},
+		{
+			"claim": "FRESHCUT-SYNCAUTH-TRIPWIRE-FIRES",
+			"title": "the retired-credential tripwire goes blind again. This replants the ACTUAL defect rather than a stand-in: under pipefail a `-q` grep exits at the first match and SIGPIPEs the awk still writing ~200KB of a 433KB run.sh, so the pipeline reports 141 and the `if` takes the CLEAN branch — the cell reported no sync_auth surface EXACTLY when one existed. It was deterministic here (100/100 measured) because the producer dwarfs the pipe buffer, which is why the self-test plants its surface near the TOP of the real run.sh: a small synthetic fixture would pass under this mutant and prove nothing",
+			"subject": "scripts/check-fresh-cut-gate.sh",
+			"find": ["  awk '!/^[[:space:]]*#/' \"$1\" | grep -c 'sync_auth' || true"],
+			"replace": ["  awk '!/^[[:space:]]*#/' \"$1\" | grep -q 'sync_auth' && echo 1 || echo 0"],
+			"gate": ["bash", "run.sh", "check-fresh-cut-gate"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCUT-SYNCAUTH-TRIPWIRE-FIRES]",
+			"signatureSource": "scripts/check-fresh-cut-gate.sh"
+		},
+		{
+			"claim": "FRESHCUT-PREFLIGHT-CUT-DETECTED",
+			"title": "the cell forbidding an install from cutting a generation by itself stops SEEING the call it forbids — the context window silently narrows to the matched line, so a fresh-cut invocation one line into preflight_v3_store() reads as absent and D7 stays green. A forbidding cell that is green on a clean tree cannot tell blindness from compliance, which is what the self-test exists to separate",
+			"subject": "scripts/check-fresh-cut-gate.sh",
+			"find": [
+				"  grep -n 'preflight_v3_store()' -A 40 \"$1\" | grep -cE 'run_ts scripts/meta-bridge-fresh-cut\\.ts' || true"
+			],
+			"replace": [
+				"  grep -n 'preflight_v3_store()' -A 0 \"$1\" | grep -cE 'run_ts scripts/meta-bridge-fresh-cut\\.ts' || true"
+			],
+			"gate": ["bash", "run.sh", "check-fresh-cut-gate"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCUT-PREFLIGHT-CUT-DETECTED]",
+			"signatureSource": "scripts/check-fresh-cut-gate.sh"
 		}
 	]
 }

package/scripts/mutants/mux-boundary.json

@@ -191,6 +191,30 @@
 			"timeoutSeconds": 60,
 			"signature": "[QK:MUX-LAUNCH-CORE-IMPORT-FREE]",
 			"signatureSource": "scripts/check-mux-launch.ts"
+		},
+		{
+			"claim": "MUX-CLOSE-SERVER-BOUND",
+			"title": "the close-side predicate accepts a foreign SERVER — a restarted server hands out the same `@id`, and a close would kill whatever window now wears it",
+			"subject": "pi-extensions/lib/mux-placement.ts",
+			"find": ["\treturn origin.serverPid === now.serverPid;\n}"],
+			"replace": ["\treturn true;\n}"],
+			"gate": ["bash", "run.sh", "check-mux-placement"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:MUX-CLOSE-SERVER-BOUND]",
+			"signatureSource": "scripts/check-mux-placement.ts"
+		},
+		{
+			"claim": "RESOLVE-TMUX-SESSION-IMPORT-FREE",
+			"title": "the session-lookup leaf reaches into the placement leaf for runTmux — the one decision leaf that must not be able to run tmux acquires exactly that power, and the injected-runner seam its whole safety argument rests on stops being the only way in",
+			"subject": "pi-extensions/lib/resolve-tmux-session.ts",
+			"find": ["export type TmuxSessionRejectReason = \"tmux-session-name-invalid\" | \"tmux-session-missing\";"],
+			"replace": [
+				"import { runTmux } from \"./mux-placement.ts\";\nvoid runTmux;\nexport type TmuxSessionRejectReason = \"tmux-session-name-invalid\" | \"tmux-session-missing\";"
+			],
+			"gate": ["bash", "run.sh", "check-mux-launch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RESOLVE-TMUX-SESSION-IMPORT-FREE]",
+			"signatureSource": "scripts/check-mux-launch.ts"
 		}
 	]
 }

package/scripts/mutants/mux-fresh-call.json

@@ -438,6 +438,87 @@
 			"timeoutSeconds": 180,
 			"signature": "[QK:FRESHCALL-BACKEND-SET-SURFACE-PARITY-PI]",
 			"signatureSource": "test/fresh-call-surfaces.contract.test.ts"
+		},
+		{
+			"claim": "TMUXSESSION-LOOKUP-ENGINE",
+			"title": "the seat lookup goes back to the `-f` filter engine, which was measured to match EVERY session when the name contains a '}' — a fresh sibling then opens in whichever session tmux listed first",
+			"subject": "pi-extensions/lib/resolve-tmux-session.ts",
+			"find": ["\treturn [\"list-windows\", \"-t\", `=${name}`, \"-F\", \"#{session_id}\"];"],
+			"replace": ["\treturn [\"list-sessions\", \"-f\", `#{==:#{session_name},${name}}`, \"-F\", \"#{session_id}\"];"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:TMUXSESSION-LOOKUP-ENGINE]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "TMUXSESSION-NAME-GRAMMAR",
+			"title": "the seat name grammar is widened to 'anything non-empty' — tmux then stores a DIFFERENT name than the one requested (or splits it on '.'/':') and the seat can never be found, reported as 'missing' instead of as a shape this rail does not address",
+			"subject": "pi-extensions/lib/resolve-tmux-session.ts",
+			"find": ["const SESSION_NAME = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;"],
+			"replace": ["const SESSION_NAME = /^.+$/;"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:TMUXSESSION-NAME-GRAMMAR]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PLACEMENT-MISSING-REJECTS",
+			"title": "an absent seat is read as success — tmux's exit code is ignored, so a missing session falls through to the caller's own session and the launch looks like the seat worked. Proof is in two halves: this mutant dies on the leaf's injected-runner assert plus the source-text ordering assert in the fast lane, and the behavioural oracle independent of that source is the real-tmux seat cell in check-mux-launch-tmux (refusal by name with a byte-identical list-windows -a before and after)",
+			"subject": "pi-extensions/lib/resolve-tmux-session.ts",
+			"find": ["\tif (result.status !== 0) return { ok: false, reason: \"tmux-session-missing\" };"],
+			"replace": [
+				"\tif (result.status !== 0 && result.stdout.length > 0) return { ok: false, reason: \"tmux-session-missing\" };"
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-PLACEMENT-MISSING-REJECTS]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PLACEMENT-TARGET-ARGV",
+			"title": "the launch argv targets the caller's own session again — a seated fresh call silently opens beside the caller instead of in the operator's project session, and the receipt still looks right",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t`${targetSessionId}:{end}`,"],
+			"replace": ["\t\t`$0:{end}`,"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-PLACEMENT-TARGET-ARGV]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PLACEMENT-BACKEND-PARITY",
+			"title": "the project seat becomes a pi capability — the grammar refusal is gated on the backend, so claude-code, copilot and omp fall past the seat check into runtime resolution and answer with the wrong reason. Every seat assertion that existed when #105 landed was written against backend pi alone, so nothing would have noticed",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\tif (badSeat) return { ok: false, reason: badSeat };"],
+			"replace": ["\t\tif (badSeat && params.backend === \"pi\") return { ok: false, reason: badSeat };"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-PLACEMENT-BACKEND-PARITY]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PLACEMENT-RECEIPT-TARGET",
+			"title": "the receipt copies the CALLER's session id again — the window is in the seat, the receipt names the caller's session, and every later close/lookup built on that receipt addresses the wrong session. Proof is in two halves: this mutant dies on the source-text assembly assert in the fast lane, and the behavioural oracle independent of that source is the real-tmux seat cell in check-mux-launch-tmux (receipt.sessionId === seatId !== callerId, read from the server's own inventory)",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t\tsessionId: targetSessionId,"],
+			"replace": ["\t\t\tsessionId: placement.sessionId,"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-PLACEMENT-RECEIPT-TARGET]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PLACEMENT-SURFACE-PARITY",
+			"title": "one surface drops the optional seat from its schema, so opening a sibling in the operator's project session works from pi and silently cannot exist from the MCP bridge",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": [
+				"\t\tplacement: z\n\t\t\t.object({\n\t\t\t\ttmuxSession: z\n\t\t\t\t\t.string()\n\t\t\t\t\t.describe(\n\t\t\t\t\t\t\"EXACT name of an EXISTING session on this agent's own tmux server. Nothing is created: an absent session is refused as tmux-session-missing, and a name outside [A-Za-z0-9][A-Za-z0-9_-]* as tmux-session-name-invalid.\",\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.optional()\n\t\t\t.describe(\n\t\t\t\t\"Optional project seat: open the sibling in ONE EXISTING tmux session of this agent's own server instead of the caller's session. Nothing is ever created — an absent session is a refusal, not a new session. Independent of cwd; neither is inferred from the other. The receipt echoes the REQUESTED name and reports the resolved target session id.\",\n\t\t\t),\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCALL-PLACEMENT-SURFACE-PARITY]",
+			"signatureSource": "test/fresh-call-surfaces.contract.test.ts"
 		}
 	]
 }

package/scripts/mutants/omp-birth.json

@@ -158,16 +158,46 @@
 		},
 		{
 			"claim": "OMP-DOCTOR-CARRIER-TRIMS",
-			"title": "treating an empty or whitespace-only PI carrier as an inherited identity makes Bundle C's deliberate tmux `-e NAME=` scrub fail the deterministic floor whenever a visible fresh omp citizen is alive",
+			"title": "treating an empty or whitespace-only PI carrier as an inherited identity makes Bundle C's deliberate tmux `-e NAME=` scrub fail the deterministic floor whenever a visible fresh omp citizen is alive. Re-anchored twice, and the replanted defect is unchanged both times — only the line it attaches to moved: first when the carrier scan went from an early-exiting `grep -q` to `grep -c` (the SIGPIPE/pipefail repair), then when the scan lost an indentation level because the `[ -d /proc ]` wrapper whose `else` arm was a fail-open `note` was removed (#78 D1)",
 			"subject": "scripts/omp-bridge-doctor.sh",
 			"find": [
-				"    if tr '\\0' '\\n' < \"$ENVIRON\" 2>/dev/null | grep -qE '^(PI_SESSION_ID|PI_AGENT_ID)=.*[^[:space:]]'; then"
+				"  HITS=\"$(tr '\\0' '\\n' < \"$ENVIRON\" 2>/dev/null | grep -cE '^(PI_SESSION_ID|PI_AGENT_ID)=.*[^[:space:]]' || true)\""
+			],
+			"replace": [
+				"  HITS=\"$(tr '\\0' '\\n' < \"$ENVIRON\" 2>/dev/null | grep -cE '^(PI_SESSION_ID|PI_AGENT_ID)=' || true)\""
 			],
-			"replace": ["    if tr '\\0' '\\n' < \"$ENVIRON\" 2>/dev/null | grep -qE '^(PI_SESSION_ID|PI_AGENT_ID)='; then"],
 			"gate": ["bash", "run.sh", "smoke-omp-bridge-state"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:OMP-DOCTOR-CARRIER-TRIMS]",
 			"signatureSource": "scripts/smoke-omp-bridge-state.sh"
+		},
+		{
+			"claim": "OMP-DOCTOR-CARRIER-NONBLANK-IS-RED",
+			"title": "the doctor stops flagging a live omp process that carries a NONBLANK inherited PI_SESSION_ID/PI_AGENT_ID, so a session whose MCP children would speak under the parent pi garden id reads as clean and the doctor prints PASS. The real defect was subtler than this replant, which is why the replant is written this way: `grep -q` exited at the first match, SIGPIPEd `tr` mid-environ, and pipefail turned a MATCH into a failed pipeline — a race on how far `tr` got, misreading ~15% of runs, so a `-q` replant would SURVIVE most of the time and prove nothing. This one makes the same false-clean deterministic. Re-anchored at one indentation level less when the `[ -d /proc ]` wrapper was removed (#78 D1)",
+			"subject": "scripts/omp-bridge-doctor.sh",
+			"find": ["  if [ \"${HITS:-0}\" -gt 0 ]; then"],
+			"replace": ["  if [ \"${HITS:-0}\" -gt 99 ]; then"],
+			"gate": ["bash", "run.sh", "smoke-omp-bridge-state"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:OMP-DOCTOR-CARRIER-NONBLANK-IS-RED]",
+			"signatureSource": "scripts/smoke-omp-bridge-state.sh"
+		},
+		{
+			"claim": "OMP-DOCTOR-UNENUMERATED-IS-UNVERIFIABLE",
+			"title": "restoring `|| true` on the candidate-discovery `pgrep` folds a FAILED enumeration (exit 2, or a `pgrep` that is not on PATH at all) into `nothing matched` (exit 1): the loop receives an empty candidate set, the doctor prints the clean carrier line and PASSes, and a live omp session carrying a foreign pi garden id reads as CLEAN because the tool that would have found it never ran. The documented `ENTWURF_OMP_CARRIER_PIDS` seam cannot substitute for this — it narrows candidates and short-circuits the very enumeration that failed",
+			"subject": "scripts/omp-bridge-doctor.sh",
+			"find": [
+				"  ENUM_RC=0",
+				"  CARRIER_CANDIDATES=\"$(pgrep -x omp 2>/dev/null)\" || ENUM_RC=$?",
+				"  if [ \"$ENUM_RC\" -gt 1 ]; then",
+				"    ENUM_FAILED=\"$ENUM_RC\"",
+				"  fi"
+			],
+			"replace": ["  CARRIER_CANDIDATES=\"$(pgrep -x omp 2>/dev/null || true)\""],
+			"gate": ["bash", "run.sh", "smoke-omp-bridge-state"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:OMP-DOCTOR-UNENUMERATED-IS-UNVERIFIABLE]",
+			"signatureSource": "scripts/smoke-omp-bridge-state.sh"
 		}
 	]
 }

package/scripts/mutants/setup-verdict.json

@@ -178,6 +178,19 @@
 			"timeoutSeconds": 180,
 			"signature": "[QK:SETUP-OMP-CONFIG-NO-OVERWRITE]",
 			"signatureSource": "scripts/check-setup-qualification.sh"
+		},
+		{
+			"claim": "SETUP-DARWIN-RAIL-COSMETIC-PASS",
+			"title": "the platform rail check is dropped, so a harness whose install completes on a platform with no rail receipt reads PASS and the whole setup reads green again — the 0.20.0 hole the installer's retired Darwin refusal used to cover",
+			"subject": "run.sh",
+			"find": [
+				"  if harness_rail_certified_platform; then\n    setup_result \"$1\" PASS \"$2 — verify: $3\"\n    return 0\n  fi"
+			],
+			"replace": ["  setup_result \"$1\" PASS \"$2 — verify: $3\"\n  return 0"],
+			"gate": ["bash", "scripts/check-setup-qualification.sh"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:SETUP-DARWIN-RAIL-COSMETIC-PASS]",
+			"signatureSource": "scripts/check-setup-qualification.sh"
 		}
 	]
 }