@junghanacs/entwurf 0.21.0 → 0.22.0

package/scripts/mutants/mux-fresh-call.json

@@ -111,7 +111,7 @@
 			"claim": "FRESHCALL-CWD-RECEIPT-REQUESTED",
 			"title": "production freshCall stops assembling the requested cwd into its receipt, so the operator-visible answer silently loses the one placement fact the caller asked for",
 			"subject": "pi-extensions/lib/mux-fresh-call.ts",
-			"find": ["\t\t\t...(cwd === undefined ? {} : { cwd }),\n"],
+			"find": ["\t\t\t...(chosenCwd === undefined ? {} : { cwd: chosenCwd.value, cwdSource: chosenCwd.source }),\n"],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 120,
@@ -123,7 +123,7 @@
 			"title": "one surface drops the optional cwd from its schema, so cross-repo fresh works from pi and silently cannot exist from the MCP bridge",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\tcwd: z\n\t\t\t.string()\n\t\t\t.optional()\n\t\t\t.describe(\n\t\t\t\t\"Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \\\"\\\" to start in this agent's own cwd. Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). The receipt echoes what was REQUESTED, never an observation.\",\n\t\t\t),\n"
+				"\t\tcwd: z\n\t\t\t.string()\n\t\t\t.optional()\n\t\t\t.describe(\n\t\t\t\t\"Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Taken exactly as given — no trim, no realpath, no project-name resolution; '#' is refused (tmux format expansion). Omit or pass \\\"\\\" to start where the CALLER is: its own directory, or for a Codex caller its own record directory, because this bridge is the app-server's child and that process's directory is not the caller's. The receipt echoes the directory that was REQUESTED or the caller record it came from, never an observation of where the pane landed.\",\n\t\t\t),\n"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -439,17 +439,6 @@
 			"signature": "[QK:FRESHCALL-BACKEND-SET-SURFACE-PARITY-PI]",
 			"signatureSource": "test/fresh-call-surfaces.contract.test.ts"
 		},
-		{
-			"claim": "FRESHCALL-CODEX-HOME-DEFAULT",
-			"title": "an omitted Codex seat falls back to the caller's session instead of the one supported `codex` home topology",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
-			"find": ["\tif (backend === \"codex\") return { tmuxSession: CODEX_HOME_TMUX_SESSION, source: \"codex-home\" };"],
-			"replace": ["\tif (backend === \"pi\") return { tmuxSession: CODEX_HOME_TMUX_SESSION, source: \"codex-home\" };"],
-			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
-			"timeoutSeconds": 180,
-			"signature": "[QK:FRESHCALL-CODEX-HOME-DEFAULT]",
-			"signatureSource": "test/mux-fresh-call.test.ts"
-		},
 		{
 			"claim": "TMUXSESSION-LOOKUP-ENGINE",
 			"title": "the seat lookup goes back to the `-f` filter engine, which was measured to match EVERY session when the name contains a '}' — a fresh sibling then opens in whichever session tmux listed first",
@@ -523,13 +512,96 @@
 			"title": "one surface drops the optional seat from its schema, so opening a sibling in the operator's project session works from pi and silently cannot exist from the MCP bridge",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\tplacement: z\n\t\t\t.object({\n\t\t\t\ttmuxSession: z\n\t\t\t\t\t.string()\n\t\t\t\t\t.describe(\n\t\t\t\t\t\t\"EXACT name of an EXISTING session on this agent's own tmux server. Nothing is created: an absent session is refused as tmux-session-missing, and a name outside [A-Za-z0-9][A-Za-z0-9_-]* as tmux-session-name-invalid.\",\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.optional()\n\t\t\t.describe(\n\t\t\t\t\"Optional expert seat override: open the sibling in ONE EXISTING tmux session of this agent's own server. When omitted, Codex selects the exact existing `codex` home session; other backends use the caller's session. Nothing is ever created. Independent of cwd; neither is inferred from the other. The receipt reports the selected name, its source, and resolved target session id.\",\n\t\t\t),\n"
+				"\t\tplacement: z\n\t\t\t.object({\n\t\t\t\ttmuxSession: z\n\t\t\t\t\t.string()\n\t\t\t\t\t.describe(\n\t\t\t\t\t\t\"EXACT name of an EXISTING session on this agent's own tmux server. Nothing is created: an absent session is refused as tmux-session-missing, and a name outside [A-Za-z0-9][A-Za-z0-9_-]* as tmux-session-name-invalid.\",\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.optional()\n\t\t\t.describe(\n\t\t\t\t\"Optional expert seat override: open the sibling in ONE EXISTING tmux session of this agent's own server, and it always wins. When omitted the seat follows the CALLER, never the backend being opened: a Codex CALLER opens beside its own TUI pane, matched by thread-id in that pane's terminal title (0 or 2+ matching panes refuse, never fall back); every other caller opens in its own session. A pane title is a placement input only — never an address, liveness or delivery fact. Nothing is ever created. Independent of cwd; neither is inferred from the other. The receipt reports the selected name (absent for the caller-pane rule, which observed a session rather than requesting a name), its source, and resolved target session id.\",\n\t\t\t),\n"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:FRESHCALL-PLACEMENT-SURFACE-PARITY]",
 			"signatureSource": "test/fresh-call-surfaces.contract.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-CODEX-THREAD-CWD",
+			"title": "codex loses the `-C <dir>` token, so an attached thread opens in the APP-SERVER's directory while its pane sits somewhere else — the launch, the receipt and the pane all still look right",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t\t\t\"-C\",\n\t\t\t\tlaunchCwd,\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-CODEX-THREAD-CWD]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-CWD-CALLER-ONLY",
+			"title": "the codex dialect reads THIS process's directory instead of the directory the launch chose, so a cross-repo or caller-record cwd places the pane while the thread opens somewhere else",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\t\t\tlaunchCwd,\n"],
+			"replace": ["\t\t\t\tprocess.cwd(),\n"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-CWD-CALLER-ONLY]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-CALLER-CWD-CODEX",
+			"title": "the composition drops the caller's record directory, so a Codex caller's omitted cwd silently falls back to the app-server's directory again — the #95 lane C defect, restored with the input still on the signature",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": [
+				"\t\t\t? { value: requestedCwd, source: \"requested\" }\n\t\t\t: callerCwd !== undefined\n\t\t\t\t? { value: callerCwd, source: \"codex-caller-record\" }\n\t\t\t\t: undefined;"
+			],
+			"replace": ["\t\t\t? { value: requestedCwd, source: \"requested\" }\n\t\t\t: undefined;"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-CALLER-CWD-CODEX]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-CALLER-CWD-PI-ARGV-UNCHANGED",
+			"title": "an EMPTY caller cwd stops meaning omit, so a surface that supplies \"\" turns into a classified value — a refusal where the pre-#95 argv simply opened",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": [
+				"\tconst callerCwd = params.callerCwd === undefined || params.callerCwd === \"\" ? undefined : params.callerCwd;"
+			],
+			"replace": ["\tconst callerCwd = params.callerCwd;"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-CALLER-CWD-PI-ARGV-UNCHANGED]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-CWD-TMUX-CARRIER-SOURCE",
+			"title": "an absent chosen directory becomes this process's, so every launch carries a `-c` and the argv four backends have had since #73 is no longer the measured one",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\tconst cwd = chosenCwd?.value;"],
+			"replace": ["\tconst cwd = chosenCwd?.value ?? process.cwd();"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-CWD-TMUX-CARRIER-SOURCE]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-CWD-RECEIPT-SOURCE",
+			"title": "the receipt relabels a caller-record directory as REQUESTED, telling the operator someone asked for a directory nobody named",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": [
+				"\t\t\t\t: r.cwdSource === \"codex-caller-record\"\n\t\t\t\t\t? `  cwd:      ${r.cwd} (the Codex caller's own record directory, used because no cwd was requested — not an observation)\\n`\n\t\t\t\t\t: `  cwd:      ${r.cwd} (requested start directory — not an observation)\\n`) +"
+			],
+			"replace": ["\t\t\t\t: `  cwd:      ${r.cwd} (requested start directory — not an observation)\\n`) +"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-CWD-RECEIPT-SOURCE]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-CALLER-CWD-SURFACE",
+			"title": "the MCP surface stops handing the codex caller's record directory to the composition, so the capability exists in the leaf and is unreachable from the only surface a codex caller can reach it through",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["\t\t\tcallerCwd = self.codexThreadId === undefined ? undefined : self.envelope.cwd;\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-CALLER-CWD-SURFACE]",
+			"signatureSource": "test/fresh-call-surfaces.contract.test.ts"
 		}
 	]
 }

package/scripts/mutants/v2-surface.json

@@ -16,6 +16,28 @@
 			"signature": "[QK:V2SURF-MCP-LOCK-DOMAIN]",
 			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
 		},
+		{
+			"claim": "V2SEND-INBAND-REJECT-REASON",
+			"title": "completed control or mailbox refusal drops its receiver-provided error, leaving the sender with bare rejected again",
+			"subject": "pi-extensions/lib/entwurf-v2-send.ts",
+			"find": ["\treturn { outcome: \"rejected\", rejectReason: result.error === \"\" ? undefined : result.error };"],
+			"replace": ["\treturn { outcome: \"rejected\" };"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-send"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2SEND-INBAND-REJECT-REASON]",
+			"signatureSource": "scripts/check-entwurf-v2-send.ts"
+		},
+		{
+			"claim": "V2PROD-INBAND-ERROR-WIRED",
+			"title": "the production sendOverSocket closure stops copying response.error onto the RpcSendResult, so a receiver's named in-band refusal is stranded one hop before driveSend and the caller sees a reasonless rejected",
+			"subject": "pi-extensions/lib/entwurf-v2-production.ts",
+			"find": ["\t\t\treturn { success: response.success, error: response.error };"],
+			"replace": ["\t\t\treturn { success: response.success };"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-production"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2PROD-INBAND-ERROR-WIRED]",
+			"signatureSource": "scripts/check-entwurf-v2-production.ts"
+		},
 		{
 			"claim": "V2SURF-PI-MODE-SCOPE",
 			"title": "pi-native mode param reverts to \"Delivery mode for a live send\" (false for native-push)",

package/scripts/smoke-codex-config-state.sh

@@ -1,12 +1,14 @@
 #!/usr/bin/env bash
 # smoke-codex-config-state — hermetic install/doctor/inverse contract for the
-# two Codex config atoms (codex-mcp-config.py + codex-statusline-config.py).
+# three Codex config atoms (codex-mcp-config.py + codex-statusline-config.py +
+# codex-terminal-title-config.py).
 # No Codex process, no model turn: the vendor's config.toml surface only.
 set -euo pipefail
 
 REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 MCP="$REPO_DIR/scripts/codex-mcp-config.py"
 SL="$REPO_DIR/scripts/codex-statusline-config.py"
+TT="$REPO_DIR/scripts/codex-terminal-title-config.py"
 pass=0
 ok() { printf '  ok    %s\n' "$1"; pass=$((pass + 1)); }
 die() { printf 'FAIL: %s\n' "$1" >&2; exit 1; }
@@ -39,6 +41,7 @@ mkdir -p "$CODEX_HOME" "$(dirname "$XDG_DATA_HOME")"
 CFG="$CODEX_HOME/config.toml"
 MCP_STATE="$XDG_DATA_HOME/entwurf/codex-mcp/install-state.json"
 SL_STATE="$XDG_DATA_HOME/entwurf/codex-statusline/install-state.json"
+TT_STATE="$XDG_DATA_HOME/entwurf/codex-terminal-title/install-state.json"
 
 seed_config() { # the operator's hand-edited file: quoted header keys, nested
   # tables, an unrelated MCP server, and NO entwurf atom content.
@@ -464,6 +467,189 @@ sed -i 's/^status_line = .*/status_line = [\n  "weather",\n  "thread-title",\n]/
 refuses "restructured list refuses blind take-back" "changed since install" python3 "$SL" uninstall "$SL_STATE"
 rm -f "$SL_STATE"
 
+
+###############################################################################
+# Atom 3 — [tui].terminal_title includes thread-id  (#95 lane B caller seat)
+#
+# Same writer shape as atom 2 and a DIFFERENT contract in two places, both of
+# which have a wrong answer that still parses: the seeded list must LEAD with
+# `activity` (the herdr Codex detector keys on the spinner/action-required
+# prefix), and an existing operator list is APPENDED to, never prepended — a
+# prepend would put thread-id ahead of an activity the operator already
+# configured. The append position is the third: a trailing comma, a trailing
+# comment or a `]` inside a string item each send a naive `rfind("]")` at the
+# wrong bytes, and one of those emits `,,`.
+###############################################################################
+
+# seeded from nothing: the herdr-safe order, verbatim
+rm -f "$CFG" "$TT_STATE"
+python3 "$TT" install "$CFG" "$TT_STATE" >"$SB/out"
+want "[QK:CODEX-TT-SEED-ACTIVITY-FIRST] seeded terminal_title leads with activity, ends with thread-id" \
+  "grep -q '^created-new ' '$SB/out' && grep -q '^terminal_title = \[\"activity\", \"project-name\", \"thread-id\"\]$' '$CFG'"
+python3 "$TT" doctor-static "$CFG" "$TT_STATE" >"$SB/out"
+want "seeded terminal-title doctor is green and owned" "grep -q '^thread-id-present owned$' '$SB/out'"
+python3 "$TT" uninstall "$TT_STATE" >"$SB/out"
+want "seeded file is removed whole by the inverse" "[ ! -e '$CFG' ] && [ ! -e '$TT_STATE' ]"
+
+# an operator list is APPENDED to — the direction that is opposite to atom 2
+seed_config
+sed -i '/^theme = /i terminal_title = ["activity", "project-name"]' "$CFG"
+cp "$CFG" "$SB/tt-seed.toml"
+python3 "$TT" install "$CFG" "$TT_STATE" >"$SB/out"
+want "[QK:CODEX-TT-APPENDS-AT-END] thread-id is appended LAST, operator order untouched" \
+  "grep -q '^merged-item ' '$SB/out' && grep -q '^terminal_title = \[\"activity\", \"project-name\", \"thread-id\"\]$' '$CFG'"
+toml_ok "$CFG"; ok "merged terminal_title still parses"
+MT1="$(stat -c %Y "$CFG")"; sleep 1.1
+python3 "$TT" install "$CFG" "$TT_STATE" >/dev/null
+want "terminal-title reinstall writes nothing" "[ '$MT1' = '$(stat -c %Y "$CFG")' ]"
+python3 "$TT" uninstall "$TT_STATE" >/dev/null
+cmp -s "$SB/tt-seed.toml" "$CFG" && ok "appended item restored byte-exact" || die "terminal-title inverse mismatch"
+
+# an activity-TERMINATED operator list: the item still lands after it
+seed_config
+sed -i '/^theme = /i terminal_title = ["project-name", "activity"]' "$CFG"
+python3 "$TT" install "$CFG" "$TT_STATE" >/dev/null
+want "an activity-terminated list keeps activity in place and appends after it" \
+  "grep -q '^terminal_title = \[\"project-name\", \"activity\", \"thread-id\"\]$' '$CFG'"
+python3 "$TT" uninstall "$TT_STATE" >/dev/null
+
+# multi-line array with a TRAILING COMMA — the shape a naive append breaks
+seed_config
+python3 - "$CFG" <<'PY'
+import sys
+p = sys.argv[1]
+t = open(p).read()
+t = t.replace('theme = "zenburn"',
+              'terminal_title = [\n  "activity",  # operator note\n  "project-name",\n]\ntheme = "zenburn"')
+open(p, 'w').write(t)
+PY
+cp "$CFG" "$SB/tt-multiline.toml"
+python3 "$TT" install "$CFG" "$TT_STATE" >/dev/null
+toml_ok "$CFG"
+want "[QK:CODEX-TT-TRAILING-COMMA] a trailing-comma array is appended to without emitting a double comma" \
+  "! grep -q ',[[:space:]]*,' '$CFG' && python3 -c \"import tomllib,sys; d=tomllib.load(open(sys.argv[1],'rb')); assert d['tui']['terminal_title']==['activity','project-name','thread-id'], d\" '$CFG'"
+python3 "$TT" uninstall "$TT_STATE" >/dev/null
+cmp -s "$SB/tt-multiline.toml" "$CFG" && ok "trailing-comma array restored byte-exact" || die "trailing-comma inverse mismatch"
+
+# a trailing COMMENT that itself contains `]` — rfind("]") would splice into it
+seed_config
+sed -i '/^theme = /i terminal_title = ["activity"]  # keep ] this' "$CFG"
+cp "$CFG" "$SB/tt-comment.toml"
+python3 "$TT" install "$CFG" "$TT_STATE" >/dev/null
+want "[QK:CODEX-TT-COMMENT-NOT-SPLICED] the item lands inside the array and the operator's comment survives" \
+  "grep -q '^terminal_title = \[\"activity\", \"thread-id\"\]  # keep \] this$' '$CFG'"
+python3 "$TT" uninstall "$TT_STATE" >/dev/null
+cmp -s "$SB/tt-comment.toml" "$CFG" && ok "commented line restored byte-exact" || die "comment inverse mismatch"
+
+# a `]` inside a string item, and the empty list
+seed_config
+sed -i '/^theme = /i terminal_title = ["a]b", "activity"]' "$CFG"
+python3 "$TT" install "$CFG" "$TT_STATE" >/dev/null
+want "a ] inside a string item does not become the append point" \
+  "grep -q '^terminal_title = \[\"a\]b\", \"activity\", \"thread-id\"\]$' '$CFG'"
+python3 "$TT" uninstall "$TT_STATE" >/dev/null
+seed_config
+sed -i '/^theme = /i terminal_title = []' "$CFG"
+cp "$CFG" "$SB/tt-empty.toml"
+python3 "$TT" install "$CFG" "$TT_STATE" >/dev/null
+want "empty terminal_title becomes exactly [\"thread-id\"]" "grep -q '^terminal_title = \[\"thread-id\"\]$' '$CFG'"
+python3 "$TT" uninstall "$TT_STATE" >/dev/null
+cmp -s "$SB/tt-empty.toml" "$CFG" && ok "empty terminal_title restored byte-exact" || die "empty terminal_title inverse mismatch"
+
+# an operator-authored item is UNOWNED, and nothing is written over it
+seed_config
+sed -i '/^theme = /i terminal_title = ["activity", "thread-id"]' "$CFG"
+cp "$CFG" "$SB/tt-operator.toml"
+rm -f "$TT_STATE"
+MT1="$(stat -c %Y "$CFG")"; sleep 1.1
+python3 "$TT" install "$CFG" "$TT_STATE" >"$SB/out"
+want "[QK:CODEX-TT-OPERATOR-ITEM-UNOWNED] an operator-authored thread-id writes NO receipt and no config byte" \
+  "grep -q '^already-present ' '$SB/out' && [ ! -e '$TT_STATE' ] && [ '$MT1' = '$(stat -c %Y "$CFG")' ]"
+python3 "$TT" doctor-static "$CFG" "$TT_STATE" >"$SB/out"
+want "the doctor reports it UNOWNED — we claim no edit we did not make" \
+  "grep -q '^thread-id-present unowned$' '$SB/out'"
+python3 "$TT" uninstall "$TT_STATE" >"$SB/out" 2>&1 \
+  && die "uninstall claimed to take back an operator's own item"
+grep -q 'nothing to undo' "$SB/out" || die "unowned uninstall refusal is unnamed: $(cat "$SB/out")"
+cmp -s "$SB/tt-operator.toml" "$CFG" && ok "the refused inverse left the operator's config byte-identical" \
+  || die "unowned uninstall mutated the operator's config"
+
+# ...and that is what keeps the INVERSE honest across a hand edit. With a receipt parked over an
+# operator's item, a reinstall after they removed it splices ours in while the stale receipt still
+# says it was already there — and the inverse then reports "nothing to take back" and leaves our
+# bytes behind for good. Writing nothing above makes that second install an ordinary merged-item.
+seed_config
+sed -i '/^theme = /i terminal_title = ["activity"]' "$CFG"
+cp "$CFG" "$SB/tt-inverse.toml"
+rm -f "$TT_STATE"
+python3 "$TT" install "$CFG" "$TT_STATE" >/dev/null
+sed -i 's/, "thread-id"\]/]/' "$CFG"          # the operator takes our item back by hand
+python3 "$TT" install "$CFG" "$TT_STATE" >"$SB/out"
+want "a reinstall after a hand removal records what it ACTUALLY did" \
+  "grep -q '^merged-item ' '$SB/out' && grep -q '\"detectMode\": \"merged-item\"' '$TT_STATE'"
+python3 "$TT" uninstall "$TT_STATE" >/dev/null
+cmp -s "$SB/tt-inverse.toml" "$CFG" && ok "the inverse takes our re-added item back, leaving nothing behind" \
+  || { printf 'left behind:\n%s\n' "$(cat "$CFG")"; die "reinstall inverse left our item in the operator's config"; }
+rm -f "$TT_STATE"
+
+# the doctor's subject is the REQUIRED caller-seat axis, receipt or no receipt
+seed_config
+sed -i '/^theme = /i terminal_title = ["activity", "thread-id"]' "$CFG"
+rm -f "$TT_STATE"
+python3 "$TT" doctor-static "$CFG" "$TT_STATE" >"$SB/out"
+want "unowned thread-id is green (state-independent)" "grep -q '^thread-id-present unowned$' '$SB/out'"
+sed -i 's/, "thread-id"\]/]/' "$CFG"
+python3 "$TT" doctor-static "$CFG" "$TT_STATE" >"$SB/out" 2>&1 \
+  && die "[QK:CODEX-TT-DOCTOR-REQUIRES-SEAT-AXIS] unowned config WITHOUT thread-id reported green: $(cat "$SB/out")"
+want "[QK:CODEX-TT-DOCTOR-REQUIRES-SEAT-AXIS] a missing caller-seat axis is RED even unowned" \
+  "grep -q '^thread-id-absent unowned$' '$SB/out'"
+python3 "$TT" install "$CFG" "$TT_STATE" >/dev/null
+sed -i 's/, "thread-id"\]/]/' "$CFG"
+python3 "$TT" doctor-static "$CFG" "$TT_STATE" >"$SB/out" 2>&1 || true
+want "our receipt over a vanished item reports drift, not green" "grep -q '^thread-id-absent owned drift$' '$SB/out'"
+rm -f "$TT_STATE"
+
+# the two [tui] atoms are independent: neither sees the other's key
+seed_config
+python3 "$SL" install "$CFG" "$SL_STATE" >/dev/null
+python3 "$TT" install "$CFG" "$TT_STATE" >/dev/null
+want "[QK:CODEX-TT-ATOM-INDEPENDENCE] both [tui] atoms live side by side" \
+  "python3 -c \"import tomllib,sys; d=tomllib.load(open(sys.argv[1],'rb'))['tui']; assert d['status_line']==['thread-title','model-with-reasoning','current-dir'], d; assert d['terminal_title']==['activity','project-name','thread-id'], d\" '$CFG'"
+python3 "$TT" uninstall "$TT_STATE" >/dev/null
+want "[QK:CODEX-TT-ATOM-INDEPENDENCE] taking back terminal_title leaves status_line exactly as it was" \
+  "grep -q '^status_line = \[\"thread-title\", \"model-with-reasoning\", \"current-dir\"\]$' '$CFG' && ! grep -q 'terminal_title' '$CFG'"
+python3 "$SL" uninstall "$SL_STATE" >/dev/null
+
+# refusals — symlink, malformed, contrary value by name, foreign/retargeted state
+seed_config
+ln -sf "$SB/foreign.toml" "$CFG"
+refuses "symlink config refused (terminal-title)" "symlink" python3 "$TT" install "$CFG" "$TT_STATE"
+rm -f "$CFG"
+printf 'garbage [[[\n' > "$CFG"
+refuses "malformed TOML refused (terminal-title)" "not valid TOML" python3 "$TT" install "$CFG" "$TT_STATE"
+seed_config
+sed -i '/^theme = /i terminal_title = "thread-id"' "$CFG"
+refuses "non-array terminal_title refused BY NAME" "terminal_title.*explicitly" python3 "$TT" install "$CFG" "$TT_STATE"
+want "terminal-title refusals wrote no state" "[ ! -e '$TT_STATE' ]"
+seed_config
+python3 "$SL" install "$CFG" "$SL_STATE" >/dev/null
+cp "$SL_STATE" "$TT_STATE"                               # atom 2's receipt, on our path
+refuses "foreign-atom state refused (terminal-title)" "belongs to atom" python3 "$TT" install "$CFG" "$TT_STATE"
+python3 "$SL" uninstall "$SL_STATE" >/dev/null
+rm -f "$TT_STATE"
+seed_config
+python3 "$TT" install "$CFG" "$TT_STATE" >/dev/null
+sed -i "s|$(json_field "$TT_STATE" managedConfigPath)|$SB/elsewhere.toml|" "$TT_STATE"
+refuses "retargeted state refused (terminal-title)" "refusing to retarget" python3 "$TT" install "$CFG" "$TT_STATE"
+rm -f "$TT_STATE"
+
+# operator restructures the list after install: the take-back refuses, by name
+seed_config
+python3 "$TT" install "$CFG" "$TT_STATE" >/dev/null
+sed -i 's/^terminal_title = .*/terminal_title = [\n  "weather",\n  "thread-id",\n]/' "$CFG"
+refuses "restructured terminal_title refuses blind take-back" "changed since install" python3 "$TT" uninstall "$TT_STATE"
+rm -f "$TT_STATE"
+
 ###############################################################################
 # Unrelated operator config survives the whole cycle, byte for byte
 ###############################################################################
@@ -471,6 +657,7 @@ seed_config
 cp "$CFG" "$SB/final-seed.toml"
 python3 "$MCP" install "$CFG" entwurf-bridge "$MCP_STATE" >/dev/null
 python3 "$SL" install "$CFG" "$SL_STATE" >/dev/null
+python3 "$TT" install "$CFG" "$TT_STATE" >/dev/null
 toml_ok "$CFG"; ok "fully installed config parses as TOML"
 python3 - "$CFG" <<'PY'
 import tomllib, sys
@@ -494,17 +681,19 @@ assert d["mcp_servers"]["entwurf-bridge"] == {
     "env": {"ENTWURF_BRIDGE_NATIVE_HOST": "codex"},
 }, d
 assert d["tui"]["status_line"] == ["thread-title", "model-with-reasoning", "current-dir"], d
+assert d["tui"]["terminal_title"] == ["activity", "project-name", "thread-id"], d
 assert d["tui"]["theme"] == "zenburn" and d["tui"]["model_availability_nux"] == {"gpt-5.5": 4}, d
 assert d["plugins"]["github@openai-curated"] == {"enabled": False}, d
 PY
-ok "unrelated tables intact and both atoms semantically live"
+ok "unrelated tables intact and all three atoms semantically live"
 # the vendor writes trust state back between install and uninstall (M1)
 printf '[hooks.state."~/c.toml:stop:0:0"]\ntrusted_hash = "sha256:def"\n' >> "$CFG"
 python3 "$MCP" uninstall "$MCP_STATE" >/dev/null
 python3 "$SL" uninstall "$SL_STATE" >/dev/null
+python3 "$TT" uninstall "$TT_STATE" >/dev/null
 printf '[hooks.state."~/c.toml:stop:0:0"]\ntrusted_hash = "sha256:def"\n' >> "$SB/final-seed.toml"
 cmp -s "$SB/final-seed.toml" "$CFG" && ok "full cycle leaves only vendor-added bytes (unrelated config survives)" || die "final byte mismatch"
-want "both states cleared" "[ ! -e '$MCP_STATE' ] && [ ! -e '$SL_STATE' ]"
+want "all three states cleared" "[ ! -e '$MCP_STATE' ] && [ ! -e '$SL_STATE' ] && [ ! -e '$TT_STATE' ]"
 
 REPO_AFTER="$(cd "$REPO_DIR" && git status --porcelain)"
 [ "$REPO_BEFORE" = "$REPO_AFTER" ] || die "smoke changed the checkout"