@junghanacs/entwurf 0.21.0 → 0.23.0

package/scripts/check-mux-launch-tmux.ts

@@ -27,7 +27,16 @@
  *   - the #105 seat, through the real `freshCall`: an absent seat refuses and creates nothing,
  *     an existing one puts the window in THAT session with a receipt naming the resolved
  *     target, and the resulting handle closes through `closeWindow` from outside that session
- *   - #95's omitted Codex seat resolves exact existing `codex`, while omitted Pi stays caller-local
+ *   - an omitted seat stays caller-local for EVERY backend (#95 D1 retired the Codex home)
+ *   - #95 lane B's caller-seat leaf against REAL pane titles: 0 / 1 / 2 matching panes, and the
+ *     activity-adjacent title a ` | `-segment rule would miss
+ *   - #95 lane B's COMPOSITION: a Codex caller's omitted-placement fresh call lands in the
+ *     session its own titled pane is in, an explicit seat still overrides it, and an
+ *     unresolvable anchor refuses with the server byte-identical
+ *   - #95 lane C: WHERE a sibling starts — a caller's record directory places the pane, an
+ *     explicit request still wins, an omitted one inherits THIS process's directory rather
+ *     than the target session's `session_path`, and codex carries that same directory to its
+ *     thread as `-C`, read off the runtime's own recorded argv
  */
 
 import assert from "node:assert/strict";
@@ -35,7 +44,7 @@ import { spawnSync } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { buildLaunchArgs, LaunchPreconditionError, launchPi } from "../pi-extensions/lib/mux-launch.ts";
-import { inspectPlacement } from "../pi-extensions/lib/mux-placement.ts";
+import { inspectPlacement, runTmux } from "../pi-extensions/lib/mux-placement.ts";
 import { skipLive } from "./lib/live-skip.ts";
 
 const LABEL = "check-mux-launch-tmux";
@@ -119,9 +128,14 @@ async function main(): Promise<void> {
 	const runtimeDir = fs.mkdtempSync(path.join(process.env.XDG_RUNTIME_DIR ?? "/tmp", "entwurf-mux-rt-"));
 	// A long-lived stand-in for the official runtime. `exec` so no shell survives: the pane's
 	// process must be the runtime itself for the pane_pid claim to mean anything.
+	// Each stand-in also DUMPS its own argv beside itself before it sleeps. That file is the
+	// only oracle in this repo for "what actually reached the runtime", independent of the
+	// builder that composed it — #95 lane C needs it because codex's thread directory rides a
+	// VENDOR flag whose absence is silent (the thread simply opens in the app-server's repo).
 	const runtime = path.join(runtimeDir, "pi");
-	fs.writeFileSync(runtime, "#!/bin/sh\nexec sleep 900\n", { mode: 0o755 });
-	fs.writeFileSync(path.join(runtimeDir, "codex"), "#!/bin/sh\nexec sleep 900\n", { mode: 0o755 });
+	const DUMP_ARGV = '#!/bin/sh\nprintf \'%s\\n\' "$@" > "$0.argv"\nexec sleep 900\n';
+	fs.writeFileSync(runtime, DUMP_ARGV, { mode: 0o755 });
+	fs.writeFileSync(path.join(runtimeDir, "codex"), DUMP_ARGV, { mode: 0o755 });
 
 	try {
 		assert.equal(fx("-f", "/dev/null", "new-session", "-d", "-s", SESSION).status, 0, "fixture new-session");
@@ -373,11 +387,16 @@ async function main(): Promise<void> {
 					!fxLines("list-windows", "-a", "-F", "#{window_id}").includes(receipt.windowId),
 			);
 
-			// (iv) Codex's omitted seat is a product default, not fixture prose. Missing home
-			// refuses before mutation; then a private session named exactly `codex` makes the real
-			// composition resolve that name while the Pi omitted-seat control stays caller-local.
-			const beforeMissingHome = inventory();
-			const missingHome = freshCall(
+			// (iv) #95 D1 (GLG, 2026-09-16): an omitted seat is caller-local for EVERY backend,
+			// Codex included. Until then an omitted-placement Codex selected a fixed existing
+			// session named `codex` — a room the operator had to keep because nothing could find
+			// the pane a Codex caller was sitting in. The caller-pane anchor below IS that
+			// mapping, so this cell now asserts the ABSENCE of the old default: with a session
+			// literally named `codex` present on this server, an omitted-placement Codex call
+			// must still land in the caller's own session and name no seat at all.
+			assert.equal(fx("new-session", "-d", "-s", "codex").status, 0, "fixture session named codex");
+			const decoyHomeId = fxLines("list-windows", "-t", "=codex", "-F", "#{session_id}")[0];
+			const omittedCodex = freshCall(
 				{
 					backend: "codex",
 					model: "fixture-model",
@@ -386,37 +405,314 @@ async function main(): Promise<void> {
 				},
 				inherited,
 			);
-			ok(
-				"codex home: omitted placement refuses a missing exact home without mutation",
-				!missingHome.ok && missingHome.reason === "tmux-session-missing" && inventory() === beforeMissingHome,
-			);
-			assert.equal(fx("new-session", "-d", "-s", "codex").status, 0, "fixture Codex home session");
-			const codexHomeId = fxLines("list-windows", "-t", "=codex", "-F", "#{session_id}")[0];
-			const home = freshCall(
-				{
-					backend: "codex",
-					model: "fixture-model",
-					task: "fixture task",
-					callerGardenId: "20260101T000000-fixture",
-				},
-				inherited,
-			);
-			assert.ok(home.ok, `the omitted-placement Codex call must succeed: ${home.ok ? "" : home.reason}`);
-			ok(
-				"codex home: omitted placement lands in exact existing `codex`, not the caller session",
-				home.receipt.sessionId === codexHomeId &&
-					home.receipt.sessionId !== placement.sessionId &&
-					home.receipt.tmuxSession === "codex" &&
-					home.receipt.tmuxSessionSource === "codex-home",
+			assert.ok(
+				omittedCodex.ok,
+				`the omitted-placement Codex call must succeed: ${omittedCodex.ok ? "" : omittedCodex.reason}`,
 			);
 			ok(
-				"codex home: the home receipt closes by stable handle",
-				closeWindow(home.receipt, inherited) === "closed" &&
-					!fxLines("list-windows", "-a", "-F", "#{window_id}").includes(home.receipt.windowId),
+				"no fixed home: an omitted Codex seat is caller-local and names NO seat, even with a session called `codex` right there",
+				omittedCodex.receipt.sessionId === placement.sessionId &&
+					omittedCodex.receipt.sessionId !== decoyHomeId &&
+					omittedCodex.receipt.tmuxSession === undefined &&
+					omittedCodex.receipt.tmuxSessionSource === undefined &&
+					fxLines("list-windows", "-t", decoyHomeId, "-F", "#{window_id}").length === 1,
 			);
+			process.kill(Number(omittedCodex.receipt.panePid), "SIGKILL");
 			fx("kill-session", "-t", seatId);
-			fx("kill-session", "-t", codexHomeId);
+			fx("kill-session", "-t", decoyHomeId);
 			ok("seat: the fixture is back to one session", sessionCount() === 1);
+
+			// (v) #95 lane B: the caller-seat leaf, against REAL pane titles on this server.
+			// The deterministic gate can pin the anchor and the counting, but "what tmux
+			// actually reports as `#{pane_title}`, and which `$session` that pane is in" had
+			// no oracle independent of the leaf's own parse. This cell is that oracle. The
+			// titles are set with `select-pane -T` rather than by a Codex process: the claim
+			// under test is the LOOKUP, and a real TUI would add a model turn, a record and a
+			// vendor version to a gate that must stay hermetic.
+			{
+				const { resolveCodexCallerSeat } = await import("../pi-extensions/lib/codex-caller-seat.ts");
+				const thread = "01a0a7f9-ed9c-7aa2-a4dd-b1a39c0d4e11";
+				const anchor = `${thread.slice(0, 29)}...`;
+				const seatRun = (args: string[]) => runTmux(args, inherited);
+				const titleOf = (pane: string): string =>
+					fxLines("list-panes", "-a", "-F", "#{pane_id}|#{pane_title}").find((row) => row.startsWith(`${pane}|`)) ?? "";
+
+				// 0 matches: every pane on this server carries the default title, which is the
+				// same shape a server with `allow-set-title off` reports for a live Codex.
+				ok(
+					"caller seat: no pane naming the thread refuses as unresolved — no fallback session",
+					(() => {
+						const r = resolveCodexCallerSeat(thread, seatRun);
+						return !r.ok && r.reason === "codex-caller-seat-unresolved";
+					})(),
+				);
+
+				// 1 match, in a session that is NOT the caller's: the leaf must report THAT
+				// session, which is the whole point of the anchor.
+				assert.equal(fx("new-session", "-d", "-s", `${SESSION}-tui`).status, 0, "fixture TUI session");
+				const tuiSessionId = fxLines("list-windows", "-t", `=${SESSION}-tui`, "-F", "#{session_id}")[0];
+				const tuiPane = fxLines("list-panes", "-t", `=${SESSION}-tui`, "-F", "#{pane_id}")[0];
+				assert.equal(fx("select-pane", "-t", tuiPane, "-T", `entwurf | ${anchor}`).status, 0, "fixture TUI title");
+				ok(
+					"caller seat: tmux really reports the OSC-shaped title we are matching against",
+					titleOf(tuiPane) === `${tuiPane}|entwurf | ${anchor}`,
+				);
+				ok(
+					"caller seat: the one matching pane resolves to ITS session, not the caller's",
+					(() => {
+						const r = resolveCodexCallerSeat(thread, seatRun);
+						return (
+							r.ok &&
+							r.seat.paneId === tuiPane &&
+							r.seat.sessionId === tuiSessionId &&
+							r.seat.sessionId !== placement.sessionId &&
+							r.seat.source === "codex-title-anchor"
+						);
+					})(),
+				);
+
+				// The ACTIVITY-adjacent shape. `title_setup.rs:183-193` joins the activity item
+				// to its neighbour with a plain space, so an operator list ending in `activity`
+				// renders the thread id INSIDE one ` | ` segment. A segment-equality rule reads
+				// this pane as no match at all; the token rule resolves it.
+				assert.equal(fx("select-pane", "-t", tuiPane, "-T", `entwurf | Working ${anchor}`).status, 0, "activity title");
+				ok(
+					"caller seat: an activity-adjacent title still resolves — the id is a TOKEN, not a whole segment",
+					(() => {
+						const r = resolveCodexCallerSeat(thread, seatRun);
+						return r.ok && r.seat.paneId === tuiPane && r.seat.sessionId === tuiSessionId;
+					})(),
+				);
+
+				// 2 matches: a stale duplicate in another session. Picking either would seat a
+				// sibling by guess, so nothing is chosen.
+				assert.equal(fx("split-window", "-d", "-t", tuiPane).status, 0, "fixture duplicate pane");
+				const duplicate = fxLines("list-panes", "-t", `=${SESSION}-tui`, "-F", "#{pane_id}").find(
+					(id) => id !== tuiPane,
+				);
+				assert.ok(duplicate, "the fixture duplicate pane must exist");
+				assert.equal(fx("select-pane", "-t", duplicate, "-T", `tmp | ${anchor}`).status, 0, "duplicate title");
+				ok(
+					"caller seat: two panes naming one thread refuse as ambiguous — never the first match",
+					(() => {
+						const r = resolveCodexCallerSeat(thread, seatRun);
+						return !r.ok && r.reason === "codex-caller-seat-ambiguous";
+					})(),
+				);
+
+				// ── the COMPOSITION, through the real `freshCall` (#95 lane B C3) ─────────
+				// The leaf's decision is proven above; what has no oracle outside production is
+				// whether the omitted-placement path for a CODEX CALLER actually reaches that
+				// decision and turns it into the `-t` target. These cells run the real
+				// composition with the same hermetic runtime the rest of this gate uses, and
+				// read the answer from the server's own inventory rather than the receipt alone.
+				// Back to EXACTLY one matching pane: the duplicate above must stop naming the
+				// thread, or the composition below would (correctly) refuse as ambiguous.
+				assert.equal(fx("select-pane", "-t", duplicate, "-T", "plain-shell").status, 0, "clear duplicate title");
+				assert.equal(fx("select-pane", "-t", tuiPane, "-T", `entwurf | ${anchor}`).status, 0, "restore TUI title");
+				const anchoredCall = (over?: { tmuxSession: string }) =>
+					freshCall(
+						{
+							backend: "pi",
+							model: "fixture/model",
+							task: "fixture task",
+							placement: over,
+							callerGardenId: "20260101T000000-fixture",
+							callerNativeSessionId: thread,
+						},
+						inherited,
+					);
+
+				const anchored = anchoredCall();
+				assert.ok(anchored.ok, `the anchored fresh call must succeed: ${anchored.ok ? "" : anchored.reason}`);
+				ok(
+					"caller seat composition: the window lands in the session the CALLER's pane is in, not the caller session",
+					anchored.receipt.sessionId === tuiSessionId &&
+						anchored.receipt.sessionId !== placement.sessionId &&
+						fxLines("list-windows", "-t", tuiSessionId, "-F", "#{window_id}").includes(anchored.receipt.windowId),
+				);
+				ok(
+					"caller seat composition: the receipt names the SOURCE and no session name — the pane was observed, not requested",
+					anchored.receipt.tmuxSessionSource === "codex-title-anchor" && anchored.receipt.tmuxSession === undefined,
+				);
+				ok(
+					"caller seat composition: that window closes by its own handle",
+					closeWindow(anchored.receipt, inherited) === "closed" &&
+						!fxLines("list-windows", "-a", "-F", "#{window_id}").includes(anchored.receipt.windowId),
+				);
+
+				// Rule 1 over rule 2, against a real server: an explicit seat is never rewritten
+				// by the anchor, even when the anchor would have resolved.
+				assert.equal(fx("new-session", "-d", "-s", `${SESSION}-over`).status, 0, "fixture override session");
+				const overrideId = fxLines("list-windows", "-t", `=${SESSION}-over`, "-F", "#{session_id}")[0];
+				const overridden = anchoredCall({ tmuxSession: `${SESSION}-over` });
+				assert.ok(overridden.ok, `the overridden fresh call must succeed: ${overridden.ok ? "" : overridden.reason}`);
+				ok(
+					"caller seat composition: an explicit seat still wins over a resolvable anchor",
+					overridden.receipt.sessionId === overrideId &&
+						overridden.receipt.sessionId !== tuiSessionId &&
+						overridden.receipt.tmuxSession === `${SESSION}-over` &&
+						overridden.receipt.tmuxSessionSource === "requested",
+				);
+				closeWindow(overridden.receipt, inherited);
+				fx("kill-session", "-t", overrideId);
+
+				// An unresolvable anchor is a refusal with NOTHING created anywhere — the D2
+				// contract, read from the server rather than from the return value alone.
+				const beforeUnresolved = inventory();
+				const unresolved = freshCall(
+					{
+						backend: "pi",
+						model: "fixture/model",
+						task: "fixture task",
+						callerGardenId: "20260101T000000-fixture",
+						callerNativeSessionId: "01a0ffff-ffff-7fff-bfff-ffffffffffff",
+					},
+					inherited,
+				);
+				ok(
+					"caller seat composition: an unresolvable anchor refuses and creates NOTHING — no window, no session, no fallback",
+					!unresolved.ok && unresolved.reason === "codex-caller-seat-unresolved" && inventory() === beforeUnresolved,
+				);
+
+				fx("kill-session", "-t", tuiSessionId);
+				ok("caller seat: the fixture is back to one session", sessionCount() === 1);
+			}
+
+			// (vi) #95 lane C: WHERE the sibling starts, read off the pane and off the runtime's
+			// own argv. The deterministic gate can pin which value the composition selects; what
+			// only tmux and the runtime can answer is whether that value actually placed the
+			// pane, and whether the vendor token carrying it survived to the process. A codex
+			// thread's directory is the sharper half: with no `-C` the TUI attaches to the
+			// operator's app-server and the THREAD opens in the app-server's repo while the pane
+			// sits somewhere else entirely — a divergence no receipt in this repo would show.
+			{
+				const callerRepo = path.join(runtimeDir, "caller-repo");
+				const requestedRepo = path.join(runtimeDir, "requested-repo");
+				const sessionRepo = path.join(runtimeDir, "session-repo");
+				for (const dir of [callerRepo, requestedRepo, sessionRepo]) fs.mkdirSync(dir);
+				const paneCwd = (paneId: string): string =>
+					fxLines("display-message", "-p", "-t", paneId, "#{pane_current_path}")[0];
+				const argvAt = (backend: "pi" | "codex"): string => `${path.join(runtimeDir, backend)}.argv`;
+				/** `[측정]` a pane's `#{pane_current_path}` is read from the child's `/proc` at
+				 * QUERY time, and tmux chdirs in that child AFTER forking it — so a read taken
+				 * straight after the launch receipt can still answer the SERVER's directory and
+				 * make a correct `-c` look ignored. The runtime's own argv dump is the settle
+				 * signal: once it exists the fixture is running and has been chdir'ed. Bounded,
+				 * never unbounded — a runtime that never starts is a failed assertion, not a hang.
+				 * Each launch clears the previous file first, so a stale dump can never be read
+				 * as this launch's. */
+				const clearArgv = (backend: "pi" | "codex"): void => fs.rmSync(argvAt(backend), { force: true });
+				const awaitRuntime = (backend: "pi" | "codex"): void => {
+					const end = Date.now() + 5000;
+					while (!fs.existsSync(argvAt(backend)) && Date.now() < end) spawnSync("sleep", ["0.05"]);
+					assert.ok(fs.existsSync(argvAt(backend)), `the ${backend} fixture started and recorded its argv`);
+				};
+				const runtimeArgv = (backend: "pi" | "codex"): string[] => {
+					awaitRuntime(backend);
+					const argv = fs.readFileSync(argvAt(backend), "utf8").split("\n").slice(0, -1);
+					clearArgv(backend);
+					return argv;
+				};
+				const freshWith = (over: { backend?: "pi" | "codex"; cwd?: string; callerCwd?: string }) =>
+					freshCall(
+						{
+							backend: over.backend ?? "pi",
+							model: "fixture/model",
+							task: "fixture task",
+							cwd: over.cwd,
+							callerCwd: over.callerCwd,
+							callerGardenId: "20260101T000000-fixture",
+						},
+						inherited,
+					);
+
+				clearArgv("pi");
+				const fromRecord = freshWith({ callerCwd: callerRepo });
+				assert.ok(fromRecord.ok, `the caller-cwd fresh call must succeed: ${fromRecord.ok ? "" : fromRecord.reason}`);
+				awaitRuntime("pi");
+				ok(
+					"caller cwd: a caller that HAS a record directory opens the pane THERE, not in this process's directory",
+					paneCwd(fromRecord.receipt.paneId) === callerRepo &&
+						callerRepo !== process.cwd() &&
+						fromRecord.receipt.cwd === callerRepo &&
+						fromRecord.receipt.cwdSource === "codex-caller-record",
+				);
+				ok(
+					"caller cwd: the runtime argv carries no tmux carrier — the directory reached the PANE through `-c`",
+					!runtimeArgv("pi").includes("-c"),
+				);
+				closeWindow(fromRecord.receipt, inherited);
+
+				clearArgv("pi");
+				const requested = freshWith({ cwd: requestedRepo, callerCwd: callerRepo });
+				assert.ok(requested.ok, `the requested-cwd fresh call must succeed: ${requested.ok ? "" : requested.reason}`);
+				awaitRuntime("pi");
+				ok(
+					"caller cwd: an explicit request still wins over the caller's record directory, and the receipt says which rule chose it",
+					paneCwd(requested.receipt.paneId) === requestedRepo &&
+						requested.receipt.cwd === requestedRepo &&
+						requested.receipt.cwdSource === "requested",
+				);
+				closeWindow(requested.receipt, inherited);
+				runtimeArgv("pi");
+
+				// The inherited case, and the measurement `-C`'s default rests on: with no `-c`
+				// the pane takes the directory of the process that ran `new-window` — NOT the
+				// target session's `session_path`, which is why a seat in another directory is
+				// what makes this readable at all.
+				assert.equal(
+					fx("new-session", "-d", "-s", `${SESSION}-cwd`, "-c", sessionRepo).status,
+					0,
+					"fixture session rooted elsewhere",
+				);
+				const seatCwdId = fxLines("list-windows", "-t", `=${SESSION}-cwd`, "-F", "#{session_id}")[0];
+				clearArgv("pi");
+				const inherit = freshCall(
+					{
+						backend: "pi",
+						model: "fixture/model",
+						task: "fixture task",
+						placement: { tmuxSession: `${SESSION}-cwd` },
+						callerGardenId: "20260101T000000-fixture",
+					},
+					inherited,
+				);
+				assert.ok(inherit.ok, `the inherited-cwd fresh call must succeed: ${inherit.ok ? "" : inherit.reason}`);
+				awaitRuntime("pi");
+				ok(
+					"caller cwd: with NO directory named, the pane inherits this process's — not the target session's session_path — and the receipt invents nothing",
+					paneCwd(inherit.receipt.paneId) === process.cwd() &&
+						process.cwd() !== sessionRepo &&
+						inherit.receipt.sessionId === seatCwdId &&
+						inherit.receipt.cwd === undefined &&
+						inherit.receipt.cwdSource === undefined,
+				);
+				closeWindow(inherit.receipt, inherited);
+				runtimeArgv("pi");
+				fx("kill-session", "-t", seatCwdId);
+
+				// The codex half: the SAME value the pane got, carried to the vendor as `-C`,
+				// read off the process's own argv rather than off the builder that wrote it.
+				clearArgv("codex");
+				const codexThread = freshWith({ backend: "codex", callerCwd: callerRepo });
+				assert.ok(codexThread.ok, `the codex fresh call must succeed: ${codexThread.ok ? "" : codexThread.reason}`);
+				const codexArgv = runtimeArgv("codex");
+				const dashC = codexArgv.indexOf("-C");
+				ok(
+					"codex thread cwd: the vendor argv carries `-C <dir>` with the SAME directory the pane landed in — one value, two carriers",
+					dashC >= 0 &&
+						codexArgv[dashC + 1] === callerRepo &&
+						codexArgv.filter((a) => a === "-C").length === 1 &&
+						paneCwd(codexThread.receipt.paneId) === callerRepo,
+				);
+				ok(
+					"codex thread cwd: the flag rides the SAME argv as the remote attachment — an attached thread with no override takes the app-server's directory",
+					codexArgv.includes("--remote") && dashC > codexArgv.indexOf("--remote"),
+				);
+				closeWindow(codexThread.receipt, inherited);
+				ok("caller cwd: the fixture is back to one session", sessionCount() === 1);
+			}
 		}
 	} finally {
 		fx("kill-server");

package/scripts/check-mux-launcher-fence.ts

@@ -26,6 +26,20 @@
  *   LAUNCHFENCE-LIFECYCLE-CELL-BRANCH   lifecycle keeps its two truthful cell branches: ACP pi
  *                                       retains the four MEASURED canonical REAL_XDG_* roots,
  *                                       the direct Claude cell gets exact-parity restore
+ *   LAUNCHFENCE-EXPOSED-SMOKE-WIRED     the population, not a list of names: EVERY LIVE smoke
+ *                                       that hands a child a fixture XDG_DATA_HOME either
+ *                                       consumes this fence or carries a stated exemption that
+ *                                       is itself true of its source
+ *
+ * WHY THE LAST CLAIM EXISTS `[측정 oracle 2026-09-18]`. The two WIRED claims above name two files,
+ * and a rail born after them walked straight through the gap: `smoke-herdr-fresh-call-live` fenced
+ * XDG while keeping the operator's real HOME, and its Claude children reinstalled themselves into
+ * the fixture and repointed `~/.local/bin/claude` at `<fixture>/claude/versions/2.1.267`. Seven
+ * preserved fixture roots each held that install; the operator's launcher pointed into the newest
+ * of them until it was relinked by hand. The vendor's own two halves are why — the version store
+ * follows `XDG_DATA_HOME` and the launcher follows `HOME` (2.1.267: `EZe = join(Wge(), "claude",
+ * "versions")` against `TN = join(home, ".local", "bin")`) — so a fixture data root beside a real
+ * HOME is the incident's precondition, and THAT is what this claim enumerates.
  */
 
 import assert from "node:assert/strict";
@@ -248,6 +262,130 @@ function main(): void {
 			"[QK:LAUNCHFENCE-WIRED-FRESH-CALL] wiring: smoke-mux-fresh-call-live consumes the SAME shared fence rather than a private copy — one protection, two smokes, per the issue's shared-repair requirement",
 			wired(read("scripts/smoke-mux-fresh-call-live.ts")),
 		);
+		// ── the population: who ELSE hands a child a fixture data root ───────────
+		{
+			// A smoke that assigns its own fixture XDG_DATA_HOME beside the operator's real HOME is
+			// standing in the incident's precondition. Three things are read STRUCTURALLY rather than
+			// by name `[sol 재검 2026-09-18]`, because the first version of this claim asked only
+			// whether four strings appeared anywhere in the file — which a comment, or dead code,
+			// satisfies as well as a wired smoke:
+			//
+			//   1. the preflight is BOUND (`const x = snapshotClaudeLauncher(`) and comes BEFORE the
+			//      smoke's first child. That boundary is the whole point `[sol 재검 2026-09-18]`: an
+			//      ordering of snapshot < verify < cleanup alone is satisfied by moving the entire
+			//      block AFTER the children, which pins the damage as the baseline and makes the
+			//      oracle green on a launcher that has already moved. Each smoke's first child is
+			//      named here by its own marker, and a smoke in the population with no marker is
+			//      RED rather than waved through — a new rail must say where its children begin.
+			//   2. the integrity oracle and the cleanup verdict both run on THAT binding, in that
+			//      order — one snapshot, not three unrelated calls;
+			//   3. a smoke that REMOVES its fixture does both before the removal. The herdr smoke
+			//      preserves its fixture as evidence and therefore has no removal to precede; that
+			//      is a real difference between the two shapes, so the rule is written as a
+			//      condition on removal rather than as a `finally` that only one of them has.
+			//
+			// An exemption is read the same way: not "the file contains HOME somewhere", but "the
+			// env object that assigns the fixture XDG_DATA_HOME also relocates HOME", which is the
+			// relation that actually keeps the vendor's store and its launcher in one tree.
+			const dataRootAssignment = (file: string): RegExp => (file.endsWith(".sh") ? /XDG_DATA_HOME=/ : /XDG_DATA_HOME:/);
+			/** The object literal / env block that carries the fixture data root, not the whole file. */
+			const envBlockAround = (src: string, file: string): string => {
+				const at = src.search(dataRootAssignment(file));
+				if (at < 0) return "";
+				const from = src.lastIndexOf("{", at);
+				if (from < 0) return src.slice(Math.max(0, at - 800), at + 800);
+				let depth = 0;
+				for (let i = from; i < src.length; i += 1) {
+					if (src[i] === "{") depth += 1;
+					else if (src[i] === "}") {
+						depth -= 1;
+						if (depth === 0) return src.slice(from, i + 1);
+					}
+				}
+				return src.slice(from);
+			};
+			const EXEMPT: Record<string, { reason: string; holds: (src: string, file: string) => boolean }> = {
+				"smoke-herdr-plugin-build-live.ts": {
+					reason: "it relocates HOME into the same sandbox, so store and launcher stay in one tree",
+					holds: (src, file) => /(^|\n)\s*HOME[,:]/.test(envBlockAround(src, file)),
+				},
+			};
+			/** Where each smoke's FIRST Claude-capable child begins. Named per smoke, because the
+			 * three rails start children in three different ways and a generic "spawn" would match
+			 * the setup probes (`tmux -V`, `command -v claude`) that run long before any child. */
+			const FIRST_CHILD: Record<string, RegExp> = {
+				"smoke-herdr-fresh-call-live.ts": /herdr\(bin, env, \[\s*"agent",\s*"start"/,
+				"smoke-mux-fresh-call-live.ts": /\n\t*const \w+ = freshCall\(/,
+				"smoke-mux-lifecycle-live.ts": /\bbridge\.call\("entwurf_fresh_call"/,
+			};
+			const consumesFence = (src: string, file: string): boolean => {
+				if (!src.includes('from "./lib/claude-launcher-fence.ts"')) return false;
+				const bound = /const (\w+) = snapshotClaudeLauncher\(/.exec(src);
+				if (bound === null) return false;
+				const marker = FIRST_CHILD[file];
+				if (marker === undefined) return false;
+				const firstChildAt = src.search(marker);
+				if (firstChildAt < 0) return false;
+				const snapshot = bound[1];
+				const preflightAt = src.indexOf(bound[0]);
+				const verifyAt = src.indexOf(`verifyClaudeLauncher(${snapshot})`);
+				const cleanupAt = src.indexOf(`assessLauncherCleanup(${snapshot})`);
+				const removalAt = src.indexOf("rmSync(root");
+				if (preflightAt < 0 || preflightAt > firstChildAt) return false;
+				if (verifyAt < firstChildAt || cleanupAt < verifyAt) return false;
+				return removalAt < 0 || (verifyAt < removalAt && cleanupAt < removalAt);
+			};
+			const exposed = fs
+				.readdirSync(path.join(ROOT, "scripts"))
+				.filter((f) => f.startsWith("smoke-") && (f.endsWith("-live.ts") || f.endsWith("-live.sh")))
+				.filter((f) => dataRootAssignment(f).test(read(path.join("scripts", f))));
+			const unguarded = exposed.filter((f) => {
+				const src = read(path.join("scripts", f));
+				if (consumesFence(src, f)) return false;
+				const exemption = EXEMPT[f];
+				return !(exemption && exemption.holds(src, f));
+			});
+			ok(
+				`population: ${exposed.length} LIVE smokes assign a fixture data root (measured across .ts AND .sh, not listed), and the three real-HOME ones are the fence's constituency`,
+				exposed.length >= 4 &&
+					["smoke-herdr-fresh-call-live.ts", "smoke-mux-fresh-call-live.ts", "smoke-mux-lifecycle-live.ts"].every((f) =>
+						exposed.includes(f),
+					),
+			);
+			ok(
+				`[QK:LAUNCHFENCE-EXPOSED-SMOKE-WIRED] every LIVE smoke that hands a child a fixture XDG_DATA_HOME beside the operator's real HOME consumes this fence AS A LIFECYCLE — one bound preflight BEFORE its first child, then its integrity oracle and cleanup verdict on that same snapshot after the children, and all of it before any fixture removal — or carries an exemption proved against the very env block that assigns the data root; unguarded: ${unguarded.join(", ") || "none"}`,
+				unguarded.length === 0,
+			);
+			ok(
+				"the exemption discriminates rather than excuses: the exempt smoke relocates HOME in the SAME env block that fences its data root, and moving that line out of the block would put it back in the constituency",
+				Object.entries(EXEMPT).every(([f, e]) => e.holds(read(path.join("scripts", f)), f)),
+			);
+			{
+				const IMPORT =
+					'import { assessLauncherCleanup, snapshotClaudeLauncher, verifyClaudeLauncher } from "./lib/claude-launcher-fence.ts";';
+				const CHILD = '\tconst launch = await bridge.call("entwurf_fresh_call", {});';
+				const PIN = "\tconst snap = snapshotClaudeLauncher({ env: process.env, fixtureRoot: root });";
+				const ORACLE = "\tverifyClaudeLauncher(snap);\n\tassessLauncherCleanup(snap);";
+				const file = "smoke-mux-lifecycle-live.ts";
+				ok(
+					"the lifecycle read is not satisfied by the STRINGS alone — a source carrying all four names with no ordering is refused",
+					!consumesFence(
+						[IMPORT, "// snapshotClaudeLauncher( verifyClaudeLauncher( assessLauncherCleanup("].join("\n"),
+						file,
+					),
+				);
+				ok(
+					"snapshot < verify < cleanup in the RIGHT order is still refused when the whole block sits after the first child — that shape pins the damage as the baseline, which is the exact way an intact-looking oracle would report a launcher that had already moved",
+					!consumesFence([IMPORT, CHILD, PIN, ORACLE].join("\n"), file) &&
+						consumesFence([IMPORT, PIN, CHILD, ORACLE].join("\n"), file),
+				);
+				ok(
+					"a smoke in the population whose first child this gate cannot locate is refused rather than waved through — a new rail must say where its children begin",
+					!consumesFence([IMPORT, PIN, CHILD, ORACLE].join("\n"), "smoke-brand-new-live.ts"),
+				);
+			}
+		}
+
 		ok(
 			"[QK:LAUNCHFENCE-LIFECYCLE-CELL-BRANCH] wiring: lifecycle's real-HOME cell env keeps its two truthful branches — the ACP-backed pi cell retains all four MEASURED canonical REAL_XDG_* assignments, and the direct Claude Code cell (the else branch) gets exact-parity restoreOriginalXdg instead",
 			/if \(backend === "pi"\) \{\s*serverEnv\.XDG_CONFIG_HOME = REAL_XDG_CONFIG_HOME;\s*serverEnv\.XDG_DATA_HOME = REAL_XDG_DATA_HOME;\s*serverEnv\.XDG_STATE_HOME = REAL_XDG_STATE_HOME;\s*serverEnv\.XDG_CACHE_HOME = REAL_XDG_CACHE_HOME;\s*\} else \{\s*restoreOriginalXdg\(serverEnv, ORIGINAL_XDG\);\s*\}/.test(