@junghanacs/entwurf 0.22.0 → 0.23.0

package/scripts/mutants/codex-native.json

@@ -46,7 +46,7 @@
 		{
 			"claim": "FRESHCALL-CODEX-ARGV",
 			"title": "Codex fresh launch drops the remote app-server attachment flag and opens an unrelated local session",
-			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": ["\t\t\t\t\"--remote\","],
 			"replace": ["\t\t\t\t\"--resume\","],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -156,7 +156,7 @@
 		},
 		{
 			"claim": "FRESHCALL-CODEX-MCP-ENV-ORDER",
-			"title": "fresh preflight accepts the managed Codex MCP env_vars in any order, as long as the set matches — a reordered vendor-visible env manifest passes as exact",
+			"title": "fresh preflight accepts the managed Codex MCP env_vars in any order, as long as the set matches \u2014 a reordered vendor-visible env manifest passes as exact",
 			"subject": "pi-extensions/lib/codex-fresh-preflight.ts",
 			"find": ["\t\tenvVars.some((name, index) => name !== CODEX_MCP_ENV_VARS[index])"],
 			"replace": [
@@ -171,8 +171,8 @@
 			"claim": "FRESHCALL-CODEX-HOOKS-SAFE",
 			"title": "fresh preflight stops checking the operator-owned hooks.json for unsafe ownership/permissions/symlinks, so a world-writable or symlinked hooks.json is treated as a safe published birth unit",
 			"subject": "pi-extensions/lib/codex-fresh-preflight.ts",
-			"find": ["\tif (!isSafeOwnedFile(paths.hooksFile, expectedUid)) return true;"],
-			"replace": ["\tif (false) return true;"],
+			"find": ["\tif (!isSafeOwnedFile(paths.hooksFile, expectedUid)) return null;"],
+			"replace": ["\tif (false) return null;"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:FRESHCALL-CODEX-HOOKS-SAFE]",
@@ -217,14 +217,14 @@
 		},
 		{
 			"claim": "FRESHCALL-CODEX-HOOK-KEYS",
-			"title": "fresh preflight stops requiring the exact birth handler key set, so an async or extra-key hook — one the installer would never publish and one that lets the turn proceed before the record exists — reads as an installed birth unit",
-			"subject": "pi-extensions/lib/codex-fresh-preflight.ts",
-			"find": ["\t\tif (Object.keys(hook).sort().join(\",\") !== \"command,timeout,type\") return true;"],
-			"replace": ["\t\tif (false) return true;"],
-			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
-			"timeoutSeconds": 120,
+			"title": "the declaration leaf stops NAMING the extra handler key, so an async or extra-key hook \u2014 still refused by the normalized digest \u2014 arrives as an anonymous mismatch instead of a diagnosis that quotes the key. This claim owns the diagnosis, never the acceptance",
+			"subject": "pi-extensions/lib/codex-declaration.js",
+			"find": ["\tif (handlerKeys.join(\",\") !== \"command,timeout,type\") {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-codex-birth-hook"],
+			"timeoutSeconds": 180,
 			"signature": "[QK:FRESHCALL-CODEX-HOOK-KEYS]",
-			"signatureSource": "test/codex-fresh-preflight.test.ts"
+			"signatureSource": "scripts/check-codex-birth-hook.ts"
 		},
 		{
 			"claim": "CODEX-TOML-STATE-BEFORE-CONFIG",
@@ -311,14 +311,14 @@
 			"signatureSource": "scripts/smoke-codex-config-state.sh"
 		},
 		{
-			"claim": "CODEX-BIRTH-FOREIGN-HOOKS-REFUSED",
-			"title": "the user-layer birth unit stops refusing a hooks.json no ownership state vouches for, so a declaration somebody else wrote is treated as one of ours",
+			"claim": "CODEX-BIRTH-JOINS-FOREIGN-FILE",
+			"title": "the birth unit refuses a hooks.json it did not write instead of joining it, so a host carrying a neighbouring integration can never be installed into",
 			"subject": "scripts/codex-birth-install.sh",
-			"find": ["  if [ \"$STATE_PRESENT\" = \"0\" ]; then"],
-			"replace": ["  if false; then  # mutant: treat a foreign hooks.json as ours"],
+			"find": ["    if (sel.code !== \"declaration-absent\") throw new Error(sel.code + \": \" + sel.detail);"],
+			"replace": ["    throw new Error(\"hooks.json already exists and no ownership state vouches for it\");"],
 			"gate": ["bash", "run.sh", "smoke-codex-birth"],
 			"timeoutSeconds": 120,
-			"signature": "[QK:CODEX-BIRTH-FOREIGN-HOOKS-REFUSED]",
+			"signature": "[QK:CODEX-BIRTH-JOINS-FOREIGN-FILE]",
 			"signatureSource": "scripts/smoke-codex-birth.sh"
 		},
 		{
@@ -380,10 +380,14 @@
 		},
 		{
 			"claim": "FRESHCALL-CODEX-PREMUTATION-MCP",
-			"title": "the MCP surface stops asking the Codex TARGET capability question before placement, so a host with no birth unit, no vendor trust receipt, no MCP hand or no app-server reaches tmux first — a window opens, and the operator is told about the missing capability only after something visible already exists",
+			"title": "the MCP public surface relabels a Codex request as pi at the shared dispatcher seam, so the one central capability preflight is bypassed and placement runs first",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
-			"find": ["\t\t\tconst targetMissing = backend === \"codex\" ? await codexFreshPreflight(process.env) : null;"],
-			"replace": ["\t\t\tconst targetMissing = null;"],
+			"find": [
+				"\t\t\tconst dispatched = await dispatchFreshCall({\n\t\t\t\tbackend,\n\t\t\t\tmodel,\n\t\t\t\ttask,\n\t\t\t\tcwd,\n\t\t\t\tplacement,\n\t\t\t\tcallerGardenId,\n\t\t\t\tcallerNativeSessionId,\n\t\t\t\tcallerCwd,\n\t\t\t});"
+			],
+			"replace": [
+				"\t\t\tconst dispatched = await dispatchFreshCall({\n\t\t\t\tbackend: \"pi\",\n\t\t\t\tmodel,\n\t\t\t\ttask,\n\t\t\t\tcwd,\n\t\t\t\tplacement,\n\t\t\t\tcallerGardenId,\n\t\t\t\tcallerNativeSessionId,\n\t\t\t\tcallerCwd,\n\t\t\t});"
+			],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:FRESHCALL-CODEX-PREMUTATION-MCP]",
@@ -391,10 +395,10 @@
 		},
 		{
 			"claim": "FRESHCALL-CODEX-PREMUTATION-PI",
-			"title": "the native pi public surface stops running the Codex capability preflight, so the same window opens from the other public door",
+			"title": "the native pi public surface relabels a Codex request as pi at the shared dispatcher seam, bypassing the same central preflight from the other public door",
 			"subject": "pi-extensions/entwurf-control.ts",
-			"find": ["\t\t\t\t\tparams.backend === \"codex\""],
-			"replace": ["\t\t\t\t\tfalse"],
+			"find": ["\t\t\t\t\tbackend: params.backend,"],
+			"replace": ["\t\t\t\t\tbackend: \"pi\","],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:FRESHCALL-CODEX-PREMUTATION-PI]",
@@ -445,9 +449,7 @@
 			"claim": "FRESHCALL-CODEX-TRUST-RECEIPT",
 			"title": "fresh preflight opens a Codex sibling whose birth hook the vendor never agreed to run",
 			"subject": "pi-extensions/lib/codex-fresh-preflight.ts",
-			"find": [
-				"\tif (config === null || trustReceiptMissing(config, paths.hooksFile)) return \"codex-birth-trust-missing\";"
-			],
+			"find": ["\tif (config === null || trustReceiptMissing(config, key)) return \"codex-birth-trust-missing\";"],
 			"replace": ["\tif (config === null) return \"codex-birth-trust-missing\";"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 180,
@@ -458,8 +460,10 @@
 			"claim": "FRESHCALL-CODEX-STATE-DIGEST",
 			"title": "fresh preflight accepts a birth closure whose bytes no longer match the digests its own ownership state recorded",
 			"subject": "pi-extensions/lib/codex-fresh-preflight.ts",
-			"find": ["\treturn closureDriftedFromState(paths, expectedUid);"],
-			"replace": ["\treturn false;  // mutant: existence is enough"],
+			"find": [
+				"\t\tif (typeof member.sha256 !== \"string\" || digest(path.join(paths.helperDir, rel)) !== member.sha256) return null;"
+			],
+			"replace": ["\t\tif (typeof member.sha256 !== \"string\") return null;  // mutant: existence is enough"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:FRESHCALL-CODEX-STATE-DIGEST]",
@@ -518,7 +522,7 @@
 			"title": "fresh preflight compares only the digests a state happens to name, so a short inventory hides an unchecked closure member",
 			"subject": "pi-extensions/lib/codex-fresh-preflight.ts",
 			"find": [
-				"\tif (named.length !== expected.length) return true;\n\tif (expected.some((name) => !named.includes(name))) return true;\n\tif (named.some((name, index) => named.indexOf(name) !== index)) return true;"
+				"\tif (named.length !== expected.length) return null;\n\tif (expected.some((name) => !named.includes(name))) return null;\n\tif (named.some((name, index) => named.indexOf(name) !== index)) return null;"
 			],
 			"replace": ["\t// mutant: judge only the members a state happens to name"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -554,7 +558,7 @@
 			"claim": "FRESHCALL-CODEX-STATE-PARENT-AUTHORITY",
 			"title": "fresh preflight trusts a digest inventory sitting in a directory anyone on the host can rewrite",
 			"subject": "pi-extensions/lib/codex-fresh-preflight.ts",
-			"find": ["\tif (!isSafeOwnedDir(path.dirname(paths.stateFile), expectedUid)) return true;"],
+			"find": ["\tif (!isSafeOwnedDir(path.dirname(paths.stateFile), expectedUid)) return null;"],
 			"replace": ["\t// mutant: the directory holding the receipt is nobody's business"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 180,
@@ -833,6 +837,168 @@
 			"timeoutSeconds": 180,
 			"signature": "[QK:CODEX-LIVE-RECOVERY-SOURCE-ONLY]",
 			"signatureSource": "test/codex-fresh-live-protocol.test.ts"
+		},
+		{
+			"claim": "CODEX-DECL-CANONICAL-KEY-ORDER",
+			"title": "the declaration digest is taken over unsorted keys, so a neighbour re-serializing the document reads as an edited entwurf declaration",
+			"subject": "pi-extensions/lib/codex-declaration.js",
+			"find": ["\tconst keys = Object.keys(value).sort();"],
+			"replace": ["\tconst keys = Object.keys(value);"],
+			"gate": ["bash", "run.sh", "check-codex-birth-hook"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CODEX-DECL-CANONICAL-KEY-ORDER]",
+			"signatureSource": "scripts/check-codex-birth-hook.ts"
+		},
+		{
+			"claim": "CODEX-DECL-SELECT-BY-COMMAND",
+			"title": "entwurf's declaration is selected by POSITION instead of by its launcher command, so a neighbour at index 0 is certified as ours",
+			"subject": "pi-extensions/lib/codex-declaration.js",
+			"find": [
+				"\t\t\tif (handler !== null && typeof handler === \"object\" && !Array.isArray(handler) && handler.command === want) {"
+			],
+			"replace": [
+				"\t\t\tif (handler !== null && typeof handler === \"object\" && !Array.isArray(handler) && h === 0) {"
+			],
+			"gate": ["bash", "run.sh", "check-codex-birth-hook"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CODEX-DECL-SELECT-BY-COMMAND]",
+			"signatureSource": "scripts/check-codex-birth-hook.ts"
+		},
+		{
+			"claim": "CODEX-DECL-SPLICE-KEEPS-FOREIGN-BYTES",
+			"title": "a certified splice returns a RE-SERIALIZED document instead of the spliced text, rewriting every byte a neighbouring integration owns",
+			"subject": "pi-extensions/lib/codex-declaration.js",
+			"find": ["\treturn spliced;"],
+			"replace": ["\treturn JSON.stringify(reparsed, null, 2);"],
+			"gate": ["bash", "run.sh", "check-codex-birth-hook"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CODEX-DECL-SPLICE-KEEPS-FOREIGN-BYTES]",
+			"signatureSource": "scripts/check-codex-birth-hook.ts"
+		},
+		{
+			"claim": "CODEX-DECL-SPLICE-CERTIFIED",
+			"title": "the span splice is written out on the span reader's word alone, with no re-parse proving it landed where the caller intended",
+			"subject": "pi-extensions/lib/codex-declaration.js",
+			"find": ["\tif (canonicalJson(reparsed) !== canonicalJson(expected)) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-codex-birth-hook"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CODEX-DECL-SPLICE-CERTIFIED]",
+			"signatureSource": "scripts/check-codex-birth-hook.ts"
+		},
+		{
+			"claim": "CODEX-DECLARATION-DUPLICATED",
+			"title": "a duplicated entwurf declaration is first-match accepted, so the vendor runs the birth hook twice and only one position carries the receipt",
+			"subject": "pi-extensions/lib/codex-declaration.js",
+			"find": ["\tif (mine.length > 1) {"],
+			"replace": ["\tif (mine.length > 2) {"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CODEX-DECLARATION-DUPLICATED]",
+			"signatureSource": "test/codex-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "CODEX-DECLARATION-TRUST-INDEX",
+			"title": "fresh preflight reads the vendor trust receipt at the constant :0:0, so a neighbour's approval at index 0 admits a birth hook the vendor never agreed to run",
+			"subject": "pi-extensions/lib/codex-fresh-preflight.ts",
+			"find": ["\tconst key = trustReceiptKey(paths.hooksFile, declaration.groupIndex, declaration.handlerIndex);"],
+			"replace": ["\tconst key = trustReceiptKey(paths.hooksFile, 0, 0);"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CODEX-DECLARATION-TRUST-INDEX]",
+			"signatureSource": "test/codex-fresh-preflight.test.ts"
+		},
+		{
+			"claim": "CODEX-BIRTH-TRUST-INDEX-MEASURED",
+			"title": "the doctor reads the vendor trust receipt at the constant :0:0, reporting a neighbour's approval as entwurf's own",
+			"subject": "scripts/codex-birth-doctor.sh",
+			"find": ["  TRUST_KEY=\"$HOOKS_FILE:session_start:$DECL_GROUP_INDEX:$DECL_HANDLER_INDEX\""],
+			"replace": ["  TRUST_KEY=\"$HOOKS_FILE:session_start:0:0\""],
+			"gate": ["bash", "run.sh", "smoke-codex-birth"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CODEX-BIRTH-TRUST-INDEX-MEASURED]",
+			"signatureSource": "scripts/smoke-codex-birth.sh"
+		},
+		{
+			"claim": "CODEX-BIRTH-SHARED-FILE-OWNERSHIP",
+			"title": "the shared ownership predicate stops seeing a group/world-writable file, so all four surfaces write into and certify bytes somebody else can rewrite",
+			"subject": "pi-extensions/lib/codex-declaration.js",
+			"find": ["\tif ((stat.mode & 0o022) !== 0) return \"writable-by-others\";"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "smoke-codex-birth"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CODEX-BIRTH-SHARED-FILE-OWNERSHIP]",
+			"signatureSource": "scripts/smoke-codex-birth.sh"
+		},
+		{
+			"claim": "CODEX-BIRTH-DOCTOR-SHARED-OWNERSHIP",
+			"title": "the doctor stops asking who owns the shared file and goes straight to the digest, so it reports green on a host every launch refuses",
+			"subject": "scripts/codex-birth-doctor.sh",
+			"find": ["    if (owned !== \"ok\") {"],
+			"replace": ["    if (false) {"],
+			"gate": ["bash", "run.sh", "smoke-codex-birth"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CODEX-BIRTH-DOCTOR-SHARED-OWNERSHIP]",
+			"signatureSource": "scripts/smoke-codex-birth.sh"
+		},
+		{
+			"claim": "CODEX-BIRTH-INVERSE-SHARED-OWNERSHIP",
+			"title": "the inverse stops asking and rewrites a shared file it cannot bind, instead of leaving it as found and counting the drift",
+			"subject": "scripts/codex-birth-uninstall.sh",
+			"find": ["  if [ \"$owned\" != \"ok\" ]; then"],
+			"replace": ["  if false; then"],
+			"gate": ["bash", "run.sh", "smoke-codex-birth"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CODEX-BIRTH-INVERSE-SHARED-OWNERSHIP]",
+			"signatureSource": "scripts/smoke-codex-birth.sh"
+		},
+		{
+			"claim": "CODEX-BIRTH-INVERSE-KEEPS-PRE-EXISTING-FILE",
+			"title": "the FILE verdict goes back to asking only whether our group was the last declaration, so a hooks.json that existed before this unit is deleted with its owners top-level bytes",
+			"subject": "scripts/codex-birth-uninstall.sh",
+			"find": [
+				"      if (createdByUs === \"yes\" && soleDeclaration && topLevel === \"description,hooks\" && ourDescription) {"
+			],
+			"replace": ["      if (soleDeclaration) {"],
+			"gate": ["bash", "run.sh", "smoke-codex-birth"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CODEX-BIRTH-INVERSE-KEEPS-PRE-EXISTING-FILE]",
+			"signatureSource": "scripts/smoke-codex-birth.sh"
+		},
+		{
+			"claim": "CODEX-BIRTH-DOCTOR-ORPHAN-RED",
+			"title": "the doctor stops looking for our own bytes when the receipt is gone, so a half-removed unit reads as a clean host and invites a reinstall over bytes the inverse will refuse",
+			"subject": "scripts/codex-birth-doctor.sh",
+			"find": ["  if [ \"$ORPHAN_DECLARATION\" = \"1\" ] || [ -e \"$HELPER_DIR\" ]; then"],
+			"replace": ["  if false; then"],
+			"gate": ["bash", "run.sh", "smoke-codex-birth"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CODEX-BIRTH-DOCTOR-ORPHAN-RED]",
+			"signatureSource": "scripts/smoke-codex-birth.sh"
+		},
+		{
+			"claim": "CODEX-BIRTH-INVERSE-KEEPS-FOREIGN",
+			"title": "the text splice takes a fixed group index instead of the one the selector measured, so the inverse reaches for a neighbours declaration and the post-condition is the only thing standing between that and a written file",
+			"subject": "scripts/codex-birth-uninstall.sh",
+			"find": ["      let spliced = m.certifySplice(m.removeSessionStartGroup(text, sel.groupIndex), want);"],
+			"replace": ["      let spliced = m.certifySplice(m.removeSessionStartGroup(text, 0), want);"],
+			"gate": ["bash", "run.sh", "smoke-codex-birth"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CODEX-BIRTH-INVERSE-KEEPS-FOREIGN]",
+			"signatureSource": "scripts/smoke-codex-birth.sh"
+		},
+		{
+			"claim": "CODEX-BIRTH-INVERSE-SOLE-OWNER",
+			"title": "the FILE arm drops the target from its own removal, so a hooks.json this unit created and was the sole declaration in survives an uninstall that reports it gone",
+			"subject": "scripts/codex-birth-uninstall.sh",
+			"find": [
+				"    FILE) rm -f -- \"$tmp\" \"$target\"; note \"removed $target (entwurf was its only declaration)\" ;;"
+			],
+			"replace": ["    FILE) rm -f -- \"$tmp\"; note \"removed $target (entwurf was its only declaration)\" ;;"],
+			"gate": ["bash", "run.sh", "smoke-codex-birth"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:CODEX-BIRTH-INVERSE-SOLE-OWNER]",
+			"signatureSource": "scripts/smoke-codex-birth.sh"
 		}
 	]
 }

package/scripts/mutants/control-socket-disconnect.json

@@ -0,0 +1,57 @@
+{
+	"schemaVersion": 1,
+	"lane": "control-socket-disconnect",
+	"mutants": [
+		{
+			"claim": "CONTROL-SOCKET-NO-UNCAUGHT",
+			"title": "the accepted connection carries no disconnect policy, so a peer that hangs up mid-exchange reaches the process as an uncaught exception and kills the resident session",
+			"subject": "pi-extensions/lib/entwurf-control-rpc.ts",
+			"find": [
+				"\tsocket.on(\"error\", (error: NodeJS.ErrnoException) => {",
+				"\t\tif (isPeerDisconnect(error)) return;",
+				"\t\tdiagnose(`[entwurf-control] control socket error (${error.code ?? \"no code\"}): ${error.message}`);",
+				"\t});"
+			],
+			"replace": ["\t// the accepted connection no longer carries a disconnect policy"],
+			"gate": ["bash", "run.sh", "check-entwurf-control-rpc"],
+			"timeoutSeconds": 90,
+			"signature": "[QK:CONTROL-SOCKET-NO-UNCAUGHT]",
+			"signatureSource": "scripts/check-entwurf-control-rpc.ts"
+		},
+		{
+			"claim": "CONTROL-SOCKET-ABSORBS-PEER-DISCONNECT",
+			"title": "a peer that went away is diagnosed instead of absorbed, so ordinary client timeouts spray the resident session with stderr about someone else state",
+			"subject": "pi-extensions/lib/entwurf-control-rpc.ts",
+			"find": ["\t\tif (isPeerDisconnect(error)) return;"],
+			"replace": ["\t\t// a vanished peer is no longer absorbed"],
+			"gate": ["bash", "run.sh", "check-entwurf-control-rpc"],
+			"timeoutSeconds": 90,
+			"signature": "[QK:CONTROL-SOCKET-ABSORBS-PEER-DISCONNECT]",
+			"signatureSource": "scripts/check-entwurf-control-rpc.ts"
+		},
+		{
+			"claim": "CONTROL-SOCKET-DIAGNOSES-UNEXPECTED",
+			"title": "an error that is NOT a peer disconnect is swallowed silently, hiding exactly the class this listener was never meant to absorb",
+			"subject": "pi-extensions/lib/entwurf-control-rpc.ts",
+			"find": [
+				"\t\tdiagnose(`[entwurf-control] control socket error (${error.code ?? \"no code\"}): ${error.message}`);"
+			],
+			"replace": ["\t\treturn;"],
+			"gate": ["bash", "run.sh", "check-entwurf-control-rpc"],
+			"timeoutSeconds": 90,
+			"signature": "[QK:CONTROL-SOCKET-DIAGNOSES-UNEXPECTED]",
+			"signatureSource": "scripts/check-entwurf-control-rpc.ts"
+		},
+		{
+			"claim": "CONTROL-SOCKET-POLICY-FIRST",
+			"title": "the policy is attached after setEncoding, leaving a window in which the first write on a freshly accepted connection can still kill the session",
+			"subject": "pi-extensions/entwurf-control.ts",
+			"find": ["\t\tattachAcceptedSocketDisconnectPolicy(socket);", "\t\tsocket.setEncoding(\"utf8\");"],
+			"replace": ["\t\tsocket.setEncoding(\"utf8\");", "\t\tattachAcceptedSocketDisconnectPolicy(socket);"],
+			"gate": ["bash", "run.sh", "check-entwurf-control-rpc"],
+			"timeoutSeconds": 90,
+			"signature": "[QK:CONTROL-SOCKET-POLICY-FIRST]",
+			"signatureSource": "scripts/check-entwurf-control-rpc.ts"
+		}
+	]
+}

package/scripts/mutants/fresh-call-dispatch.json

@@ -0,0 +1,154 @@
+{
+	"schemaVersion": 1,
+	"lane": "fresh-call-dispatch",
+	"mutants": [
+		{
+			"claim": "FCD-RAIL-IS-CAPABILITY",
+			"title": "the herdr marker is read loosely, so a process carrying HERDR_ENV=0 is treated as being inside herdr",
+			"subject": "pi-extensions/lib/fresh-call-dispatch.ts",
+			"find": ["\treturn env.HERDR_ENV === \"1\" ? \"herdr\" : \"tmux\";"],
+			"replace": ["\treturn env.HERDR_ENV !== undefined ? \"herdr\" : \"tmux\";"],
+			"gate": ["bash", "run.sh", "check-fresh-call-dispatch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FCD-RAIL-IS-CAPABILITY]",
+			"signatureSource": "scripts/check-fresh-call-dispatch.ts"
+		},
+		{
+			"claim": "FCD-NO-RAIL-PARAMETER",
+			"title": "the request gains a caller-chosen rail, so someone can ask for tmux placement from inside herdr and fail after a mutation",
+			"subject": "pi-extensions/lib/fresh-call-dispatch.ts",
+			"find": ["export interface FreshCallRequest {"],
+			"replace": ["export interface FreshCallRequest {\n\treadonly rail?: FreshCallRail;"],
+			"gate": ["bash", "run.sh", "check-fresh-call-dispatch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FCD-NO-RAIL-PARAMETER]",
+			"signatureSource": "scripts/check-fresh-call-dispatch.ts"
+		},
+		{
+			"claim": "FCD-NO-FALLBACK",
+			"title": "an incomplete herdr context falls back to tmux, opening a window the operator cannot see from where they are standing",
+			"subject": "pi-extensions/lib/fresh-call-dispatch.ts",
+			"find": ["\t\t\treturn { rail: \"herdr\", result: { ok: false, reason: context.reason } };"],
+			"replace": ["\t\t\treturn { rail: \"tmux\", result: freshCall(request as never, env, nonce) };"],
+			"gate": ["bash", "run.sh", "check-fresh-call-dispatch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FCD-NO-FALLBACK]",
+			"signatureSource": "scripts/check-fresh-call-dispatch.ts"
+		},
+		{
+			"claim": "FCD-HERDR-BACKEND-FIRST",
+			"title": "the herdr branch runs the Codex preflight before refusing a non-pilot backend, answering an irrelevant question first",
+			"subject": "pi-extensions/lib/fresh-call-dispatch.ts",
+			"find": [
+				"\t\tconst run: HerdrRun = createHerdrRunner(context.context.bin, env, spawn ?? (spawnChildProcess as SpawnFn));"
+			],
+			"replace": [
+				"\t\tif (request.backend === \"codex\") await codexFreshPreflight(env);\n\t\tconst run: HerdrRun = createHerdrRunner(context.context.bin, env, spawn ?? (spawnChildProcess as SpawnFn));"
+			],
+			"gate": ["bash", "run.sh", "check-fresh-call-dispatch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FCD-HERDR-BACKEND-FIRST]",
+			"signatureSource": "scripts/check-fresh-call-dispatch.ts"
+		},
+		{
+			"claim": "FCD-CODEX-PREFLIGHT-TMUX",
+			"title": "the Codex preflight moves after the composition, so a window opens before the capability question is asked",
+			"subject": "pi-extensions/lib/fresh-call-dispatch.ts",
+			"find": [
+				"\tconst targetMissing = request.backend === \"codex\" ? await codexFreshPreflight(env) : null;\n\tconst callerMissing =\n\t\ttargetMissing === null && request.callerNativeSessionId !== undefined && request.placement === undefined\n\t\t\t? codexCallerFreshPreflight(env)\n\t\t\t: null;\n\tconst missing = targetMissing ?? callerMissing;\n\tif (missing) return { rail: \"tmux\", result: { ok: false, reason: missing } };"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-fresh-call-dispatch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FCD-CODEX-PREFLIGHT-TMUX]",
+			"signatureSource": "scripts/check-fresh-call-dispatch.ts"
+		},
+		{
+			"claim": "FCD-ONE-NONCE",
+			"title": "the rail mints its own second nonce, so the sibling calls back with a tag the caller never recorded",
+			"subject": "pi-extensions/lib/fresh-call-dispatch.ts",
+			"find": ["\t\treturn { rail: \"herdr\", result: await herdrFreshCall(request, run, env, nonce) };"],
+			"replace": ["\t\treturn { rail: \"herdr\", result: await herdrFreshCall(request, run, env, mintNonce()) };"],
+			"gate": ["bash", "run.sh", "check-fresh-call-dispatch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FCD-ONE-NONCE]",
+			"signatureSource": "scripts/check-fresh-call-dispatch.ts"
+		},
+		{
+			"claim": "FCD-SURFACE-PARITY",
+			"title": "the MCP surface goes back to calling a rail directly, so the two public surfaces can drift on rail choice",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": [
+				"\t\t\tconst dispatched = await dispatchFreshCall({\n\t\t\t\tbackend,\n\t\t\t\tmodel,\n\t\t\t\ttask,\n\t\t\t\tcwd,\n\t\t\t\tplacement,\n\t\t\t\tcallerGardenId,\n\t\t\t\tcallerNativeSessionId,\n\t\t\t\tcallerCwd,\n\t\t\t});"
+			],
+			"replace": [
+				"\t\t\tconst dispatched = { rail: \"tmux\" as const, result: { ok: false, reason: \"caller-identity-unavailable\" as const } };\n\t\t\tvoid selectFreshCallRail;"
+			],
+			"gate": ["bash", "run.sh", "check-fresh-call-dispatch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FCD-SURFACE-PARITY]",
+			"signatureSource": "scripts/check-fresh-call-dispatch.ts"
+		},
+		{
+			"claim": "FCD-PI-DYNAMIC-IMPORT",
+			"title": "pi reaches the composition root by a literal path again, which is how the lazy import fence erodes",
+			"subject": "pi-extensions/entwurf-control.ts",
+			"find": ["const FRESH_CALL_DISPATCH_MODULE = \"./lib/fresh-call-dispatch.ts\";"],
+			"replace": ["const FRESH_CALL_DISPATCH_MODULE = \"./lib/fresh-call-dispatch-renamed.ts\";"],
+			"gate": ["bash", "run.sh", "check-fresh-call-dispatch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FCD-PI-DYNAMIC-IMPORT]",
+			"signatureSource": "scripts/check-fresh-call-dispatch.ts"
+		},
+		{
+			"claim": "FCD-RENDER-PER-RAIL",
+			"title": "both rails render through the tmux renderer, so a herdr caller is told their sibling is in a tmux window",
+			"subject": "pi-extensions/lib/fresh-call-dispatch.ts",
+			"find": [
+				"\treturn dispatched.rail === \"herdr\" ? renderHerdrFreshCall(dispatched.result) : renderFreshCall(dispatched.result);"
+			],
+			"replace": ["\treturn renderFreshCall(dispatched.result as never);"],
+			"gate": ["bash", "run.sh", "check-fresh-call-dispatch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FCD-RENDER-PER-RAIL]",
+			"signatureSource": "scripts/check-fresh-call-dispatch.ts"
+		},
+		{
+			"claim": "FCD-HERDR-VIEW-NOT-ADDRESS",
+			"title": "the herdr receipt stops saying its coordinates are a view, which is the first step to someone dispatching at a pane id",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": [
+				"`  pane:     ${r.herdrPaneId} terminal ${r.herdrTerminalId} — the tab's initial pane; herdr VIEW coordinates, not an address\\n` +"
+			],
+			"replace": ["`  pane:     ${r.herdrPaneId} terminal ${r.herdrTerminalId}\\n` +"],
+			"gate": ["bash", "run.sh", "check-fresh-call-dispatch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FCD-HERDR-VIEW-NOT-ADDRESS]",
+			"signatureSource": "scripts/check-fresh-call-dispatch.ts"
+		},
+		{
+			"claim": "FCD-RECOVERY-VISIBLE",
+			"title": "an unreclaimed orphan renders as if it had been closed, so nobody goes to look at the pane still sitting there",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": [
+				"\t\t\treturn `  recovery: orphan-unreclaimed:${recovery.reason} (${recovery.paneId}) — this pane was NOT closed, on purpose\\n`;"
+			],
+			"replace": ["\t\t\treturn `  recovery: closed ${recovery.paneId}\\n`;"],
+			"gate": ["bash", "run.sh", "check-fresh-call-dispatch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FCD-RECOVERY-VISIBLE]",
+			"signatureSource": "scripts/check-fresh-call-dispatch.ts"
+		},
+		{
+			"claim": "FCD-NO-SYNC-SPAWN",
+			"title": "the composition root regains synchronous child authority, which is how a blocking runner gets wired back in without anyone reading the runner",
+			"subject": "pi-extensions/lib/fresh-call-dispatch.ts",
+			"find": ["import { spawn as spawnChildProcess } from \"node:child_process\";"],
+			"replace": ["import { spawn as spawnChildProcess, spawnSync } from \"node:child_process\";"],
+			"gate": ["bash", "run.sh", "check-fresh-call-dispatch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FCD-NO-SYNC-SPAWN]",
+			"signatureSource": "scripts/check-fresh-call-dispatch.ts"
+		}
+	]
+}