@junghanacs/entwurf 0.22.0 → 0.23.1

package/scripts/mutants/herdr-fresh-call.json

@@ -0,0 +1,448 @@
+{
+	"schemaVersion": 1,
+	"lane": "herdr-fresh-call",
+	"mutants": [
+		{
+			"claim": "HFC-RAIL-IMPORT-FENCE",
+			"title": "the herdr rail takes a mux import again — one is all it takes to make either rail undeletable",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["import { createHash } from \"node:crypto\";"],
+			"replace": ["import { createHash } from \"node:crypto\";\nimport { runTmux } from \"./mux-placement.ts\";"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-RAIL-IMPORT-FENCE]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-PILOT-CLOSED",
+			"title": "a backend nobody measured on herdr is admitted to the pilot, so a caller gets a pane running something this rail never proved it can open",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["export const HERDR_FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\"] as const;"],
+			"replace": ["export const HERDR_FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"codex\"] as const;"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-PILOT-CLOSED]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-TMUX-PLACEMENT-REFUSED",
+			"title": "a tmux seat inside herdr is silently ignored instead of refused, so the sibling opens somewhere the caller did not ask for and the call still looks successful",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\treturn placement === undefined ? null : \"herdr-placement-tmux-rejected\";"],
+			"replace": [
+				"\treturn placement === undefined || placement.tmuxSession === undefined || placement.tmuxSession.length === 0\n\t\t? null\n\t\t: \"herdr-placement-tmux-rejected\";"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-TMUX-PLACEMENT-REFUSED]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-ENCODE-ROUNDTRIP",
+			"title": "the encoder normalises the caller's task bytes before quoting them, so the sibling is born with a task nobody wrote",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\tconst literal = escapeRemainingControlChars(JSON.stringify(task));"],
+			"replace": ["\tconst literal = escapeRemainingControlChars(JSON.stringify(task.replace(/\\t/g, \" \")));"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-ENCODE-ROUNDTRIP]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-ENCODE-NO-CONTROL",
+			"title": "the C1/DEL escape pass is dropped and only JSON.stringify's C0 handling remains — herdr refuses the argv after the pane already exists",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\tconst literal = escapeRemainingControlChars(JSON.stringify(task));"],
+			"replace": ["\tconst literal = JSON.stringify(task);"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-ENCODE-NO-CONTROL]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-ENCODE-MAX-TASK",
+			"title": "the encoded literal is truncated past a length nobody documented, so a long task silently loses its tail",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\tconst argv = `${folded} ${HERDR_TASK_LITERAL_INSTRUCTION}${literal}`;"],
+			"replace": ["\tconst argv = `${folded} ${HERDR_TASK_LITERAL_INSTRUCTION}${literal.slice(0, 4096)}`;"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-ENCODE-MAX-TASK]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-FRAMING-IS-PROSE",
+			"title": "the framing is quoted back into a JSON literal behind a decode instruction — the exact shape a safety-tuned sibling refused, restored",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\tconst folded = framing.filter((line) => line.length > 0).join(\" \");"],
+			"replace": [
+				"\tconst folded = `Decode the following JSON string literal and follow the decoded instructions exactly as if they were this message: ${JSON.stringify(framing.join(\"\\n\"))}`;"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-FRAMING-IS-PROSE]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-FRAMING-CONTROL-REFUSED",
+			"title": "a control character in the rail's own framing is escaped into the prose instead of refused, so a sibling reads an escape sequence as text",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\tconst folded = framing.filter((line) => line.length > 0).join(\" \");"],
+			"replace": [
+				"\tconst folded = escapeRemainingControlChars(framing.filter((line) => line.length > 0).join(\" \"));"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-FRAMING-CONTROL-REFUSED]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-PREMUTATION-ONLY",
+			"title": "a pre-mutation input refusal is dropped, so a call that should have refused instead splits a pane in the operator's workspace first",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": [
+				"\t\tconst badCwd = classifyHerdrCwd(cwd);\n\t\tif (badCwd !== null) return { ok: false, reason: badCwd };"
+			],
+			"replace": ["\t\tvoid classifyHerdrCwd(cwd);"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-PREMUTATION-ONLY]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-CALLER-WORKSPACE",
+			"title": "the caller's workspace is dropped and herdr defaults --workspace to whatever is focused, so the sibling opens in a workspace nobody asked for under a green receipt",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": [
+				"\tif (callerPane.workspaceId === undefined) return { ok: false, reason: \"herdr-caller-workspace-missing\" };\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-CALLER-WORKSPACE]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-CALLER-PANE-BOUND",
+			"title": "the caller pane-get answer is no longer bound to the pane we asked about, so a readable reply describing ANOTHER pane places the sibling in a workspace nobody named, under a green receipt",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": [
+				"\tif (callerPane.paneId !== context.context.callerPaneId) return { ok: false, reason: \"herdr-caller-pane-drift\" };\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-CALLER-PANE-BOUND]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-TAB-ARGV",
+			"title": "the new tab steals focus from the operator who was typing when the sibling opened",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\t\"--no-focus\",\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-TAB-ARGV]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-START-ARGV",
+			"title": "the backend argv loses its `--` separator, so herdr reads the sibling's prompt as its own flags",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\tString(HERDR_START_READY_MS),\n\t\t\"--\",\n\t\t...params.backendArgs,"],
+			"replace": ["\t\tString(HERDR_START_READY_MS),\n\t\t...params.backendArgs,"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-START-ARGV]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-START-READY-BOUND",
+			"title": "the start stops telling herdr how long to wait, so herdr falls back to its own 30s default and a cold runtime start comes back as a named timeout over a pane holding a healthy sibling",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\t\"--timeout\",\n\t\tString(HERDR_START_READY_MS),\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-START-READY-BOUND]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-AGENT-NAME-OPAQUE",
+			"title": "the raw nonce becomes the herdr agent name, which herdr's own name rule refuses — and a correlation tag becomes a visible label",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\treturn `entwurf-${createHash(\"sha256\").update(nonce).digest(\"hex\").slice(0, 20)}`;"],
+			"replace": ["\treturn nonce;"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-AGENT-NAME-OPAQUE]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-PARSE-STRICT",
+			"title": "a pane reply missing its terminal id is half-believed, so the launch carries a coordinate it never received",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\tif (typeof terminalId !== \"string\" || terminalId.length === 0) return null;"],
+			"replace": ["\tif (typeof terminalId !== \"string\") return null;"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-PARSE-STRICT]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-TAB-HALVES-AGREE",
+			"title": "the tab-create reply's two halves are bound only when they happen to agree in one field, so a contradictory reply is assembled into a green launch whose receipt names a tab the agent did not start in",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": [
+				"\tif (rootPane.tabId !== tabId) return null;\n\tif (rootPane.workspaceId !== workspaceId) return null;"
+			],
+			"replace": ["\tif (rootPane.tabId !== undefined && rootPane.tabId !== tabId) return null;"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-TAB-HALVES-AGREE]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-PANE-ID-OPAQUE",
+			"title": "the pane id is normalised on the way in, so herdr's own `pA` coordinate stops matching the one herdr will answer about",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\tpaneId,\n\t\tterminalId,"],
+			"replace": ["\t\tpaneId: paneId.toLowerCase(),\n\t\tterminalId,"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-PANE-ID-OPAQUE]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-RECEIPT-NO-ADDRESS",
+			"title": "the launch receipt starts carrying an identity field, which is the first step in promoting a herdr view to a garden address",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\t\therdrPaneId: started.pane.paneId,"],
+			"replace": ["\t\t\tnativeSessionId: started.pane.terminalId,\n\t\t\therdrPaneId: started.pane.paneId,"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-RECEIPT-NO-ADDRESS]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-CLOSE-WITHIN-GENERATION",
+			"title": "the close drops its terminal-id proof and trusts a bare pane id — after a herdr restart that id belongs to someone else's view",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": [
+				"\tif (current.terminalId !== created.terminalId) return { close: false, reason: \"terminal-id-mismatch\" };"
+			],
+			"replace": ["\tvoid created.terminalId;"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-CLOSE-WITHIN-GENERATION]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-ORPHAN-NAMED",
+			"title": "two different reclaim failures collapse into one name, so the operator cannot tell a wrong pane from an unreadable one",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\tif (current.paneId !== created.paneId) return { close: false, reason: \"pane-id-mismatch\" };"],
+			"replace": ["\tif (current.paneId !== created.paneId) return { close: false, reason: \"pane-get-failed\" };"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-ORPHAN-NAMED]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-INPUT-PARITY",
+			"title": "the task cap is dropped on the herdr rail, so the same oversized task is refused on one rail and launched on the other",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
+			"find": ["\tif (task.length > TASK_MAX_CHARS) return { ok: false, reason: \"task-too-long\" };"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-INPUT-PARITY]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-CWD-EMPTY-IS-OMITTED",
+			"title": "an empty cwd is read as a path again, turning the public verb's documented no-op into an invalid-directory refusal",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
+			"find": ["\tconst cwd = params.cwd === undefined || params.cwd === \"\" ? undefined : params.cwd;"],
+			"replace": ["\tconst cwd = params.cwd;"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-CWD-EMPTY-IS-OMITTED]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-TAB-OCCUPIED",
+			"title": "a brand-new tab whose initial pane already holds an agent is started into anyway, landing beside somebody else's sibling",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\tif (pane.hasAgentSession) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-TAB-OCCUPIED]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-CREATE-OUTCOME-HONEST",
+			"title": "a tab create cut off by OUR OWN timeout is reported as `nothing was created`, sending the operator away from a tab that may be sitting on their screen",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\t\trecovery: code === undefined ? indeterminate() : nothingCreated(),"],
+			"replace": ["\t\t\trecovery: nothingCreated(),"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-CREATE-OUTCOME-HONEST]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-START-PANE-BINDING",
+			"title": "a start reporting another pane, terminal or TAB is accepted as success, so the receipt points at a coordinate that never held the sibling",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": [
+				"\tif (\n\t\tstarted.pane.paneId !== pane.paneId ||\n\t\tstarted.pane.terminalId !== pane.terminalId ||\n\t\t(started.pane.tabId !== undefined && started.pane.tabId !== tab.tabId)\n\t) {"
+			],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-START-PANE-BINDING]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-WITNESS-SETTLED-BY-READ",
+			"title": "the settle window stops believing a session that arrives on a later read, so every launch whose start reply was early reports an unavailable witness it did not have to",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": [
+				"\t\t\tif (agent.hasAgentSession) return { ok: true, witness: { state: \"reported\", reads, settleMs: elapsed } };"
+			],
+			"replace": ["\t\t\tif (false) return { ok: true, witness: { state: \"reported\", reads, settleMs: elapsed } };"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-WITNESS-SETTLED-BY-READ]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-WITNESS-ABSENCE-KEEPS",
+			"title": "the settle window expiring becomes a launch FAILURE again, which is the shape that closed a pane holding a live Claude Code child",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": [
+				"\t\tif (elapsed >= settleMs) {\n\t\t\t// The two expiry words are the whole point of `observed`: we may only say the agent is\n\t\t\t// still in our pane if a readable reply said so.\n\t\t\treturn {\n\t\t\t\tok: true,\n\t\t\t\twitness: { state: observed ? \"unavailable\" : \"unobserved\", reads, settleMs: elapsed },\n\t\t\t};\n\t\t}"
+			],
+			"replace": ["\t\tif (elapsed >= settleMs) {\n\t\t\treturn { ok: false, reads };\n\t\t}"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-WITNESS-ABSENCE-KEEPS]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-WITNESS-DRIFT-VANISHED",
+			"title": "a readable reply about a different agent stops being a named failure, so a launch that drifted waits out its window and reports a healthy unavailable witness",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\t\tif (drifted) return { ok: false, reads };"],
+			"replace": ["\t\t\tif (false) return { ok: false, reads };"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-WITNESS-DRIFT-VANISHED]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-CLOSE-REFUSES-OCCUPIED",
+			"title": "the reclaim stops reading occupancy and judges an empty pane by the session id alone, so a pane holding an agent nobody has reported yet is closable again",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\tif (current.agent !== undefined) return { close: false, reason: \"agent-present\" };"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-CLOSE-REFUSES-OCCUPIED]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-START-ARGV-FIDELITY",
+			"title": "the echoed argv is no longer checked, so a sibling started with a framing we never composed passes as ours",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\tif (!argvMatchesRequest(started.argv, backend, backendArgs)) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-START-ARGV-FIDELITY]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HERDR-RUNNER-NONBLOCKING",
+			"title": "a synchronous wait is reintroduced on the caller thread, so a herdr call in flight holds the event loop and the sibling first callback cannot be read",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\treturn new Promise((resolve) => {"],
+			"replace": [
+				"\t\treturn new Promise((resolve) => {",
+				"\t\t\tAtomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 1000);"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HERDR-RUNNER-NONBLOCKING]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HERDR-RUNNER-TIMEOUT-KILLS",
+			"title": "the bound stops waiting without killing the child, so a child keeps its pane after we reported the launch gone",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\t\tconst timer = setTimeout(() => {", "\t\t\t\tchild.kill(\"SIGKILL\");"],
+			"replace": ["\t\t\tconst timer = setTimeout(() => {"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HERDR-RUNNER-TIMEOUT-KILLS]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HERDR-RUNNER-OUTPUT-BOUNDED",
+			"title": "the output cap is no longer enforced, so a runaway child is buffered without limit into the caller memory",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\t\t\tif (stdout.length + stderr.length <= bounds.maxOutputBytes) return;"],
+			"replace": ["\t\t\t\treturn;"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HERDR-RUNNER-OUTPUT-BOUNDED]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-CWD-HASH-IS-DATA",
+			"title": "the herdr rail absorbs the tmux rails format-token refusal, so an ordinary directory whose name contains a hash is rejected on a rail that has no format expansion to protect against",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\tif (!path.isAbsolute(cwd)) return \"cwd-not-absolute\";"],
+			"replace": [
+				"\tif (!path.isAbsolute(cwd)) return \"cwd-not-absolute\";\n\tif (cwd.includes(\"#\")) return \"cwd-not-directory\";"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-CWD-HASH-IS-DATA]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-WITNESS-UNREAD-SAYS-NOTHING",
+			"title": "a launch whose every witness read failed borrows the sentence that says herdr still showed the agent in our pane — the receipt then asserts a current liveness nobody confirmed, and contradicts its own closing paragraph while doing it",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": [
+				"\t\t\treturn `unobserved after ${cost} — no readable answer about this agent ever came back, so this receipt says nothing about whether the sibling is running. Nothing was reclaimed on that silence: an unreadable read is not evidence that a sibling is gone. Its peers placement column will read unobserved, and its garden id still arrives in the callback`;"
+			],
+			"replace": [
+				"\t\t\treturn `unavailable after ${cost} — herdr DID still show this agent in the pane we opened when we last read it`;"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-WITNESS-UNREAD-SAYS-NOTHING]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-WITNESS-BINDING-COMPLETE",
+			"title": "a half-bound reply — one that omits tab, name or kind — is counted as having seen our sibling, so the exact-rebinding claim in the comment stops being true of the code and an expiry says `unavailable` on the strength of an answer that never named our pane's agent",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": [
+				"\t\t\t\tagent.tabId === params.tabId &&\n\t\t\t\tagent.agentName === params.agentName &&\n\t\t\t\tagent.agent === params.kind;"
+			],
+			"replace": [
+				"\t\t\t\t(agent.tabId === undefined || agent.tabId === params.tabId) &&\n\t\t\t\t(agent.agentName === undefined || agent.agentName === params.agentName) &&\n\t\t\t\t(agent.agent === undefined || agent.agent === params.kind);"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-WITNESS-BINDING-COMPLETE]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		}
+	]
+}

package/scripts/mutants/herdr-placement.json

@@ -0,0 +1,161 @@
+{
+	"schemaVersion": 1,
+	"lane": "herdr-placement",
+	"mutants": [
+		{
+			"claim": "HP-UNREADABLE-IS-UNOBSERVED",
+			"title": "an unreadable herdr payload answered with an EMPTY row list turns 'nobody looked' into 'herdr was read and has none of your citizens' \u2014 a fabricated measurement about a read that did not happen (#116 S1)",
+			"subject": "pi-extensions/lib/herdr-placement.ts",
+			"find": ["\tif (!Array.isArray(panes)) return null;"],
+			"replace": ["\tif (!Array.isArray(panes)) return [];"],
+			"gate": ["bash", "run.sh", "check-herdr-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:HP-UNREADABLE-IS-UNOBSERVED]",
+			"signatureSource": "scripts/check-herdr-placement.ts"
+		},
+		{
+			"claim": "HP-JOIN-CLAUDE-EXACT",
+			"title": "joining the claude axis on a PREFIX instead of the whole value lets one citizen attach to another citizen's pane \u2014 the exact-key discipline that makes this evidence rather than a guess (#116 S1)",
+			"subject": "pi-extensions/lib/herdr-placement.ts",
+			"find": [
+				"\tconst nativeSessionId = official.kind === \"id\" ? row.sessionValue : piNativeSessionIdFromPath(row.sessionValue);"
+			],
+			"replace": [
+				"\tconst nativeSessionId =\n\t\tofficial.kind === \"id\" ? row.sessionValue.slice(0, 8) : piNativeSessionIdFromPath(row.sessionValue);"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:HP-JOIN-CLAUDE-EXACT]",
+			"signatureSource": "scripts/check-herdr-placement.ts"
+		},
+		{
+			"claim": "HP-JOIN-PI-FILENAME",
+			"title": "accepting any filename tail as the pi native session id drops the uuid shape check, so a renamed or foreign .jsonl joins a citizen to the wrong pane (#116 S1)",
+			"subject": "pi-extensions/lib/herdr-placement.ts",
+			"find": ["\treturn PI_SESSION_UUID.test(candidate) ? candidate : null;"],
+			"replace": ["\treturn candidate;"],
+			"gate": ["bash", "run.sh", "check-herdr-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:HP-JOIN-PI-FILENAME]",
+			"signatureSource": "scripts/check-herdr-placement.ts"
+		},
+		{
+			"claim": "HP-JOIN-NEVER-GUESSES",
+			"title": "coercing an UNMEASURED agent_session kind into the claude rule invents a join rule for a herdr version nobody here has run (#116 S1)",
+			"subject": "pi-extensions/lib/herdr-placement.ts",
+			"find": ["\tif (row.sessionKind !== official.kind) return null;"],
+			"replace": ["\tif (false && row.sessionKind !== official.kind) return null;"],
+			"gate": ["bash", "run.sh", "check-herdr-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:HP-JOIN-NEVER-GUESSES]",
+			"signatureSource": "scripts/check-herdr-placement.ts"
+		},
+		{
+			"claim": "HP-AMBIGUOUS-NOT-A-PANE",
+			"title": "letting the FIRST pane win when two claim one native session id settles an ambiguity by arrival order and prints a guess as a placement (#116 S1)",
+			"subject": "pi-extensions/lib/herdr-placement.ts",
+			"find": ["\t\t\tbyNativeSessionId.delete(key);"],
+			"replace": ["\t\t\tambiguous.delete(key);"],
+			"gate": ["bash", "run.sh", "check-herdr-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:HP-AMBIGUOUS-NOT-A-PANE]",
+			"signatureSource": "scripts/check-herdr-placement.ts"
+		},
+		{
+			"claim": "HP-NO-HERDR-IS-UNOBSERVED",
+			"title": "answering a host with NO placement owner with `none` claims a measurement that never ran \u2014 the blank-filling docs/mux-launch-rail.md 7 refuses (#116 S1)",
+			"subject": "pi-extensions/lib/herdr-placement.ts",
+			"find": ["\tif (index === null) return UNOBSERVED_PLACEMENT;"],
+			"replace": ["\tif (index === null) return NO_PLACEMENT;"],
+			"gate": ["bash", "run.sh", "check-herdr-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:HP-NO-HERDR-IS-UNOBSERVED]",
+			"signatureSource": "scripts/check-herdr-placement.ts"
+		},
+		{
+			"claim": "HP-ONE-READ-PER-LISTING",
+			"title": "moving the placement read INSIDE the per-citizen observer spawns one placement-owner call per record and is the first half of a discovery watcher (#116 S1)",
+			"subject": "pi-extensions/lib/entwurf-fact-provider.ts",
+			"find": [
+				"\tconst observe = deps.observe ?? makeObservePeerFacts((deps.readPlacementIndex ?? readHerdrPlacementIndex)());"
+			],
+			"replace": [
+				"\tconst observe =\n\t\tdeps.observe ??\n\t\t((identity) => makeObservePeerFacts((deps.readPlacementIndex ?? readHerdrPlacementIndex)())(identity));"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:HP-ONE-READ-PER-LISTING]",
+			"signatureSource": "scripts/check-herdr-placement.ts"
+		},
+		{
+			"claim": "HP-PLACEMENT-NOT-DISPATCH",
+			"title": "letting a dispatch module SEE the placement axis is how a pane that is one server restart from being false reaches a routing decision (Hard Rule 16, #116 S1)",
+			"subject": "pi-extensions/lib/entwurf-v2-production.ts",
+			"find": ["import { isOutOfSocketDomainGardenIdConflict } from \"./entwurf-facts.ts\";"],
+			"replace": [
+				"import { isOutOfSocketDomainGardenIdConflict } from \"./entwurf-facts.ts\";\nimport type { PlacementObservation } from \"./herdr-placement.ts\";"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:HP-PLACEMENT-NOT-DISPATCH]",
+			"signatureSource": "scripts/check-herdr-placement.ts"
+		},
+		{
+			"claim": "HP-JOIN-OFFICIAL-ONLY",
+			"title": "reading a session report without checking WHO reported it lets a third-party integration stand in for the placement owner \u2014 and that the placement owner reported it is the whole reason mux-launch-rail section 7 admits this join as exact evidence (#116 S1)",
+			"subject": "pi-extensions/lib/herdr-placement.ts",
+			"find": ["\tif (row.agent !== official.agent) return null;"],
+			"replace": ["\tif (false && row.agent !== official.agent) return null;"],
+			"gate": ["bash", "run.sh", "check-herdr-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:HP-JOIN-OFFICIAL-ONLY]",
+			"signatureSource": "scripts/check-herdr-placement.ts"
+		},
+		{
+			"claim": "HP-JOIN-BACKEND-BOUND",
+			"title": "handing a pane to a citizen whose backend the reporting integration does not speak for turns a native-id collision into a confident wrong placement (#116 S1)",
+			"subject": "pi-extensions/lib/herdr-placement.ts",
+			"find": [
+				"\t\treturn entry.backend === identity.backend ? { kind: \"herdr-pane\", paneId: entry.paneId } : UNOBSERVED_PLACEMENT;"
+			],
+			"replace": ["\t\treturn { kind: \"herdr-pane\", paneId: entry.paneId };"],
+			"gate": ["bash", "run.sh", "check-herdr-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:HP-JOIN-BACKEND-BOUND]",
+			"signatureSource": "scripts/check-herdr-placement.ts"
+		},
+		{
+			"claim": "HP-DECLINED-IS-UNOBSERVED",
+			"title": "reporting none after declining to read part of the listing claims a complete negative read that never happened \u2014 the report we refused might have been that citizen's (#116 S1)",
+			"subject": "pi-extensions/lib/herdr-placement.ts",
+			"find": ["\treturn index.declinedReports > 0 ? UNOBSERVED_PLACEMENT : NO_PLACEMENT;"],
+			"replace": ["\treturn NO_PLACEMENT;"],
+			"gate": ["bash", "run.sh", "check-herdr-placement"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:HP-DECLINED-IS-UNOBSERVED]",
+			"signatureSource": "scripts/check-herdr-placement.ts"
+		},
+		{
+			"claim": "HP-READ-ENV-GATED-NULL-NEVER-EMPTY",
+			"title": "the placement read stops requiring herdr's own env fact by value, so a host that merely has the variable set spawns a binary this process was never told to use",
+			"subject": "pi-extensions/lib/entwurf-peer-observe.ts",
+			"find": ["\tif (env.HERDR_ENV !== \"1\") return null;"],
+			"replace": ["\tif (env.HERDR_ENV === \"0\") return null;"],
+			"gate": ["bash", "run.sh", "check-herdr-placement"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HP-READ-ENV-GATED-NULL-NEVER-EMPTY]",
+			"signatureSource": "scripts/check-herdr-placement.ts"
+		},
+		{
+			"claim": "HP-READ-TIMEOUT-BOUNDED",
+			"title": "the one placement read loses its bound, so a placement owner that never answers hangs the whole peer listing behind a column that was only ever a convenience",
+			"subject": "pi-extensions/lib/entwurf-peer-observe.ts",
+			"find": ["\t\t\ttimeout: HERDR_READ_TIMEOUT_MS,"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-herdr-placement"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HP-READ-TIMEOUT-BOUNDED]",
+			"signatureSource": "scripts/check-herdr-placement.ts"
+		}
+	]
+}