@junghanacs/entwurf 0.22.0 → 0.23.1

package/scripts/mutants/herdr-runtime-bootstrap.json

@@ -0,0 +1,411 @@
+{
+	"schemaVersion": 1,
+	"lane": "herdr-runtime-bootstrap",
+	"mutants": [
+		{
+			"claim": "HRB-ONE-SHIPPED-OWNER",
+			"title": "forking any implementation back into the plugin copy recreates the split this move exists to close: Herdr deletes the checkout on uninstall, so an activation written by the shipped owner would be read back by a plugin-side copy that no longer exists — or worse, by one that does and disagrees",
+			"subject": "plugins/herdr/lib/runtime-bootstrap.mjs",
+			"find": ["export * from \"../../../scripts/herdr-runtime.mjs\";"],
+			"replace": [
+				"export * from \"../../../scripts/herdr-runtime.mjs\";",
+				"",
+				"export const RUNTIME_SCHEMA_VERSION = 2;"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-ONE-SHIPPED-OWNER]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-STABLE-ADDRESS",
+			"title": "making the active address a symlink is the candidate #116 rejected by name: the scoped wiring records absolute commands under this root and Pi records the owner root it was wired with, so a link whose canonicalisation lands in a per-version directory turns every upgrade into a different owner taking that root over",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\t\tfs.renameSync(layout.stagingDir, layout.activeDir);"],
+			"replace": ["\t\tfs.symlinkSync(layout.stagingDir, layout.activeDir);"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:HRB-STABLE-ADDRESS]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-PRE-MUTATION-ORDER",
+			"title": "creating the runtime root before ownership is decided answers 'is this ours?' with this module's own footprint — every later ownership question on that host is then answered by a directory we made while refusing to act",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": [
+				"\tconst layout = resolveRuntimeLayout(env);",
+				"",
+				"\t// PRE-MUTATION, and that word is literal: not one directory is created before ownership and the"
+			],
+			"replace": [
+				"\tconst layout = resolveRuntimeLayout(env);",
+				"\tfs.mkdirSync(layout.runtimeRoot, { recursive: true });",
+				"",
+				"\t// PRE-MUTATION, and that word is literal: not one directory is created before ownership and the"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-PRE-MUTATION-ORDER]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-PATH-KIND-LSTAT",
+			"title": "classifying with a link-following stat makes a dangling symlink read as absent and a link into somebody else's tree read as a directory we may rename — the two shapes a hostile or half-removed host actually presents",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\tconst stat = fs.lstatSync(target, { throwIfNoEntry: false });"],
+			"replace": ["\tconst stat = fs.statSync(target, { throwIfNoEntry: false });"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-PATH-KIND-LSTAT]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-EXACT-ARTIFACT",
+			"title": "accepting any version whose NAME matches unpins the supply chain — the runtime a clean host ends up with becomes whatever the registry served, and the journal's provenance line then records a version nobody verified",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\tif (seen.version !== spec.version) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:HRB-EXACT-ARTIFACT]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-RUNTIME-COMPLETE",
+			"title": "skipping the required-bin check calls a tree ready that the scoped wiring above cannot actually invoke: the install runs with --ignore-scripts, so a missing or non-executable bin is exactly the shape that survives an install nobody chmod'd, and the harness command configured against it simply does not run",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": [
+				"\tfor (const name of REQUIRED_BINS) {",
+				"\t\tconst bin = path.join(prefix, \"node_modules\", \".bin\", name);",
+				"\t\ttry {",
+				"\t\t\tfs.accessSync(bin, fs.constants.X_OK);",
+				"\t\t} catch (err) {",
+				"\t\t\treturn { ok: false, code: \"runtime-required-bin-missing\", detail: `${bin}: ${err.message}` };",
+				"\t\t}",
+				"\t}"
+			],
+			"replace": ["\tfor (const name of REQUIRED_BINS) void name;"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:HRB-RUNTIME-COMPLETE]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-LOCK-SHAPE-NAMED",
+			"title": "reading `.schemaVersion` off whatever JSON.parse returned leaks a native TypeError with no code when the lock is a bare null — an unnamed crash on the ONE file that says which package gets installed, where the contract promises a named refusal",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": [
+				"\tif (parsed === null || typeof parsed !== \"object\" || Array.isArray(parsed)) {",
+				"\t\tthrow new RuntimeBootstrapError(",
+				"\t\t\t\"runtime-lock-unreadable\","
+			],
+			"replace": ["\tif (false) {", "\t\tthrow new RuntimeBootstrapError(", "\t\t\t\"runtime-lock-unreadable\","],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-LOCK-SHAPE-NAMED]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-ARTIFACT-LOCK",
+			"title": "letting the lock and the checkout disagree installs a version nobody in this repository reviewed — the lock is the only place the published integrity lives, so a lock that has drifted is an integrity check performed against the wrong artifact",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\tif (lock.name !== checkoutSpec.name || lock.version !== checkoutSpec.version) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:HRB-ARTIFACT-LOCK]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-OWNED-NPM-CACHE",
+			"title": "letting an inherited npm cache setting win writes megabytes into the operator's default cache on behalf of a plugin install they typed one command for, and no inverse can afterwards tell those bytes from the operator's own",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\t\tnpm_config_cache: cacheDir,"],
+			"replace": ["\t\tnpm_config_cache: env.npm_config_cache ?? cacheDir,"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:HRB-OWNED-NPM-CACHE]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-INSTALL-SCRIPTS-OFF",
+			"title": "dropping --ignore-scripts runs a package's arbitrary postinstall hook inside the HOME of a Herdr user who never saw an npm prompt to decline — the plugin install is the only consent that was given, and it was not consent to execute install hooks",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\t\t\"--ignore-scripts\","],
+			"replace": ["\t\t\"--no-package-lock\","],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:HRB-INSTALL-SCRIPTS-OFF]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-OWNER-STATE-CERTIFIED",
+			"title": "renaming away a directory at our address with no certified journal behind it destroys files this module cannot prove are its own — a fresh host, a half-removed install and a stranger's directory are indistinguishable from the path alone, and the journal is the only thing that tells them apart",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": [
+				"\tif (assessed.state === \"unowned-residue\") {",
+				"\t\tthrow new RuntimeBootstrapError(",
+				"\t\t\t\"runtime-owner-state-missing\","
+			],
+			"replace": ["\tif (false) {", "\t\tthrow new RuntimeBootstrapError(", "\t\t\t\"runtime-owner-state-missing\","],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:HRB-OWNER-STATE-CERTIFIED]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-JOURNAL-SHAPE-CERTIFIED",
+			"title": "`JSON.parse` returning something is not the same as a journal: a bare null, an array or a scalar reaches the key checks as an object-shaped value and what it grants is authority to delete a user's directories",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": [
+				"\tif (parsed === null || typeof parsed !== \"object\" || Array.isArray(parsed)) {",
+				"\t\tthrow new RuntimeBootstrapError(",
+				"\t\t\t\"runtime-journal-uncertified\","
+			],
+			"replace": ["\tif (false) {", "\t\tthrow new RuntimeBootstrapError(", "\t\t\t\"runtime-journal-uncertified\","],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-JOURNAL-SHAPE-CERTIFIED]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-FAILED-CANDIDATE-PRESERVES-ACTIVE",
+			"title": "clearing the active directory when a CANDIDATE fails verification destroys a working runtime on behalf of an upgrade that never arrived — the host is left with its wiring pointing at an emptied address, strictly worse than the old version it was replacing",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\t\tremoveTree(layout.cacheDir);", "\t\tthrow err;"],
+			"replace": ["\t\tremoveTree(layout.cacheDir);", "\t\tremoveTree(layout.activeDir);", "\t\tthrow err;"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:HRB-FAILED-CANDIDATE-PRESERVES-ACTIVE]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-LAST-GOOD-NEVER-LOST",
+			"title": "deleting the backup because a sibling directory merely exists is how a corrupt active plus a good previous ends with zero usable runtimes — measured on the first cut of this module: it dropped the backup, then failed to acquire a candidate, and the address the wiring names held nothing",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": [
+				"\t\t\tif (inspectInstalledRuntime(layout.activeDir, activePackageName(certified)).ok) {",
+				"\t\t\t\tremoveTree(layout.previousDir);",
+				"\t\t\t\trecovered = \"stale-backup\";",
+				"\t\t\t} else {"
+			],
+			"replace": [
+				"\t\t\tif (true) {",
+				"\t\t\t\tremoveTree(layout.previousDir);",
+				"\t\t\t\trecovered = \"stale-backup\";",
+				"\t\t\t} else {"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-LAST-GOOD-NEVER-LOST]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-ALL-STATES-NAMED",
+			"title": "collapsing two presence combinations into one name is a branch nobody decided: the leftover candidate beside a restored backup is handled as if it were not there, which is how a half-written tree survives into the next run",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": [
+				"\tif (!active && staging && previous) return Object.freeze({ state: \"torn-swap-with-candidate\", ...facts });"
+			],
+			"replace": ["\tif (!active && staging && previous) return Object.freeze({ state: \"torn-swap\", ...facts });"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-ALL-STATES-NAMED]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-PROVENANCE-CARRIED",
+			"title": "overwriting the finished runtime's provenance when the installing entry is written leaves a host that dies mid-install holding a backup directory and no statement of what is in it — recoverable bytes with unrecoverable provenance",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\t\tpreviousRuntime: carried,"],
+			"replace": ["\t\tpreviousRuntime: null,"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-PROVENANCE-CARRIED]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-IDEMPOTENT-REINSTALL",
+			"title": "failing to recognise an already-correct runtime makes Herdr's own reinstall — the explicit refresh trigger this product depends on — re-download and re-swap every time, so the routine safe operation becomes the expensive and risky one",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\t\tcertified.phase === \"runtime-ready\" &&"],
+			"replace": ["\t\tcertified.phase === \"installing\" &&"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:HRB-IDEMPOTENT-REINSTALL]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-JOURNAL-MUST-MATCH-DISK",
+			"title": "believing the journal without re-verifying the tree turns one damaged install into a permanent one: the record says runtime-ready, the bytes are gone or wrong, and every later install agrees there is nothing to do",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": [
+				"\t\ttry {",
+				"\t\t\tverifyInstalledRuntime(layout.activeDir, artifactCompleteness(certified.artifactIdentity));",
+				"\t\t\treturn Object.freeze({ phase: \"runtime-ready\", changed: false, recovered, journal: certified });"
+			],
+			"replace": [
+				"\t\ttry {",
+				"\t\t\treturn Object.freeze({ phase: \"runtime-ready\", changed: false, recovered, journal: certified });"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:HRB-JOURNAL-MUST-MATCH-DISK]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-INVERSE-STATE-BACKED",
+			"title": "an inverse that walks past an address it cannot prove is its own will happily delete a stranger's directory — Herdr has no cleanup hook (measured: the plugin manifest has six sections, none an uninstall), so this is the only inverse that will ever run and there is no second chance to notice",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\tif (certified === null) {", "\t\tif (assessed.state === \"unowned-residue\") {"],
+			"replace": ["\tif (certified === null) {", "\t\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:HRB-INVERSE-STATE-BACKED]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-NO-HERDR-CLAIM",
+			"title": "giving this module a phase that claims Herdr installed the plugin records a step that had not run: [[build]] finishes BEFORE Herdr re-reads the manifest, swaps its checkout and registers, so the next install would reconcile against a state nobody observed",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["export const JOURNAL_PHASES = Object.freeze([\"installing\", \"runtime-ready\", \"removing\"]);"],
+			"replace": [
+				"export const JOURNAL_PHASES = Object.freeze([\"installing\", \"runtime-ready\", \"removing\", \"herdr-installed\"]);"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 240,
+			"signature": "[QK:HRB-NO-HERDR-CLAIM]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-LOCK-SOURCE-CLOSED",
+			"title": "defaulting an unknown or absent `source` instead of refusing it lets whoever edits a lock — or ships a v1 one — choose the acquisition authority silently, which is the one decision this discriminant exists to keep committed",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\tif (!ARTIFACT_KINDS.includes(parsed.source)) {"],
+			"replace": ["\tif (false && !ARTIFACT_KINDS.includes(parsed.source)) {"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-LOCK-SOURCE-CLOSED]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-CHECKOUT-REPO-LITERAL",
+			"title": "accepting any repository inside the identity certifier means a journal or ledger naming a foreign tree is believed on re-read — a strange source becomes ours by transcription, which is how a record-based authority gets laundered",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\t\tif (value.repository !== CHECKOUT_REPOSITORY) {"],
+			"replace": ["\t\tif (false && value.repository !== CHECKOUT_REPOSITORY) {"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-CHECKOUT-REPO-LITERAL]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-ARTIFACT-IDENTITY-EXACT",
+			"title": "accepting either stage wherever an identity is read makes a ready-shaped `installing` entry legal — an observation nobody made — and lets a requested-shaped ready entry name a runtime whose bytes were never looked at",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\tconst shapes = stage === \"either\" ? [\"requested\", \"ready\"] : [stage];"],
+			"replace": ["\tconst shapes = [\"requested\", \"ready\"];"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-ARTIFACT-IDENTITY-EXACT]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-IDENTITY-COMMIT-DECIDES",
+			"title": "dropping the commit from the checkout comparison makes a stale candidate satisfy a request for a new one — two commits can both call themselves 0.21.0, so the host keeps serving the old artifact while every receipt above it names the new",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\treturn ready.repository === requested.repository && ready.commit === requested.commit;"],
+			"replace": ["\treturn ready.repository === requested.repository;"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-IDENTITY-COMMIT-DECIDES]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-CHECKOUT-COMMIT-CANONICAL",
+			"title": "accepting whatever `rev-parse` printed lets an abbreviated sha, an empty line or a git error message become the anchor a candidate is identified by, and an anchor that is not a full commit identifies nothing",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\tif (!COMMIT_SHA.test(commit)) {"],
+			"replace": ["\tif (false && !COMMIT_SHA.test(commit)) {"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-CHECKOUT-COMMIT-CANONICAL]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-CHECKOUT-ARGV-FIXED",
+			"title": "adding `--ignore-scripts` to the PACK skips `prepare`, so the tarball arrives with no compiled bridge — the exact footgun measured on npm 11.16.0, where only the git-spec form builds and the directory form needs a global pnpm",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\t\t`${buildCheckoutRemote(identity.repository)}#${identity.commit}`,", "\t\t\"--json\","],
+			"replace": [
+				"\t\t`${buildCheckoutRemote(identity.repository)}#${identity.commit}`,",
+				"\t\t\"--ignore-scripts\",",
+				"\t\t\"--json\","
+			],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-CHECKOUT-ARGV-FIXED]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-SOURCE-UNAVAILABLE-NAMED",
+			"title": "collapsing a remote that cannot serve the commit into the generic acquire failure erases the one distinction an operator needs: this candidate does not exist at that source, and no other artifact may stand in for it",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\t\t\t\"runtime-checkout-source-unavailable\","],
+			"replace": ["\t\t\t\"runtime-acquire-failed\","],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-SOURCE-UNAVAILABLE-NAMED]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-CACHE-UNOWNED-REFUSED",
+			"title": "adopting a cache directory with no journal behind it makes this module's first act on a strange host the deletion of a tree it cannot prove it wrote",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": [
+				"\t\tif (kinds.cache !== \"absent\") return Object.freeze({ state: \"unowned-cache-residue\", ...facts });"
+			],
+			"replace": ["\t\tif (false) return Object.freeze({ state: \"unowned-cache-residue\", ...facts });"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-CACHE-UNOWNED-REFUSED]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-CACHE-FAILED-ACQUIRE-RECLAIMED",
+			"title": "leaving a half-fetched tarball in our own cache after a failed acquisition is what a retry then trips over — and the transaction that wrote those bytes is the only one that can prove they are ours to remove",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": [
+				"\t\t// cache entry may be incomplete, and OUR cache is the only place this transaction wrote.",
+				"\t\tremoveTree(layout.cacheDir);"
+			],
+			"replace": ["\t\t// cache entry may be incomplete, and OUR cache is the only place this transaction wrote."],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-CACHE-FAILED-ACQUIRE-RECLAIMED]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-INVERSE-CACHE-UNOWNED",
+			"title": "letting the inverse report success over a journal-less cache makes the two sides of one ownership fact disagree — the forward path refuses that exact state, and the side that shrugs is the one that eventually deletes what the careful side would not",
+			"subject": "scripts/herdr-runtime.mjs",
+			"find": ["\t\tif (assessed.state === \"unowned-cache-residue\") {"],
+			"replace": ["\t\tif (false && assessed.state === \"unowned-cache-residue\") {"],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-INVERSE-CACHE-UNOWNED]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		},
+		{
+			"claim": "HRB-PREPARE-STDOUT-CLEAN",
+			"title": "silencing stderr instead of stdout is the exact byte that broke the first clean-host install: husky writes `.git can't be found` to STDOUT when npm packs our GitHub git spec (no `.git` in a codeload tarball), npm merges that line into `npm pack --json`, and a perfectly good artifact is refused as `runtime-checkout-source-unavailable` — invisible to both the fake-npm cells here and to the LIVE gate, whose `insteadOf` mirror is cloned and therefore HAS a `.git`",
+			"subject": "package.json",
+			"find": ["\t\t\"prepare\": \"husky 1>&2 || true; npm run --silent build-bridge 1>&2\","],
+			"replace": ["\t\t\"prepare\": \"husky 2>/dev/null || true; npm run --silent build-bridge\","],
+			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HRB-PREPARE-STDOUT-CLEAN]",
+			"signatureSource": "scripts/check-herdr-runtime-bootstrap.ts"
+		}
+	]
+}

package/scripts/mutants/herdr-supply.json

@@ -0,0 +1,133 @@
+{
+	"schemaVersion": 1,
+	"lane": "herdr-supply",
+	"mutants": [
+		{
+			"claim": "HSUP-MANIFEST-SSOT",
+			"title": "a second copy of the pinned version appears in the sandbox gate, so an installed version and an expected version can drift apart with nobody watching",
+			"subject": "scripts/check-herdr-sandbox.ts",
+			"find": ["const SUPPLY_MANIFEST = \"scripts/fixtures/herdr-supply.json\";"],
+			"replace": [
+				"const SUPPLY_MANIFEST = \"scripts/fixtures/herdr-supply.json\";\nconst PINNED_FALLBACK = \"0.9.1\";\nvoid PINNED_FALLBACK;"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-supply"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HSUP-MANIFEST-SSOT]",
+			"signatureSource": "scripts/check-herdr-supply.ts"
+		},
+		{
+			"claim": "HSUP-DIGEST-SHAPE",
+			"title": "a pinned digest is truncated, so the check that is supposed to catch a swapped binary can no longer fail",
+			"subject": "scripts/fixtures/herdr-supply.json",
+			"find": ["\"sha256\": \"2a02fed16beb651ef006e1d43f048f652ca4dc58ad053cd2d44450563d5c54b7\""],
+			"replace": ["\"sha256\": \"2a02fed16beb651ef006e1d43f04\""],
+			"gate": ["bash", "run.sh", "check-herdr-supply"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HSUP-DIGEST-SHAPE]",
+			"signatureSource": "scripts/check-herdr-supply.ts"
+		},
+		{
+			"claim": "HSUP-ARCH-FAIL-CLOSED",
+			"title": "an unmeasured architecture silently receives the x86_64 binary instead of a refusal",
+			"subject": "scripts/install-herdr-ci.sh",
+			"find": ["\t\tif (!asset) {"],
+			"replace": ["\t\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-supply"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HSUP-ARCH-FAIL-CLOSED]",
+			"signatureSource": "scripts/check-herdr-supply.ts"
+		},
+		{
+			"claim": "HSUP-VERIFY-BEFORE-CHMOD",
+			"title": "the downloaded file is made executable BEFORE its digest is checked, so a byte nobody chose becomes runnable first",
+			"subject": "scripts/install-herdr-ci.sh",
+			"find": ["actual_sha=\"$(sha256sum \"$target\" | cut -d' ' -f1)\""],
+			"replace": ["chmod +x \"$target\"\nactual_sha=\"$(sha256sum \"$target\" | cut -d' ' -f1)\""],
+			"gate": ["bash", "run.sh", "check-herdr-supply"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HSUP-VERIFY-BEFORE-CHMOD]",
+			"signatureSource": "scripts/check-herdr-supply.ts"
+		},
+		{
+			"claim": "HSUP-NO-MUTABLE-SUPPLY",
+			"title": "the installer falls back to the upstream curl-pipe, which pins no version and verifies no digest",
+			"subject": "scripts/install-herdr-ci.sh",
+			"find": ["curl -fsSL --retry 3 --retry-delay 2 -o \"$target\" \"$url\" || fail \"download failed: ${url}\""],
+			"replace": ["curl -fsSL https://herdr.dev/install.sh | sh || fail \"download failed: ${url}\""],
+			"gate": ["bash", "run.sh", "check-herdr-supply"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HSUP-NO-MUTABLE-SUPPLY]",
+			"signatureSource": "scripts/check-herdr-supply.ts"
+		},
+		{
+			"claim": "HSUP-NO-ATTESTATION-CLI",
+			"title": "the installer starts depending on `gh attestation verify`, which measured on gh 2.97.0 cannot close herdr's predicate at all",
+			"subject": "scripts/install-herdr-ci.sh",
+			"find": ["chmod +x \"$target\""],
+			"replace": [
+				"chmod +x \"$target\"\ngh attestation verify \"$target\" --repo herdrdev/herdr || fail \"attestation\""
+			],
+			"gate": ["bash", "run.sh", "check-herdr-supply"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HSUP-NO-ATTESTATION-CLI]",
+			"signatureSource": "scripts/check-herdr-supply.ts"
+		},
+		{
+			"claim": "HSUP-CI-INSTALL-BEFORE-FLOOR",
+			"title": "CI installs herdr AFTER the floor, so the required cell skips in the one place it was supposed to be required",
+			"subject": ".github/workflows/ci.yml",
+			"find": ["      - name: install the pinned herdr binary\n        run: ./scripts/install-herdr-ci.sh\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-herdr-supply"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HSUP-CI-INSTALL-BEFORE-FLOOR]",
+			"signatureSource": "scripts/check-herdr-supply.ts"
+		},
+		{
+			"claim": "HSUP-CI-REQUIRES-HERDR",
+			"title": "CI runs the floor without the required-mode switch, so a failed install downgrades to a silent skip",
+			"subject": ".github/workflows/ci.yml",
+			"find": ["        env:\n          ENTWURF_REQUIRE_HERDR: \"1\"\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-herdr-supply"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HSUP-CI-REQUIRES-HERDR]",
+			"signatureSource": "scripts/check-herdr-supply.ts"
+		},
+		{
+			"claim": "HSUP-CI-LINUX-ONLY",
+			"title": "a second job installs herdr, widening a Linux-only certification to platforms this rail has never been measured on",
+			"subject": ".github/workflows/ci.yml",
+			"find": ["      - name: install the pinned herdr binary\n        run: ./scripts/install-herdr-ci.sh\n"],
+			"replace": [
+				"      - name: install the pinned herdr binary\n        run: ./scripts/install-herdr-ci.sh\n      - name: install the pinned herdr binary again\n        run: ./scripts/install-herdr-ci.sh\n"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-supply"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HSUP-CI-LINUX-ONLY]",
+			"signatureSource": "scripts/check-herdr-supply.ts"
+		},
+		{
+			"claim": "HSUP-SETUP-NEVER-INSTALLS",
+			"title": "the product itself gains a script that installs herdr, which is Entwurf supplying a placement owner's bytes",
+			"subject": "package.json",
+			"find": ["\"check:contracts\":"],
+			"replace": ["\"install-herdr\": \"./scripts/install-herdr-ci.sh\",\n\t\t\"check:contracts\":"],
+			"gate": ["bash", "run.sh", "check-herdr-supply"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HSUP-SETUP-NEVER-INSTALLS]",
+			"signatureSource": "scripts/check-herdr-supply.ts"
+		},
+		{
+			"claim": "HSUP-X86-UNEXECUTED",
+			"title": "the x86_64 asset is recorded as executed although no cell of this rail has ever run on it",
+			"subject": "scripts/fixtures/herdr-supply.json",
+			"find": ["\"executed\": false"],
+			"replace": ["\"executed\": true"],
+			"gate": ["bash", "run.sh", "check-herdr-supply"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HSUP-X86-UNEXECUTED]",
+			"signatureSource": "scripts/check-herdr-supply.ts"
+		}
+	]
+}

package/scripts/mutants/meta-hook-session-switch.json

@@ -129,10 +129,10 @@
 			"title": "measuring both axes and printing neither returns the listing to two identical rows for a live citizen and a phantom — the surface gap that made a sibling dispatch into a void",
 			"subject": "pi-extensions/lib/entwurf-peers-render.ts",
 			"find": [
-				"\t\t`- ${p.gardenId}  backend=${p.backend}  liveness=${p.liveness}  receiver=${p.receiver}  ` +\n\t\t`transcript=${p.transcript}  cwd=${p.cwd}  model=${model}`"
+				"\t\t`- ${p.gardenId}  backend=${p.backend}  liveness=${p.liveness}  receiver=${p.receiver}  ` +\n\t\t`transcript=${p.transcript}  cwd=${p.cwd}  model=${model}  placement=${renderPlacement(p.placement)}`"
 			],
 			"replace": [
-				"\t\t`- ${p.gardenId}  backend=${p.backend}  liveness=${p.liveness}  ` + `cwd=${p.cwd}  model=${model}`"
+				"\t\t`- ${p.gardenId}  backend=${p.backend}  liveness=${p.liveness}  ` +\n\t\t`cwd=${p.cwd}  model=${model}  placement=${renderPlacement(p.placement)}`"
 			],
 			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
 			"timeoutSeconds": 300,