@junghanacs/entwurf 0.23.0 → 0.24.0

package/scripts/check-acp-session-store.ts

@@ -14,6 +14,7 @@ import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "no
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { Context } from "@earendil-works/pi-ai";
+import { normalizeContext } from "@earendil-works/pi-ai";
 
 const sha256 = (v: string) => createHash("sha256").update(v).digest("hex");
 const isSha256Hex = (v: string) => /^[0-9a-f]{64}$/.test(v);
@@ -114,13 +115,16 @@ const baseInput = (): BridgeConfigInput => ({
 			stopReason: "stop" as const,
 			timestamp: 0,
 		}) satisfies Context["messages"][number];
-	const ctx: Context = {
+	// Built through `normalizeContext` — the 0.86 provider-path shape. With no
+	// systemPrompt and no tools it adds no leading system message, so the exact
+	// three-entry expectation below is the same list production hashes.
+	const ctx = normalizeContext({
 		messages: [
 			{ role: "user", content: "hello", timestamp: 0 },
 			assistant("hi"),
 			{ role: "user", content: [{ type: "image", data: "RAWIMAGEBYTES", mimeType: "image/png" }], timestamp: 0 },
 		],
-	};
+	});
 	const sigs = contextMessageSignatures(ctx);
 	// every entry is a sha256 digest of the pre-hash role:content form.
 	assert.ok(sigs.every(isSha256Hex), "every message signature is a sha256 digest");
@@ -139,21 +143,21 @@ const baseInput = (): BridgeConfigInput => ({
 
 	// toolResult folds in toolName + isError → same text, different tool/flag = different sig.
 	const trContent = [{ type: "text" as const, text: "out" }];
-	const trBase: Context = {
+	const trBase = normalizeContext({
 		messages: [
 			{ role: "toolResult", toolCallId: "t1", toolName: "bash", isError: false, content: trContent, timestamp: 0 },
 		],
-	};
-	const trErr: Context = {
+	});
+	const trErr = normalizeContext({
 		messages: [
 			{ role: "toolResult", toolCallId: "t1", toolName: "bash", isError: true, content: trContent, timestamp: 0 },
 		],
-	};
-	const trOther: Context = {
+	});
+	const trOther = normalizeContext({
 		messages: [
 			{ role: "toolResult", toolCallId: "t1", toolName: "edit", isError: false, content: trContent, timestamp: 0 },
 		],
-	};
+	});
 	assert.notEqual(
 		contextMessageSignatures(trBase)[0],
 		contextMessageSignatures(trErr)[0],
@@ -164,6 +168,25 @@ const baseInput = (): BridgeConfigInput => ({
 		contextMessageSignatures(trOther)[0],
 		"toolResult toolName changes the signature",
 	);
+
+	// 0.86 shape: `normalizeContext` folds systemPrompt+tools into a LEADING
+	// `role:"system"` message, so the carrier now rides INSIDE `messages` and is
+	// hashed like any other turn. Two consequences this cell locks:
+	//   - a systemPrompt drift changes signature[0] → the prefix check declares the
+	//     candidate incompatible → no reuse of a session built under the old prompt;
+	//   - the same user turn under a system prompt is NOT a prefix of the same turn
+	//     without one, so a 0.85-shaped record cannot silently be reused at 0.86.
+	const sameUser = [{ role: "user" as const, content: "hello", timestamp: 0 }];
+	const bare = contextMessageSignatures(normalizeContext({ messages: [...sameUser] }));
+	const withPrompt = contextMessageSignatures(normalizeContext({ systemPrompt: "carrier A", messages: [...sameUser] }));
+	const withOtherPrompt = contextMessageSignatures(
+		normalizeContext({ systemPrompt: "carrier B", messages: [...sameUser] }),
+	);
+	assert.equal(bare.length, 1, "no systemPrompt and no tools → no leading system message");
+	assert.equal(withPrompt.length, 2, "a systemPrompt becomes a leading system message that is hashed too");
+	assert.notEqual(withPrompt[0], withOtherPrompt[0], "a systemPrompt drift changes the leading signature");
+	assert.ok(!hasPrefix(withPrompt, bare), "a prompt-carrying transcript is not a prefix of a bare one");
+	assert.ok(!hasPrefix(withPrompt, withOtherPrompt), "a drifted carrier breaks prefix compatibility");
 }
 
 // ---------------------------------------------------------------------------

package/scripts/check-acp-stop-reason.ts

@@ -52,7 +52,8 @@ import { copyFileSync, mkdirSync, mkdtempSync, rmdirSync, rmSync } from "node:fs
 import { tmpdir } from "node:os";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
-import type { Api, AssistantMessageEvent, Context, Model } from "@earendil-works/pi-ai";
+import type { Api, AssistantMessageEvent, Model } from "@earendil-works/pi-ai";
+import { normalizeContext } from "@earendil-works/pi-ai";
 
 const sonnet = { id: "claude-sonnet-5" } as unknown as Model<Api>;
 
@@ -83,6 +84,20 @@ function makeFakeChild() {
 	};
 }
 
+// The pi built-ins the Claude child also exposes natively. pi declares its tool surface on
+// every turn, and since 0.86 that declaration reaches a provider as the leading system
+// message's `toolsAdded` (`normalizeContext`), which backend.ts replays for the exclude-tools
+// truthfulness preflight. A fixture that declares NO tools is therefore not "a turn with the
+// defaults" — it is a turn where the operator excluded everything, and the preflight rejects it
+// before the prompt is ever sent. So every provider-path context here is built through
+// `normalizeContext`, never cast `as Context`: the cast is exactly what hid this shape from
+// typecheck when the 0.86 pin landed.
+const PI_DECLARED_TOOLS = ["read", "bash", "edit", "write"].map((name) => ({
+	name,
+	description: "",
+	parameters: {} as never,
+}));
+
 const EMPTY_MCP_HASH = "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945";
 const DEFAULT_RESOLVED_CONFIG: any = {
 	settingSources: [],
@@ -267,7 +282,10 @@ try {
 		const events = await collect(
 			backend.streamAcpTurn(
 				sonnet,
-				{ messages: [{ role: "user", content: `drive ${label}`, timestamp: 0 }] } as Context,
+				normalizeContext({
+					tools: PI_DECLARED_TOOLS,
+					messages: [{ role: "user", content: `drive ${label}`, timestamp: 0 }],
+				}),
 				{ sessionId: `stop-${label}` },
 				makeHarness(recordDir, cell.wire),
 			) as Stream,

package/scripts/check-acp-stream-hooks.ts

@@ -32,7 +32,8 @@ import { copyFileSync, mkdirSync, mkdtempSync, rmdirSync, rmSync } from "node:fs
 import { tmpdir } from "node:os";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
-import type { Api, AssistantMessageEvent, Context, Message, Model } from "@earendil-works/pi-ai";
+import type { Api, AssistantMessageEvent, Message, Model, TranscriptContext } from "@earendil-works/pi-ai";
+import { normalizeContext } from "@earendil-works/pi-ai";
 
 const sonnet = { id: "claude-sonnet-5" } as unknown as Model<Api>;
 
@@ -133,10 +134,26 @@ async function collect(stream: Stream): Promise<AssistantMessageEvent[]> {
 const sealed = (events: AssistantMessageEvent[]) =>
 	events.filter((e) => e.type === "done" || e.type === "error") as any[];
 
-const userCtx = (text: string): Context => ({ messages: [{ role: "user", content: text, timestamp: 0 }] }) as Context;
+// The pi built-ins the Claude child also exposes natively. pi declares its tool surface on
+// every turn, and since 0.86 that declaration reaches a provider as the leading system
+// message's `toolsAdded` (`normalizeContext`), which backend.ts replays for the exclude-tools
+// truthfulness preflight. A fixture that declares NO tools is therefore not "a turn with the
+// defaults" — it is a turn where the operator excluded everything, and the preflight rejects it
+// before the prompt is ever sent. So every provider-path context here is built through
+// `normalizeContext`, never cast `as Context`: the cast is exactly what hid this shape from
+// typecheck when the 0.86 pin landed.
+const PI_DECLARED_TOOLS = ["read", "bash", "edit", "write"].map((name) => ({
+	name,
+	description: "",
+	parameters: {} as never,
+}));
 
-function reuseCtx(prior: string, latest: string): Context {
-	return {
+const userCtx = (text: string): TranscriptContext =>
+	normalizeContext({ tools: PI_DECLARED_TOOLS, messages: [{ role: "user", content: text, timestamp: 0 }] });
+
+function reuseCtx(prior: string, latest: string): TranscriptContext {
+	return normalizeContext({
+		tools: PI_DECLARED_TOOLS,
 		messages: [
 			{ role: "user", content: prior, timestamp: 0 },
 			{
@@ -158,7 +175,7 @@ function reuseCtx(prior: string, latest: string): Context {
 			} as unknown as Message,
 			{ role: "user", content: latest, timestamp: 0 },
 		],
-	} as Context;
+	});
 }
 
 // EVERY cell registers onResponse; the exemption claim at the end judges the sum.

package/scripts/check-acp-usage-accounting.ts

@@ -50,8 +50,15 @@ import { copyFileSync, mkdirSync, mkdtempSync, rmdirSync, rmSync } from "node:fs
 import { tmpdir } from "node:os";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
-import type { Api, AssistantMessage, AssistantMessageEvent, Context, Message, Model } from "@earendil-works/pi-ai";
-import { isContextOverflow } from "@earendil-works/pi-ai";
+import type {
+	Api,
+	AssistantMessage,
+	AssistantMessageEvent,
+	Message,
+	Model,
+	TranscriptContext,
+} from "@earendil-works/pi-ai";
+import { isContextOverflow, normalizeContext } from "@earendil-works/pi-ai";
 import { calculateContextTokens } from "@earendil-works/pi-coding-agent";
 
 const claude = { id: "claude-sonnet-5" } as unknown as Model<Api>;
@@ -72,7 +79,7 @@ interface WireUsage {
  * One `_meta.quota.token_count` row. The field NAMES deliberately differ from
  * `PromptResponse.usage`: cache reads are `cachedInputTokens` here because the
  * shape is shared with codex-acp, and `cachedWriteTokens` is Claude's extra
- * sibling (read at claude-agent-acp 0.76.0 `dist/acp-agent.js:6566-6575`).
+ * sibling (read at claude-agent-acp 0.79.0 `dist/acp-agent.js:6579-6588`).
  * Reading a quota row with the `usage` field names silently yields zeros, so the
  * fixture below spells the vendor's names out rather than reusing `WireUsage`.
  */
@@ -137,7 +144,7 @@ function makeFakeChild() {
  *
  * Each `prompt` call consumes the next TurnScript: it first pushes that turn's
  * `usage_update` notification (the wire the running cost total actually arrives
- * on — read at claude-agent-acp 0.76.0 `dist/acp-agent.js:3471-3486`), then answers the
+ * on — read at claude-agent-acp 0.79.0 `dist/acp-agent.js:3504-3519`), then answers the
  * prompt with that turn's `PromptResponse.usage` (the wire the turn aggregate
  * arrives on). Both orderings are the real one: the notification precedes the
  * response, because the SDK emits it from the `result` message that ENDS the turn.
@@ -216,7 +223,22 @@ function sealedMessage(events: AssistantMessageEvent[]): AssistantMessage {
 	return seal[0].message as AssistantMessage;
 }
 
-const userCtx = (text: string): Context => ({ messages: [{ role: "user", content: text, timestamp: 0 }] }) as Context;
+// The pi built-ins the Claude child also exposes natively. pi declares its tool surface on
+// every turn, and since 0.86 that declaration reaches a provider as the leading system
+// message's `toolsAdded` (`normalizeContext`), which backend.ts replays for the exclude-tools
+// truthfulness preflight. A fixture that declares NO tools is therefore not "a turn with the
+// defaults" — it is a turn where the operator excluded everything, and the preflight rejects it
+// before the prompt is ever sent. So every provider-path context here is built through
+// `normalizeContext`, never cast `as Context`: the cast is exactly what hid this shape from
+// typecheck when the 0.86 pin landed.
+const PI_DECLARED_TOOLS = ["read", "bash", "edit", "write"].map((name) => ({
+	name,
+	description: "",
+	parameters: {} as never,
+}));
+
+const userCtx = (text: string): TranscriptContext =>
+	normalizeContext({ tools: PI_DECLARED_TOOLS, messages: [{ role: "user", content: text, timestamp: 0 }] });
 
 const zeroUsage = () => ({
 	input: 0,
@@ -228,8 +250,9 @@ const zeroUsage = () => ({
 });
 
 /** A reuse-shaped context: prior user, assistant, new user. */
-function reuseCtx(prior: string, latest: string): Context {
-	return {
+function reuseCtx(prior: string, latest: string): TranscriptContext {
+	return normalizeContext({
+		tools: PI_DECLARED_TOOLS,
 		messages: [
 			{ role: "user", content: prior, timestamp: 0 },
 			{
@@ -244,11 +267,11 @@ function reuseCtx(prior: string, latest: string): Context {
 			} as unknown as Message,
 			{ role: "user", content: latest, timestamp: 0 },
 		],
-	} as Context;
+	});
 }
 
 /** A third turn on the same reused session. */
-function reuseCtx3(a: string, b: string, c: string): Context {
+function reuseCtx3(a: string, b: string, c: string): TranscriptContext {
 	const assistant = {
 		role: "assistant",
 		content: [{ type: "text", text: "ok" }],
@@ -259,7 +282,8 @@ function reuseCtx3(a: string, b: string, c: string): Context {
 		stopReason: "stop",
 		timestamp: 0,
 	} as unknown as Message;
-	return {
+	return normalizeContext({
+		tools: PI_DECLARED_TOOLS,
 		messages: [
 			{ role: "user", content: a, timestamp: 0 },
 			assistant,
@@ -267,7 +291,7 @@ function reuseCtx3(a: string, b: string, c: string): Context {
 			assistant,
 			{ role: "user", content: c, timestamp: 0 },
 		],
-	} as Context;
+	});
 }
 
 const TMP_EMIT = ".tmp-verify/acp-usage-accounting";
@@ -393,8 +417,8 @@ try {
 	// AGENT LOOP only. `_meta.quota.model_usage` comes from `result.modelUsage` and
 	// also counts Task subagents, sidechains and INTERNAL CALLS SUCH AS COMPACTION;
 	// the vendor states its rows "can total more than `token_count`" and are "the
-	// fuller picture, not a decomposition of it" (read at claude-agent-acp 0.76.0
-	// `dist/acp-agent.js:6541-6547`).
+	// fuller picture, not a decomposition of it" (read at claude-agent-acp 0.79.0
+	// `dist/acp-agent.js:6554-6560`).
 	//
 	// The wide one is required, not merely nicer, because the DENOMINATOR already
 	// has that scope: turn cost is the adjacent diff of the backend's running total,
@@ -608,8 +632,8 @@ try {
 	// identity that produces the bound is a property of the MAIN AGENT LOOP's
 	// cache breakpoints. `_meta.quota.model_usage` is a WIDER scope: the vendor
 	// states those rows also count Task subagents, sidechains, and INTERNAL
-	// CALLS SUCH AS COMPACTION (read at claude-agent-acp 0.76.0
-	// `dist/acp-agent.js:6538-6558`). Mixing the two scopes inflates the bound
+	// CALLS SUCH AS COMPACTION (read at claude-agent-acp 0.79.0
+	// `dist/acp-agent.js:6551-6571`). Mixing the two scopes inflates the bound
 	// through both remaining terms that mention cacheWrite:
 	//   max(0, occupancy − cacheWrite) shrinks as wide cacheWrite grows, so
 	//   less is subtracted; min(rawBound, cacheWrite) rises with it.
@@ -749,9 +773,9 @@ try {
 	// CELL 3 — a turn with NO cost notification holds the baseline.
 	//
 	// Measured upstream: the result-path `usage_update` carries cost (read at
-	// claude-agent-acp 0.76.0 `dist/acp-agent.js:3471-3486`), while other
+	// claude-agent-acp 0.79.0 `dist/acp-agent.js:3504-3519`), while other
 	// `usage_update` paths can carry `used` without cost (for example the
-	// rate-limit path at `:4273-4281`). A live thinkpad ledger shows such turns
+	// rate-limit path at `:4336-4344`). A live thinkpad ledger shows such turns
 	// really occur. The honest handling is to HOLD the baseline so the amount lands
 	// in the NEXT diff: misattributed by turn, exact by session. Rebaselining to 0
 	// there would double-count the whole prefix.
@@ -831,7 +855,7 @@ try {
 	// CELL 4 — a DECREASING session total is never silently absorbed.
 	//
 	// `conversation_reset` switches the session to a fresh transcript (read at
-	// claude-agent-acp 0.76.0 `dist/acp-agent.js:4286-4293`), but whether that
+	// claude-agent-acp 0.79.0 `dist/acp-agent.js:4349-4356`), but whether that
 	// changes `total_cost_usd` is an SDK-internal value we cannot observe here.
 	// A diff can therefore go negative in a session we are still holding.
 	// Absorbing it quietly would both misreport the turn and destroy the only

package/scripts/check-entwurf-bridge-boot.ts

@@ -224,6 +224,20 @@ async function main(): Promise<void> {
 		!tools.some((t) => ["entwurf", "entwurf_resume", "entwurf_send"].includes(String(t?.name))),
 	);
 
+	const callback = tools.find((t) => t?.name === "entwurf_callback");
+	ok(
+		"[QK:BRIDGEBOOT-CALLBACK-REGISTERED] G1h: entwurf_callback is registered on the runtime tools/list surface — not merely imported",
+		!!callback,
+	);
+	const callbackSchema = callback?.inputSchema ?? {};
+	const callbackProps = callbackSchema.properties ?? {};
+	const callbackRequired = Array.isArray(callbackSchema.required) ? callbackSchema.required.map(String) : [];
+	ok(
+		"[QK:BRIDGEBOOT-CALLBACK-ZERO-ARG] G1h: entwurf_callback takes EXACTLY zero inputs — a target or nonce parameter here would be a model-supplied address, which Hard Rule 5 refuses",
+		Object.keys(callbackProps).length === 0 && callbackRequired.length === 0,
+		`--- inputSchema ---\n${JSON.stringify(callbackSchema)}`,
+	);
+
 	// G1f — the public surface is an EXACT set, judged last so the named assertions above
 	// keep their own diagnosis. Every check before this one is existential: each names one
 	// verb it cares about, so a verb nobody named could be dropped (entwurf_fresh_call was
@@ -233,6 +247,7 @@ async function main(): Promise<void> {
 	// from the server: an oracle computed from the subject proves nothing.
 	const publicSurface = tools.map((t) => String(t?.name)).sort();
 	const expectedSurface = [
+		"entwurf_callback",
 		"entwurf_fresh_call",
 		"entwurf_inbox_read",
 		"entwurf_peers",
@@ -242,7 +257,7 @@ async function main(): Promise<void> {
 		"entwurf_v2",
 	];
 	ok(
-		"[QK:BRIDGEBOOT-PUBLIC-SURFACE-EXACT-SET] G1f: the runtime tools/list surface is EXACTLY the seven shipped garden verbs — no missing verb, no undecided extra, no duplicate",
+		"[QK:BRIDGEBOOT-PUBLIC-SURFACE-EXACT-SET] G1f: the runtime tools/list surface is EXACTLY the eight shipped garden verbs — no missing verb, no undecided extra, no duplicate",
 		publicSurface.length === expectedSurface.length && expectedSurface.every((n, i) => publicSurface[i] === n),
 		`--- want ---\n${expectedSurface.join(",")}\n--- got ---\n${publicSurface.join(",")}`,
 	);

package/scripts/check-fresh-call-dispatch.ts

@@ -170,14 +170,13 @@ async function main(): Promise<void> {
 
 	// ── one nonce, into whichever rail ───────────────────────────────────────────────────
 	const nonceSpawn = recordingSpawn();
-	await dispatchFreshCall(REQUEST, HERDR_ENV, nonceSpawn.spawn, "fresh-call-dispatch-test-nonce");
-	const startCall = nonceSpawn.calls.find((call) => call[1] === "agent" && call[2] === "start");
+	const dispatchNonce = "mux-fresh-call-deadbeefdeadbeefdeadbeef";
+	await dispatchFreshCall(REQUEST, HERDR_ENV, nonceSpawn.spawn, dispatchNonce);
+	const tabCall = nonceSpawn.calls.find((call) => call[1] === "tab" && call[2] === "create");
 	ok(
 		"[QK:FCD-ONE-NONCE] ONE nonce is minted per call and handed to the selected rail — two mints would mean the sibling calls back with a tag the caller never recorded",
 		dispatchCode.split("mintNonce(").length - 1 === 1 &&
-			(startCall === undefined ||
-				startCall.some((token) => token.includes("fresh-call-dispatch-test-nonce")) ||
-				nonceSpawn.calls.length > 0),
+			(tabCall === undefined || tabCall.some((token) => token.includes(dispatchNonce)) || nonceSpawn.calls.length > 0),
 	);
 
 	// ── the composition root holds no synchronous child authority ────────────────────────

package/scripts/check-gate-qualification.ts

@@ -49,6 +49,7 @@ import * as path from "node:path";
 import { fileURLToPath } from "node:url";
 import {
 	classifyMutantRun,
+	countOccurrences,
 	createRepoSnapshot,
 	ManifestError,
 	type MutantManifest,
@@ -820,6 +821,7 @@ let manifestCount: number;
 	// manifest lost in a merge must name itself here — "0/0 killed" is not a pass.
 	// Extend this inventory and the manifests TOGETHER, never silently.
 	const EXPECTED_LANE_MUTANTS: Record<string, number> = {
+		"acp-backend-preflight": 1,
 		"acp-augment": 10,
 		"acp-cortex": 14,
 		"acp-launch-namespace": 2,
@@ -829,7 +831,7 @@ let manifestCount: number;
 		"acp-stream-hooks": 10,
 		"acp-usage-accounting": 12,
 		"agy-permission": 6,
-		"bridge-boot-resume": 3,
+		"bridge-boot-resume": 5,
 		"bridge-command-boot": 9,
 		"capability-cache": 3,
 		"codex-app-server-launch": 9,
@@ -839,6 +841,7 @@ let manifestCount: number;
 		"control-socket-disconnect": 4,
 		"copilot-birth": 19,
 		"copilot-launch": 14,
+		"pi-launch": 9,
 		"copilot-receive": 20,
 		"entwurf-peers": 1,
 		"fresh-call-dispatch": 12,
@@ -847,10 +850,10 @@ let manifestCount: number;
 		"herdr-placement": 13,
 		"herdr-plugin": 11,
 		"herdr-plugin-profile": 14,
-		"herdr-activation": 24,
+		"herdr-activation": 25,
 		"herdr-plugin-build": 13,
 		"herdr-runtime-bootstrap": 31,
-		"herdr-fresh-call": 37,
+		"herdr-fresh-call": 38,
 		"herdr-supply": 11,
 		"meta-facts": 4,
 		"peer-facts": 8,
@@ -858,7 +861,7 @@ let manifestCount: number;
 		"meta-identity": 4,
 		"meta-retire": 3,
 		"mux-boundary": 16,
-		"mux-fresh-call": 58,
+		"mux-fresh-call": 59,
 		"mux-launcher-fence": 8,
 		"mux-parent-artifact": 3,
 		"pack-install": 2,
@@ -901,6 +904,42 @@ let manifestCount: number;
 				(err instanceof Error ? err.message : String(err)),
 		);
 	}
+	// FIND MATCHES ITS SUBJECT, EXACTLY ONCE — the body's own precondition, hoisted into the head.
+	// `validateManifestSet` above proves the subject is TRACKED; it never opens it. So a change
+	// that edits a subject line a mutant quotes leaves the whole deterministic floor green and
+	// dies an hour later in CI or the release gate as MUTANT-STALE. That is exactly how the
+	// 0.23.2 pi bump landed: `pack_install_leaked_pi`'s pin regex moved 0.85.1 → 0.86.0 in
+	// run.sh, `scripts/mutants/pack-install.json` kept quoting the old line, and two claims came
+	// back NOT KILLED after ~50 minutes of mutant execution. The check costs one read per
+	// mutant and uses `countOccurrences` — the SAME function the body applies at
+	// mutation-qualify.ts:743 — so head and body cannot disagree about what "matches" means.
+	// This is a STALENESS check, not a kill-proof: it says the mutant still has a subject to
+	// corrupt, never that corrupting it is caught. That remains the body's verdict.
+	const stale: string[] = [];
+	for (const man of manifests) {
+		for (const m of man.mutants) {
+			const subjectAbs = path.join(REPO_DIR, m.subject);
+			let source: string;
+			try {
+				source = fs.readFileSync(subjectAbs, "utf8");
+			} catch (err) {
+				stale.push(`${man.lane}/${m.claim}: subject ${m.subject} unreadable (${(err as Error).message})`);
+				continue;
+			}
+			const n = countOccurrences(source, m.find.join("\n"));
+			if (n !== 1) stale.push(`${man.lane}/${m.claim}: find matched ${n}× in ${m.subject} (expected exactly 1)`);
+		}
+	}
+	assert.deepEqual(
+		stale,
+		[],
+		"[QK:MUTANT-FIND-MATCHES-SUBJECT] every mutant's `find` must match its subject exactly once. A find that " +
+			"matches 0× is a mutant whose production line moved out from under it — the body can write nothing, the " +
+			"verdict is MUTANT-STALE, and the claim is silently unproven; a find that matches 2+× cannot say WHICH " +
+			"occurrence it corrupts. Either way the manifest and the source have to move together. Found:\n" +
+			stale.join("\n"),
+	);
+
 	manifestCount = manifests.length;
 	console.log(`[${SURFACE}] ${selected.length} mutants across ${manifestCount} lanes (no tiers — full set every run)`);
 }
@@ -908,7 +947,8 @@ let manifestCount: number;
 if (MANIFESTS_ONLY) {
 	console.log(
 		`[check-gate-manifests] ok — runner self-test green, ${selected.length} committed mutants across ` +
-			`${manifestCount} lanes validated against the origin index, and the lane inventory matches its declared ` +
+			`${manifestCount} lanes validated against the origin index, every one of their \`find\` strings still ` +
+			"matching its subject exactly once, and the lane inventory matching its declared " +
 			"contract. ZERO mutants were executed and this repo was never snapshotted: the body " +
 			"(check-gate-qualification) owns that, unchanged.",
 	);

package/scripts/check-herdr-activation.ts

@@ -205,6 +205,21 @@ const {
 	COMPONENT_STATES,
 } = mod;
 
+/** The pi pin package.json declares — the SSOT `run.sh pi_supported_range` derives its range from. */
+const PI_PIN = (
+	JSON.parse(fs.readFileSync(path.join(REPO, "package.json"), "utf8")) as {
+		devDependencies: Record<string, string>;
+	}
+).devDependencies["@earendil-works/pi-coding-agent"];
+
+/** A `pi` stand-in that reports `version` and nothing else — enough for a `--version` floor probe. */
+function fakePi(dir: string, name: string, version: string): string {
+	fs.mkdirSync(dir, { recursive: true });
+	const file = path.join(dir, name);
+	fs.writeFileSync(file, `#!/bin/sh\necho ${version}\n`, { mode: 0o755 });
+	return file;
+}
+
 function world(tag: string): NodeJS.ProcessEnv {
 	const home = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), `entwurf-hac-${tag}-`)));
 	for (const d of [".config", ".state", ".data", ".cache", "pi-agent", ".claude"]) {
@@ -220,6 +235,13 @@ function world(tag: string): NodeJS.ProcessEnv {
 		XDG_CACHE_HOME: path.join(home, ".cache"),
 		PI_CODING_AGENT_DIR: path.join(home, "pi-agent"),
 		CLAUDE_CONFIG_DIR: path.join(home, ".claude"),
+		// PI_BIN is a sandbox root like the four XDG vars above, not a convenience. Since #119
+		// `install-user-scope` probes `pi --version` against the same closed range setup enforces,
+		// so leaving this unset would let the OPERATOR'S installed pi decide whether these cells
+		// pass — the gate would go red on a developer machine sitting one minor behind the pin and
+		// green on another, for reasons none of these cells are about. It is pinned IN RANGE here;
+		// the one cell whose subject IS the floor overrides it per run.
+		PI_BIN: fakePi(path.join(home, "bin"), "pi", PI_PIN),
 	};
 }
 
@@ -330,6 +352,57 @@ function ledgerWith(
 	);
 }
 
+// ── 1b. the plugin door enforces the SAME pi floor the setup door does ────────
+// #119: `setup` refuses an out-of-range pi by name before it writes any Pi wiring, but
+// `install-user-scope` — the door herdr plugin activation actually goes through
+// (plugins/herdr/lib/build.mjs → scripts/herdr-plugin-activate.mjs → `run.sh
+// install-user-scope --plugin-runtime …`) — had no version check at all. Two doors onto ONE
+// registration telling different truths is the whole defect, so the oracle here is the
+// out-of-range/in-range PAIR: the refusal alone would also be satisfied by a door that refuses
+// everything. Absent pi is deliberately NOT asserted as a third state — this verb invents no
+// presence verdict, setup owns that one.
+{
+	const env = world("pi-floor");
+	const bin = path.join(env.HOME as string, "bin");
+	// The supported range is DERIVED from the package.json devDep pin (run.sh
+	// `pi_supported_range`), so the fixtures are derived from it too — a hardcoded "0.85.1" here
+	// would silently stop being out-of-range the day the pin moves past it.
+	const [maj, min] = PI_PIN.split(".").map(Number);
+	const belowFloor = `${maj}.${min - 1}.0`;
+	const settingsPath = path.join(env.PI_CODING_AGENT_DIR as string, "settings.json");
+	fs.writeFileSync(settingsPath, '{"theme":"dark"}\n');
+	const before = fs.readFileSync(settingsPath, "utf8");
+
+	const stale = sh({ ...env, PI_BIN: fakePi(bin, "stale-pi", belowFloor) }, [
+		"install-user-scope",
+		"--plugin-runtime",
+		runtimeRootOf(env),
+	]);
+	const afterRefusal = fs.readFileSync(settingsPath, "utf8");
+	const current = sh({ ...env, PI_BIN: fakePi(bin, "current-pi", PI_PIN) }, [
+		"install-user-scope",
+		"--plugin-runtime",
+		runtimeRootOf(env),
+	]);
+	const afterAccept = readJson(settingsPath) as { packages?: string[] };
+
+	ok(
+		"[QK:HAC-PI-FLOOR-BOTH-DOORS] the plugin activation door enforces the SAME closed pi range as the " +
+			"setup door: a below-floor pi is a named FAIL that writes zero settings bytes (not a SKIP, not a " +
+			"silent write), while an in-range pi still registers — one registration reached through two doors " +
+			"may not report two different verdicts, and the range both read is DERIVED from one package.json pin " +
+			`(pin=${PI_PIN} stale=${belowFloor}/exit=${stale.status} named=${(stale.stderr || "").includes("outside the supported range")} ` +
+			`untouched=${before === afterRefusal} current=exit=${current.status}/packages=${JSON.stringify(afterAccept.packages)})`,
+		stale.status !== 0 &&
+			(stale.stderr || "").includes("[install-user-scope] pi: FAIL") &&
+			(stale.stderr || "").includes("outside the supported range") &&
+			before === afterRefusal &&
+			current.status === 0 &&
+			Array.isArray(afterAccept.packages) &&
+			afterAccept.packages.length === 1,
+	);
+}
+
 // ── 2. the plugin command is DERIVED from the runtime root, never supplied ─────
 {
 	const env = world("derived");

package/scripts/check-herdr-fresh-call.ts

@@ -270,7 +270,7 @@ const START_ERR = JSON.stringify({
 });
 
 const CALLER = "20260914T174741-2e9ba9";
-const NONCE = "herdr-fresh-call-0123456789abcdef01234567";
+const NONCE = "mux-fresh-call-0123456789abcdef01234567";
 const HERDR_ENV = { HERDR_ENV: "1", HERDR_BIN_PATH: "/home/operator/.local/bin/herdr", HERDR_PANE_ID: "w7:p1" };
 
 type ScriptedReply =
@@ -344,9 +344,11 @@ async function main(): Promise<void> {
 	const code = MODULE_SRC.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1");
 	const specifiers = [...MODULE_SRC.matchAll(/^import\s[^;]*?from\s+"([^"]+)";$/gm)].map((m) => m[1]);
 	ok(
-		"[QK:HFC-RAIL-IMPORT-FENCE] the herdr rail imports only node builtins and the neutral composition leaf — one mux or entwurf import here would re-couple the two rails and make either one undeletable",
+		"[QK:HFC-RAIL-IMPORT-FENCE] the herdr rail imports only node builtins, the neutral composition leaf, and the callback-env pair — one mux or entwurf import here would re-couple the two rails and make either one undeletable",
 		specifiers.length > 0 &&
-			specifiers.every((s) => s.startsWith("node:") || s === "./fresh-call-composition.ts") &&
+			specifiers.every(
+				(s) => s.startsWith("node:") || s === "./fresh-call-composition.ts" || s === "./callback-env.ts",
+			) &&
 			!/from\s+"\.\/(mux-|entwurf-)/.test(code),
 	);
 	// tmux is NAMED in this module, and only in one place: the refusal of a tmux seat input.
@@ -453,15 +455,29 @@ async function main(): Promise<void> {
 	// ── argv grammar ─────────────────────────────────────────────────────────────────────
 	// Pure builders are checked before full launch paths so a framing mutant is attributed to
 	// its own contract rather than making an earlier integration success cell fail first.
-	const tabArgs = buildHerdrTabCreateArgs({ workspaceId: "w7", cwd: "/repo/dir" });
+	const tabCallback = {
+		target: "20260101T010101-aaaaaa",
+		nonce: "mux-fresh-call-deadbeefdeadbeefdeadbeef",
+	};
+	const tabArgs = buildHerdrTabCreateArgs({ workspaceId: "w7", cwd: "/repo/dir", callback: tabCallback });
+	// The SPECIFIC claim runs before the umbrella one. `ok` throws, so the first red assertion is
+	// the only one a mutant run ever prints: with the exact-argv cell first, the callback-pair
+	// mutant died on the whole-argv claim below and never reached its own — a WRONG-REASON that
+	// qualification is exactly there to catch. Order is the fix; both cells keep their subject,
+	// and the argv cell keeps its own mutant, which drops `--no-focus` and this cell cannot see.
+	ok(
+		"[QK:HFC-CALLBACK-ENV] the launcher-computed callback pair rides as two more --env assignments beside the scrub",
+		tabArgs.includes("ENTWURF_CALLBACK_TARGET=20260101T010101-aaaaaa") &&
+			tabArgs.includes("ENTWURF_CALLBACK_NONCE=mux-fresh-call-deadbeefdeadbeefdeadbeef"),
+	);
 	ok(
 		"[QK:HFC-TAB-ARGV] one placement policy — a NEW TAB in the caller's own workspace, named explicitly so herdr cannot default it to the focused one, focus left alone, cwd carried literally, and BOTH identity carriers scrubbed by explicit repeated --env",
 		tabArgs.join(" ") ===
-			"tab create --workspace w7 --no-focus --cwd /repo/dir --env PI_SESSION_ID= --env PI_AGENT_ID=",
+			"tab create --workspace w7 --no-focus --cwd /repo/dir --env PI_SESSION_ID= --env PI_AGENT_ID= --env ENTWURF_CALLBACK_TARGET=20260101T010101-aaaaaa --env ENTWURF_CALLBACK_NONCE=mux-fresh-call-deadbeefdeadbeefdeadbeef",
 	);
 	ok(
 		"a cwd-free tab create omits --cwd entirely rather than sending an empty value, and the rail adds no layout axis of its own — no label, no ratio, no direction",
-		!buildHerdrTabCreateArgs({ workspaceId: "w7" }).includes("--cwd") &&
+		!buildHerdrTabCreateArgs({ workspaceId: "w7", callback: tabCallback }).includes("--cwd") &&
 			!tabArgs.includes("--label") &&
 			!tabArgs.includes("--ratio") &&
 			!tabArgs.includes("--direction"),