@junghanacs/entwurf 0.23.0 → 0.24.0

package/scripts/check-herdr-sandbox.ts

@@ -291,7 +291,15 @@ async function main(): Promise<void> {
 		if (callerPane?.workspaceId === undefined) {
 			fail(`pane get of the caller pane failed or carried no workspace: ${callerGet.stderr || callerGet.stdout}`);
 		}
-		const tabRun = herdr(bin, sandbox, buildHerdrTabCreateArgs({ workspaceId: callerPane.workspaceId, cwd: REPO_DIR }));
+		const tabCallback = {
+			target: "20260101T010101-aaaaaa",
+			nonce: "mux-fresh-call-deadbeefdeadbeefdeadbeef",
+		};
+		const tabRun = herdr(
+			bin,
+			sandbox,
+			buildHerdrTabCreateArgs({ workspaceId: callerPane.workspaceId, cwd: REPO_DIR, callback: tabCallback }),
+		);
 		const tab = tabRun.status === 0 ? parseHerdrTabCreateResponse(tabRun.stdout) : null;
 		if (tab === null) fail(`tab create failed or was unreadable: ${tabRun.stderr || tabRun.stdout}`);
 		const tabRootPane = tab.rootPane;
@@ -401,7 +409,11 @@ async function main(): Promise<void> {
 			);
 		}
 
-		const spareRun = herdr(bin, sandbox, buildHerdrTabCreateArgs({ workspaceId: callerPane.workspaceId }));
+		const spareRun = herdr(
+			bin,
+			sandbox,
+			buildHerdrTabCreateArgs({ workspaceId: callerPane.workspaceId, callback: tabCallback }),
+		);
 		const spareTab = spareRun.status === 0 ? parseHerdrTabCreateResponse(spareRun.stdout) : null;
 		if (spareTab === null)
 			fail(`the second tab create failed or was unreadable: ${spareRun.stderr || spareRun.stdout}`);

package/scripts/check-install-container.sh

@@ -321,7 +321,7 @@ function finish(t) {
   // artifact ship" is precisely the question it owns. The subset form named only the five
   // pre-0.14 verbs and would have accepted a candidate with no entwurf_fresh_call /
   // entwurf_resume_call; equality also refuses an extra or duplicated verb.
-  const EXPECT_TOOLS = ['entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
+  const EXPECT_TOOLS = ['entwurf_callback', 'entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
   if (names.length !== EXPECT_TOOLS.length || EXPECT_TOOLS.some((n, i) => names[i] !== n)) {
     console.error('MCP tool set MISMATCH — want exactly [' + EXPECT_TOOLS.join(',') + '] got [' + names.join(',') + ']');
     process.exit(1);

package/scripts/check-pi-launch.ts

@@ -0,0 +1,361 @@
+/**
+ * check-pi-launch — deterministic gate for the MANAGED pi launch (`entwurf pi`, #118 홉 2).
+ * Hermetic: no real pi, no network, no model turn, no write outside its own temp root.
+ *
+ * SAME ORACLE AS check-copilot-launch, and deliberately the same one: the subject is a
+ * process REPLACEMENT, so the truth is a FAKE VENDOR — a real executable named `pi` on a
+ * sandbox PATH that reports the argv, environment and pid it was actually handed. Nothing
+ * below is asserted by reading the launcher's source, and the launcher is driven through
+ * its PUBLIC address (`run.sh pi`) because the dispatcher's own argv handling is part of
+ * the contract. Reusing that harness shape rather than importing it is the honest split:
+ * the two launchers share a posture, not a body, and a shared fixture would have to grow a
+ * vendor-name parameter that neither production path has.
+ *
+ * WHY THE PRECONDITION SET IS EMPTY, measured rather than assumed. `entwurf copilot` checks
+ * six receiver-state facts before it execs, because setting its flag is a PROMISE of a
+ * doorbell that may not exist. `entwurf pi` promises nothing pi does not already own: on a
+ * host where the entwurf extension is not registered, `pi --entwurf-control` refuses itself
+ * with `Error: Unknown option: --entwurf-control` and exit 1 (`[측정 2026-09-20]` pi 0.86.0,
+ * sandbox HOME + PI_CODING_AGENT_DIR, that exact stderr line and exit 1). A
+ * pre-check here would duplicate that refusal and go stale the day pi renames it.
+ *
+ * WHY ONE RECURSION FENCE AND NOT TWO. The sentinel closes the only real loop — a PATH
+ * executable named `pi` that shells back to `entwurf pi`. Copilot's second fence (resolve
+ * the binary, refuse our own entrypoints) closes a case that is NOT a loop here, and the
+ * cell below measures that rather than asserting it: a PATH `pi` symlinked to run.sh is
+ * exec'd as `run.sh --entwurf-control …`, an unknown verb this dispatcher already refuses.
+ *
+ * WHY THE FLAG IS ADDED AND NEVER DEDUPLICATED. `pit`/`pius`-style operator wrappers already
+ * pass `--entwurf-control`; passing it twice was measured byte-identical to passing it once
+ * (pi 0.85.1, extension registered — that receipt was NOT retaken at 0.86.0, because it needs a
+ * host with the extension registered and taking it would have meant opening a control session on
+ * the operator's own pi; the 0.86.0 re-measure above covers the unregistered refusal instead). The launcher therefore injects exactly ONE and leaves
+ * the operator's copies alone — an argv scan would be code earning nothing.
+ */
+
+import assert from "node:assert/strict";
+import { execFileSync, spawnSync } from "node:child_process";
+import {
+	chmodSync,
+	existsSync,
+	mkdirSync,
+	mkdtempSync,
+	readFileSync,
+	rmSync,
+	symlinkSync,
+	writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const REPO = path.join(path.dirname(fileURLToPath(import.meta.url)), "..");
+const RUN_SH = path.join(REPO, "run.sh");
+
+let passed = 0;
+function ok(label: string, cond: boolean, detail = ""): void {
+	assert.ok(cond, detail ? `${label}\n${detail}` : label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+// ── the flag SSOT, read as text ──────────────────────────────────────────────
+// The shell cannot import a TypeScript constant, so the launcher spells the flag as a
+// literal and this gate is what keeps the two in step. The SSOT is the constant; every
+// argv-composing site below must carry exactly its value.
+const storeSrc = readFileSync(path.join(REPO, "pi-extensions", "lib", "acp", "session-store.ts"), "utf8");
+const flagMatch = /export const ENTWURF_CONTROL_FLAG = "([^"]+)";/.exec(storeSrc);
+assert.ok(flagMatch, "ENTWURF_CONTROL_FLAG is not declared in pi-extensions/lib/acp/session-store.ts");
+const FLAG = flagMatch[1];
+
+const root = mkdtempSync(path.join(tmpdir(), "entwurf-pi-launch."));
+try {
+	const bin = path.join(root, "bin");
+	mkdirSync(bin, { recursive: true });
+
+	// The fake vendor, installed under the REAL name `pi`. There is no "which command
+	// stands in for the vendor" switch: a production env seam that can redirect an exec is
+	// an authority, not a test convenience.
+	const vendor = path.join(bin, "pi");
+	writeFileSync(
+		vendor,
+		`#!/usr/bin/env bash
+echo "PID=$$"
+echo "SENTINEL=[\${ENTWURF_PI_LAUNCH_ACTIVE-<unset>}]"
+for a in "$@"; do printf 'ARG<%s>\\n' "$a"; done
+exit "\${FAKE_PI_EXIT:-0}"
+`,
+	);
+	chmodSync(vendor, 0o755);
+
+	// A PATH with no `pi` anywhere on it — built by dropping every real entry that holds
+	// one, rather than by emptying PATH (the launcher still needs bash and friends).
+	// The sandbox is TOTAL, the same way check-copilot-launch's is. The launcher writes
+	// nothing itself, but it EXECS a vendor, and a fixture that leaves the operator's HOME
+	// and XDG roots reachable is one careless vendor away from touching them. Naming every
+	// root explicitly is also what #119 asks of each test rather than of each gate.
+	const sandboxEnv = {
+		HOME: path.join(root, "home"),
+		XDG_DATA_HOME: path.join(root, "xdg", "data"),
+		XDG_CONFIG_HOME: path.join(root, "xdg", "config"),
+		XDG_STATE_HOME: path.join(root, "xdg", "state"),
+		XDG_CACHE_HOME: path.join(root, "xdg", "cache"),
+		PI_CODING_AGENT_DIR: path.join(root, "pi-agent"),
+	};
+	for (const d of Object.values(sandboxEnv)) mkdirSync(d, { recursive: true });
+
+	const pathWithoutVendor = (process.env.PATH ?? "")
+		.split(":")
+		.filter((d) => d !== "" && !existsSync(path.join(d, "pi")))
+		.join(":");
+
+	interface Run {
+		status: number | null;
+		out: string;
+		args: string[];
+		sentinel: string;
+		pid: string;
+	}
+	function launch(args: string[], extraEnv: Record<string, string> = {}, withVendor = true): Run {
+		const r = spawnSync("bash", [RUN_SH, "pi", ...args], {
+			cwd: root,
+			encoding: "utf8",
+			env: {
+				...process.env,
+				...sandboxEnv,
+				PATH: withVendor ? `${bin}:${pathWithoutVendor}` : pathWithoutVendor,
+				ENTWURF_PI_LAUNCH_ACTIVE: undefined as unknown as string,
+				FAKE_PI_EXIT: undefined as unknown as string,
+				...extraEnv,
+			},
+		});
+		const out = `${r.stdout ?? ""}${r.stderr ?? ""}`;
+		const argv: string[] = [];
+		for (const line of out.split("\n")) {
+			const m = /^ARG<([\s\S]*)>$/.exec(line);
+			if (m) argv.push(m[1]);
+		}
+		return {
+			status: r.status,
+			out,
+			args: argv,
+			sentinel: /^SENTINEL=\[(.*)\]$/m.exec(out)?.[1] ?? "<no-launch>",
+			pid: /^PID=(.*)$/m.exec(out)?.[1] ?? "",
+		};
+	}
+
+	// ── 1. the flag literal agrees with its SSOT, everywhere argv is composed ──
+	{
+		// CODE only. The branch explains itself at length and quotes the flag four times in
+		// prose; a literal check that read those goes green on a launcher whose actual exec
+		// line carries a typo — measured, and it is why the comments are dropped first.
+		const branch = /^ {2}pi\)$[\s\S]*?^ {4};;$/m.exec(readFileSync(RUN_SH, "utf8"))?.[0] ?? "";
+		const launcher = branch
+			.split("\n")
+			.filter((line) => !/^\s*#/.test(line))
+			.join("\n");
+		// Deliberately narrow: this cell owns the LITERAL and nothing else. Asserting the
+		// whole exec line here would swallow every other claim below — a mutation of the
+		// argv order, the quoting or the exec itself would all die on this assertion first,
+		// and each mutant is supposed to name exactly one broken thing. The token boundary
+		// is what makes a near-miss like `--entwurf-controll` a failure rather than a
+		// substring hit.
+		ok(
+			"[QK:PILAUNCH-FLAG-SSOT] the run.sh launcher spells the flag exactly as ENTWURF_CONTROL_FLAG declares it — the shell cannot import the constant, so the literal is checked as a whole token",
+			new RegExp(`(^|\\s)${FLAG.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(\\s|$)`, "m").test(launcher),
+			`FLAG=${FLAG}\n--- launcher branch, comments dropped ---\n${launcher}`,
+		);
+		// EXHAUSTIVE, not a list. The first cut named five files and claimed "every
+		// argv-composing site"; cross-review found eight more that the list did not know
+		// about. They all happened to be spelled correctly, so there was no false success —
+		// but a drift OUTSIDE the list would have passed silently, which is the same gate
+		// rot in a slower form. So the sweep walks every tracked source file and requires
+		// that every `--entwurf-…` token it finds IS this flag. A typo, a rename, or a
+		// second spelling anywhere becomes a named red, and a new call site needs no edit
+		// here to be covered.
+		//
+		// Prose is excluded and that exclusion is the load-bearing part: comments and
+		// markdown quote the flag constantly, and a checker that read them would be a spell
+		// checker for documentation rather than a guard on what pi actually receives. Only
+		// lines that can compose argv are read.
+		const tracked = execFileSync(
+			"git",
+			["ls-files", "--", "scripts", "pi-extensions", "mcp", "demo", "plugins", "run.sh"],
+			{
+				cwd: REPO,
+				encoding: "utf8",
+			},
+		)
+			.split("\n")
+			.filter((f) => f.length > 0 && /\.(ts|mjs|js|sh)$/.test(f));
+
+		// Narrowed to the DRIFT class, and the first run is why. A pattern of `--entwurf-…`
+		// swept up `--entwurf-bootstrap` (scripts/check-omp-birth-hook.ts), which is a real and
+		// unrelated flag — this cell is not the registry of every entwurf flag. What it owns is
+		// that no VARIANT of the control flag exists: `--entwurf-controll`, `--entwurf-control-x`
+		// and friends. A wholesale rename to a different word is a different change, and the SSOT
+		// cell above catches it by reading the constant.
+		const FLAGLIKE = new RegExp(`${FLAG.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}[A-Za-z0-9-]*`, "g");
+		const wrong: string[] = [];
+		let sites = 0;
+		for (const rel of tracked) {
+			const body = readFileSync(path.join(REPO, rel), "utf8");
+			body.split("\n").forEach((line, i) => {
+				// A whole-line comment in any of the three syntaxes these files use. An inline
+				// trailing comment is NOT stripped: `#` and `//` both appear inside real argv
+				// strings here, and guessing where a comment starts would drop live code.
+				if (/^\s*(\/\/|#|\*|\/\*)/.test(line)) return;
+				for (const m of line.matchAll(FLAGLIKE)) {
+					sites++;
+					if (m[0] !== FLAG) wrong.push(`${rel}:${i + 1}: ${m[0]}`);
+				}
+			});
+		}
+		ok(
+			`[QK:PILAUNCH-FLAG-SITES] every control-flag PREFIX VARIANT in tracked code is exactly the constant (${sites} occurrences swept, prose excluded)`,
+			wrong.length === 0,
+			`FLAG=${FLAG}\ndisagreeing:\n${wrong.join("\n")}`,
+		);
+		// A sweep that found nothing would also report zero disagreements, so the count is
+		// asserted too: the launcher alone guarantees at least one.
+		ok(
+			"[QK:PILAUNCH-FLAG-SWEEP-REACHES] the sweep actually reached code that names the flag",
+			sites > 1,
+			`sites=${sites}`,
+		);
+	}
+
+	// ── 2. the dispatcher verb must not reach the vendor ──────────────────────
+	{
+		const r = launch(["--model", "x"]);
+		ok(
+			"[QK:PILAUNCH-VERB-DROPPED] the dispatcher verb never reaches the vendor — without the shift, `pi` arrives as a prompt argument",
+			r.status === 0 && !r.args.includes("pi"),
+			`argv: ${JSON.stringify(r.args)}`,
+		);
+		ok(
+			"[QK:PILAUNCH-FLAG-FIRST] the injected flag is the FIRST token, so the control socket is stood up before anything the operator asked for",
+			r.args[0] === FLAG,
+			`argv: ${JSON.stringify(r.args)}`,
+		);
+		ok(
+			"[QK:PILAUNCH-NOTHING-ELSE-INJECTED] the launcher adds the flag and NOTHING else — operator taste is not a launcher decision (Rule 9)",
+			JSON.stringify(r.args) === JSON.stringify([FLAG, "--model", "x"]),
+			`argv: ${JSON.stringify(r.args)}`,
+		);
+	}
+
+	// ── 3. operator argv crosses byte-identical ───────────────────────────────
+	{
+		const operator = ["--model", "a b", "", "-", "--", "한글 인자", "  spaced  "];
+		const r = launch(operator);
+		ok(
+			"[QK:PILAUNCH-ARGV-BYTES] every operator element crosses byte-identical — empty strings, embedded spaces, a bare dash, the terminator and non-ASCII",
+			JSON.stringify(r.args) === JSON.stringify([FLAG, ...operator]),
+			`expected: ${JSON.stringify([FLAG, ...operator])}\nactual:   ${JSON.stringify(r.args)}`,
+		);
+	}
+
+	// ── 4. the flag is ADDED, never deduplicated ──────────────────────────────
+	{
+		const r = launch([FLAG, "--model", "x"]);
+		ok(
+			"[QK:PILAUNCH-FLAG-NOT-DEDUPED] an operator who already passes the flag gets it twice, because pi was measured to eat the duplicate and a scan would earn nothing",
+			JSON.stringify(r.args) === JSON.stringify([FLAG, FLAG, "--model", "x"]),
+			`argv: ${JSON.stringify(r.args)}`,
+		);
+	}
+
+	// ── 5. the vendor's exit status is this command's exit status ─────────────
+	// THIS CELL CARRIES NO MUTANT, and the reason is measured rather than conceded: run.sh
+	// is `set -euo pipefail` (run.sh:14), so every mutation that stops the vendor status
+	// from reaching the caller also stops `exec` from replacing the process. The non-exec
+	// form still exits 7, because set -e aborts before a planted `exit 0` can run. A mutant
+	// that kills two claims is not an attributable mutant, so this stands on its assertion
+	// alone until that coupling changes.
+	// Asserted BEFORE the pid cell on purpose: dropping `exec` for a plain call still
+	// propagates the status, while running the vendor and then exiting 0 breaks both. With
+	// the status checked first each of those two mutations lands on exactly one claim.
+	{
+		const r = launch([], { FAKE_PI_EXIT: "7" });
+		ok(
+			"[QK:PILAUNCH-EXIT-PASSTHROUGH] the vendor's exit status is the launch's exit status",
+			r.status === 7,
+			`status=${r.status}`,
+		);
+	}
+
+	// ── 6. exec, not fork: the pid survives ───────────────────────────────────
+	{
+		const r = spawnSync("bash", ["-c", `echo "SHELL_PID=$$"; exec bash "${RUN_SH}" pi`], {
+			cwd: root,
+			encoding: "utf8",
+			env: {
+				...process.env,
+				...sandboxEnv,
+				PATH: `${bin}:${pathWithoutVendor}`,
+				ENTWURF_PI_LAUNCH_ACTIVE: undefined as unknown as string,
+			},
+		});
+		const shellPid = /^SHELL_PID=(\d+)$/m.exec(r.stdout ?? "")?.[1];
+		const vendorPid = /^PID=(\d+)$/m.exec(r.stdout ?? "")?.[1];
+		ok(
+			"[QK:PILAUNCH-EXEC-KEEPS-PID] the vendor REPLACES this process — a fork would leave run.sh as a parent that supervises nothing",
+			Boolean(shellPid) && shellPid === vendorPid,
+			`shell=${shellPid} vendor=${vendorPid}`,
+		);
+	}
+
+	// ── 7. an absent vendor is a NAMED refusal, never a quiet success ─────────
+	{
+		const r = launch([], {}, false);
+		ok(
+			"[QK:PILAUNCH-VENDOR-ABSENT] with no `pi` on PATH the launch refuses by name and non-zero, and never reports success",
+			r.status !== 0 && r.out.includes("no 'pi' executable found on PATH") && r.pid === "",
+			`status=${r.status}\n${r.out}`,
+		);
+	}
+
+	// ── 8. the recursion fence, and the sentinel that carries it ──────────────
+	{
+		const armed = launch([]);
+		ok(
+			"[QK:PILAUNCH-SENTINEL-EXPORTED] the sentinel is EXPORTED, so a PATH `pi` that shells back here sees it on re-entry",
+			armed.sentinel === "1",
+			`sentinel=${armed.sentinel}`,
+		);
+		const r = launch([], { ENTWURF_PI_LAUNCH_ACTIVE: "1" });
+		ok(
+			"[QK:PILAUNCH-RECURSION-FENCE] a re-entered launch refuses by name instead of spinning forever behind a hung terminal",
+			r.status !== 0 && r.out.includes("recursive managed launch detected") && r.pid === "",
+			`status=${r.status}\n${r.out}`,
+		);
+	}
+
+	// ── 9. the case copilot's SECOND fence covers, measured here instead ───────
+	{
+		const loopBin = path.join(root, "loopbin");
+		mkdirSync(loopBin, { recursive: true });
+		symlinkSync(RUN_SH, path.join(loopBin, "pi"));
+		const r = spawnSync("bash", [RUN_SH, "pi"], {
+			cwd: root,
+			encoding: "utf8",
+			timeout: 30_000,
+			env: {
+				...process.env,
+				...sandboxEnv,
+				PATH: `${loopBin}:${pathWithoutVendor}`,
+				ENTWURF_PI_LAUNCH_ACTIVE: undefined as unknown as string,
+			},
+		});
+		ok(
+			"[QK:PILAUNCH-SYMLINK-NOT-A-LOOP] a PATH `pi` symlinked to run.sh is exec'd as an unknown verb and fails closed — this is why the second fence copilot carries is not needed here",
+			r.status !== 0 && r.signal === null,
+			`status=${r.status} signal=${r.signal}`,
+		);
+	}
+
+	console.log(`\ncheck-pi-launch: ${passed} checks passed`);
+} finally {
+	rmSync(root, { recursive: true, force: true });
+}

package/scripts/check-release-gate-outcomes.ts

@@ -316,6 +316,13 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 		// history that earns a place in the gate blocking every cut. On-demand, with the exclusion
 		// stated where an operator reads it.
 		"smoke-herdr-plugin-build-live": ["VERIFY.md", "The release aggregate does not require the plugin build smoke"],
+		// #118 홉 1, third on the same rail and for the same two reasons: herdr is OPTIONAL, so an
+		// aggregate that required this would block a cut on a host that does not have the rail at
+		// all; and first evidence precedes promotion — this smoke's acceptance runs are hours old,
+		// which is evidence the axis works rather than the run history that earns a place in the
+		// gate blocking every cut. It also needs a Docker daemon and the public network, neither of
+		// which the aggregate owns. On-demand, with the exclusion stated where an operator reads it.
+		"smoke-herdr-raw-install-live": ["VERIFY.md", "The plugin's FIRST USER PATH is its own on-demand axis"],
 	};
 
 	const allLive = globSync("scripts/smoke-*live*.{ts,sh}", { cwd: REPO_DIR })

package/scripts/inventory-verification-surface.ts

@@ -69,7 +69,22 @@ function listWorkSurface(pathspec: string[]): string[] {
 }
 
 const legacyFiles = listWorkSurface(["scripts/"]);
-const frameworkFiles = listWorkSurface(["test/", "vitest.config.ts"]);
+// The framework axis is every vitest-managed lane, and since #119 V2 that is TWO locations:
+// the migration lane under test/, and tests written beside the behaviour they certify. The
+// pathspecs are `:(glob)` so `**` means "at any depth" and nothing but a test file enters —
+// pi-extensions/ and plugins/ are product trees, and pulling them in whole would put 20k lines
+// of product into a VERIFICATION denominator.
+//
+// This is what keeps the combined total honest through the V3 migration: a gate moving from
+// scripts/ to a file beside its subject moves lines BETWEEN axes, and only a drop in the
+// combined number is subtraction. Before this, such a gate left the denominator entirely and
+// every migrated line read as a deletion.
+const frameworkFiles = listWorkSurface([
+	"test/",
+	"vitest.config.ts",
+	":(glob)pi-extensions/**/*.test.ts",
+	":(glob)plugins/herdr/**/*.test.mjs",
+]);
 
 function countLines(rel: string): number {
 	const body = fs.readFileSync(path.join(REPO_DIR, rel), "utf8");
@@ -83,6 +98,20 @@ const H_TEXT = /readFileSync[^\n]*(?:pi-extensions|mcp\/|\.ts["'`]|SOURCE|SRC)|\
 const H_PROC = /\b(?:spawn|spawnSync|execFile|execFileSync|execSync|fork)\s*\(|subprocess\.(?:run|Popen|check_)/;
 const H_NET = /\b(?:http|net)\.createServer|\.listen\(/;
 const H_FS = /from\s+["']node:fs["']|require\(["']node:fs["']\)/;
+// H_IMPORTS asks for an ASCENDING path into a product tree, because every gate under scripts/
+// has to climb to reach one. A test written beside its subject never climbs: it imports
+// `./subject.ts`. The distinction is the file's own location, not its spelling — a lane living
+// inside pi-extensions/ or plugins/ that imports a relative sibling is importing product by
+// construction. Applied ONLY to those lanes: scripts/check-*.ts also import `./lib/*`, and that
+// is the verification surface importing itself, which is a different fact the mutant inventory
+// already counts as infra-subject.
+const H_IMPORTS_SIBLING = /(?:from\s+["']|import\(\s*["'])\.{1,2}\//;
+// Wider than the framework-axis glob (`plugins/herdr/**`) on purpose, and the asymmetry only
+// runs one way: the glob decides what ENTERS the denominator, this decides how a file already
+// in it is read. A test under some other plugins/ package would have to be admitted by the
+// glob first, so the looser shape here cannot inflate a count — it only keeps the classifier
+// from throwing on the day that glob widens.
+const BESIDE_BEHAVIOUR = /^(pi-extensions|plugins)\/.*\.test\.(ts|mjs)$/;
 // H_LIVE asks whether the file's OWN CODE reads the LIVE switch — not whether the
 // three letters appear. The naive `\bLIVE=1\b` form classified
 // scripts/check-release-gate-outcomes.ts as real-live because that gate QUOTES the
@@ -145,6 +174,45 @@ const CLASS_OVERRIDES: Record<string, { cls: SemanticClass; reason: string }> =
 		cls: "source-topology",
 		reason: "asserts the scrubbed parent-transcript fixture's recorded shape — an artifact contract, no product run",
 	},
+	// #119 V1 measured the classifier THROWING on these four at HEAD 5062147 — the
+	// assertion below did its job and named real drift, in three distinct shapes. None
+	// of them is reachable by widening H_IMPORTS: there is no literal `../plugins/`
+	// import anywhere under scripts/ or test/ (measured, 0 matches), so a `plugins`
+	// alternative in that predicate would match nothing and only claim coverage it
+	// does not have.
+	//
+	// Shape 1 — the herdr gates reach their subject through a RUNTIME-ASSEMBLED
+	// dynamic import, `await import(pathToFileURL(LEAF).href)`. H_IMPORTS matches a
+	// literal specifier by design (a computed one cannot be read as text without
+	// executing the gate), so these two are override territory, not predicate
+	// territory.
+	"scripts/check-herdr-plugin-profile.ts": {
+		cls: "behavioral-contract",
+		reason:
+			"dynamically imports plugins/herdr/lib/integration-profile.mjs and source-reads that same leaf — executes product code, no process",
+	},
+	"scripts/check-herdr-runtime-bootstrap.ts": {
+		cls: "behavioral-contract",
+		reason:
+			"dynamically imports the herdr runtime leaf and its plugin re-export and drives them against mkdtemp HOME/XDG fixtures — executes product code, spawns nothing",
+	},
+	// Shape 2 — the reads go through a local `read(rel)` helper, so H_TEXT's
+	// line-level form (readFileSync on the same line as the path literal) cannot see
+	// them. No product is executed: this is a manifest/installer/CI structure gate.
+	"scripts/check-herdr-supply.ts": {
+		cls: "source-topology",
+		reason:
+			"reads the supply manifest, the CI installer and the workflow as text through a read() helper; runs no product",
+	},
+	// Shape 3 — a vitest lane whose SUBJECT is the verification surface itself
+	// (scripts/lib), not pi-extensions/ or mcp/. The mutant inventory below already
+	// counts that as infra-subject; the class axis needs the same honesty rather than
+	// a widened "product import" predicate that would blur the two.
+	"test/tmux-coordinate-row.test.ts": {
+		cls: "pure-unit",
+		reason:
+			"executes the scripts/lib/tmux-coordinate-row leaf — an INFRA-subject lane; no fs, no text read, no process",
+	},
 };
 
 /**
@@ -187,9 +255,13 @@ function classify(rel: string, axis: "legacy" | "framework"): Row {
 	const body = isShell ? fs.readFileSync(path.join(REPO_DIR, rel), "utf8") : effectiveBody(rel);
 	const base = path.basename(rel);
 
+	// One notion of "imports product", used by BOTH axes below so the style table and the class
+	// table can never disagree about the same file.
+	const importsProduct = H_IMPORTS.test(body) || (BESIDE_BEHAVIOUR.test(rel) && H_IMPORTS_SIBLING.test(body));
+
 	const style: Style = (() => {
 		if (isShell) return "shell";
-		const axes = [H_IMPORTS.test(body), H_TEXT.test(body), H_PROC.test(body)];
+		const axes = [importsProduct, H_TEXT.test(body), H_PROC.test(body)];
 		const n = axes.filter(Boolean).length;
 		if (n >= 2) return "mixed";
 		if (axes[0]) return "imports-product";
@@ -207,11 +279,11 @@ function classify(rel: string, axis: "legacy" | "framework"): Row {
 				? "package-install"
 				: isShell || H_PROC.test(body) || H_NET.test(body)
 					? "hermetic-integration"
-					: H_TEXT.test(body) && !H_IMPORTS.test(body)
+					: H_TEXT.test(body) && !importsProduct
 						? "source-topology"
-						: H_IMPORTS.test(body) && (H_TEXT.test(body) || H_FS.test(body))
+						: importsProduct && (H_TEXT.test(body) || H_FS.test(body))
 							? "behavioral-contract"
-							: H_IMPORTS.test(body)
+							: importsProduct
 								? "pure-unit"
 								: null;
 	if (cls === null) {
@@ -224,7 +296,7 @@ function classify(rel: string, axis: "legacy" | "framework"): Row {
 
 // ── buckets ──────────────────────────────────────────────────────────────────
 const legacyGates = legacyFiles.filter((f) => /^scripts\/(check-|smoke-)/.test(f));
-const frameworkGates = frameworkFiles.filter((f) => /^test\/.*\.test\.ts$/.test(f));
+const frameworkGates = frameworkFiles.filter((f) => /\.test\.(ts|mjs)$/.test(f));
 const lib = legacyFiles.filter((f) => f.startsWith("scripts/lib/"));
 const mutantManifests = legacyFiles.filter((f) => f.startsWith("scripts/mutants/") && f.endsWith(".json"));
 const fixtures = legacyFiles.filter((f) => f.startsWith("scripts/fixtures/"));
@@ -254,14 +326,16 @@ rule predicates (re-derive any number from these):
   H_PROC     ${H_PROC}
   H_NET      ${H_NET}
   H_FS       ${H_FS}
+  H_IMPORTS_SIBLING ${H_IMPORTS_SIBLING}   (only for ${BESIDE_BEHAVIOUR})
   H_LIVE     ${H_LIVE}
 H_LIVE is applied to the CODE-ONLY projection (comments and inert literals blanked;
 shell double-quoted expansions kept), so a gate that merely QUOTES "LIVE=1" is not
 real-live. Two-tier gates are listed under the class breakdown.
 semantic classes, first match wins: override → real-live (name -live | H_LIVE on code) →
   package-install (name pack|install) → hermetic-integration (.sh | H_PROC | H_NET) →
-  source-topology (H_TEXT ∧ ¬H_IMPORTS) → behavioral-contract (H_IMPORTS ∧ (H_TEXT ∨ H_FS)) →
-  pure-unit (H_IMPORTS) → ERROR (unclassified is asserted zero)
+  source-topology (H_TEXT ∧ ¬importsProduct) → behavioral-contract (importsProduct ∧ (H_TEXT ∨ H_FS)) →
+  pure-unit (importsProduct) → ERROR (unclassified is asserted zero)
+importsProduct = H_IMPORTS, plus H_IMPORTS_SIBLING for a BESIDE_BEHAVIOUR lane
 test/*.test.ts is classified together with the ./helpers/* bodies it imports.
 `);
 
@@ -275,9 +349,11 @@ console.log(`  scripts/lib/:                    ${lib.length} files, ${total(lib
 console.log(`  scripts/mutants/:                ${mutantManifests.length} manifests`);
 console.log(`  scripts/fixtures/:               ${fixtures.length} files`);
 console.log(`  other:                           ${legacyOther.length} files, ${total(legacyOther)} lines`);
-console.log(`framework axis (test/ + vitest.config.ts): ${frameworkFiles.length} files, ${frameworkTotal} lines`);
 console.log(
-	`  vitest lanes (test/**/*.test.ts):  ${frameworkGates.length} files, ${sum(rows.filter((r) => r.axis === "framework"))} lines`,
+	`framework axis (vitest-managed, both locations):  ${frameworkFiles.length} files, ${frameworkTotal} lines`,
+);
+console.log(
+	`  lanes (test/** + beside behaviour): ${frameworkGates.length} files, ${sum(rows.filter((r) => r.axis === "framework"))} lines`,
 );
 console.log(`  helpers/config:                    ${frameworkSupport.length} files, ${total(frameworkSupport)} lines`);
 console.log(

package/scripts/lib/mutation-qualify.ts

@@ -617,7 +617,7 @@ function sha256File(file: string): string {
 	return createHash("sha256").update(fs.readFileSync(file)).digest("hex");
 }
 
-function countOccurrences(haystack: string, needle: string): number {
+export function countOccurrences(haystack: string, needle: string): number {
 	let count = 0;
 	let at = haystack.indexOf(needle);
 	while (at !== -1) {

package/scripts/mutants/acp-backend-preflight.json

@@ -0,0 +1,20 @@
+{
+	"schemaVersion": 1,
+	"lane": "acp-backend-preflight",
+	"mutants": [
+		{
+			"claim": "ACP-PREFLIGHT-REPLAYS-TRANSCRIPT-TOOLS",
+			"title": "reading a `context.tools` field instead of replaying the transcript makes the exclude-tools preflight unfireable on every pi 0.86 turn — the operator is told a tool is excluded while the backend still runs it",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\t\tconst activeToolNames = getCurrentTools(context.messages).map((t) => t.name);"],
+			"replace": [
+				"\t\t\tconst activeToolNames =",
+				"\t\t\t\t(context as unknown as { tools?: { name: string }[] }).tools?.map((t) => t.name) ?? [\"read\", \"bash\", \"edit\", \"write\"];"
+			],
+			"gate": ["bash", "run.sh", "check-acp-backend-preflight"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACP-PREFLIGHT-REPLAYS-TRANSCRIPT-TOOLS]",
+			"signatureSource": "scripts/check-acp-backend-preflight.ts"
+		}
+	]
+}

package/scripts/mutants/bridge-boot-resume.json

@@ -40,6 +40,32 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:BRIDGEBOOT-PUBLIC-SURFACE-EXACT-SET]",
 			"signatureSource": "scripts/check-entwurf-bridge-boot.ts"
+		},
+		{
+			"claim": "BRIDGEBOOT-CALLBACK-REGISTERED",
+			"title": "the callback verb is imported but never registered — invisible to every host, while every import-level assertion stays green",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["server.tool(\n\t\"entwurf_callback\","],
+			"replace": [
+				"const _unregisteredCallbackTool = (...a: unknown[]) => void a;\n_unregisteredCallbackTool(\n\t\"entwurf_callback\","
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-bridge-boot"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BRIDGEBOOT-CALLBACK-REGISTERED]",
+			"signatureSource": "scripts/check-entwurf-bridge-boot.ts"
+		},
+		{
+			"claim": "BRIDGEBOOT-CALLBACK-ZERO-ARG",
+			"title": "a target parameter is added to the callback schema, giving the model a way to supply an address the env pair was meant to own",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["\t\"MCP child). No arguments, no fallback to a model-supplied target.\",\n\t{},"],
+			"replace": [
+				"\t\"MCP child). No arguments, no fallback to a model-supplied target.\",\n\t{ target: z.string().optional() },"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-bridge-boot"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BRIDGEBOOT-CALLBACK-ZERO-ARG]",
+			"signatureSource": "scripts/check-entwurf-bridge-boot.ts"
 		}
 	]
 }