@junghanacs/entwurf 0.23.1 → 0.25.0

package/scripts/check-herdr-sandbox.ts

@@ -291,7 +291,15 @@ async function main(): Promise<void> {
 		if (callerPane?.workspaceId === undefined) {
 			fail(`pane get of the caller pane failed or carried no workspace: ${callerGet.stderr || callerGet.stdout}`);
 		}
-		const tabRun = herdr(bin, sandbox, buildHerdrTabCreateArgs({ workspaceId: callerPane.workspaceId, cwd: REPO_DIR }));
+		const tabCallback = {
+			target: "20260101T010101-aaaaaa",
+			nonce: "mux-fresh-call-deadbeefdeadbeefdeadbeef",
+		};
+		const tabRun = herdr(
+			bin,
+			sandbox,
+			buildHerdrTabCreateArgs({ workspaceId: callerPane.workspaceId, cwd: REPO_DIR, callback: tabCallback }),
+		);
 		const tab = tabRun.status === 0 ? parseHerdrTabCreateResponse(tabRun.stdout) : null;
 		if (tab === null) fail(`tab create failed or was unreadable: ${tabRun.stderr || tabRun.stdout}`);
 		const tabRootPane = tab.rootPane;
@@ -401,7 +409,11 @@ async function main(): Promise<void> {
 			);
 		}
 
-		const spareRun = herdr(bin, sandbox, buildHerdrTabCreateArgs({ workspaceId: callerPane.workspaceId }));
+		const spareRun = herdr(
+			bin,
+			sandbox,
+			buildHerdrTabCreateArgs({ workspaceId: callerPane.workspaceId, callback: tabCallback }),
+		);
 		const spareTab = spareRun.status === 0 ? parseHerdrTabCreateResponse(spareRun.stdout) : null;
 		if (spareTab === null)
 			fail(`the second tab create failed or was unreadable: ${spareRun.stderr || spareRun.stdout}`);

package/scripts/check-install-container.sh

@@ -321,7 +321,7 @@ function finish(t) {
   // artifact ship" is precisely the question it owns. The subset form named only the five
   // pre-0.14 verbs and would have accepted a candidate with no entwurf_fresh_call /
   // entwurf_resume_call; equality also refuses an extra or duplicated verb.
-  const EXPECT_TOOLS = ['entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
+  const EXPECT_TOOLS = ['entwurf_callback', 'entwurf_fresh_call', 'entwurf_inbox_read', 'entwurf_peers', 'entwurf_register_native', 'entwurf_resume_call', 'entwurf_self', 'entwurf_v2'];
   if (names.length !== EXPECT_TOOLS.length || EXPECT_TOOLS.some((n, i) => names[i] !== n)) {
     console.error('MCP tool set MISMATCH — want exactly [' + EXPECT_TOOLS.join(',') + '] got [' + names.join(',') + ']');
     process.exit(1);

package/scripts/check-mux-launcher-fence.ts

@@ -288,10 +288,30 @@ function main(): void {
 			// env object that assigns the fixture XDG_DATA_HOME also relocates HOME", which is the
 			// relation that actually keeps the vendor's store and its launcher in one tree.
 			const dataRootAssignment = (file: string): RegExp => (file.endsWith(".sh") ? /XDG_DATA_HOME=/ : /XDG_DATA_HOME:/);
+			/** A shell `env ... \` invocation is ONE logical command, and that command — not a brace
+			 * pair — is the env block there. `${...}` is everywhere in a shell script, so the brace
+			 * walk below would answer with a two-character slice and read HOME from a neighbouring
+			 * line that assigns nothing. Walk the backslash continuations instead. */
+			const shellCommandAround = (src: string, at: number): string => {
+				const lines = src.split("\n");
+				let idx = 0;
+				let line = 0;
+				for (; line < lines.length - 1; line += 1) {
+					const next = idx + lines[line].length + 1;
+					if (next > at) break;
+					idx = next;
+				}
+				let first = line;
+				while (first > 0 && lines[first - 1].endsWith("\\")) first -= 1;
+				let last = line;
+				while (last < lines.length - 1 && lines[last].endsWith("\\")) last += 1;
+				return lines.slice(first, last + 1).join("\n");
+			};
 			/** The object literal / env block that carries the fixture data root, not the whole file. */
 			const envBlockAround = (src: string, file: string): string => {
 				const at = src.search(dataRootAssignment(file));
 				if (at < 0) return "";
+				if (file.endsWith(".sh")) return shellCommandAround(src, at);
 				const from = src.lastIndexOf("{", at);
 				if (from < 0) return src.slice(Math.max(0, at - 800), at + 800);
 				let depth = 0;
@@ -309,6 +329,11 @@ function main(): void {
 					reason: "it relocates HOME into the same sandbox, so store and launcher stay in one tree",
 					holds: (src, file) => /(^|\n)\s*HOME[,:]/.test(envBlockAround(src, file)),
 				},
+				"smoke-herdr-raw-install-live.sh": {
+					reason:
+						"its single fixture data root rides one `env` invocation that relocates HOME into the same mktemp sandbox, so the child it starts there never meets a fixture data root beside the operator's real HOME",
+					holds: (src, file) => /(^|\s)HOME=/.test(envBlockAround(src, file)),
+				},
 			};
 			/** Where each smoke's FIRST Claude-capable child begins. Named per smoke, because the
 			 * three rails start children in three different ways and a generic "spawn" would match
@@ -360,6 +385,18 @@ function main(): void {
 				"the exemption discriminates rather than excuses: the exempt smoke relocates HOME in the SAME env block that fences its data root, and moving that line out of the block would put it back in the constituency",
 				Object.entries(EXEMPT).every(([f, e]) => e.holds(read(path.join("scripts", f)), f)),
 			);
+			{
+				// The shell half of that same sentence, proved rather than asserted: the exemption is
+				// read off the `env` invocation, so deleting HOME from THAT line — and only that line —
+				// must put the smoke straight back into the constituency.
+				const file = "smoke-herdr-raw-install-live.sh";
+				const src = read(path.join("scripts", file));
+				const withoutHome = src.replace(/ HOME="\$HOMELESS"/, "");
+				ok(
+					"the shell exemption is read from the env INVOCATION, not from the file: deleting the HOME assignment out of the same `env` line puts smoke-herdr-raw-install-live.sh back in the constituency",
+					withoutHome !== src && !EXEMPT[file].holds(withoutHome, file),
+				);
+			}
 			{
 				const IMPORT =
 					'import { assessLauncherCleanup, snapshotClaudeLauncher, verifyClaudeLauncher } from "./lib/claude-launcher-fence.ts";';

package/scripts/check-pi-launch.ts

@@ -15,7 +15,9 @@
  * six receiver-state facts before it execs, because setting its flag is a PROMISE of a
  * doorbell that may not exist. `entwurf pi` promises nothing pi does not already own: on a
  * host where the entwurf extension is not registered, `pi --entwurf-control` refuses itself
- * with `Error: Unknown option: --entwurf-control` and exit 1 (measured, pi 0.85.1). A
+ * with `Error: Unknown option: --entwurf-control` and exit 1 (`[측정 2026-09-20]` pi 0.86.0,
+ * `[측정 2026-09-22]` pi 0.87.0 and `[측정 2026-09-23]` pi 0.87.1 — sandbox HOME +
+ * PI_CODING_AGENT_DIR, byte-identical stderr line and exit 1 at all three floors). A
  * pre-check here would duplicate that refusal and go stale the day pi renames it.
  *
  * WHY ONE RECURSION FENCE AND NOT TWO. The sentinel closes the only real loop — a PATH
@@ -26,7 +28,11 @@
  *
  * WHY THE FLAG IS ADDED AND NEVER DEDUPLICATED. `pit`/`pius`-style operator wrappers already
  * pass `--entwurf-control`; passing it twice was measured byte-identical to passing it once
- * (pi 0.85.1, extension registered). The launcher therefore injects exactly ONE and leaves
+ * (pi 0.85.1, extension REGISTERED — and that receipt has NOT been retaken at 0.86.0, 0.87.0 or 0.87.1.
+ * It needs a host where the extension is registered, which means opening a control session on the
+ * operator's own pi; the unregistered refusal above is what gets re-measured at each floor
+ * instead. So this line is a 0.85.1 fact and is not promoted to a 0.87.1 one — a LIVE observation
+ * candidate for a future release, never part of a deterministic green.) The launcher therefore injects exactly ONE and leaves
  * the operator's copies alone — an argv scan would be code earning nothing.
  */
 

package/scripts/check-release-gate-outcomes.ts

@@ -868,6 +868,171 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 	);
 }
 
+// ===========================================================================
+// A MUST step's ABSENT operator input is a SKIP; a WRONG one is a FAIL
+//
+// The step above is a MUST that takes three values only the operator can give.
+// `[측정 2026-09-23]` all three were `ok()` assertions, and `ok()` throws, so
+// their absence exited as FAIL — while `release_gate()` supplies none of them.
+// The step therefore declined as a FAILURE inside every aggregate on every host,
+// and 0.25.0's candidate receipt (`MUST PASS=23 FAIL=1`, `cut: BLOCKED (MUST
+// FAIL)`) carries a prose classification of that red, and reading it as a floor
+// would require a per-cut exception. The release skill says "Do not waive a MUST
+// failure without diagnosing and explicitly classifying the failing axis", and
+// classifying is what that record does -- but a contract that manufactures the same
+// red every cut invites the exception rather than earning a floor. (The cut stayed
+// BLOCKED; nothing was approved.)
+//
+// This cell pins the repaired boundary in BOTH directions, because either half
+// alone is a different defect: make absence a FAIL and the exception comes back;
+// make a wrong answer a SKIP and a dead pid or a foreign process buys silence.
+// It is deliberately separate from the claim above — that one owns WHERE the step
+// is wired, this one owns WHAT its outcome means — so one mutant cannot satisfy
+// both, and it reads the smoke with comments stripped so a promise in prose
+// cannot stand in for the arm that actually executes.
+// ===========================================================================
+{
+	const SMOKE = "scripts/smoke-codex-fresh-live.ts";
+	const smokeRaw = readFileSync(join(REPO_DIR, SMOKE), "utf8");
+	// Comments are where this exact defect hid for a release: the old skip line
+	// NAMED all three env vars while only LIVE=1 could produce a skip.
+	const smoke = smokeRaw
+		.replace(/\/\*[\s\S]*?\*\//g, "")
+		.split("\n")
+		.map((line) => line.replace(/(^|\s)\/\/.*$/, ""))
+		.join("\n");
+	const verify = readFileSync(join(REPO_DIR, "VERIFY.md"), "utf8");
+	const skill = readFileSync(join(REPO_DIR, ".claude/skills/entwurf-release/SKILL.md"), "utf8");
+	const TRIPLE = ["ENTWURF_CODEX_APP_SERVER_PID", "ENTWURF_CODEX_FRESH_MODEL", "ENTWURF_CODEX_FRESH_PI_MODEL"] as const;
+	const broken: string[] = [];
+
+	// (a) Absence must reach `skipLive`, and the GUARD that routes it there is part of
+	//     the claim — not just the presence of a skipLive call somewhere nearby. A
+	//     dead arm behind a constant-false condition would satisfy "there is a skip"
+	//     while every absent input fell through to the assertions below and threw,
+	//     which is precisely the pre-repair behaviour. So the emptiness test, the
+	//     guard and the arm are pinned as one contiguous shape, and nothing may
+	//     assert in between.
+	const absenceArm = smoke.match(
+		/const absentInputs\s*=\s*OPERATOR_INPUTS\.filter\(([^\n]*?)===\s*""\);\s*if \(absentInputs\.length > 0\) \{\s*skipLive\(([\s\S]{0,1400}?)\n\t\}/,
+	);
+	if (absenceArm === null) {
+		broken.push(
+			`${SMOKE}: the absent-operator-input arm is not the contiguous shape ` +
+				'`absentInputs = OPERATOR_INPUTS.filter(... === "")` -> `if (absentInputs.length > 0)` -> `skipLive(` — ' +
+				"an unset prerequisite would fall through to an assertion and exit as FAIL again",
+		);
+	} else if (!absenceArm[2]?.includes("absentInputs")) {
+		broken.push(`${SMOKE}: the skipLive arm does not report WHICH operator inputs were absent`);
+	}
+	for (const name of TRIPLE) {
+		if (!new RegExp(`\\[\\s*"${name}"`).test(smoke)) {
+			broken.push(`${SMOKE}: ${name} is not in the declared operator-input set, so its absence is unclassified`);
+		}
+	}
+
+	// (c) The reproducible green must be WRITTEN DOWN where a cut is taken from,
+	//     or "supply the triple" is folklore. VERIFY owns the acceptance condition;
+	//     the release skill owns the command an operator actually types at P5.
+	const p5 = skill.slice(skill.indexOf("## P5."), skill.indexOf("## P6."));
+	for (const name of TRIPLE) {
+		if (!p5.includes(name)) {
+			broken.push(`.claude/skills/entwurf-release/SKILL.md P5: the release-gate invocation does not carry ${name}`);
+		}
+	}
+	if (!verify.includes("`release-gate --cut` inherits that triple")) {
+		broken.push(
+			"VERIFY.md no longer states that the aggregate cut inherits the operator-supplied Codex triple — " +
+				"without that sentence a cut host cannot know why the MUST step skipped",
+		);
+	}
+
+	// (d) The policy half is unchanged: a MUST SKIP still blocks a cut. Asked of the
+	//     SHARED shell authority rather than re-implemented here, so this cell cannot
+	//     drift from the truth table the protocol owns. Reclassifying an absent
+	//     prerequisite as SKIP is only honest while that answer stays NO.
+	const cutReleasable = (failc: number, skipc: number, cut: number): boolean =>
+		inShell(`if entwurf_release_releasable ${failc} ${skipc} ${cut}; then echo YES; else echo NO; fi`) === "YES";
+	if (cutReleasable(0, 1, 1) !== false) {
+		broken.push("a MUST SKIP no longer blocks --cut, so classifying an absent prerequisite as SKIP would hide it");
+	}
+	if (cutReleasable(0, 1, 0) !== true) {
+		broken.push("a MUST SKIP now blocks the unattended diagnostic run, which was never the contract");
+	}
+
+	assert.ok(
+		broken.length === 0,
+		"[QK:CODEX-OPERATOR-PREREQ-ABSENT-SKIPS] a MUST step that takes operator-supplied inputs must DECLINE when they " +
+			"are absent — protocol SKIP naming each missing one — while `--cut` keeps refusing that SKIP and the cut " +
+			"invocation that supplies the triple is written in VERIFY and the release skill. Absence classified as FAIL " +
+			"is what made this step red inside every cut and would require a per-cut exception. " +
+			`Broken: ${broken.join("; ")}`,
+	);
+
+	// The MIRROR claim, and its own token: a value the operator DID supply stays a
+	// FAIL when it is wrong. Kept apart from the arm above because softening this
+	// direction is the opposite defect and must not be killable by the same mutant —
+	// a dead pid, a foreign process or an app-server in the gate's own session would
+	// otherwise buy silence instead of a red.
+	const softened: string[] = [];
+	if (!/ok\(\s*\n?\s*"ENTWURF_CODEX_APP_SERVER_PID explicitly names/.test(smoke)) {
+		softened.push(
+			`${SMOKE}: the pid grammar is no longer an ok() assertion — a malformed operator answer must FAIL, not decline`,
+		);
+	}
+	// A model env asserted non-empty would put absence back behind a throw, making
+	// the decline arm above dead code. One direction repaired at the cost of the
+	// other is not the boundary.
+	if (/ok\([^)]*ENTWURF_CODEX_FRESH_(?:PI_)?MODEL[^)]*length\s*>\s*0/.test(smoke)) {
+		softened.push(`${SMOKE}: a model env is still asserted non-empty, which re-classifies its absence as FAIL`);
+	}
+	assert.ok(
+		softened.length === 0,
+		"[QK:CODEX-OPERATOR-PREREQ-WRONG-FAILS] the same step must still FAIL on an operator input that is PRESENT and " +
+			"wrong. Declining there would let a dead pid or a non-Codex process pass as a missing prerequisite, and a " +
+			`cut would read silence as acceptance. Broken: ${softened.join("; ")}`,
+	);
+
+	// A THIRD claim, because this one is about a different subject: not what the smoke
+	// does with an input, but WHERE the release operator's input comes from.
+	//
+	// `[측정 2026-09-23]` the first cut of the P5 instructions above derived the pid with
+	// `pgrep -f 'codex.*app-server' | head -1`. That is exactly the inference the step
+	// refuses, written into the page an operator follows — and worse than a stale
+	// sentence, because a host can hold more than one app-server and `head -1` picks an
+	// arbitrary one, which the smoke would then dutifully verify as "the operator's
+	// answer". A no-inference rule that the operating instructions violate is enforced
+	// nowhere. So provenance is pinned in the skill itself: each value is STATED, the
+	// three `:` guards refuse an unset or empty one before any LIVE cost, and no process
+	// search or command substitution may manufacture them.
+	const provenance: string[] = [];
+	const SKILL_REL = ".claude/skills/entwurf-release/SKILL.md";
+	for (const forbidden of ["pgrep", "pidof", "ps -", "$(pgrep"]) {
+		if (p5.includes(forbidden)) {
+			provenance.push(
+				`${SKILL_REL} P5: builds an operator input with \`${forbidden}\` — the pid is stated, never searched for`,
+			);
+		}
+	}
+	for (const name of ["CODEX_APP_SERVER_PID", "CODEX_FRESH_MODEL", "CODEX_FRESH_PI_MODEL"]) {
+		// `: "${VAR:?...}"` — an explicit required-parameter guard. Anything weaker
+		// (a default via `:-`, or no guard) lets a forgotten export reach a LIVE run.
+		if (!new RegExp(`: "\\$\\{${name}:\\?[^"]+}"`).test(p5)) {
+			provenance.push(`${SKILL_REL} P5: ${name} has no \`: "\${${name}:?…}"\` required-value guard`);
+		}
+		if (new RegExp(`${name}=\\$\\(`).test(p5)) {
+			provenance.push(`${SKILL_REL} P5: ${name} is assigned from a command substitution rather than stated`);
+		}
+	}
+	assert.ok(
+		provenance.length === 0,
+		"[QK:CODEX-OPERATOR-PREREQ-STATED-NOT-SEARCHED] the release instructions must make the operator STATE each Codex " +
+			"input and guard it with an explicit required-value check, never derive one by process search or command " +
+			"substitution. A page that infers the app-server pid teaches the very inference the gate refuses, and picks an " +
+			`arbitrary process when a host runs several. Broken: ${provenance.join("; ")}`,
+	);
+}
+
 // ===========================================================================
 // The operator's CONFIGURED bridge invocation is proven BEFORE the cost-bearing LIVE tier
 //

package/scripts/doctor-pi-provider.ts

@@ -159,11 +159,24 @@ log(`  EFFECTIVE (${effectiveScope}): ${effectiveDesc}`);
 
 // install-state ownership (user scope). absent state on a configured effective is either a
 // pre-Task-2 install or a user-override we deliberately did not own.
+//
+// `command` is read beside it because it — not the bare name — is the CANONICAL managed command
+// (#116 M3-b2). `register-pi-provider.py` writes the same string into the settings entry and into
+// this record (:332-342, :368-369), and in plugin mode that string is an absolute bridge under the
+// certified stable runtime, because a Herdr-plugin host has nothing entwurf on PATH. Reading it
+// here is what lets this doctor judge drift without re-deriving the stable runtime root: the root
+// is the writer's business, and a second derivation in this file would be a second address axis.
+//
+// `ownership` is the PREIMAGE classification — what stood at the key BEFORE that install — so
+// `absent` means "we created it", not "nobody owns it". Treating it as an ownership verdict is what
+// made every plugin-mode host red while its bridge booted and served all eight verbs.
 let ownership: string | undefined;
+let stateCommand: string | undefined;
 if (existsSync(statePath)) {
 	try {
-		const st = JSON.parse(readFileSync(statePath, "utf8")) as { ownership?: string };
+		const st = JSON.parse(readFileSync(statePath, "utf8")) as { ownership?: string; command?: string };
 		ownership = typeof st.ownership === "string" ? st.ownership : undefined;
+		stateCommand = typeof st.command === "string" ? st.command : undefined;
 		log(`  state: install-state present (ownership=${ownership}).`);
 	} catch {
 		log(`  state: FAIL — install-state ${statePath} is unreadable/corrupt.`);
@@ -219,9 +232,36 @@ if (effectiveEntry === undefined) {
 		}
 	}
 
-	if (!isBare) {
-		// Ownership classification never rounds a broken runtime up to green. It only says who may
-		// repair the non-canonical entry after the independent boot verdict above.
+	// Ownership classification never rounds a broken runtime up to green. It only says who may
+	// repair the entry after the independent boot verdict above.
+	//
+	// A MANAGED record is the pair (known preimage ownership, recorded command). For that pair the
+	// recorded command is canonical and the comparison runs REGARDLESS of whether the effective
+	// command happens to be the bare name. Keeping this decision inside a `!isBare` branch is how
+	// real drift escaped: a record naming the absolute plugin bridge, with the settings repointed to
+	// the bare `entwurf-bridge`, is drift — and a bare bridge that boots would otherwise carry it to
+	// green. "The effective command is spellable as our old default" is not evidence that it is the
+	// command this install wrote.
+	//
+	// Everything else — a record that names no command, or one whose ownership is a word this
+	// doctor does not know — falls through to the ORIGINAL logic below, unchanged. Repairing this
+	// defect is not a licence to migrate the state schema, to grant an amnesty to records written
+	// before `command` existed, or to let an unknown ownership word buy a managed green because a
+	// string happened to match. The state is rewritten by `./run.sh setup`, not by its reader.
+	const knownManagedOwnership =
+		ownership === "absent" || ownership === "managed-current" || ownership === "managed-legacy";
+	if (knownManagedOwnership && stateCommand !== undefined) {
+		if (cmd !== stateCommand) {
+			log(
+				`  FAIL: state records '${stateCommand}' as the managed command (ownership=${ownership}), but the effective command is '${cmd}' — the key drifted to something entwurf never wrote.`,
+			);
+			hardFail = 1;
+		} else {
+			log(
+				`  ok: effective command is the managed command this install recorded ('${stateCommand}', preimage ownership=${ownership}).`,
+			);
+		}
+	} else if (!isBare) {
 		if (ownership && ownership !== "user-override") {
 			log(`  FAIL: state owns entwurf-bridge (ownership=${ownership}) but the effective command drifted to '${cmd}'.`);
 			hardFail = 1;

package/scripts/herdr-rails.mjs

@@ -0,0 +1,75 @@
+/**
+ * herdr-rails — the ONE place the herdr rail's backend set and its per-backend model SYNTAX
+ * example are written down (#116 A7).
+ *
+ * WHY THIS FILE EXISTS. Three surfaces were about to say the same two things in three
+ * dialects: `herdr-fresh-call.ts` owned the closed backend tuple, `build.mjs` narrated one
+ * model id per harness at install time, and the status pane was about to print a RAILS block.
+ * Three copies of one fact is how a rail quietly grows a fourth backend in prose that no
+ * dispatch honours. So the fact lives here and the three read it.
+ *
+ * WHY `.mjs` AND NOT `.ts`. It is read by two runtimes that cannot agree on anything else:
+ * the Herdr plugin runs `node lib/status.mjs` with no loader flags at all, and the pi
+ * extension is typechecked by `tsc`. A `.ts` leaf would be unloadable by the first; a second
+ * copy would defeat the point. `protocol.js` set this precedent for exactly the same reason
+ * (root tsconfig.json `allowJs`), and this file keeps its shape: dependency-free, no imports,
+ * no environment, no IO, so importing it can never be a side effect.
+ *
+ * WHAT THIS FILE IS NOT, and each absence is load-bearing:
+ *   - NOT a model catalogue. One example per backend, chosen to show the SHAPE of the string
+ *     (`provider/model` vs a bare vendor id). Adding a second example starts a list, a list
+ *     invites completeness, and completeness is a catalogue Entwurf would then be expected to
+ *     keep current for every vendor. `entwurf_fresh_call` takes a model string with no default
+ *     and validates nothing; that is the contract, and an example must not imply otherwise.
+ *   - NOT a supported-model set, a recommendation, or a validator. Nothing reads MODEL_SYNTAX_EXAMPLE
+ *     to decide anything — it is display text on three surfaces.
+ *   - NOT a provider, billing or quota statement. No rail here names a provider, a subscription
+ *     or a cost. `#76` is about which rail a sibling may be launched on, and a syntax example
+ *     that mentioned a provider would read as an answer to it. It does not answer it.
+ *   - NOT a launcher, and not a claim that any binary exists. `HERDR_AGENT_KIND` (the herdr
+ *     `--kind` token) stays with the rail that spends it; this leaf carries no argv.
+ */
+
+/**
+ * The closed pilot set for the herdr launch rail. Herdr's own `--kind` enum is much larger and
+ * that is not evidence of support: every other backend is a named pre-mutation reject.
+ *
+ * The JSDoc cast is what keeps the TYPE half of this single source honest. Without it TypeScript
+ * infers `readonly string[]` from a `.mjs` file and `HerdrFreshCallBackend` silently widens to
+ * `string` — the tuple would still be one source at runtime while the compiler had stopped
+ * checking anything. A gate pins both halves.
+ *
+ * @type {readonly ["pi", "claude-code"]}
+ */
+export const HERDR_FRESH_CALL_BACKENDS = Object.freeze(["pi", "claude-code"]);
+
+/**
+ * ONE model string per backend, and it is an example of SYNTAX, never of choice.
+ *
+ * `[관측: GLG, 날것 PC, 2026-09-17]` "일단 정확한 모델명을 모른다" — after a green install the first
+ * thing missing is a call that works, and the two runtimes spell a model differently enough that
+ * guessing fails: pi wants a provider-qualified path, Claude Code wants the vendor id alone.
+ * That difference is the whole content of this map.
+ *
+ * @type {Readonly<Record<"pi" | "claude-code", string>>}
+ */
+export const MODEL_SYNTAX_EXAMPLE = Object.freeze({
+	pi: "openai-codex/gpt-5.6-terra",
+	"claude-code": "claude-sonnet-5",
+});
+
+/**
+ * How a citizen on each backend is REACHED once it exists, in the operator's words. This is the
+ * rail fact the status pane's RAILS block renders and the install narration states — the same
+ * sentence, so a host cannot be told two different things about one backend.
+ *
+ * `[관측: GLG, 날것 PC, 2026-09-17]` from the operator's chair a plain `pi` looks identical to a
+ * citizen pi: the install says green, `pi` starts, and nothing is there. Citizenship is argv-gated
+ * on purpose, and that gate is invisible unless something says it out loud.
+ *
+ * @type {Readonly<Record<"pi" | "claude-code", string>>}
+ */
+export const RAIL_ENTRY_NOTE = Object.freeze({
+	pi: "start it as `pi --entwurf-control` to be a garden citizen — a plain `pi` loads the extension but has no garden id, no control socket and no entwurf tools",
+	"claude-code": "nothing to add — an ordinary `claude` picks up the entwurf tools through MCP",
+});

package/scripts/lib/mutation-qualify.ts

@@ -617,7 +617,7 @@ function sha256File(file: string): string {
 	return createHash("sha256").update(fs.readFileSync(file)).digest("hex");
 }
 
-function countOccurrences(haystack: string, needle: string): number {
+export function countOccurrences(haystack: string, needle: string): number {
 	let count = 0;
 	let at = haystack.indexOf(needle);
 	while (at !== -1) {

package/scripts/meta-bridge-state.py

@@ -81,13 +81,18 @@ LEGACY_PERMISSION_ALLOW = ["mcp__pi-tools-bridge__*"]
 # native rail stops owning `autoCompactEnabled` / `env.DISABLE_AUTOCOMPACT` too.
 # Backend-native context management is allowed; we add no guard and only measure.
 # Both keys live in RETIRED_SETTINGS_SCALARS below.
+#
+# NEITHER IS `showTurnDuration`. It reports how long a turn took, which is
+# OPERATOR INFORMATION — it opens no background autonomy surface and drives no
+# single-driver behaviour, so the policy reason the rest of this list stands on
+# never applied to it. GLG's ruling: the operator owns that scalar and entwurf
+# must not force it to false. It joins RETIRED_SETTINGS_SCALARS below.
 MANAGED_SETTINGS_SCALARS: list[tuple[str, list[str], Any]] = [
     ("cleanupPeriodDays", ["cleanupPeriodDays"], 365),
     ("promptSuggestionEnabled", ["promptSuggestionEnabled"], False),
     ("awaySummaryEnabled", ["awaySummaryEnabled"], False),
     ("autoMemoryEnabled", ["autoMemoryEnabled"], False),
     ("verbose", ["verbose"], False),
-    ("showTurnDuration", ["showTurnDuration"], False),
     ("terminalProgressBarEnabled", ["terminalProgressBarEnabled"], False),
     ("useAutoModeDuringPlan", ["useAutoModeDuringPlan"], False),
     ("enableWorkflows", ["enableWorkflows"], False),
@@ -108,6 +113,18 @@ RETIRED_SETTINGS_SCALARS: list[tuple[str, list[str], Any]] = [
     # reach it.
     ("env.DISABLE_AUTOCOMPACT", ["env", "DISABLE_AUTOCOMPACT"], "1"),
     ("autoCompactEnabled", ["autoCompactEnabled"], False),
+    # `showTurnDuration` returns to the operator for the same structural reason
+    # and by the same one-shot path. It is retired rather than deleted because an
+    # existing install-state ALREADY carries its entry — measured on the source
+    # host 2026-09-23: `~/.claude/entwurf.install-state.json` records
+    # `original {existed: true, value: false}` while live settings say `true`,
+    # i.e. the operator turned it on after our install. Deleting the constant
+    # would orphan that entry, and uninstall() walks every ledger entry through
+    # restore_entry(), so it would write `false` back over the operator's own
+    # choice. relinquish_retired_scalar() is what makes the inverse honest: the
+    # live `true` is not what we last managed, so it is left untouched and the
+    # entry is consumed, after which no code path can reach that key again.
+    ("showTurnDuration", ["showTurnDuration"], False),
 ]
 
 _managed_scalar_names = {name for name, _path, _desired in MANAGED_SETTINGS_SCALARS}

package/scripts/mutants/acp-backend-preflight.json

@@ -0,0 +1,20 @@
+{
+	"schemaVersion": 1,
+	"lane": "acp-backend-preflight",
+	"mutants": [
+		{
+			"claim": "ACP-PREFLIGHT-REPLAYS-TRANSCRIPT-TOOLS",
+			"title": "reading a `context.tools` field instead of replaying the transcript makes the exclude-tools preflight unfireable on every pi 0.86 turn — the operator is told a tool is excluded while the backend still runs it",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\t\tconst activeToolNames = getCurrentTools(context.messages).map((t) => t.name);"],
+			"replace": [
+				"\t\t\tconst activeToolNames =",
+				"\t\t\t\t(context as unknown as { tools?: { name: string }[] }).tools?.map((t) => t.name) ?? [\"read\", \"bash\", \"edit\", \"write\"];"
+			],
+			"gate": ["bash", "run.sh", "check-acp-backend-preflight"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:ACP-PREFLIGHT-REPLAYS-TRANSCRIPT-TOOLS]",
+			"signatureSource": "scripts/check-acp-backend-preflight.ts"
+		}
+	]
+}

package/scripts/mutants/bridge-boot-resume.json

@@ -40,6 +40,32 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:BRIDGEBOOT-PUBLIC-SURFACE-EXACT-SET]",
 			"signatureSource": "scripts/check-entwurf-bridge-boot.ts"
+		},
+		{
+			"claim": "BRIDGEBOOT-CALLBACK-REGISTERED",
+			"title": "the callback verb is imported but never registered — invisible to every host, while every import-level assertion stays green",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["server.tool(\n\t\"entwurf_callback\","],
+			"replace": [
+				"const _unregisteredCallbackTool = (...a: unknown[]) => void a;\n_unregisteredCallbackTool(\n\t\"entwurf_callback\","
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-bridge-boot"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BRIDGEBOOT-CALLBACK-REGISTERED]",
+			"signatureSource": "scripts/check-entwurf-bridge-boot.ts"
+		},
+		{
+			"claim": "BRIDGEBOOT-CALLBACK-ZERO-ARG",
+			"title": "a target parameter is added to the callback schema, giving the model a way to supply an address the env pair was meant to own",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["\t\"MCP child). No arguments, no fallback to a model-supplied target.\",\n\t{},"],
+			"replace": [
+				"\t\"MCP child). No arguments, no fallback to a model-supplied target.\",\n\t{ target: z.string().optional() },"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-bridge-boot"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BRIDGEBOOT-CALLBACK-ZERO-ARG]",
+			"signatureSource": "scripts/check-entwurf-bridge-boot.ts"
 		}
 	]
 }

package/scripts/mutants/bridge-command-boot.json

@@ -37,6 +37,44 @@
 			"signature": "[QK:PI-DOCTOR-PROBES-OVERRIDE]",
 			"signatureSource": "scripts/smoke-pi-provider-state.sh"
 		},
+		{
+			"claim": "PI-DOCTOR-PLUGIN-COMMAND-IS-NOT-DRIFT",
+			"title": "the recorded-command comparison degenerates to 'always drifted', so a Herdr-plugin host whose effective command IS exactly the absolute bridge this install wrote is red again — the #116 M3-b2 false-red restored in the new wording. It is the always-red half of a symmetric pair with PI-DOCTOR-REAL-DRIFT-STILL-RED's always-green half; a mutation that instead re-scoped the comparison under `!isBare` would also kill that claim's bare cell, so this one deliberately does not touch the managedState predicate",
+			"subject": "scripts/doctor-pi-provider.ts",
+			"find": ["\t\tif (cmd !== stateCommand) {"],
+			"replace": ["\t\tif (true) {"],
+			"gate": ["bash", "scripts/smoke-pi-provider-state.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PI-DOCTOR-PLUGIN-COMMAND-IS-NOT-DRIFT]",
+			"signatureSource": "scripts/smoke-pi-provider-state.sh"
+		},
+		{
+			"claim": "PI-DOCTOR-REAL-DRIFT-STILL-RED",
+			"title": "the drift comparison is dropped entirely, so a managed key repointed at a command entwurf never wrote reads as 'the managed command this install recorded' — the ownership axis silently stops existing",
+			"subject": "scripts/doctor-pi-provider.ts",
+			"find": ["\t\tif (cmd !== stateCommand) {"],
+			"replace": ["\t\tif (false) {"],
+			"gate": ["bash", "scripts/smoke-pi-provider-state.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PI-DOCTOR-REAL-DRIFT-STILL-RED]",
+			"signatureSource": "scripts/smoke-pi-provider-state.sh"
+		},
+		{
+			"claim": "PI-DOCTOR-LEGACY-STATE-UNCHANGED",
+			"title": "the plugin-mode repair is turned into a schema amnesty: a managed record written before `command` existed stops being red and its unrecorded, uncomparable entry is adopted as a note — a green nobody measured, handed out by the doctor instead of by ./run.sh setup",
+			"subject": "scripts/doctor-pi-provider.ts",
+			"find": [
+				"\t\t\tlog(`  FAIL: state owns entwurf-bridge (ownership=${ownership}) but the effective command drifted to '${cmd}'.`);",
+				"\t\t\thardFail = 1;"
+			],
+			"replace": [
+				"\t\t\tlog(`  note: legacy record (ownership=${ownership}) — no recorded command, adopting '${cmd}'.`);"
+			],
+			"gate": ["bash", "scripts/smoke-pi-provider-state.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PI-DOCTOR-LEGACY-STATE-UNCHANGED]",
+			"signatureSource": "scripts/smoke-pi-provider-state.sh"
+		},
 		{
 			"claim": "AGY-DOCTOR-PROBES-ARGS",
 			"title": "the agy invocation parser drops configured args, so the doctor boots command defaults while agy executes a failing argv",