@junghanacs/entwurf 0.23.1 → 0.25.0

package/scripts/mutants/control-send-receipt.json

@@ -0,0 +1,235 @@
+{
+	"schemaVersion": 1,
+	"lane": "control-send-receipt",
+	"mutants": [
+		{
+			"claim": "SEND-RECEIPT-IDLE-IS-SENT",
+			"title": "an idle receiver's DIRECT trigger is reported as a queue it never touched, so the one boundary that actually started a turn becomes indistinguishable from the two that did not",
+			"subject": "pi-extensions/lib/control-send-receipt.ts",
+			"find": ["\tif (input.idle) return \"sent\";"],
+			"replace": ["\tif (false) return \"sent\";"],
+			"gate": ["bash", "run.sh", "check-control-send-receipt"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-RECEIPT-IDLE-IS-SENT]",
+			"signatureSource": "pi-extensions/lib/control-send-receipt.test.ts"
+		},
+		{
+			"claim": "SEND-RECEIPT-BUSY-STEER-IS-QUEUED",
+			"title": "a busy receiver's steering queue is reported as `sent`, which is the exact false claim #120 was opened about: the sender is told the message landed while it lies in volatile process memory behind whatever else is there",
+			"subject": "pi-extensions/lib/control-send-receipt.ts",
+			"find": ["\treturn input.mode === \"follow_up\" ? \"queued-follow-up\" : \"queued-steer\";"],
+			"replace": ["\treturn input.mode === \"follow_up\" ? \"queued-follow-up\" : \"sent\";"],
+			"gate": ["bash", "run.sh", "check-control-send-receipt"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-RECEIPT-BUSY-STEER-IS-QUEUED]",
+			"signatureSource": "pi-extensions/lib/control-send-receipt.test.ts"
+		},
+		{
+			"claim": "SEND-RECEIPT-BUSY-FOLLOWUP-IS-QUEUED",
+			"title": "the follow-up queue is reported under the steering queue's name, collapsing the only fact that explains a reorder after it happens — a later steer overtakes every earlier follow_up, and one name for both makes that unaccountable",
+			"subject": "pi-extensions/lib/control-send-receipt.ts",
+			"find": ["? \"queued-follow-up\" : \"queued-steer\";"],
+			"replace": ["? \"queued-steer\" : \"queued-steer\";"],
+			"gate": ["bash", "run.sh", "check-control-send-receipt"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-RECEIPT-BUSY-FOLLOWUP-IS-QUEUED]",
+			"signatureSource": "pi-extensions/lib/control-send-receipt.test.ts"
+		},
+		{
+			"claim": "SEND-RECEIPT-UNKNOWN-IS-ACCEPTED-NOT-SENT",
+			"title": "an answer this build cannot classify is reported as `sent`, so a version-skewed peer's acceptance is dressed as a direct injection nobody observed",
+			"subject": "pi-extensions/lib/control-send-receipt.ts",
+			"find": ["\treturn isObservedBoundary(value) ? value : \"accepted-unknown-boundary\";"],
+			"replace": ["\treturn isObservedBoundary(value) ? value : \"sent\";"],
+			"gate": ["bash", "run.sh", "check-control-send-receipt"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-RECEIPT-UNKNOWN-IS-ACCEPTED-NOT-SENT]",
+			"signatureSource": "pi-extensions/lib/control-send-receipt.test.ts"
+		},
+		{
+			"claim": "SEND-BOUNDARY-CARRIED",
+			"title": "the primary leg reports a fixed `sent` instead of the boundary the receiver actually named, so every busy acceptance reads as a direct trigger again",
+			"subject": "pi-extensions/lib/entwurf-v2-send.ts",
+			"find": [
+				"\treturn result.success ? { outcome: \"sent\", boundary: requireBoundary(result) } : inBandRejected(result);"
+			],
+			"replace": ["\treturn result.success ? { outcome: \"sent\", boundary: \"sent\" } : inBandRejected(result);"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-send"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-BOUNDARY-CARRIED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-send.test.ts"
+		},
+		{
+			"claim": "SEND-FALLBACK-KEEPS-BOUNDARY",
+			"title": "a re-resolved socket drops the boundary it was handed, so a first socket that died and a second that was BUSY come out reading as a delivery — the route axis erasing the receipt axis",
+			"subject": "pi-extensions/lib/entwurf-v2-send.ts",
+			"find": [
+				"\t\t\t\treturn r.success ? { outcome: \"fallback-sent\", boundary: requireBoundary(r) } : inBandRejected(r);"
+			],
+			"replace": ["\t\t\t\treturn r.success ? { outcome: \"fallback-sent\", boundary: \"sent\" } : inBandRejected(r);"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-send"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-FALLBACK-KEEPS-BOUNDARY]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-send.test.ts"
+		},
+		{
+			"claim": "SEND-SOCKET-SUCCESS-NEEDS-BOUNDARY",
+			"title": "a successful socket answer with no boundary is accepted silently, so a bypassed wire seam — the one shape that must never pass for a direct trigger — reads exactly like one",
+			"subject": "pi-extensions/lib/entwurf-v2-send.ts",
+			"find": ["\tif (result.boundary === undefined) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-send"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-SOCKET-SUCCESS-NEEDS-BOUNDARY]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-send.test.ts"
+		},
+		{
+			"claim": "SEND-RECEIVER-EMITS-BOUNDARY",
+			"title": "the receiver goes back to answering with a bare `delivered:true`, which was equally true of a direct trigger and of a message rotting in a queue — the bare `delivered` DELIVERY.md refuses by name, and the sender is left with nothing to render",
+			"subject": "pi-extensions/entwurf-control.ts",
+			"find": ["\t\t\tboundary: sendReceiptBoundary({ idle: isIdle, mode }),"],
+			"replace": ["\t\t\tdelivered: true,"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SEND-RECEIVER-EMITS-BOUNDARY]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "SEND-SURFACE-RENDERS-BOUNDARY",
+			"title": "the sender surface renders the internal route word again instead of the receiver's boundary, putting `control-socket → sent` back on a message that is sitting in a queue",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": [
+				"\t\t\t\t\treturn { text: `entwurf_v2 control-socket → ${boundary}${route}${enqueued}`, isError: false };"
+			],
+			"replace": [
+				"\t\t\t\t\treturn { text: `entwurf_v2 control-socket → ${o.outcome}${route}${enqueued}`, isError: false };"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SEND-SURFACE-RENDERS-BOUNDARY]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "SEND-SURFACE-UNKNOWN-NOT-SENT",
+			"title": "an unclassifiable acceptance is rendered with the word `sent`, which is the claim the whole axis exists to stop making — it was accepted, and nobody observed a direct injection",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": [
+				"\t\t\t\t\t\to.boundary ?? (o.outcome === \"fallback-sent\" ? \"mailbox-enqueued\" : \"accepted-unknown-boundary\");"
+			],
+			"replace": [
+				"\t\t\t\t\t\to.boundary === \"accepted-unknown-boundary\" ? \"sent\" : (o.boundary ?? \"mailbox-enqueued\");"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SEND-SURFACE-UNKNOWN-NOT-SENT]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "SEND-SURFACE-FALLBACK-KEEPS-BOUNDARY",
+			"title": "the re-resolved route annotation is dropped, so a caller cannot tell that its first socket was dead — the two legs render identically and a dead-socket host looks healthy",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": ["\t\t\t\t\tconst route = o.outcome === \"fallback-sent\" ? \" (via a re-resolved route)\" : \"\";"],
+			"replace": ["\t\t\t\t\tconst route = \"\";"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SEND-SURFACE-FALLBACK-KEEPS-BOUNDARY]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "SEND-PROSE-NO-INTERRUPT",
+			"title": "the caller-facing description of `mode` goes back to promising that steer interrupts the current turn — a caller picks it for urgency and gets a queue drained only after the turn ends, with no order against the other queue",
+			"subject": "pi-extensions/lib/entwurf-v2-contract-schema.ts",
+			"find": ["\t\t\t\t\"delivery mode — NOT the ownership axis (F1) nor liveness routing."],
+			"replace": [
+				"\t\t\t\t\"delivery mode (steer = interrupt current turn, follow_up = queue) — NOT the ownership axis (F1) nor liveness routing."
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SEND-PROSE-NO-INTERRUPT]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "SEND-DIRTY-LOCK-NAMES-ACCEPTANCE",
+			"title": "the dirty-lock line goes back to `DELIVERED (<route>)` for all three shapes that reach it — a refusal that delivered nothing, a message lying in a volatile queue, and a durable mailbox file all read as one word, at the exact moment an operator is deciding BY HAND whether anything still needs sending",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": [
+				"\t\t\t\t\t\t? `rejected${result.finalizedRejectReason ? ` (${result.finalizedRejectReason})` : \"\"} — the receiver refused it; nothing was accepted`"
+			],
+			"replace": ["\t\t\t\t\t\t? `DELIVERED (${result.finalizedOutcome})`"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SEND-DIRTY-LOCK-NAMES-ACCEPTANCE]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "VITEST-TEST-DIR-ON-THE-FLOOR",
+			"title": "the pi queue oracle's public coordinate is dropped from `check:vitest`, so the file that proves every claim the receipt makes about a receiver's queues is green only when somebody runs `pnpm test` by hand — the discovery door deliberately does not select `test/**`, so nothing else would notice",
+			"subject": "package.json",
+			"find": [
+				"\"check:vitest\": \"./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior\""
+			],
+			"replace": [
+				"\"check:vitest\": \"./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-tests-beside-behavior\""
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:VITEST-TEST-DIR-ON-THE-FLOOR]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PI-CORE-PIN-TRACKS-FLOOR",
+			"title": "the queue oracle's pi-agent-core pin drifts off the floor the rest of the pi runtime is pinned to, so the oracle keeps answering honestly — about a pi nobody in this repo runs",
+			"subject": "package.json",
+			"find": ["\"@earendil-works/pi-agent-core\": \"0.87.1\","],
+			"replace": ["\"@earendil-works/pi-agent-core\": \"0.86.0\","],
+			"gate": ["bash", "run.sh", "check-dep-versions"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-CORE-PIN-TRACKS-FLOOR]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "SEND-DIRTY-LOCK-ERROR-CARRIES-ACCEPTANCE",
+			"title": "the structured dirty-lock error stops carrying the refusal's reason, so a receiver that said WHY it refused loses that word at the one moment an operator is deciding by hand whether the message still needs sending — the render cell cannot see this, because it builds its own result object",
+			"subject": "pi-extensions/lib/entwurf-v2-send.ts",
+			"find": ["\t\t\t\trejectReason: drive.rejectReason,"],
+			"replace": ["\t\t\t\trejectReason: undefined,"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-send"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-DIRTY-LOCK-ERROR-CARRIES-ACCEPTANCE]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-send.test.ts"
+		},
+		{
+			"claim": "SEND-DIRTY-LOCK-RUNNER-MOVES-ACCEPTANCE",
+			"title": "the runner drops the acceptance fields on the way from the thrown error to the result, so the hand proves it fills them and the surface proves it renders them while the operator still sees nothing — the classic middle-seam hole two端 tests cannot cover",
+			"subject": "pi-extensions/lib/entwurf-v2-runner.ts",
+			"find": ["\t\t\t\t\t\tfinalizedRejectReason: err.finalizedRejectReason,"],
+			"replace": ["\t\t\t\t\t\tfinalizedRejectReason: undefined,"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-runner"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-DIRTY-LOCK-RUNNER-MOVES-ACCEPTANCE]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-runner.test.ts"
+		},
+		{
+			"claim": "VITEST-TEST-DIR-HAS-COORDINATE",
+			"title": "the only line that EXECUTES the pi queue oracle is deleted while its verb and its explanatory comment stay, so the file is run by nothing at all — and a checker that accepted a mention instead of a call would keep reporting the floor as complete",
+			"subject": "run.sh",
+			"find": ["  run_vitest test/pi-queue.oracle.test.ts"],
+			"replace": ["  : # the oracle is no longer executed here"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:VITEST-TEST-DIR-HAS-COORDINATE]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "SEND-OUTCOME-LIST-NAMES-EVERY-RAIL",
+			"title": "the caller-facing outcome list drops the native-push rail, so a caller reading the one blurb it reads before dispatching is told the control rail's vocabulary covers a rail that answers with a direct injection instead",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["\t\t\"native-push INJECTION, a rejection, or lock-dirty. EXISTING targets only; discover with \" +"],
+			"replace": ["\t\t\"a rejection, or lock-dirty. EXISTING targets only; discover with \" +"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SEND-OUTCOME-LIST-NAMES-EVERY-RAIL]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		}
+	]
+}

package/scripts/mutants/herdr-activation.json

@@ -13,6 +13,22 @@
 			"signature": "[QK:HAC-PI-USER-SCOPE-ONLY]",
 			"signatureSource": "scripts/check-herdr-activation.ts"
 		},
+		{
+			"claim": "HAC-PI-FLOOR-BOTH-DOORS",
+			"title": "dropping the pi range check from install-user-scope re-opens the door asymmetry: setup refuses a below-floor pi by name while the herdr activation door writes the same registration in silence, so one host reports two verdicts for one citizen",
+			"subject": "run.sh",
+			"find": [
+				"    if ! pi_version_in_range \"${pi_ver:-0}\" \"$pi_range\"; then",
+				"      echo \"[install-user-scope] pi: FAIL — detected pi ${pi_ver:-<unreadable version>} is outside the supported range $pi_range; nothing was written. Align pi, then re-run.\" >&2",
+				"      exit 1",
+				"    fi"
+			],
+			"replace": ["    : \"$pi_range\""],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-PI-FLOOR-BOTH-DOORS]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
 		{
 			"claim": "HAC-COMMAND-IS-DERIVED",
 			"title": "accepting any absolute directory as 'the plugin runtime' is a way to point every pi session at an executable of the caller's choosing — 'absolute' was never the contract, 'this host's stable runtime' was",

package/scripts/mutants/herdr-fresh-call.json

@@ -15,10 +15,10 @@
 		},
 		{
 			"claim": "HFC-PILOT-CLOSED",
-			"title": "a backend nobody measured on herdr is admitted to the pilot, so a caller gets a pane running something this rail never proved it can open",
-			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
-			"find": ["export const HERDR_FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\"] as const;"],
-			"replace": ["export const HERDR_FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"codex\"] as const;"],
+			"title": "a backend nobody measured on herdr is admitted to the pilot, so a caller gets a pane running something this rail never proved it can open (#116 A7: the tuple moved to the shared rails leaf, so the mutant follows its subject — widening the pilot set is still the mutation, it is simply written in one place now)",
+			"subject": "scripts/herdr-rails.mjs",
+			"find": ["export const HERDR_FRESH_CALL_BACKENDS = Object.freeze([\"pi\", \"claude-code\"]);"],
+			"replace": ["export const HERDR_FRESH_CALL_BACKENDS = Object.freeze([\"pi\", \"claude-code\", \"codex\"]);"],
 			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:HFC-PILOT-CLOSED]",
@@ -443,6 +443,17 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:HFC-WITNESS-BINDING-COMPLETE]",
 			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HFC-CALLBACK-ENV",
+			"title": "the launcher-computed callback pair is dropped from herdr --env, so a herdr sibling's first action has to retype a garden id out of prose",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\t...callbackEnvAssignments(params.callback).flatMap((assignment) => [\"--env\", assignment]),"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-CALLBACK-ENV]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
 		}
 	]
 }

package/scripts/mutants/herdr-plugin-build.json

@@ -132,14 +132,10 @@
 		},
 		{
 			"claim": "HPB-USAGE-NOTE-NAMES-A-MODEL",
-			"title": "the install names a model id in the wrong harness's grammar, so the first fresh call an operator copies is refused",
-			"subject": "plugins/herdr/lib/build.mjs",
-			"find": [
-				"\t\tnotes.push(\"claude-code: a model id looks like `claude-sonnet-5` — the vendor id, not a provider path.\");"
-			],
-			"replace": [
-				"\t\tnotes.push(\"claude-code: a model id looks like `anthropic/claude-sonnet-5` — provider-qualified.\");"
-			],
+			"title": "the install names a model id in the wrong harness's grammar, so the first fresh call an operator copies is refused (#116 A7: the example moved to the shared rails leaf; the mutation still gives claude-code a provider-qualified id, which is the grammar confusion this claim exists to catch)",
+			"subject": "scripts/herdr-rails.mjs",
+			"find": ["\t\"claude-code\": \"claude-sonnet-5\","],
+			"replace": ["\t\"claude-code\": \"anthropic/claude-sonnet-5\","],
 			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:HPB-USAGE-NOTE-NAMES-A-MODEL]",
@@ -147,10 +143,10 @@
 		},
 		{
 			"claim": "HPB-INSTALL-USAGE-NOTE",
-			"title": "dropping the pi line leaves the one backend whose wiring is invisible from the operator's chair unexplained: claude-code picks the tools up through MCP with nothing added, while a plain pi loads the extension on every session of the host and is still not a citizen — a green install followed by a silent, tool-less pi is indistinguishable from an install that did nothing",
+			"title": "dropping the pi line leaves the one backend whose wiring is invisible from the operator's chair unexplained: claude-code picks the tools up through MCP with nothing added, while a plain pi loads the extension on every session of the host and is still not a citizen — a green install followed by a silent, tool-less pi is indistinguishable from an install that did nothing (#116 A7: usageNotes now loops the shared backend tuple instead of a literal pair, so the mutation suppresses pi's notes at the loop guard rather than at a per-backend `if`)",
 			"subject": "plugins/herdr/lib/build.mjs",
-			"find": ["\tif (activated.includes(\"pi\")) {"],
-			"replace": ["\tif (false && activated.includes(\"pi\")) {"],
+			"find": ["\t\tif (!activated.includes(backend)) continue;"],
+			"replace": ["\t\tif (backend === \"pi\" || !activated.includes(backend)) continue;"],
 			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:HPB-INSTALL-USAGE-NOTE]",

package/scripts/mutants/herdr-plugin.json

@@ -6,9 +6,9 @@
 			"claim": "HPL-ONE-OPEN-ONE-READ",
 			"title": "re-reading either listing turns one answered question into a poll — peer-facts observes every citizen unbounded (measured 4.1s on a 1,150-record store) and herdr publishes no 'the session reference landed' event, so a second read is both the slow path and the discovery watcher docs/mux-launch-rail.md §7 refuses by name (#116 M2-b)",
 			"subject": "plugins/herdr/lib/status.mjs",
-			"find": ["\t\t\tconst agents = readJson(herdrBin, [\"agent\", \"list\"], {"],
+			"find": ["\tconst agents = readJson(herdrBin, [\"agent\", \"list\"], {"],
 			"replace": [
-				"\t\t\treadJson(herdrBin, [\"agent\", \"list\"], { failed: \"x\", unparsable: \"y\" });\n\t\t\tconst agents = readJson(herdrBin, [\"agent\", \"list\"], {"
+				"\treadJson(herdrBin, [\"agent\", \"list\"], { failed: \"x\", unparsable: \"y\" });\n\tconst agents = readJson(herdrBin, [\"agent\", \"list\"], {"
 			],
 			"gate": ["bash", "run.sh", "check-herdr-plugin"],
 			"timeoutSeconds": 180,
@@ -19,8 +19,8 @@
 			"claim": "HPL-SKIP-NOT-FAILURE",
 			"title": "turning a missing Entwurf into a red makes every host that simply has not installed it look broken, and invites the plugin to 'fix' it — installing Entwurf is not a plugin's business (AGENTS.md Hard Rule 17, #116 M2-b)",
 			"subject": "plugins/herdr/lib/status.mjs",
-			"find": ["\tfinish([\"entwurf-not-found\"], OK);"],
-			"replace": ["\tfinish([\"entwurf-not-found\"], RED);"],
+			"find": ["\t\t\t\t\tcode: \"entwurf-not-found\","],
+			"replace": ["\t\t\t\t\tcode: \"quietly-nothing\","],
 			"gate": ["bash", "run.sh", "check-herdr-plugin"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:HPL-SKIP-NOT-FAILURE]",
@@ -28,12 +28,12 @@
 		},
 		{
 			"claim": "HPL-FAILED-READ-IS-RED",
-			"title": "treating a nonzero listing exit as success renders an empty table for a listing that was never read — a host whose store could not be opened becomes indistinguishable from a host with no citizens (#116 M2-b)",
+			"title": "treating a nonzero listing exit as success renders an empty table for a listing that was never read — a host whose store could not be opened becomes indistinguishable from a host with no citizens (#116 M2-b) (#116 P1: the non-zero check moved into the single `spawnOnce` call site, so the mutation follows its subject — both listings now lose their exit check at once, which is the same defect stated in one place)",
 			"subject": "plugins/herdr/lib/status.mjs",
 			"find": [
-				"\tif (run.status !== 0) return { error: names.failed, detail: `exit ${run.status}: ${(run.stderr ?? \"\").trim()}` };"
+				"\tif (run.status !== 0) return { error: failedCode, detail: `exit ${run.status}: ${(run.stderr ?? \"\").trim()}` };"
 			],
-			"replace": ["\tif (false) return { error: names.failed, detail: `exit ${run.status}` };"],
+			"replace": ["\tif (false) return { error: failedCode, detail: `exit ${run.status}` };"],
 			"gate": ["bash", "run.sh", "check-herdr-plugin"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:HPL-FAILED-READ-IS-RED]",
@@ -65,8 +65,12 @@
 			"claim": "HPL-DIAGNOSTICS-SHOWN",
 			"title": "dropping the provider's diagnostics shows a store carrying hazards as a clean listing — the one lie a status pane can tell while looking green (#116 M2-b)",
 			"subject": "plugins/herdr/lib/status.mjs",
-			"find": ["\t\t\t\t\t\t...renderDiagnostics(diagnostics),"],
-			"replace": ["\t\t\t\t\t\t...renderDiagnostics([]),"],
+			"find": [
+				"\t\tlines: [...renderTable(peers, indexActivityByPane(agentRows)), \"\", ...renderDiagnostics(diagnostics)],"
+			],
+			"replace": [
+				"\t\tlines: [...renderTable(peers, indexActivityByPane(agentRows)), \"\", ...renderDiagnostics([])],"
+			],
 			"gate": ["bash", "run.sh", "check-herdr-plugin"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:HPL-DIAGNOSTICS-SHOWN]",
@@ -128,6 +132,170 @@
 			"timeoutSeconds": 180,
 			"signature": "[QK:HPL-DIAGNOSTIC-SUBJECTS]",
 			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-BLOCK-PROVENANCE",
+			"title": "the activation block stops saying it is an install-time receipt and claims it was read now — the one sentence that keeps an add-only ledger from being mistaken for a live probe, and the moment it goes the four blocks collapse into one implied 'as of now'",
+			"subject": "plugins/herdr/lib/capability-report.mjs",
+			"find": ["\tactivation: \"install-time\","],
+			"replace": ["\tactivation: \"now\","],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-BLOCK-PROVENANCE]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-NO-AGGREGATE-VERDICT",
+			"title": "a summary line is added over the four blocks, which is exactly the merged green this surface exists to refuse: one word has to pick one observation time and be wrong about the other two",
+			"subject": "plugins/herdr/lib/capability-report.mjs",
+			"find": ["\tconst out = [];"],
+			"replace": ["\tconst out = [\"Overall: all ready.\"];"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-NO-AGGREGATE-VERDICT]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-RAILS-SHARED-SOURCE",
+			"title": "the RAILS block stops reading the shared declaration leaf and renders a hardcoded model string, re-opening the third-copy drift that leaf was created to close",
+			"subject": "plugins/herdr/lib/capability-report.mjs",
+			"find": [
+				"\t\t\t`  ${backend}: ${railEntryNote[backend]}\\n    model string syntax, one example only: \\`${modelSyntaxExample[backend]}\\``,"
+			],
+			"replace": [
+				"\t\t\t`  ${backend}: ${railEntryNote[backend]}\\n    model string syntax, one example only: \\`some-provider/some-model\\``,"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-RAILS-SHARED-SOURCE]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-LEDGER-FALLBACK-READS-CITIZENS",
+			"title": "the D3=C fallback is removed, so a correct plugin install — which puts nothing on PATH — closes its own first screen with entwurf-not-found again, and the operator is back to setting ENTWURF_BIN by hand",
+			"subject": "plugins/herdr/lib/status.mjs",
+			"find": ["\tif (evidence.kind === \"ledger\" && evidence.runtimeBin !== null) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-LEDGER-FALLBACK-READS-CITIZENS]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-OVERRIDE-BEATS-LEDGER",
+			"title": "the ledger is consulted BEFORE the operator's own ENTWURF_BIN and PATH, so a receipt silently out-votes the person at the keyboard — the failure mode a fallback is most likely to grow",
+			"subject": "plugins/herdr/lib/status.mjs",
+			"find": ["\tconst declared = process.env.ENTWURF_BIN;\n\tif (declared !== undefined && declared !== \"\") {"],
+			"replace": [
+				"\tconst declared = process.env.ENTWURF_BIN;\n\tif (evidence.kind !== \"ledger\" && declared !== undefined && declared !== \"\") {"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-OVERRIDE-BEATS-LEDGER]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-ACTIVATION-NAMED-REDS",
+			"title": "every broken activation state collapses into one generic code, so `we cannot import the reader`, `the body is not certifiable`, `this receipt is about another root` and `the promised binary is gone` become indistinguishable — four different repairs behind one word",
+			"subject": "plugins/herdr/lib/activation-evidence.mjs",
+			"find": ["\t\t\tcode: \"activation-runtime-root-mismatch\","],
+			"replace": ["\t\t\tcode: \"activation-reader-unavailable\","],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-ACTIVATION-NAMED-REDS]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-LEDGER-AT-WRITER-PATH",
+			"title": "the ledger is addressed at the RUNTIME's data root again instead of the writer's XDG state root, so on every correctly activated host the pane finds no ledger where one certainly exists — and because the writer's reader answers a missing file with `null`, the original of this mutation did not merely lose the D3=C fallback, it killed the pane before a single block was drawn",
+			"subject": "plugins/herdr/lib/activation-evidence.mjs",
+			"find": ["\t\tledgerPath: activation.ledgerPath,"],
+			"replace": ["\t\tledgerPath: path.join(layout.pluginRoot, \"activation.json\"),"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-LEDGER-AT-WRITER-PATH]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-LEDGER-MISSING-IS-NAMED",
+			"title": "a missing ledger is only noticed AFTER the installed reader has been located, so a host whose single real fact is that nothing ever wrote a receipt is told its runtime is broken instead — two different repairs behind one name, and the ledger's address needed no installed artifact to resolve in the first place",
+			"subject": "plugins/herdr/lib/activation-evidence.mjs",
+			"find": ["\tif (!ledgerPresent) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-LEDGER-MISSING-IS-NAMED]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-ENV-ROOT-IS-NAMED",
+			"title": "the layout resolvers are called outside any guard, so a host with neither HOME nor an XDG root takes the pane down on an unhandled rejection instead of being told, in the activation block, that we cannot even say where its ledger would live — the other three blocks never needed that root",
+			"subject": "plugins/herdr/lib/activation-evidence.mjs",
+			"find": [
+				"\tlet roots;\n\ttry {\n\t\troots = deriveRoots(env, { runtimeModule, activationModule });\n\t} catch (err) {"
+			],
+			"replace": [
+				"\tlet roots;\n\troots = deriveRoots(env, { runtimeModule, activationModule });\n\ttry {\n\t\tif (roots === undefined) throw new Error(\"unreachable\");\n\t} catch (err) {"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-ENV-ROOT-IS-NAMED]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-PHASE-GATES-FALLBACK",
+			"title": "any certified ledger grants the runtime fallback, including one written mid-teardown, so an add-only install-time receipt is spent as if it were a live probe — `deactivating` says what was wired, not what is standing there now, and merging those two is how this pane would start answering a runtime question with an install-time answer",
+			"subject": "plugins/herdr/lib/activation-evidence.mjs",
+			"find": ["\tif (ledger.phase !== \"active\") {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-PHASE-GATES-FALLBACK]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-INTEGRATION-NONCURRENT-IS-RED",
+			"title": "a selected atom herdr reports as outdated or needs-repair leaves block [1] a neutral `reported` and the pane at exit 0, so a surface that has ALREADY classified those two into `profile.fail` — and whose build runner refuses them — reports them as if nothing were wrong. `no aggregate green` keeps each axis's own receipt; it never meant an axis that failed leaves at zero",
+			"subject": "plugins/herdr/lib/capability-report.mjs",
+			"find": ["\tif (failing.length > 0) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-INTEGRATION-NONCURRENT-IS-RED]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-READER-EXPORT-IS-REQUIRED",
+			"title": "the export check is dropped, so an installed reader that loads without `readCertifiedLedger` raises its TypeError inside the certification try and is filed as `activation-ledger-uncertified` — the operator is sent to inspect a ledger that is fine instead of to the install that is not, and no body was ever read",
+			"subject": "plugins/herdr/lib/activation-evidence.mjs",
+			"find": ["\tif (typeof reader.readCertifiedLedger !== \"function\") {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-READER-EXPORT-IS-REQUIRED]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-LEDGER-VANISHED-IS-NAMED",
+			"title": "the LATE null guard is dropped, so a ledger that passed the presence check and is gone by the time the installed reader reads it is dereferenced — the early branch cannot cover that race because it already answered while the file existed, and the pane dies with a TypeError before drawing a block",
+			"subject": "plugins/herdr/lib/activation-evidence.mjs",
+			"find": ["\tif (ledger === null) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-LEDGER-VANISHED-IS-NAMED]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
+		},
+		{
+			"claim": "HPL-PACKAGE-NAME-FROM-MANIFEST",
+			"title": "reading the installed package's directory name off `runtime-lock.json` works only on the `npm` arm — the `herdr-checkout` arm is `{source, repository}` and carries no `name`, so this drift yields `undefined`, `path.join` answers that with a TypeError past every named refusal, and the status pane dies before drawing one block on exactly the carrier every candidate window rides (#120; born in 79391fb)",
+			"subject": "plugins/herdr/lib/activation-evidence.mjs",
+			"find": ["\t\tconst packageName = runtimeModule.readCheckoutPackageSpec(checkoutRoot).name;"],
+			"replace": ["\t\tconst packageName = runtimeModule.readRuntimeLock(checkoutRoot).name;"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:HPL-PACKAGE-NAME-FROM-MANIFEST]",
+			"signatureSource": "scripts/check-herdr-plugin.ts"
 		}
 	]
 }

package/scripts/mutants/meta-retire.json

@@ -42,6 +42,28 @@
 			"timeoutSeconds": 300,
 			"signature": "[QK:META-RETIRE-FRESH-TOUCH]",
 			"signatureSource": "scripts/smoke-meta-install-state.sh"
+		},
+		{
+			"claim": "META-RETIRE-TURN-DURATION-OPERATOR-OWNED",
+			"title": "putting showTurnDuration back under management makes entwurf force the operator's own turn-duration display to false, and re-collides the cross-repo managed-keys contract with the operator's own settings fragment",
+			"subject": "scripts/meta-bridge-state.py",
+			"find": [
+				"    (\"showTurnDuration\", [\"showTurnDuration\"], False),",
+				"]",
+				"",
+				"_managed_scalar_names = {name for name, _path, _desired in MANAGED_SETTINGS_SCALARS}"
+			],
+			"replace": [
+				"]",
+				"",
+				"MANAGED_SETTINGS_SCALARS.append((\"showTurnDuration\", [\"showTurnDuration\"], False))",
+				"",
+				"_managed_scalar_names = {name for name, _path, _desired in MANAGED_SETTINGS_SCALARS}"
+			],
+			"gate": ["bash", "run.sh", "smoke-meta-install-state"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:META-RETIRE-TURN-DURATION-OPERATOR-OWNED]",
+			"signatureSource": "scripts/smoke-meta-install-state.sh"
 		}
 	]
 }