@junghanacs/entwurf 0.24.0 → 0.25.1

package/scripts/lib/qualification-release.ts

@@ -0,0 +1,271 @@
+/**
+ * qualification-release — compose a RELEASE ledger from CI collections along a
+ * first-parent chain (#124 step 2). PURE: no network, no git, no fs. The caller hands
+ * in what it has already fetched and verified elsewhere; this function never claims its
+ * inputs came from anywhere in particular, and it produces no acceptance class.
+ *
+ * Inputs:
+ *   - finalSha and firstParent (`git rev-list --first-parent finalSha`, finalSha first);
+ *   - runs: one entry per CI run attempt — runId, runAttempt, headSha, and the unpacked
+ *     collection files (name → bytes);
+ *   - independent: the candidate recomputed by the caller from the final tree ITSELF
+ *     (surface, groups, manifest claims, CORE_FILES fingerprints). Its node/node_modules
+ *     part cannot be recomputed off the CI runner and is not used;
+ *   - operatorDeclared: extra groups a human requires to be measured on the final SHA.
+ *
+ * Contract errors (any → RED): a run that is not CI provenance (runId/runAttempt not
+ * digits), a headSha off the first-parent chain, the same (runId, runAttempt) twice, a
+ * collection whose own runId/runAttempt/head disagree with the run, no collection at the
+ * final SHA, an incomplete final collection, or a final candidate the independent
+ * recomputation contradicts.
+ *
+ * Per SHA only the newest (runId, then runAttempt) run counts; older ones are listed as
+ * superseded. An incomplete ancestor collection is excluded from the basis with its
+ * reason. Order across runs is first-parent position, then collection index — never a
+ * clock. Release blockers on top of the local ones: every group needs a usable pass
+ * receipt somewhere in the chain (UNRUN blocks), and the runner group, every group whose
+ * newest receipt in the chain is red, and every operator-declared group must be
+ * exact-MEASURED on the final SHA. A red on an ancestor that the final SHA re-measured
+ * green stays in history and contributes no FAIL.
+ */
+
+import { type Collection, checkCollectionData, mapReader } from "./qualification-collection.ts";
+import {
+	type ContentCandidate,
+	type CurrentCandidate,
+	composeLedger,
+	type Ledger,
+	type LoadedReceipt,
+} from "./qualification-ledger.ts";
+import { canonicalJson } from "./qualification-receipt.ts";
+
+export interface CiRun {
+	runId: string;
+	runAttempt: string;
+	headSha: string;
+	files: Record<string, Buffer>;
+}
+
+export interface ReleaseInput {
+	finalSha: string;
+	firstParent: string[];
+	runs: CiRun[];
+	/** The final tree's content projection — no C0 environment part (see ContentCandidate). */
+	independent: ContentCandidate;
+	operatorDeclared: string[][];
+}
+
+export interface RunRef {
+	runId: string;
+	runAttempt: string;
+	headSha: string;
+}
+
+export interface ReleaseLedger extends Ledger {
+	release: {
+		finalSha: string;
+		contractErrors: string[];
+		crossCheck: string[];
+		used: RunRef[];
+		excluded: (RunRef & { reason: string })[];
+		required: string[][];
+		denominator: {
+			groups: number;
+			claims: number;
+			measuredOnFinal: { groups: number; claims: number; list: string[] };
+			inheritedCore: { gate: string; from: RunRef | null; reason: string }[];
+			flagged: string[];
+			unrun: number;
+			fail: number;
+		};
+		/** What this ledger can and cannot vouch for. */
+		provenance: string[];
+	};
+}
+
+const DIGITS = /^[0-9]+$/;
+const refOf = (r: CiRun): RunRef => ({ runId: r.runId, runAttempt: r.runAttempt, headSha: r.headSha });
+const newer = (a: CiRun, b: CiRun): boolean =>
+	BigInt(a.runId) !== BigInt(b.runId) ? BigInt(a.runId) > BigInt(b.runId) : BigInt(a.runAttempt) > BigInt(b.runAttempt);
+
+/** Content fields a CI-claimed candidate must share with the independent recomputation. */
+export function crossCheckCandidate(claimed: CurrentCandidate, independent: ContentCandidate): string[] {
+	const out: string[] = [];
+	if (claimed.head !== independent.head) out.push(`head: CI ${claimed.head} vs tree ${independent.head}`);
+	if (claimed.workSurfaceSha256 !== independent.workSurfaceSha256) out.push("workSurface");
+	if (canonicalJson(claimed.manifestClaims) !== canonicalJson(independent.manifestClaims)) out.push("manifestClaims");
+	if (canonicalJson(claimed.groups) !== canonicalJson(independent.groups)) out.push("groups");
+	if (!claimed.coreFiles || !independent.coreFiles) out.push("coreFiles: missing on one side");
+	else if (canonicalJson(claimed.coreFiles) !== canonicalJson(independent.coreFiles)) out.push("coreFiles");
+	return out;
+}
+
+export function composeRelease(input: ReleaseInput): ReleaseLedger {
+	const contractErrors: string[] = [];
+	const excluded: ReleaseLedger["release"]["excluded"] = [];
+	const chainPos = new Map(input.firstParent.map((sha, i) => [sha, i]));
+	if (input.firstParent[0] !== input.finalSha) contractErrors.push("firstParent must start with finalSha");
+
+	// 1. Admission: provenance shape, chain membership, uniqueness, collection integrity.
+	const seenAttempt = new Set<string>();
+	const admitted: { run: CiRun; collection: Collection; complete: boolean; errors: string[] }[] = [];
+	for (const run of input.runs) {
+		const tag = `run ${run.runId}#${run.runAttempt}@${run.headSha.slice(0, 12)}`;
+		if (!DIGITS.test(run.runId) || !DIGITS.test(run.runAttempt)) {
+			contractErrors.push(`${tag}: runId/runAttempt are not CI provenance`);
+			continue;
+		}
+		const key = `${run.runId}#${run.runAttempt}`;
+		if (seenAttempt.has(key)) {
+			contractErrors.push(`${tag}: the same run attempt is supplied twice`);
+			continue;
+		}
+		seenAttempt.add(key);
+		if (!chainPos.has(run.headSha)) {
+			contractErrors.push(`${tag}: headSha is not on the first-parent chain of ${input.finalSha.slice(0, 12)}`);
+			continue;
+		}
+		const { errors, collection } = checkCollectionData(mapReader(run.files), Object.keys(run.files).sort());
+		if (!collection) {
+			contractErrors.push(`${tag}: ${errors.join("; ")}`);
+			continue;
+		}
+		if (collection.runId !== run.runId || collection.runAttempt !== run.runAttempt) {
+			contractErrors.push(`${tag}: the collection records run ${collection.runId}#${collection.runAttempt}`);
+			continue;
+		}
+		if (collection.candidate.head !== run.headSha) {
+			contractErrors.push(`${tag}: the collection measured head ${collection.candidate.head}`);
+			continue;
+		}
+		admitted.push({ run, collection, complete: errors.length === 0, errors });
+	}
+
+	// 2. One run per SHA: the newest attempt wins; the rest are superseded, never mixed in.
+	const perSha = new Map<string, (typeof admitted)[number]>();
+	for (const a of admitted) {
+		const cur = perSha.get(a.run.headSha);
+		if (!cur || newer(a.run, cur.run)) {
+			if (cur) excluded.push({ ...refOf(cur.run), reason: `superseded by run ${a.run.runId}#${a.run.runAttempt}` });
+			perSha.set(a.run.headSha, a);
+		} else {
+			excluded.push({ ...refOf(a.run), reason: `superseded by run ${cur.run.runId}#${cur.run.runAttempt}` });
+		}
+	}
+	const finalEntry = perSha.get(input.finalSha);
+	if (!finalEntry) contractErrors.push(`no CI collection at the final SHA ${input.finalSha.slice(0, 12)}`);
+	else if (!finalEntry.complete)
+		contractErrors.push(`final-SHA collection incomplete: ${finalEntry.errors.join("; ")}`);
+	const used: (typeof admitted)[number][] = [];
+	for (const [sha, a] of perSha) {
+		if (sha !== input.finalSha && !a.complete) {
+			excluded.push({ ...refOf(a.run), reason: `incomplete ancestor collection, not a basis: ${a.errors.join("; ")}` });
+			continue;
+		}
+		used.push(a);
+	}
+
+	// 3. The final candidate: content from the independent recomputation, C0 environment
+	//    part (node, node_modules) as the final run witnessed it.
+	const crossCheck = finalEntry ? crossCheckCandidate(finalEntry.collection.candidate, input.independent) : [];
+	const current: CurrentCandidate = {
+		...input.independent,
+		head: input.finalSha,
+		// porcelainClean stays the INDEPENDENT candidate's own: a clean final tree is the
+		// oracle's to produce and prove, never this function's to assume.
+		coreSha256: finalEntry ? finalEntry.collection.candidate.coreSha256 : "unwitnessed",
+	};
+
+	// 4. Receipts in chain order (older first-parent position first), collection index next.
+	const maxPos = input.firstParent.length;
+	const loaded: LoadedReceipt[] = [];
+	const receiptRun = new Map<string, RunRef>();
+	const finalSources = new Set<string>();
+	for (const a of used) {
+		const base = (maxPos - (chainPos.get(a.run.headSha) ?? maxPos)) * 1_000_000;
+		a.collection.attempted.forEach((att, i) => {
+			if (att.outcome !== "receipt-written" || !att.file) return;
+			const bytes = a.run.files[att.file];
+			if (!bytes) return;
+			if (a.run.headSha === input.finalSha) finalSources.add(`run ${a.run.runId}#${a.run.runAttempt}/${att.file}`);
+			loaded.push({
+				source: `run ${a.run.runId}#${a.run.runAttempt}/${att.file}`,
+				text: bytes.toString("utf8"),
+				seq: base + i,
+			});
+			try {
+				receiptRun.set(JSON.parse(bytes.toString("utf8")).receiptSha256, refOf(a.run));
+			} catch {
+				// unparseable: composeLedger reports it as INVALID
+			}
+		});
+	}
+
+	// 5. The required set on the final SHA: runner, every group whose newest receipt among
+	//    the ANCESTOR runs is red (the section that broke — computed before the final run,
+	//    so re-measuring it green does not erase the requirement), operator-declared.
+	const newestPassed = new Map<string, boolean>();
+	for (const l of [...loaded].filter((x) => !finalSources.has(x.source)).sort((x, y) => (x.seq ?? 0) - (y.seq ?? 0))) {
+		try {
+			const r = JSON.parse(l.text);
+			newestPassed.set(JSON.stringify(r.group.gate), r.result.passed === true);
+		} catch {
+			// INVALID, reported by composeLedger
+		}
+	}
+	const requiredKeys = new Set<string>([JSON.stringify(input.independent.coreGroupGate)]);
+	for (const [k, passed] of newestPassed) if (!passed) requiredKeys.add(k);
+	for (const argv of input.operatorDeclared) requiredKeys.add(JSON.stringify(argv));
+	const required = [...requiredKeys].map((k) => JSON.parse(k) as string[]);
+
+	const ledger = composeLedger(loaded, current, undefined, { mode: "release", required });
+	const red = contractErrors.length > 0 || crossCheck.length > 0;
+	const verdict = red ? "RED" : ledger.verdict;
+	const summary = [
+		...(red ? [`[qualification-release] RED on ${input.finalSha.slice(0, 12)}`] : []),
+		...contractErrors.map((e) => `  CONTRACT ${e}`),
+		...crossCheck.map((e) => `  CROSS-CHECK ${e}: the CI-claimed candidate contradicts the final tree`),
+		...excluded.map((e) => `  EXCLUDED run ${e.runId}#${e.runAttempt}@${e.headSha.slice(0, 12)}: ${e.reason}`),
+		...ledger.summary,
+	];
+	const measured = ledger.groups.filter((g) => g.state === "MEASURED" && g.provenance === "exact");
+	return {
+		...ledger,
+		verdict,
+		summary,
+		release: {
+			finalSha: input.finalSha,
+			contractErrors,
+			crossCheck,
+			used: used.map((a) => refOf(a.run)),
+			excluded,
+			required,
+			denominator: {
+				groups: ledger.counts.groups.total,
+				claims: ledger.counts.claims.total,
+				measuredOnFinal: {
+					groups: measured.length,
+					claims: measured.reduce((n, g) => n + g.claims.length, 0),
+					list: measured.map((g) => g.gate.join(" ")),
+				},
+				inheritedCore: ledger.groups
+					.filter((g) => g.state === "INHERITED-UNVERIFIED" && g.inheritKind === "c-core")
+					.map((g) => ({
+						gate: g.gate.join(" "),
+						from: (g.decidedBy && receiptRun.get(g.decidedBy)) || null,
+						reason: g.reasons[0],
+					})),
+				flagged: ledger.groups
+					.filter((g) => g.flags.length > 0)
+					.map((g) => `${g.gate.join(" ")}: ${g.flags.join("; ")}`),
+				unrun: ledger.counts.groups.UNRUN,
+				fail: ledger.counts.groups.FAIL,
+			},
+			provenance: [
+				"inputs are whatever the caller supplied; this function does not fetch or authenticate them",
+				"node/node_modules identity is the final run's own witness, not recomputed here",
+				"no acceptance class is produced: RISK-PENDING awaits a human decision",
+			],
+		},
+	};
+}

package/scripts/meta-bridge-state.py

@@ -81,13 +81,18 @@ LEGACY_PERMISSION_ALLOW = ["mcp__pi-tools-bridge__*"]
 # native rail stops owning `autoCompactEnabled` / `env.DISABLE_AUTOCOMPACT` too.
 # Backend-native context management is allowed; we add no guard and only measure.
 # Both keys live in RETIRED_SETTINGS_SCALARS below.
+#
+# NEITHER IS `showTurnDuration`. It reports how long a turn took, which is
+# OPERATOR INFORMATION — it opens no background autonomy surface and drives no
+# single-driver behaviour, so the policy reason the rest of this list stands on
+# never applied to it. GLG's ruling: the operator owns that scalar and entwurf
+# must not force it to false. It joins RETIRED_SETTINGS_SCALARS below.
 MANAGED_SETTINGS_SCALARS: list[tuple[str, list[str], Any]] = [
     ("cleanupPeriodDays", ["cleanupPeriodDays"], 365),
     ("promptSuggestionEnabled", ["promptSuggestionEnabled"], False),
     ("awaySummaryEnabled", ["awaySummaryEnabled"], False),
     ("autoMemoryEnabled", ["autoMemoryEnabled"], False),
     ("verbose", ["verbose"], False),
-    ("showTurnDuration", ["showTurnDuration"], False),
     ("terminalProgressBarEnabled", ["terminalProgressBarEnabled"], False),
     ("useAutoModeDuringPlan", ["useAutoModeDuringPlan"], False),
     ("enableWorkflows", ["enableWorkflows"], False),
@@ -108,6 +113,18 @@ RETIRED_SETTINGS_SCALARS: list[tuple[str, list[str], Any]] = [
     # reach it.
     ("env.DISABLE_AUTOCOMPACT", ["env", "DISABLE_AUTOCOMPACT"], "1"),
     ("autoCompactEnabled", ["autoCompactEnabled"], False),
+    # `showTurnDuration` returns to the operator for the same structural reason
+    # and by the same one-shot path. It is retired rather than deleted because an
+    # existing install-state ALREADY carries its entry — measured on the source
+    # host 2026-09-23: `~/.claude/entwurf.install-state.json` records
+    # `original {existed: true, value: false}` while live settings say `true`,
+    # i.e. the operator turned it on after our install. Deleting the constant
+    # would orphan that entry, and uninstall() walks every ledger entry through
+    # restore_entry(), so it would write `false` back over the operator's own
+    # choice. relinquish_retired_scalar() is what makes the inverse honest: the
+    # live `true` is not what we last managed, so it is left untouched and the
+    # entry is consumed, after which no code path can reach that key again.
+    ("showTurnDuration", ["showTurnDuration"], False),
 ]
 
 _managed_scalar_names = {name for name, _path, _desired in MANAGED_SETTINGS_SCALARS}

package/scripts/mutants/bridge-command-boot.json

@@ -37,6 +37,44 @@
 			"signature": "[QK:PI-DOCTOR-PROBES-OVERRIDE]",
 			"signatureSource": "scripts/smoke-pi-provider-state.sh"
 		},
+		{
+			"claim": "PI-DOCTOR-PLUGIN-COMMAND-IS-NOT-DRIFT",
+			"title": "the recorded-command comparison degenerates to 'always drifted', so a Herdr-plugin host whose effective command IS exactly the absolute bridge this install wrote is red again — the #116 M3-b2 false-red restored in the new wording. It is the always-red half of a symmetric pair with PI-DOCTOR-REAL-DRIFT-STILL-RED's always-green half; a mutation that instead re-scoped the comparison under `!isBare` would also kill that claim's bare cell, so this one deliberately does not touch the managedState predicate",
+			"subject": "scripts/doctor-pi-provider.ts",
+			"find": ["\t\tif (cmd !== stateCommand) {"],
+			"replace": ["\t\tif (true) {"],
+			"gate": ["bash", "scripts/smoke-pi-provider-state.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PI-DOCTOR-PLUGIN-COMMAND-IS-NOT-DRIFT]",
+			"signatureSource": "scripts/smoke-pi-provider-state.sh"
+		},
+		{
+			"claim": "PI-DOCTOR-REAL-DRIFT-STILL-RED",
+			"title": "the drift comparison is dropped entirely, so a managed key repointed at a command entwurf never wrote reads as 'the managed command this install recorded' — the ownership axis silently stops existing",
+			"subject": "scripts/doctor-pi-provider.ts",
+			"find": ["\t\tif (cmd !== stateCommand) {"],
+			"replace": ["\t\tif (false) {"],
+			"gate": ["bash", "scripts/smoke-pi-provider-state.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PI-DOCTOR-REAL-DRIFT-STILL-RED]",
+			"signatureSource": "scripts/smoke-pi-provider-state.sh"
+		},
+		{
+			"claim": "PI-DOCTOR-LEGACY-STATE-UNCHANGED",
+			"title": "the plugin-mode repair is turned into a schema amnesty: a managed record written before `command` existed stops being red and its unrecorded, uncomparable entry is adopted as a note — a green nobody measured, handed out by the doctor instead of by ./run.sh setup",
+			"subject": "scripts/doctor-pi-provider.ts",
+			"find": [
+				"\t\t\tlog(`  FAIL: state owns entwurf-bridge (ownership=${ownership}) but the effective command drifted to '${cmd}'.`);",
+				"\t\t\thardFail = 1;"
+			],
+			"replace": [
+				"\t\t\tlog(`  note: legacy record (ownership=${ownership}) — no recorded command, adopting '${cmd}'.`);"
+			],
+			"gate": ["bash", "scripts/smoke-pi-provider-state.sh"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PI-DOCTOR-LEGACY-STATE-UNCHANGED]",
+			"signatureSource": "scripts/smoke-pi-provider-state.sh"
+		},
 		{
 			"claim": "AGY-DOCTOR-PROBES-ARGS",
 			"title": "the agy invocation parser drops configured args, so the doctor boots command defaults while agy executes a failing argv",

package/scripts/mutants/control-send-receipt.json

@@ -0,0 +1,235 @@
+{
+	"schemaVersion": 1,
+	"lane": "control-send-receipt",
+	"mutants": [
+		{
+			"claim": "SEND-RECEIPT-IDLE-IS-SENT",
+			"title": "an idle receiver's DIRECT trigger is reported as a queue it never touched, so the one boundary that actually started a turn becomes indistinguishable from the two that did not",
+			"subject": "pi-extensions/lib/control-send-receipt.ts",
+			"find": ["\tif (input.idle) return \"sent\";"],
+			"replace": ["\tif (false) return \"sent\";"],
+			"gate": ["bash", "run.sh", "check-control-send-receipt"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-RECEIPT-IDLE-IS-SENT]",
+			"signatureSource": "pi-extensions/lib/control-send-receipt.test.ts"
+		},
+		{
+			"claim": "SEND-RECEIPT-BUSY-STEER-IS-QUEUED",
+			"title": "a busy receiver's steering queue is reported as `sent`, which is the exact false claim #120 was opened about: the sender is told the message landed while it lies in volatile process memory behind whatever else is there",
+			"subject": "pi-extensions/lib/control-send-receipt.ts",
+			"find": ["\treturn input.mode === \"follow_up\" ? \"queued-follow-up\" : \"queued-steer\";"],
+			"replace": ["\treturn input.mode === \"follow_up\" ? \"queued-follow-up\" : \"sent\";"],
+			"gate": ["bash", "run.sh", "check-control-send-receipt"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-RECEIPT-BUSY-STEER-IS-QUEUED]",
+			"signatureSource": "pi-extensions/lib/control-send-receipt.test.ts"
+		},
+		{
+			"claim": "SEND-RECEIPT-BUSY-FOLLOWUP-IS-QUEUED",
+			"title": "the follow-up queue is reported under the steering queue's name, collapsing the only fact that explains a reorder after it happens — a later steer overtakes every earlier follow_up, and one name for both makes that unaccountable",
+			"subject": "pi-extensions/lib/control-send-receipt.ts",
+			"find": ["? \"queued-follow-up\" : \"queued-steer\";"],
+			"replace": ["? \"queued-steer\" : \"queued-steer\";"],
+			"gate": ["bash", "run.sh", "check-control-send-receipt"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-RECEIPT-BUSY-FOLLOWUP-IS-QUEUED]",
+			"signatureSource": "pi-extensions/lib/control-send-receipt.test.ts"
+		},
+		{
+			"claim": "SEND-RECEIPT-UNKNOWN-IS-ACCEPTED-NOT-SENT",
+			"title": "an answer this build cannot classify is reported as `sent`, so a version-skewed peer's acceptance is dressed as a direct injection nobody observed",
+			"subject": "pi-extensions/lib/control-send-receipt.ts",
+			"find": ["\treturn isObservedBoundary(value) ? value : \"accepted-unknown-boundary\";"],
+			"replace": ["\treturn isObservedBoundary(value) ? value : \"sent\";"],
+			"gate": ["bash", "run.sh", "check-control-send-receipt"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-RECEIPT-UNKNOWN-IS-ACCEPTED-NOT-SENT]",
+			"signatureSource": "pi-extensions/lib/control-send-receipt.test.ts"
+		},
+		{
+			"claim": "SEND-BOUNDARY-CARRIED",
+			"title": "the primary leg reports a fixed `sent` instead of the boundary the receiver actually named, so every busy acceptance reads as a direct trigger again",
+			"subject": "pi-extensions/lib/entwurf-v2-send.ts",
+			"find": [
+				"\treturn result.success ? { outcome: \"sent\", boundary: requireBoundary(result) } : inBandRejected(result);"
+			],
+			"replace": ["\treturn result.success ? { outcome: \"sent\", boundary: \"sent\" } : inBandRejected(result);"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-send"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-BOUNDARY-CARRIED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-send.test.ts"
+		},
+		{
+			"claim": "SEND-FALLBACK-KEEPS-BOUNDARY",
+			"title": "a re-resolved socket drops the boundary it was handed, so a first socket that died and a second that was BUSY come out reading as a delivery — the route axis erasing the receipt axis",
+			"subject": "pi-extensions/lib/entwurf-v2-send.ts",
+			"find": [
+				"\t\t\t\treturn r.success ? { outcome: \"fallback-sent\", boundary: requireBoundary(r) } : inBandRejected(r);"
+			],
+			"replace": ["\t\t\t\treturn r.success ? { outcome: \"fallback-sent\", boundary: \"sent\" } : inBandRejected(r);"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-send"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-FALLBACK-KEEPS-BOUNDARY]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-send.test.ts"
+		},
+		{
+			"claim": "SEND-SOCKET-SUCCESS-NEEDS-BOUNDARY",
+			"title": "a successful socket answer with no boundary is accepted silently, so a bypassed wire seam — the one shape that must never pass for a direct trigger — reads exactly like one",
+			"subject": "pi-extensions/lib/entwurf-v2-send.ts",
+			"find": ["\tif (result.boundary === undefined) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-send"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-SOCKET-SUCCESS-NEEDS-BOUNDARY]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-send.test.ts"
+		},
+		{
+			"claim": "SEND-RECEIVER-EMITS-BOUNDARY",
+			"title": "the receiver goes back to answering with a bare `delivered:true`, which was equally true of a direct trigger and of a message rotting in a queue — the bare `delivered` DELIVERY.md refuses by name, and the sender is left with nothing to render",
+			"subject": "pi-extensions/entwurf-control.ts",
+			"find": ["\t\t\tboundary: sendReceiptBoundary({ idle: isIdle, mode }),"],
+			"replace": ["\t\t\tdelivered: true,"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SEND-RECEIVER-EMITS-BOUNDARY]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "SEND-SURFACE-RENDERS-BOUNDARY",
+			"title": "the sender surface renders the internal route word again instead of the receiver's boundary, putting `control-socket → sent` back on a message that is sitting in a queue",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": [
+				"\t\t\t\t\treturn { text: `entwurf_v2 control-socket → ${boundary}${route}${enqueued}`, isError: false };"
+			],
+			"replace": [
+				"\t\t\t\t\treturn { text: `entwurf_v2 control-socket → ${o.outcome}${route}${enqueued}`, isError: false };"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SEND-SURFACE-RENDERS-BOUNDARY]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "SEND-SURFACE-UNKNOWN-NOT-SENT",
+			"title": "an unclassifiable acceptance is rendered with the word `sent`, which is the claim the whole axis exists to stop making — it was accepted, and nobody observed a direct injection",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": [
+				"\t\t\t\t\t\to.boundary ?? (o.outcome === \"fallback-sent\" ? \"mailbox-enqueued\" : \"accepted-unknown-boundary\");"
+			],
+			"replace": [
+				"\t\t\t\t\t\to.boundary === \"accepted-unknown-boundary\" ? \"sent\" : (o.boundary ?? \"mailbox-enqueued\");"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SEND-SURFACE-UNKNOWN-NOT-SENT]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "SEND-SURFACE-FALLBACK-KEEPS-BOUNDARY",
+			"title": "the re-resolved route annotation is dropped, so a caller cannot tell that its first socket was dead — the two legs render identically and a dead-socket host looks healthy",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": ["\t\t\t\t\tconst route = o.outcome === \"fallback-sent\" ? \" (via a re-resolved route)\" : \"\";"],
+			"replace": ["\t\t\t\t\tconst route = \"\";"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SEND-SURFACE-FALLBACK-KEEPS-BOUNDARY]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "SEND-PROSE-NO-INTERRUPT",
+			"title": "the caller-facing description of `mode` goes back to promising that steer interrupts the current turn — a caller picks it for urgency and gets a queue drained only after the turn ends, with no order against the other queue",
+			"subject": "pi-extensions/lib/entwurf-v2-contract-schema.ts",
+			"find": ["\t\t\t\t\"delivery mode — NOT the ownership axis (F1) nor liveness routing."],
+			"replace": [
+				"\t\t\t\t\"delivery mode (steer = interrupt current turn, follow_up = queue) — NOT the ownership axis (F1) nor liveness routing."
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SEND-PROSE-NO-INTERRUPT]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "SEND-DIRTY-LOCK-NAMES-ACCEPTANCE",
+			"title": "the dirty-lock line goes back to `DELIVERED (<route>)` for all three shapes that reach it — a refusal that delivered nothing, a message lying in a volatile queue, and a durable mailbox file all read as one word, at the exact moment an operator is deciding BY HAND whether anything still needs sending",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": [
+				"\t\t\t\t\t\t? `rejected${result.finalizedRejectReason ? ` (${result.finalizedRejectReason})` : \"\"} — the receiver refused it; nothing was accepted`"
+			],
+			"replace": ["\t\t\t\t\t\t? `DELIVERED (${result.finalizedOutcome})`"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SEND-DIRTY-LOCK-NAMES-ACCEPTANCE]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
+		{
+			"claim": "VITEST-TEST-DIR-ON-THE-FLOOR",
+			"title": "the pi queue oracle's public coordinate is dropped from `check:vitest`, so the file that proves every claim the receipt makes about a receiver's queues is green only when somebody runs `pnpm test` by hand — the discovery door deliberately does not select `test/**`, so nothing else would notice",
+			"subject": "package.json",
+			"find": [
+				"\"check:vitest\": \"./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior\""
+			],
+			"replace": [
+				"\"check:vitest\": \"./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-tests-beside-behavior\""
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:VITEST-TEST-DIR-ON-THE-FLOOR]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PI-CORE-PIN-TRACKS-FLOOR",
+			"title": "the queue oracle's pi-agent-core pin drifts off the floor the rest of the pi runtime is pinned to, so the oracle keeps answering honestly — about a pi nobody in this repo runs",
+			"subject": "package.json",
+			"find": ["\"@earendil-works/pi-agent-core\": \"0.87.1\","],
+			"replace": ["\"@earendil-works/pi-agent-core\": \"0.86.0\","],
+			"gate": ["bash", "run.sh", "check-dep-versions"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-CORE-PIN-TRACKS-FLOOR]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "SEND-DIRTY-LOCK-ERROR-CARRIES-ACCEPTANCE",
+			"title": "the structured dirty-lock error stops carrying the refusal's reason, so a receiver that said WHY it refused loses that word at the one moment an operator is deciding by hand whether the message still needs sending — the render cell cannot see this, because it builds its own result object",
+			"subject": "pi-extensions/lib/entwurf-v2-send.ts",
+			"find": ["\t\t\t\trejectReason: drive.rejectReason,"],
+			"replace": ["\t\t\t\trejectReason: undefined,"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-send"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-DIRTY-LOCK-ERROR-CARRIES-ACCEPTANCE]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-send.test.ts"
+		},
+		{
+			"claim": "SEND-DIRTY-LOCK-RUNNER-MOVES-ACCEPTANCE",
+			"title": "the runner drops the acceptance fields on the way from the thrown error to the result, so the hand proves it fills them and the surface proves it renders them while the operator still sees nothing — the classic middle-seam hole two端 tests cannot cover",
+			"subject": "pi-extensions/lib/entwurf-v2-runner.ts",
+			"find": ["\t\t\t\t\t\tfinalizedRejectReason: err.finalizedRejectReason,"],
+			"replace": ["\t\t\t\t\t\tfinalizedRejectReason: undefined,"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-runner"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:SEND-DIRTY-LOCK-RUNNER-MOVES-ACCEPTANCE]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-runner.test.ts"
+		},
+		{
+			"claim": "VITEST-TEST-DIR-HAS-COORDINATE",
+			"title": "the only line that EXECUTES the pi queue oracle is deleted while its verb and its explanatory comment stay, so the file is run by nothing at all — and a checker that accepted a mention instead of a call would keep reporting the floor as complete",
+			"subject": "run.sh",
+			"find": ["  run_vitest test/pi-queue.oracle.test.ts"],
+			"replace": ["  : # the oracle is no longer executed here"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:VITEST-TEST-DIR-HAS-COORDINATE]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "SEND-OUTCOME-LIST-NAMES-EVERY-RAIL",
+			"title": "the caller-facing outcome list drops the native-push rail, so a caller reading the one blurb it reads before dispatching is told the control rail's vocabulary covers a rail that answers with a direct injection instead",
+			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"find": ["\t\t\"native-push INJECTION, a rejection, or lock-dirty. EXISTING targets only; discover with \" +"],
+			"replace": ["\t\t\"a rejection, or lock-dirty. EXISTING targets only; discover with \" +"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:SEND-OUTCOME-LIST-NAMES-EVERY-RAIL]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		}
+	]
+}

package/scripts/mutants/herdr-fresh-call.json

@@ -15,10 +15,10 @@
 		},
 		{
 			"claim": "HFC-PILOT-CLOSED",
-			"title": "a backend nobody measured on herdr is admitted to the pilot, so a caller gets a pane running something this rail never proved it can open",
-			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
-			"find": ["export const HERDR_FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\"] as const;"],
-			"replace": ["export const HERDR_FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"codex\"] as const;"],
+			"title": "a backend nobody measured on herdr is admitted to the pilot, so a caller gets a pane running something this rail never proved it can open (#116 A7: the tuple moved to the shared rails leaf, so the mutant follows its subject — widening the pilot set is still the mutation, it is simply written in one place now)",
+			"subject": "scripts/herdr-rails.mjs",
+			"find": ["export const HERDR_FRESH_CALL_BACKENDS = Object.freeze([\"pi\", \"claude-code\"]);"],
+			"replace": ["export const HERDR_FRESH_CALL_BACKENDS = Object.freeze([\"pi\", \"claude-code\", \"codex\"]);"],
 			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:HFC-PILOT-CLOSED]",

package/scripts/mutants/herdr-plugin-build.json

@@ -132,14 +132,10 @@
 		},
 		{
 			"claim": "HPB-USAGE-NOTE-NAMES-A-MODEL",
-			"title": "the install names a model id in the wrong harness's grammar, so the first fresh call an operator copies is refused",
-			"subject": "plugins/herdr/lib/build.mjs",
-			"find": [
-				"\t\tnotes.push(\"claude-code: a model id looks like `claude-sonnet-5` — the vendor id, not a provider path.\");"
-			],
-			"replace": [
-				"\t\tnotes.push(\"claude-code: a model id looks like `anthropic/claude-sonnet-5` — provider-qualified.\");"
-			],
+			"title": "the install names a model id in the wrong harness's grammar, so the first fresh call an operator copies is refused (#116 A7: the example moved to the shared rails leaf; the mutation still gives claude-code a provider-qualified id, which is the grammar confusion this claim exists to catch)",
+			"subject": "scripts/herdr-rails.mjs",
+			"find": ["\t\"claude-code\": \"claude-sonnet-5\","],
+			"replace": ["\t\"claude-code\": \"anthropic/claude-sonnet-5\","],
 			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:HPB-USAGE-NOTE-NAMES-A-MODEL]",
@@ -147,10 +143,10 @@
 		},
 		{
 			"claim": "HPB-INSTALL-USAGE-NOTE",
-			"title": "dropping the pi line leaves the one backend whose wiring is invisible from the operator's chair unexplained: claude-code picks the tools up through MCP with nothing added, while a plain pi loads the extension on every session of the host and is still not a citizen — a green install followed by a silent, tool-less pi is indistinguishable from an install that did nothing",
+			"title": "dropping the pi line leaves the one backend whose wiring is invisible from the operator's chair unexplained: claude-code picks the tools up through MCP with nothing added, while a plain pi loads the extension on every session of the host and is still not a citizen — a green install followed by a silent, tool-less pi is indistinguishable from an install that did nothing (#116 A7: usageNotes now loops the shared backend tuple instead of a literal pair, so the mutation suppresses pi's notes at the loop guard rather than at a per-backend `if`)",
 			"subject": "plugins/herdr/lib/build.mjs",
-			"find": ["\tif (activated.includes(\"pi\")) {"],
-			"replace": ["\tif (false && activated.includes(\"pi\")) {"],
+			"find": ["\t\tif (!activated.includes(backend)) continue;"],
+			"replace": ["\t\tif (backend === \"pi\" || !activated.includes(backend)) continue;"],
 			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:HPB-INSTALL-USAGE-NOTE]",