@junghanacs/entwurf 0.30.0 → 0.31.0

package/scripts/fixtures/herdr-supply.json

@@ -1,10 +1,10 @@
 {
 	"$comment": "SSOT for the herdr binary this repository has MEASURED against. Nothing else may carry a version or a digest: the CI installer, the sandbox gate's boundary check and the launch-rail document all read or cite this file. Re-measuring a new herdr means running check-herdr-sandbox against it FIRST, then editing this file, then repairing the measured sentences in docs/herdr-launch-rail.md in the same commit — miss one and the gate fails on version mismatch, which is the point.",
-	"version": "0.9.1",
-	"tag": "v0.9.1",
-	"tagCommit": "065ef9d6a531c49fb8bee7e818ef837065b21ee9",
+	"version": "0.9.3",
+	"tag": "v0.9.3",
+	"tagCommit": "7b116c05bfda646af39d2524c54e70c751f57ee8",
 	"socketProtocol": 22,
-	"measuredOn": "2026-09-17",
+	"measuredOn": "2026-10-03",
 	"measuredArch": "aarch64",
 	"releaseUrlPrefix": "https://github.com/herdrdev/herdr/releases/download",
 	"integrity": {
@@ -15,15 +15,15 @@
 	"assets": {
 		"x86_64": {
 			"name": "herdr-linux-x86_64",
-			"sha256": "2a02fed16beb651ef006e1d43f048f652ca4dc58ad053cd2d44450563d5c54b7",
+			"sha256": "18a8dc65f1c2fa485884344356dea1cfd911c6f06cf46fa78e193f4087f4dba7",
 			"executed": false,
-			"executedNote": "pending the first CI run on an x86_64 runner — the digest is pinned, but no cell of this rail has ever run on this binary"
+			"executedNote": "pending the first CI run on an x86_64 runner — the digest is pinned (and named by GitHub's release attestation for pkg:github/herdrdev/herdr@v0.9.3), but no cell of this rail has ever run on this binary"
 		},
 		"aarch64": {
 			"name": "herdr-linux-aarch64",
-			"sha256": "f4ccf4de745f2cb9a39a983e9ba3703dad50ec2a58dea83026ceab721bbd8d9e",
+			"sha256": "4de7aa3e25678812e92960de64f7c2aaa1bca1f0f80a3c5e559837e231e1f5c0",
 			"executed": true,
-			"executedNote": "the #116 rail was re-measured on this exact binary on 2026-09-17: `check-herdr-sandbox` green, `herdr status client` reports protocol 22 (unchanged from 0.9.0), and `integration status` adds exactly one row — `letta (experimental)` — with every other row byte-identical to 0.9.0. The operator host still runs the 0.9.0 asset at that date; the binary measured here was fetched by digest into a temp dir"
+			"executedNote": "the #116 rail was re-measured on this exact binary on 2026-10-03 (#126), fetched by digest through scripts/install-herdr-ci.sh into a temp dir and run from an isolated snapshot whose manifest named it: `check-herdr-sandbox` green (12 assertions, private server), `herdr status client` reports protocol 22 (unchanged from 0.9.1), and `integration status` prints the same 18 rows as 0.9.1 in a sandbox HOME once that root path is normalized; pi (v9) and claude (v10) integrations installed by 0.9.1 read `current` under 0.9.3 and a 0.9.3 reinstall leaves their bytes identical. The operator host still runs the 0.9.1 asset at that date and was not touched. The 0.9.1 receipt (2026-09-17) stays dated in docs/herdr-launch-rail.md"
 		}
 	}
 }

package/scripts/lib/pi-durable-fresh-live-receipts.ts

@@ -0,0 +1,139 @@
+/**
+ * The oracles of `smoke-pi-durable-fresh-live`, as pure functions over raw evidence, so the same code
+ * that judges a live run can re-judge its saved raw (Pi's JSONL and the pd native-store snapshot).
+ *
+ * Pi side: a message lands only as an exact payload with ONE anchored terminal sender envelope —
+ * `piCallbackSenders` already decides that shape; this adds the expected sender and returns the row.
+ * A body that merely MENTIONS the token and the sender's id (the fixture's own instruction did) is
+ * not a delivery.
+ *
+ * pd side: the native store's ROOT conversation only (no owner conversation or task), read through
+ * its entry kinds — `pi.system` (tool offering, applied as toolsAdded/toolsRemoved in order),
+ * `pi.assistant` (the model that answered, and the tool calls in order) and `pi.tool-result` (each
+ * call's settled result, joined by toolCallId).
+ */
+import { piCallbackSenders } from "./codex-fresh-source-receipts.ts";
+
+/** The one Pi transcript row whose exact payload arrived from `expectedSender`, or null. */
+export function piExactDeliveryRow(
+	entries: readonly unknown[],
+	payload: string,
+	expectedSender: string,
+): { row: unknown; index: number } | null {
+	const hits: { row: unknown; index: number }[] = [];
+	entries.forEach((row, index) => {
+		const senders = piCallbackSenders([row], payload);
+		if (senders.length === 1 && senders[0] === expectedSender) hits.push({ row, index });
+	});
+	return hits.length === 1 ? (hits[0] as { row: unknown; index: number }) : null;
+}
+
+export interface PdNativeRow {
+	id: number;
+	conversation_id: number;
+	record: string;
+}
+export interface PdNativeSubmissionRow {
+	conversation_id: number;
+	status: string;
+	record: string;
+}
+export interface PdToolCall {
+	id: string;
+	name: string;
+	arguments: Record<string, unknown>;
+	result: { text: string; isError: boolean } | null;
+}
+export interface PdRootView {
+	offering: string[];
+	models: string[];
+	calls: PdToolCall[];
+}
+
+interface Message {
+	role?: unknown;
+	provider?: unknown;
+	model?: unknown;
+	content?: unknown;
+	toolsAdded?: unknown;
+	toolsRemoved?: unknown;
+	toolCallId?: unknown;
+	isError?: unknown;
+}
+
+function messagesOf(record: Record<string, unknown>): Message[] {
+	return Array.isArray(record.model) ? (record.model as Message[]) : [];
+}
+function names(list: unknown): string[] {
+	return Array.isArray(list)
+		? list.flatMap((t) =>
+				t !== null && typeof t === "object" && typeof (t as { name?: unknown }).name === "string"
+					? [(t as { name: string }).name]
+					: [],
+			)
+		: [];
+}
+
+/** The root conversation's offering, models and tool calls, from its own entries in id order. */
+export function pdRootView(entries: readonly PdNativeRow[], rootConversationId: number): PdRootView {
+	let offering: string[] = [];
+	const models = new Set<string>();
+	const calls: PdToolCall[] = [];
+	const byId = new Map<string, PdToolCall>();
+	for (const row of [...entries].sort((a, b) => a.id - b.id)) {
+		if (row.conversation_id !== rootConversationId) continue;
+		const record = JSON.parse(row.record) as Record<string, unknown>;
+		for (const message of messagesOf(record)) {
+			if (record.kind === "pi.system") {
+				const removed = new Set(names(message.toolsRemoved));
+				offering = [...offering.filter((n) => !removed.has(n)), ...names(message.toolsAdded)];
+			} else if (record.kind === "pi.assistant" && message.role === "assistant") {
+				if (typeof message.provider === "string" && typeof message.model === "string")
+					models.add(`${message.provider}/${message.model}`);
+				for (const block of Array.isArray(message.content) ? message.content : []) {
+					const b = block as { type?: unknown; id?: unknown; name?: unknown; arguments?: unknown };
+					if (b.type !== "toolCall" || typeof b.id !== "string" || typeof b.name !== "string") continue;
+					const call: PdToolCall = {
+						id: b.id,
+						name: b.name,
+						arguments: (b.arguments ?? {}) as Record<string, unknown>,
+						result: null,
+					};
+					calls.push(call);
+					byId.set(b.id, call);
+				}
+			} else if (
+				record.kind === "pi.tool-result" &&
+				message.role === "toolResult" &&
+				typeof message.toolCallId === "string"
+			) {
+				const call = byId.get(message.toolCallId);
+				if (call === undefined) continue;
+				const text = (Array.isArray(message.content) ? message.content : [])
+					.map((c) =>
+						(c as { type?: unknown; text?: unknown }).type === "text" ? String((c as { text: unknown }).text) : "",
+					)
+					.join("");
+				call.result = { text, isError: message.isError === true };
+			}
+		}
+	}
+	return { offering, models: [...models], calls };
+}
+
+/** The doorbell submission for exactly this mailbox message, on the root conversation. */
+export function pdDoorbellSubmission(
+	submissions: readonly PdNativeSubmissionRow[],
+	rootConversationId: number,
+	requestId: string,
+): { status: string; record: Record<string, unknown> } | null {
+	const hits = submissions
+		.map((s) => ({ s, record: JSON.parse(s.record) as Record<string, unknown> }))
+		.filter(({ s, record }) => s.conversation_id === rootConversationId && record.requestId === requestId);
+	return hits.length === 1
+		? {
+				status: (hits[0] as { s: PdNativeSubmissionRow }).s.status,
+				record: (hits[0] as { record: Record<string, unknown> }).record,
+			}
+		: null;
+}

package/scripts/lib/pi-durable-r1.ts

@@ -0,0 +1,100 @@
+// The R1 cell's go/no-go predicates for check-pi-durable-send (#129 L-send), as pure functions so
+// the exact conditions the gate stops on can be checked on their own. Each returns the reasons it
+// refuses; an empty list is the only pass.
+
+function canonicalJson(value: unknown): string {
+	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+	if (value !== null && typeof value === "object") {
+		const entries = Object.entries(value as Record<string, unknown>).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+		return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+	}
+	return JSON.stringify(value);
+}
+
+export interface Verdict {
+	ok: boolean;
+	reasons: string[];
+}
+const verdict = (reasons: string[]): Verdict => ({ ok: reasons.length === 0, reasons });
+
+/** The reported frame: a root `pi.tool` task running in `execute`, and the same-task slot for the call. */
+export function intentFrameVerdict(frame: unknown, callId: string): Verdict {
+	const f = frame as {
+		node?: { id?: unknown; kind?: unknown; conversationId?: unknown; state?: { status?: unknown; phase?: unknown } };
+		slot?: { taskId?: unknown; name?: unknown; callId?: unknown; status?: unknown };
+	} | null;
+	const reasons: string[] = [];
+	if (f?.node?.kind !== "pi.tool") reasons.push("node is not pi.tool");
+	if (f?.node?.conversationId !== 1) reasons.push("node is not on the root conversation");
+	if (f?.node?.state?.status !== "running") reasons.push("node is not running");
+	if (f?.node?.state?.phase !== "execute") reasons.push("node phase is not execute");
+	if (f?.slot?.taskId === undefined || f.slot.taskId !== f.node?.id) reasons.push("slot taskId is not the node's");
+	if (f?.slot?.name !== "entwurf_v2") reasons.push("slot is not entwurf_v2");
+	if (f?.slot?.callId !== callId) reasons.push(`slot is not ${callId}`);
+	if (f?.slot?.status !== "running") reasons.push("slot is not running");
+	return verdict(reasons);
+}
+
+export interface PreCopyFacts {
+	/** host1's actual exit signal. */
+	hostExitSignal: string | null | undefined;
+	/** bridge1's /proc state when its counters were last read. */
+	bridgeStateAtRead: string | null;
+	bridgeGone: boolean;
+	readDelta: { rchar: number; syscr: number };
+	/** Wall-clock ms when `go` was written and when host1 was signalled. */
+	goAt: number;
+	killAt: number;
+	deadlineMs: number;
+}
+
+/** Everything that must hold before the database set is copied and the session reopened. */
+export function preCopyVerdict(f: PreCopyFacts): Verdict {
+	const reasons: string[] = [];
+	if (f.hostExitSignal !== "SIGKILL") reasons.push(`host1 exit signal is ${String(f.hostExitSignal)}, not SIGKILL`);
+	if (f.bridgeStateAtRead !== "T") reasons.push(`bridge1 state at read is ${String(f.bridgeStateAtRead)}, not T`);
+	if (!f.bridgeGone) reasons.push("bridge1 is not gone");
+	if (f.readDelta.rchar !== 0 || f.readDelta.syscr !== 0) {
+		reasons.push(`bridge1 counted reads (rchar +${f.readDelta.rchar}, syscr +${f.readDelta.syscr})`);
+	}
+	const elapsed = f.killAt - f.goAt;
+	if (!(elapsed >= 0 && elapsed <= f.deadlineMs)) {
+		reasons.push(`go→kill took ${elapsed}ms, outside the ${f.deadlineMs}ms validity cutoff`);
+	}
+	return verdict(reasons);
+}
+
+export interface CheckpointFacts {
+	row: { id?: unknown; conversation_id?: unknown; status?: unknown } | null;
+	record: {
+		id?: unknown;
+		kind?: unknown;
+		conversationId?: unknown;
+		input?: { callId?: unknown };
+		state?: { status?: unknown; checkpoint?: { phase?: unknown; replay?: unknown; arguments?: unknown } };
+	} | null;
+	resultEntriesForCall: number;
+}
+
+/** The copied database holds THIS call's committed, unsafe intent and no result for it. */
+export function checkpointVerdict(
+	f: CheckpointFacts,
+	expect: { nodeId: number; callId: string; args: unknown },
+): Verdict {
+	const reasons: string[] = [];
+	if (f.row === null || f.record === null) return verdict(["no task row for the observed task id"]);
+	if (f.row.id !== expect.nodeId) reasons.push("queried row id is not the observed task id");
+	if (f.record.id !== expect.nodeId) reasons.push("record id is not the observed task id");
+	if (f.record.kind !== "pi.tool") reasons.push("record is not pi.tool");
+	if (f.record.conversationId !== 1) reasons.push("record is not on the root conversation");
+	if (f.record.input?.callId !== expect.callId) reasons.push(`record input callId is not ${expect.callId}`);
+	if (f.record.state?.status !== "running") reasons.push("record is not running");
+	if (f.record.state?.checkpoint?.phase !== "execute") reasons.push("checkpoint phase is not execute");
+	if (f.record.state?.checkpoint?.replay !== "unsafe") reasons.push("checkpoint replay is not unsafe");
+	if (canonicalJson(f.record.state?.checkpoint?.arguments) !== canonicalJson(expect.args)) {
+		reasons.push("checkpoint arguments are not the scripted arguments");
+	}
+	if (f.resultEntriesForCall !== 0)
+		reasons.push(`${f.resultEntriesForCall} result entr(ies) already exist for the call`);
+	return verdict(reasons);
+}

package/scripts/lib/pi-durable-reap.ts

@@ -0,0 +1,27 @@
+// The cleanup verdict of check-pi-durable-send (#129 L-send), as a pure function so the exact
+// predicate the gate uses can be checked on its own.
+//
+// Green only when every owned process is gone, no signal failed, the scripted endpoint closed, and
+// every owned host's children were OBSERVED before it went away. A host that exited before /proc
+// could be asked about its children leaves an unknown, and an unknown is not a clean reap.
+
+export interface ReapFacts {
+	/** Owned processes still alive with their recorded start key. */
+	alive: readonly number[];
+	/** Signal or exit failures met while reaping. */
+	problems: readonly string[];
+	endpointClosed: boolean;
+	endpointListening: boolean;
+	/** Hosts that exited before their children were observed. */
+	observationNotes: readonly string[];
+}
+
+export function ownedReapVerdict(facts: ReapFacts): { green: boolean; reasons: string[] } {
+	const reasons = [
+		...(facts.alive.length > 0 ? [`still alive: ${facts.alive.join(",")}`] : []),
+		...facts.problems,
+		...(facts.endpointClosed && !facts.endpointListening ? [] : ["the scripted endpoint did not close"]),
+		...facts.observationNotes.map((note) => `unobserved: ${note}`),
+	];
+	return { green: reasons.length === 0, reasons };
+}

package/scripts/lib/pi-durable-receive.ts

@@ -0,0 +1,137 @@
+// The receive cell's go/no-go predicates for check-pi-durable-receive (#129 L-receive), as pure
+// functions so the exact conditions the gate stops on can be checked on their own. Each returns the
+// reasons it refuses; an empty list is the only pass. Nothing here imports the adapter: the doorbell
+// notice and the request id are recognised by the contract's public words, not by its constants.
+
+export interface Verdict {
+	ok: boolean;
+	reasons: string[];
+}
+const verdict = (reasons: string[]): Verdict => ({ ok: reasons.length === 0, reasons });
+
+/** The mailbox file a meta-mailbox ENQUEUE receipt names, or undefined when the text is not one. */
+export function enqueuedFile(receipt: string): string | undefined {
+	return /^entwurf_v2 meta-mailbox → enqueued \(([^()/]+\.msg)\)$/.exec(receipt.trim())?.[1];
+}
+
+export interface HeldCaptureFacts {
+	hostGid: string;
+	hostPid: number;
+	hostStartKey: string;
+	/** The ENQUEUE receipt's file name. */
+	enqueued: string | undefined;
+	/** The host's mailbox directory listing at the hold. */
+	listing: string[];
+	/** Bytes of `<enqueued>.delivered` at the hold, or null when absent. */
+	deliveredBody: string | null;
+	sentMessage: string;
+	signalPresent: boolean;
+	/** The host's raw receiver marker at the hold, or null when absent. */
+	receiverMarker: Record<string, unknown> | null;
+	/** The newest user message text of the held request #1. */
+	request1UserText: string;
+	/** The tool names request #1 offers. */
+	request1Tools: string[];
+}
+
+/**
+ * Everything that must hold while response #1 is withheld: the sender's ENQUEUE named a file, the
+ * host's doorbell has already stamped exactly that file `.delivered` (a wake attempt, not a read), its
+ * bytes carry the sent message, the signal and the host-owned receiver marker are in place, and the
+ * request that the root admission started is the announce — garden and tool named, body absent.
+ */
+export function heldCaptureVerdict(f: HeldCaptureFacts): Verdict {
+	const reasons: string[] = [];
+	if (f.enqueued === undefined) return verdict(["the sender's receipt is not a meta-mailbox ENQUEUE"]);
+	if (f.listing.includes(f.enqueued)) reasons.push(`${f.enqueued} is still a fresh .msg — no doorbell stamped it`);
+	if (!f.listing.includes(`${f.enqueued}.delivered`)) reasons.push(`${f.enqueued}.delivered is absent`);
+	if (f.listing.some((n) => n.endsWith(".read"))) reasons.push("a body was already archived before the hold");
+	if (f.deliveredBody === null || !f.deliveredBody.includes(f.sentMessage)) {
+		reasons.push("the delivered bytes do not carry the sent message");
+	}
+	if (!f.signalPresent) reasons.push("inbox.signal is absent");
+	const m = f.receiverMarker;
+	if (m === null) reasons.push("the host's receiver marker is absent");
+	else {
+		if (m.gardenId !== f.hostGid) reasons.push("the receiver marker names another garden");
+		if (m.ownerPid !== f.hostPid) reasons.push("the receiver marker is not owned by the spawned host");
+		if (m.ownerStartKey !== `linux:${f.hostStartKey}`)
+			reasons.push("the receiver marker's start key is not the host's");
+		if (m.ownerKind !== "pi-durable-host") reasons.push("the receiver marker is not pi-durable-host");
+	}
+	const text = f.request1UserText;
+	if (!text.startsWith("[entwurf inbox] 1 unread mailbox message available for garden ")) {
+		reasons.push("request #1's user input is not a one-message doorbell notice");
+	}
+	if (!text.includes(f.hostGid) || !text.includes("entwurf_inbox_read")) {
+		reasons.push("the notice does not name the host's garden and entwurf_inbox_read");
+	}
+	if (text.includes(f.sentMessage)) reasons.push("the notice carries the body");
+	if (!f.request1Tools.includes("entwurf_inbox_read")) reasons.push("request #1 does not offer entwurf_inbox_read");
+	return verdict(reasons);
+}
+
+/**
+ * How upstream writes the indexed `submissions.request_id` column: `JSON.stringify` of the request id
+ * (`[read packages/durable/src/storage/sqlite/storage.ts:64 encodeIndexedString, :762 insert, :442
+ * lookup]` @cd32f77), the same encoding R1 measured on `tasks.kind`. The record JSON keeps it raw.
+ */
+export const encodedRequestIdColumn = (requestId: string): string => JSON.stringify(requestId);
+
+export interface SubmissionFacts {
+	/** The `submissions` row whose parsed record carries the request id, with that record, or null. */
+	row: { id?: unknown; conversation_id?: unknown; request_id?: unknown; status?: unknown } | null;
+	record: {
+		id?: unknown;
+		conversationId?: unknown;
+		requestId?: unknown;
+		type?: unknown;
+		status?: unknown;
+		entry?: unknown;
+	} | null;
+	/** Rows whose parsed record carries the request id, over the whole table. */
+	rowsForRequest: number;
+	/** Rows whose indexed `request_id` column holds the request id as upstream encodes it. */
+	rowsForColumn: number;
+	/** The entry the record names, parsed, or null. */
+	entry: { kind?: unknown; model?: { role?: unknown; content?: unknown }[] } | null;
+}
+
+/**
+ * The copied database holds exactly one input submission for the doorbell's request id — found both
+ * by its record and by its indexed column — on the root conversation, whose row id AND record id are
+ * the id the receiver reported, placed as the root user entry carrying the notice and answered. A row
+ * still queued is reported as queued — never read as placed.
+ */
+export function submissionVerdict(
+	f: SubmissionFacts,
+	expect: { submissionId: unknown; requestId: string; notice: string },
+): Verdict {
+	const reasons: string[] = [];
+	if (f.rowsForRequest !== 1) reasons.push(`${f.rowsForRequest} records carry the request id`);
+	if (f.rowsForColumn !== 1) reasons.push(`${f.rowsForColumn} rows hold the encoded request id in the indexed column`);
+	if (f.row === null || f.record === null) return verdict([...reasons, "no submission row for the request id"]);
+	if (f.row.id !== expect.submissionId) reasons.push("the row id is not the reported submission id");
+	if (f.record.id === undefined) reasons.push("the record carries no id");
+	else if (f.record.id !== f.row.id || f.record.id !== expect.submissionId) {
+		reasons.push("the record id is not the row id and the reported submission id");
+	}
+	if (f.row.conversation_id !== 1 || f.record.conversationId !== 1)
+		reasons.push("the row is not on the root conversation");
+	if (f.row.request_id !== encodedRequestIdColumn(expect.requestId) || f.record.requestId !== expect.requestId) {
+		reasons.push("the row's request id is not the doorbell's");
+	}
+	if (f.record.type !== "input") reasons.push("the submission is not an input");
+	if (f.row.status !== f.record.status) reasons.push("the row status and the record status disagree");
+	if (f.record.status === "queued") reasons.push("the submission is still queued, not placed");
+	else if (f.record.status !== "done") reasons.push(`the submission is ${String(f.record.status)}, not done`);
+	const message = f.entry?.model?.[0];
+	if (f.entry === null) reasons.push("the record names no readable entry");
+	else {
+		if (f.entry.kind !== "pi.user") reasons.push("the placed entry is not pi.user");
+		if (message?.role !== "user" || message.content !== expect.notice) {
+			reasons.push("the placed entry's content is not the notice the model received");
+		}
+	}
+	return verdict(reasons);
+}

package/scripts/mutants/acp-prompt-lifecycle.json

@@ -54,8 +54,8 @@
 			"claim": "REUSE-CARRIES-CHILD-DIAGNOSTICS",
 			"title": "the reuse path drops the child's stderr tail again — exactly the live sonnet failure that showed only \"ACP connection closed\"",
 			"subject": "pi-extensions/lib/acp/backend.ts",
-			"find": ["\t\t\tfinishError(err, aborted, session.stderrTail, lifecycle, session.launchObservation);"],
-			"replace": ["\t\t\tfinishError(err, aborted, undefined, lifecycle, session.launchObservation);"],
+			"find": ["\t\t\tfinishError(err, aborted, session.stderrTail, lifecycle, session.launchObservation, adapter);"],
+			"replace": ["\t\t\tfinishError(err, aborted, undefined, lifecycle, session.launchObservation, adapter);"],
 			"gate": ["bash", "run.sh", "check-acp-prompt-lifecycle"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:REUSE-CARRIES-CHILD-DIAGNOSTICS]",

package/scripts/mutants/acp-vendor-rejection.json

@@ -0,0 +1,62 @@
+{
+	"schemaVersion": 1,
+	"lane": "acp-vendor-rejection",
+	"mutants": [
+		{
+			"claim": "ACP-INCOMPLETE-TOOL-NO-REPLAY-NEW",
+			"title": "finishError stops consulting the adapter's prompt-rejection reader — the vendor's raw 'Internal error' text becomes errorMessage again and pi replays a turn whose tools already ran",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\tconst rejection = aborted ? undefined : adapter?.readPromptRejection?.(err);"],
+			"replace": ["\t\tconst rejection = aborted ? undefined : undefined;"],
+			"gate": ["bash", "run.sh", "check-acp-vendor-rejection"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:ACP-INCOMPLETE-TOOL-NO-REPLAY-NEW]",
+			"signatureSource": "pi-extensions/lib/acp/backend.vendor-rejection.test.ts"
+		},
+		{
+			"claim": "ACP-PROMPT-REJECTION-CLAUDE-ONLY",
+			"title": "the claude reader stops checking the vendor's errorKind — any -32603 carrying an errorKind (no_result included) is rewritten to the incomplete-tool verdict",
+			"subject": "pi-extensions/lib/acp/backend-adapter.ts",
+			"find": ["\tif (data.errorKind !== CLAUDE_INCOMPLETE_TOOL_CALL) return undefined;"],
+			"replace": ["\tif (data.errorKind === undefined) return undefined;"],
+			"gate": ["bash", "run.sh", "check-acp-vendor-rejection"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:ACP-PROMPT-REJECTION-CLAUDE-ONLY]",
+			"signatureSource": "pi-extensions/lib/acp/backend-adapter.test.ts"
+		},
+		{
+			"claim": "ACP-INCOMPLETE-TOOL-RAW-EVIDENCE",
+			"title": "the recognised rejection is sealed with the verdict but its raw vendor message, data and stderr are dropped instead of riding a pi diagnostic",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": [
+				"\t\t\tappendAssistantMessageDiagnostic(",
+				"\t\t\t\tstate.output,",
+				"\t\t\t\tcreateAssistantMessageDiagnostic(ACP_PROMPT_REJECTION_DIAGNOSTIC, err, {",
+				"\t\t\t\t\terrorKind: rejection.errorKind,",
+				"\t\t\t\t\tdataJson: rejection.dataJson,",
+				"\t\t\t\t\t...(lifecycle ? { lifecycle } : {}),",
+				"\t\t\t\t\t...(observed ? { launchSignal: observed } : {}),",
+				"\t\t\t\t\t...(tail ? { stderrTail: tail } : {}),",
+				"\t\t\t\t\t...(hint ? { hint } : {}),",
+				"\t\t\t\t}),",
+				"\t\t\t);"
+			],
+			"replace": ["\t\t\t// mutant: the raw rejection is not preserved"],
+			"gate": ["bash", "run.sh", "check-acp-vendor-rejection"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:ACP-INCOMPLETE-TOOL-RAW-EVIDENCE]",
+			"signatureSource": "pi-extensions/lib/acp/backend.vendor-rejection.test.ts"
+		},
+		{
+			"claim": "ACP-REUSE-COOPERATIVE-CANCEL",
+			"title": "a reused session's cooperatively cancelled turn is sealed and retained but no longer persisted — the record lags the live session",
+			"subject": "pi-extensions/lib/acp/backend.ts",
+			"find": ["\t\t\tfinishSuccess(adapter, session, promptResult);", "\t\t\tpersistRecord(session, deps);"],
+			"replace": ["\t\t\tfinishSuccess(adapter, session, promptResult);"],
+			"gate": ["bash", "run.sh", "check-acp-vendor-rejection"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:ACP-REUSE-COOPERATIVE-CANCEL]",
+			"signatureSource": "pi-extensions/lib/acp/backend.vendor-rejection.test.ts"
+		}
+	]
+}

package/scripts/mutants/control-send-receipt.json

@@ -181,7 +181,7 @@
 			"claim": "PI-CORE-PIN-TRACKS-FLOOR",
 			"title": "the queue oracle's pi-agent-core pin drifts off the floor the rest of the pi runtime is pinned to, so the oracle keeps answering honestly — about a pi nobody in this repo runs",
 			"subject": "package.json",
-			"find": ["\"@earendil-works/pi-agent-core\": \"1.0.0\","],
+			"find": ["\"@earendil-works/pi-agent-core\": \"1.0.2\","],
 			"replace": ["\"@earendil-works/pi-agent-core\": \"0.87.1\","],
 			"gate": ["bash", "run.sh", "check-dep-versions"],
 			"timeoutSeconds": 300,

package/scripts/mutants/copilot-birth.json

@@ -133,10 +133,10 @@
 			"title": "closing the reader half leaves the writer talking to nobody — the hook writes a copilot marker, the bridge never looks in that directory, and the citizen's sends are refused as anonymous (the #46 shape, which is why writer and reader open in one change)",
 			"subject": "pi-extensions/lib/meta-sender-identity.ts",
 			"find": [
-				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\"claude-code\", \"antigravity\", \"copilot\", \"omp\"];"
+				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\n\t\"claude-code\",\n\t\"antigravity\",\n\t\"copilot\",\n\t\"omp\",\n\t\"pi-durable\",\n];"
 			],
 			"replace": [
-				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\"claude-code\", \"antigravity\", \"omp\"];"
+				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\n\t\"claude-code\",\n\t\"antigravity\",\n\t\"omp\",\n\t\"pi-durable\",\n];"
 			],
 			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
 			"timeoutSeconds": 300,

package/scripts/mutants/herdr-plugin-build.json

@@ -68,6 +68,17 @@
 			"signature": "[QK:HPB-SEQUENTIAL-TWO-STAGE]",
 			"signatureSource": "scripts/check-herdr-plugin-build.ts"
 		},
+		{
+			"claim": "HPB-DEFAULT-LOCK-READ",
+			"title": "reading the default lock from the repository root rather than the plugin directory breaks the real build while source-injected fixture drives stay green; the production composition must consume this plugin's committed source and artifact fields",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\tconst lock = lockReader(PLUGIN_DIR);"],
+			"replace": ["\tconst lock = lockReader(CHECKOUT_ROOT);"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-DEFAULT-LOCK-READ]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
 		{
 			"claim": "HPB-POST-BUILD-GAP",
 			"title": "claiming Herdr's registration in this runner's own receipt states a step that has not run: herdr commits its checkout and registry only AFTER the build returns, so the next reconcile would be arguing with a lie",

package/scripts/mutants/herdr-supply.json

@@ -8,7 +8,7 @@
 			"subject": "scripts/check-herdr-sandbox.ts",
 			"find": ["const SUPPLY_MANIFEST = \"scripts/fixtures/herdr-supply.json\";"],
 			"replace": [
-				"const SUPPLY_MANIFEST = \"scripts/fixtures/herdr-supply.json\";\nconst PINNED_FALLBACK = \"0.9.1\";\nvoid PINNED_FALLBACK;"
+				"const SUPPLY_MANIFEST = \"scripts/fixtures/herdr-supply.json\";\nconst PINNED_FALLBACK = \"0.9.3\";\nvoid PINNED_FALLBACK;"
 			],
 			"gate": ["bash", "run.sh", "check-herdr-supply"],
 			"timeoutSeconds": 120,
@@ -19,8 +19,8 @@
 			"claim": "HSUP-DIGEST-SHAPE",
 			"title": "a pinned digest is truncated, so the check that is supposed to catch a swapped binary can no longer fail",
 			"subject": "scripts/fixtures/herdr-supply.json",
-			"find": ["\"sha256\": \"2a02fed16beb651ef006e1d43f048f652ca4dc58ad053cd2d44450563d5c54b7\""],
-			"replace": ["\"sha256\": \"2a02fed16beb651ef006e1d43f04\""],
+			"find": ["\"sha256\": \"18a8dc65f1c2fa485884344356dea1cfd911c6f06cf46fa78e193f4087f4dba7\""],
+			"replace": ["\"sha256\": \"18a8dc65f1c2fa485884344356de\""],
 			"gate": ["bash", "run.sh", "check-herdr-supply"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:HSUP-DIGEST-SHAPE]",

package/scripts/mutants/meta-hook-session-switch.json

@@ -182,9 +182,11 @@
 			"claim": "MHSS-JOIN-SCOPE-OWNERKIND",
 			"title": "admitting copilot-extension into the sender-marker join makes every Copilot citizen permanently mailbox-undeliverable: its watch owner is a forked child whose pid never carries a sender marker, so the join can only ever answer no",
 			"subject": "pi-extensions/lib/entwurf-deliverability.ts",
-			"find": ["export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\"];"],
+			"find": [
+				"export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\", \"pi-durable-host\"];"
+			],
 			"replace": [
-				"export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\", \"copilot-extension\"];"
+				"export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\", \"pi-durable-host\", \"copilot-extension\"];"
 			],
 			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
 			"timeoutSeconds": 300,