@junghanacs/entwurf 0.30.0 → 0.31.0

package/scripts/mutants/mux-fresh-call.json

@@ -151,7 +151,7 @@
 			"title": "MCP drops the required model field from fresh-call while the composition still expects one",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\tmodel: z\n\t\t\t.string()\n\t\t\t.min(1)\n\t\t\t.max(200)\n\t\t\t// The `\\[` below is USELESS TO JS AND LOAD-BEARING TO THE HOST. zod emits this source\n\t\t\t// text verbatim as the JSON Schema `pattern`, and the host's tool-schema validator is a\n\t\t\t// Rust regex engine that rejects an unescaped `[` inside a character class as \"unclosed\n\t\t\t// character class\" — a 400 on tools/list that stops EVERY Claude session from opening\n\t\t\t// (7-M-fix). Biome's safe fix removes it; do not accept that fix. The suppression must\n\t\t\t// stay on the line DIRECTLY above the expression, or it attaches to nothing and reads\n\t\t\t// as an unused suppression while the escape goes back to being fixable.\n\t\t\t// biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above\n\t\t\t.regex(/^[A-Za-z0-9][A-Za-z0-9._/:\\[\\]-]*$/)\n\t\t\t.describe(\n\t\t\t\t\"Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot/OMP/Codex model name.\",\n\t\t\t),\n"
+				"\t\tmodel: z\n\t\t\t.string()\n\t\t\t.min(1)\n\t\t\t.max(200)\n\t\t\t// The `\\[` below is USELESS TO JS AND LOAD-BEARING TO THE HOST. zod emits this source\n\t\t\t// text verbatim as the JSON Schema `pattern`, and the host's tool-schema validator is a\n\t\t\t// Rust regex engine that rejects an unescaped `[` inside a character class as \"unclosed\n\t\t\t// character class\" — a 400 on tools/list that stops EVERY Claude session from opening\n\t\t\t// (7-M-fix). Biome's safe fix removes it; do not accept that fix. The suppression must\n\t\t\t// stay on the line DIRECTLY above the expression, or it attaches to nothing and reads\n\t\t\t// as an unused suppression while the escape goes back to being fixable.\n\t\t\t// biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above\n\t\t\t.regex(/^[A-Za-z0-9][A-Za-z0-9._/:\\[\\]-]*$/)\n\t\t\t.describe(\n\t\t\t\t\"Required runtime model: canonical provider/model for pi, provider/<exact catalog model id> for pi-durable, a Claude Code model id/alias, or a Copilot/OMP/Codex model name.\",\n\t\t\t),\n"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -192,6 +192,17 @@
 			"signature": "[QK:PIIMPORT-WORK-SURFACE]",
 			"signatureSource": "run.sh"
 		},
+		{
+			"claim": "PIIMPORT-DURABLE-BOOTSTRAP-EXACT",
+			"title": "the #129 durable exception loses its file scope: the two experimental durable specifiers become allowed in every file, so a new pi private-subpath import elsewhere passes the floor",
+			"subject": "run.sh",
+			"find": ["      | sed -E \"/^pi\\/pi-durable\\/bootstrap\\.mjs:[0-9]+:/ s#"],
+			"replace": ["      | sed -E \"s#"],
+			"gate": ["bash", "run.sh", "check-pi-import-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PIIMPORT-DURABLE-BOOTSTRAP-EXACT]",
+			"signatureSource": "run.sh"
+		},
 		{
 			"claim": "VITEST-FAILED-TITLE-ATTRIBUTION",
 			"title": "the pilot's kill attribution collects PASSING test titles instead of failed ones, recreating the code-frame false-KILLED hole this lane exists to close",
@@ -323,8 +334,8 @@
 			"claim": "FRESHCALL-BACKEND-SET-SURFACE-PARITY",
 			"title": "a backend the composition can open is missing from the MCP surface enum — the capability exists and no external host can reach it",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
-			"find": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\", \"omp\", \"codex\"])"],
-			"replace": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\", \"omp\"])"],
+			"find": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\", \"omp\", \"codex\", \"pi-durable\"])"],
+			"replace": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\", \"omp\", \"pi-durable\"])"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:FRESHCALL-BACKEND-SET-SURFACE-PARITY]",
@@ -700,6 +711,61 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:FRESHCALL-CALLBACK-ENV]",
 			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PI-DURABLE-ARGV",
+			"title": "pi-durable loses its explicit task-wide width, so the packaged bootstrap refuses a launch the composition said it built",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
+			"find": ["\t\t\t\t\"--width\",\n\t\t\t\t\"task-wide\",\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-PI-DURABLE-ARGV]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PI-DURABLE-PREFLIGHT-PREMUTATION",
+			"title": "the pi-durable runtime/unit preflight is skipped, so an absent or drifted operator runtime is discovered only after a window was placed",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\tif (params.backend === \"pi-durable\") {\n"],
+			"replace": ["\tif (false) {\n"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-PI-DURABLE-PREFLIGHT-PREMUTATION]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PI-DURABLE-MANAGED-RUNTIME",
+			"title": "pi-durable opens the bare app instead of the managed `entwurf pi-durable`, so nothing verifies the operator runtime against the pin before its resolver runs",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\"pi-durable\": \"entwurf\","],
+			"replace": ["\t\"pi-durable\": \"pi\","],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-PI-DURABLE-MANAGED-RUNTIME]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PI-DURABLE-CALLBACK-DIALECT",
+			"title": "pi-durable is told the composed MCP callback name, which the durable contact never registers — the contact offers the bridge verbs under their bare names",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
+			"find": ["\t\"pi-durable\": \"entwurf_callback\","],
+			"replace": ["\t\"pi-durable\": \"mcp__entwurf-bridge__entwurf_callback\","],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-PI-DURABLE-CALLBACK-DIALECT]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "PD-FRESH-LIVE-FOREIGN-SENDER-REFUSED",
+			"title": "the pi-durable LIVE gate's Pi-side oracle drops its expected-sender check, so the exact payload relayed by any other citizen counts as pd's delivery",
+			"subject": "scripts/lib/pi-durable-fresh-live-receipts.ts",
+			"find": ["\t\tif (senders.length === 1 && senders[0] === expectedSender) hits.push({ row, index });"],
+			"replace": ["\t\tif (senders.length === 1) hits.push({ row, index });"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PD-FRESH-LIVE-FOREIGN-SENDER-REFUSED]",
+			"signatureSource": "test/pi-durable-fresh-live-receipts.test.ts"
 		}
 	]
 }

package/scripts/mutants/omp-birth.json

@@ -66,10 +66,10 @@
 			"title": "a backend whose hook writes a marker but is absent from the reader list is INVISIBLE — the bridge holds the owner pid, never looks in that directory, and every send is refused as anonymous for a reason nothing logs (the #46 defect)",
 			"subject": "pi-extensions/lib/meta-sender-identity.ts",
 			"find": [
-				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\"claude-code\", \"antigravity\", \"copilot\", \"omp\"];"
+				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\n\t\"claude-code\",\n\t\"antigravity\",\n\t\"copilot\",\n\t\"omp\",\n\t\"pi-durable\",\n];"
 			],
 			"replace": [
-				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\"claude-code\", \"antigravity\", \"copilot\"];"
+				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\n\t\"claude-code\",\n\t\"antigravity\",\n\t\"copilot\",\n\t\"pi-durable\",\n];"
 			],
 			"gate": ["bash", "run.sh", "check-omp-birth-hook"],
 			"timeoutSeconds": 300,

package/scripts/mutants/omp-fresh.json

@@ -7,9 +7,11 @@
 			"title": "a post-#82 harness admitted as a full D6 citizen while entwurf_fresh_call cannot open it — the exact state the Bundle A+B candidate shipped in, where every gate was green and only prose said the backend was unsupported. This is the defect the whole gate exists for: without it, an `unsupported` note reads as a partial-release permit",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": [
-				"export const FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"copilot\", \"omp\", \"codex\"] as const;"
+				"export const FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"copilot\", \"omp\", \"codex\", \"pi-durable\"] as const;"
+			],
+			"replace": [
+				"export const FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"copilot\", \"codex\", \"pi-durable\"] as const;"
 			],
-			"replace": ["export const FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"copilot\", \"codex\"] as const;"],
 			"gate": ["bash", "run.sh", "check-harness-admission-parity"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:ADMISSION-FRESH-PARITY]",
@@ -119,8 +121,8 @@
 			"claim": "FRESHCALL-BACKEND-SET-SURFACE-PARITY-SKILL",
 			"title": "a backend added to the composition and both schema surfaces but not to the operator skill — the third public surface step 9 names, and the one that had no gate at all. The skill is what an operator reads to decide what can be opened, so a stale list makes the backend unreachable in practice exactly the way a missing enum value makes it unreachable in schema",
 			"subject": ".claude/skills/entwurf-dev/SKILL.md",
-			"find": ["backend는 정확히 `pi | claude-code | copilot | omp | codex`이고"],
-			"replace": ["backend는 정확히 `pi | claude-code | copilot | omp`이고"],
+			"find": ["backend는 정확히 `pi | claude-code | copilot | omp | codex | pi-durable`이고"],
+			"replace": ["backend는 정확히 `pi | claude-code | copilot | omp | pi-durable`이고"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:FRESHCALL-BACKEND-SET-SURFACE-PARITY-SKILL]",

package/scripts/mutants/pack-install.json

@@ -6,7 +6,7 @@
 			"claim": "PACK-INSTALL-PIN-MATCHER-BOUNDED",
 			"title": "the pin-leak matcher loses its version boundary and blesses substring lookalikes — @0.85.10 reads as the pinned 0.85.1 and the gate announces a verified tree it never verified (independent review, 2026-08-25)",
 			"subject": "run.sh",
-			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.0\\.0(_|$)' || true"],
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.0\\.2(_|$)' || true"],
 			"replace": ["  grep '^@earendil-works+' | grep -v '@0\\.87\\.1' || true"],
 			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
 			"timeoutSeconds": 120,
@@ -17,8 +17,8 @@
 			"claim": "PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE",
 			"title": "the pin-leak matcher narrows back to the pi-* families and goes blind to a non-pi member of the same runtime closure — @earendil-works/chord (new in pi 0.85.0, a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol) floats unpinned while the gate prints a verified pin (measured 2026-09-06 on a real 0.85.1 install tree)",
 			"subject": "run.sh",
-			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.0\\.0(_|$)' || true"],
-			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@1\\.0\\.0(_|$)' || true"],
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.0\\.2(_|$)' || true"],
+			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@1\\.0\\.2(_|$)' || true"],
 			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE]",

package/scripts/mutants/pi-durable.json

@@ -0,0 +1,390 @@
+{
+	"schemaVersion": 1,
+	"lane": "pi-durable",
+	"mutants": [
+		{
+			"claim": "PI-DURABLE-RUNTIME-UNTRACKED-DRIFT",
+			"title": "a non-ignored untracked file in the operator runtime no longer counts as pin drift",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": [" || facts.untracked !== \"\" || "],
+			"replace": [" || "],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-UNTRACKED-DRIFT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-MODELDATA-DRIFT",
+			"title": "model data that is not the pinned bytes is no longer its own refusal",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["\t\treturn \"pi-durable-runtime-modeldata-drift\";\n"],
+			"replace": ["\t\treturn null;\n"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-MODELDATA-DRIFT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-READ-ONLY",
+			"title": "verification runs git against the operator checkout's own index instead of a private copy, so a stale stat cache is rewritten",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["const onCopy = { ...base, GIT_INDEX_FILE: copy };"],
+			"replace": ["const onCopy = { ...base };"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-READ-ONLY]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-LOCATOR-FIXED",
+			"title": "a relative XDG_DATA_HOME is honoured, so the runtime's one fixed place follows the caller's cwd",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": [" && xdg.length > 0 && path.isAbsolute(xdg)) {"],
+			"replace": [" && xdg.length > 0) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-LOCATOR-FIXED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-STAGED-DRIFT",
+			"title": "the index == HEAD term leaves the verdict, so a staged change behind an equal worktree diff verifies as the pin",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["\tif (!facts.indexMatchesHead) return \"pi-durable-runtime-pin-drift\";\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-STAGED-DRIFT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-ENTRY-GUARD-FLOOR-SAFE",
+			"title": "the verifier's entry guard goes back to import.meta.main, which the floor's runner can misread as the process entry",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["if (invokedDirectly) {\n"],
+			"replace": ["if (import.meta.main) {\n"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-ENTRY-GUARD-FLOOR-SAFE]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-CONFIG-NEUTRAL",
+			"title": "the diff's blank-context spacing is left to the runtime's git configuration again, so a config can move the verdict",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": [
+				"[\"-c\", \"core.abbrev=8\", \"-c\", \"diff.suppressBlankEmpty=false\", \"diff\", ...PI_DURABLE_DIFF_SHAPE]"
+			],
+			"replace": ["[\"-c\", \"core.abbrev=8\", \"diff\", ...PI_DURABLE_DIFF_SHAPE]"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-CONFIG-NEUTRAL]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-GATES-CONSUME-INDEX-TERM",
+			"title": "the contact gate's tracked-overlay assertion loses the index term, so it certifies a runtime tree it never saw",
+			"subject": "scripts/check-pi-durable-contact.ts",
+			"find": ["facts.gitAnswered && facts.indexMatchesHead && facts.diffEqualsPatch && facts.untracked"],
+			"replace": ["facts.gitAnswered && facts.diffEqualsPatch && facts.untracked"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-GATES-CONSUME-INDEX-TERM]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-PREFLIGHT-FOUR-UNITS",
+			"title": "the receive unit stops asking whether the compiled owner join admits the durable host, so a launch proceeds to a citizen nobody can deliver to",
+			"subject": "pi-extensions/lib/pi-durable-fresh-preflight.ts",
+			"find": [
+				"\tif (!ownerJoinAdmitsDurableHost(layout.deliverability)) return \"pi-durable-receive-unit-missing\";\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-PREFLIGHT-FOUR-UNITS]",
+			"signatureSource": "pi-extensions/lib/pi-durable-fresh-preflight.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-PREFLIGHT-MODEL-QUALIFIED",
+			"title": "a model without a provider part passes the preflight and reaches the durable launch",
+			"subject": "pi-extensions/lib/pi-durable-fresh-preflight.ts",
+			"find": ["\tif (at <= 0 || at === model.length - 1) return null;"],
+			"replace": ["\tif (at < 0 || at === model.length - 1) return null;"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-PREFLIGHT-MODEL-QUALIFIED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-fresh-preflight.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-BOOTSTRAP-ARGV-NO-BRIDGE-ENTRY",
+			"title": "the launch argv accepts --bridge-entry, so a caller can point the contact at a bridge outside this package",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["const VALUE_FLAGS = [\"--provider\", \"--model\", \"--width\", \"--entwurf-bootstrap\"];"],
+			"replace": [
+				"const VALUE_FLAGS = [\"--bridge-entry\", \"--provider\", \"--model\", \"--width\", \"--entwurf-bootstrap\"];"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-BOOTSTRAP-ARGV-NO-BRIDGE-ENTRY]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-FRESH-CALL-EXPOSED",
+			"title": "entwurf_fresh_call drops out of the durable contact's tools, so the citizen cannot open a sibling",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["\t\ttools: PI_DURABLE_TOOL_NAMES.map(tool),"],
+			"replace": ["\t\ttools: PI_DURABLE_TOOL_NAMES.filter((name) => name !== \"entwurf_fresh_call\").map(tool),"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-FRESH-CALL-EXPOSED]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-BRIDGE-DIRECT-SCRUBBED",
+			"title": "the identity scrub is omitted, so inherited identity carriers reach the bridge child",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["\t\tif (value !== undefined && !scrubbed.has(key)) env[key] = value;\n"],
+			"replace": ["\t\tif (value !== undefined) env[key] = value;\n"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-BRIDGE-DIRECT-SCRUBBED]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-CHILD-ROOTS-ARE-WRITTEN-ROOTS",
+			"title": "the root binding is omitted, so the bridge child reads whatever garden roots it inherited instead of the roots the contact wrote",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": [
+				"\tfor (const key of Object.keys(PI_DURABLE_BRIDGE_ROOT_ENV) as (keyof PiDurableRoots)[]) {\n\t\tenv[PI_DURABLE_BRIDGE_ROOT_ENV[key]] = roots[key];\n\t}\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CHILD-ROOTS-ARE-WRITTEN-ROOTS]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PDH-JOIN-FOREIGN-SENDER-REFUSED",
+			"title": "the durable host leaves the sender join, so a live durable receiver whose owner sender marker names another garden is no longer refused (ABSENT-SENDER and SCOPE also go red)",
+			"subject": "pi-extensions/lib/entwurf-deliverability.ts",
+			"find": [
+				"export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\", \"pi-durable-host\"];"
+			],
+			"replace": ["export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\"];"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PDH-JOIN-FOREIGN-SENDER-REFUSED]",
+			"signatureSource": "pi-extensions/lib/entwurf-deliverability.owner-join.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-SCHEMA-DRIFT-REFUSED",
+			"title": "schema drift is never reported, so a bridge whose tool schemas differ from the exposed copies is accepted at birth",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["\treturn problems.length === 0 ? undefined : problems.join(\"; \");"],
+			"replace": ["\treturn undefined;"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-SCHEMA-DRIFT-REFUSED]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RECEIVER-REFUSES-UNVERIFIED-IDENTITY",
+			"title": "the receiver arms against any live sender marker, even one naming another garden or session",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": [
+				"\t\t\tif (sender === null || sender.gardenId !== gardenId || sender.nativeSessionId !== nativeSessionId) {"
+			],
+			"replace": [
+				"\t\t\tif (sender === null || (sender.gardenId !== gardenId && sender.nativeSessionId !== nativeSessionId)) {"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RECEIVER-REFUSES-UNVERIFIED-IDENTITY]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-ONE-BIRTH",
+			"title": "a born contact can attach again, minting a second birth on the same contact",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": [
+				"\t\t\tif (state.kind !== \"pending\") {\n\t\t\t\tthrow new Error(`pi-durable contact: attach is a one-time birth"
+			],
+			"replace": [
+				"\t\t\tif (state.kind === \"attaching\") {\n\t\t\t\tthrow new Error(`pi-durable contact: attach is a one-time birth"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-ONE-BIRTH]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-FIRST-INPUT-ONCE",
+			"title": "the launcher's first input loses its fixed request id, so a reopen can admit the same task again",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\t\t\t\trequestId: `entwurf-first-input:${attachment.gardenId}`,\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-FIRST-INPUT-ONCE]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-GATE-SEND-OWNS-QUALIFIED-START",
+			"title": "the send gate registers a bridge under a fresh start read instead of the start that qualified it, so a pid recycled after qualification is owned and signalled",
+			"subject": "scripts/check-pi-durable-send.ts",
+			"find": ["own(child.pid, \"bridge\", child.start)"],
+			"replace": ["own(child.pid, \"bridge\")"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-GATE-SEND-OWNS-QUALIFIED-START]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-GATE-SEND-OBSERVED-BY-IDENTITY",
+			"title": "the send gate looks complete observation up by pid, so a host whose pid was reused inherits its predecessor's observed children",
+			"subject": "scripts/check-pi-durable-send.ts",
+			"find": ["childrenObserved.has(host)"],
+			"replace": ["[...childrenObserved].some((h) => h.pid === host.pid)"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-GATE-SEND-OBSERVED-BY-IDENTITY]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-GATE-SEND-S3-START-RECHECKED",
+			"title": "the send gate's SIGKILL of the paused bridge loses its start-key re-check, so a process that replaced it after the IO and state reads is killed",
+			"subject": "scripts/check-pi-durable-send.ts",
+			"find": [
+				"\tif (procStat(bridge1.pid)?.start !== bridge1.start)\n\t\tthrow new Error(`GAP: bridge1 ${bridge1.pid} is not the observed process immediately before its SIGKILL`);\n"
+			],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-GATE-SEND-S3-START-RECHECKED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-GATE-RECEIVE-CONNECT-CLOSES",
+			"title": "the receive gate's failed connect no longer closes the transport, so a bridge spawned inside connect is left neither owned nor closed",
+			"subject": "scripts/check-pi-durable-receive.ts",
+			"find": [
+				"\ttry {\n\t\tawait client.connect(transport);\n\t} catch (error) {\n\t\t// A failed connect may already have spawned the bridge, which is not owned yet: close the\n\t\t// transport (it ends the child it spawned) before rethrowing, and keep the cause first.\n\t\ttry {\n\t\t\tawait transport.close();\n\t\t} catch (closeError) {\n\t\t\tthrow new AggregateError(\n\t\t\t\t[error, closeError],\n\t\t\t\t`the sending bridge did not connect (${(error as Error).message}); closing it also failed`,\n\t\t\t);\n\t\t}\n\t\tthrow error;\n\t}\n"
+			],
+			"replace": ["\tawait client.connect(transport);\n"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-GATE-RECEIVE-CONNECT-CLOSES]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RECEIVER-DIAGNOSTIC-LATEST-ONLY",
+			"title": "the receiver diagnostic appends every successful admission instead of keeping the latest one, so it grows with the host's lifetime (RING-COALESCES, whose two-pass expectation is latest-only, also goes red)",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": [
+				"\t\t\t\tadmissions.splice(0, admissions.length, { why, requestId, submissionId: submission.id, fresh, unread });"
+			],
+			"replace": ["\t\t\t\tadmissions.push({ why, requestId, submissionId: submission.id, fresh, unread });"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RECEIVER-DIAGNOSTIC-LATEST-ONLY]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		}
+	]
+}

package/scripts/mutants/pi-floor.json

@@ -7,10 +7,10 @@
 			"title": "one row of the pnpm workspace closure is left on the previous floor while every other surface moved — the shape a version bump actually fails in. Nothing else reads that file, so the stranded row surfaces only at install time, in a different command, far from the change that stranded it",
 			"subject": "pnpm-workspace.yaml",
 			"find": [
-				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0'"
+				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0 || 1.0.2'"
 			],
 			"replace": [
-				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2'"
+				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0'"
 			],
 			"gate": ["bash", "run.sh", "check-dep-versions"],
 			"timeoutSeconds": 300,