@junghanacs/entwurf 0.30.1 → 0.31.0

package/scripts/lib/pi-durable-fresh-live-receipts.ts

@@ -0,0 +1,139 @@
+/**
+ * The oracles of `smoke-pi-durable-fresh-live`, as pure functions over raw evidence, so the same code
+ * that judges a live run can re-judge its saved raw (Pi's JSONL and the pd native-store snapshot).
+ *
+ * Pi side: a message lands only as an exact payload with ONE anchored terminal sender envelope —
+ * `piCallbackSenders` already decides that shape; this adds the expected sender and returns the row.
+ * A body that merely MENTIONS the token and the sender's id (the fixture's own instruction did) is
+ * not a delivery.
+ *
+ * pd side: the native store's ROOT conversation only (no owner conversation or task), read through
+ * its entry kinds — `pi.system` (tool offering, applied as toolsAdded/toolsRemoved in order),
+ * `pi.assistant` (the model that answered, and the tool calls in order) and `pi.tool-result` (each
+ * call's settled result, joined by toolCallId).
+ */
+import { piCallbackSenders } from "./codex-fresh-source-receipts.ts";
+
+/** The one Pi transcript row whose exact payload arrived from `expectedSender`, or null. */
+export function piExactDeliveryRow(
+	entries: readonly unknown[],
+	payload: string,
+	expectedSender: string,
+): { row: unknown; index: number } | null {
+	const hits: { row: unknown; index: number }[] = [];
+	entries.forEach((row, index) => {
+		const senders = piCallbackSenders([row], payload);
+		if (senders.length === 1 && senders[0] === expectedSender) hits.push({ row, index });
+	});
+	return hits.length === 1 ? (hits[0] as { row: unknown; index: number }) : null;
+}
+
+export interface PdNativeRow {
+	id: number;
+	conversation_id: number;
+	record: string;
+}
+export interface PdNativeSubmissionRow {
+	conversation_id: number;
+	status: string;
+	record: string;
+}
+export interface PdToolCall {
+	id: string;
+	name: string;
+	arguments: Record<string, unknown>;
+	result: { text: string; isError: boolean } | null;
+}
+export interface PdRootView {
+	offering: string[];
+	models: string[];
+	calls: PdToolCall[];
+}
+
+interface Message {
+	role?: unknown;
+	provider?: unknown;
+	model?: unknown;
+	content?: unknown;
+	toolsAdded?: unknown;
+	toolsRemoved?: unknown;
+	toolCallId?: unknown;
+	isError?: unknown;
+}
+
+function messagesOf(record: Record<string, unknown>): Message[] {
+	return Array.isArray(record.model) ? (record.model as Message[]) : [];
+}
+function names(list: unknown): string[] {
+	return Array.isArray(list)
+		? list.flatMap((t) =>
+				t !== null && typeof t === "object" && typeof (t as { name?: unknown }).name === "string"
+					? [(t as { name: string }).name]
+					: [],
+			)
+		: [];
+}
+
+/** The root conversation's offering, models and tool calls, from its own entries in id order. */
+export function pdRootView(entries: readonly PdNativeRow[], rootConversationId: number): PdRootView {
+	let offering: string[] = [];
+	const models = new Set<string>();
+	const calls: PdToolCall[] = [];
+	const byId = new Map<string, PdToolCall>();
+	for (const row of [...entries].sort((a, b) => a.id - b.id)) {
+		if (row.conversation_id !== rootConversationId) continue;
+		const record = JSON.parse(row.record) as Record<string, unknown>;
+		for (const message of messagesOf(record)) {
+			if (record.kind === "pi.system") {
+				const removed = new Set(names(message.toolsRemoved));
+				offering = [...offering.filter((n) => !removed.has(n)), ...names(message.toolsAdded)];
+			} else if (record.kind === "pi.assistant" && message.role === "assistant") {
+				if (typeof message.provider === "string" && typeof message.model === "string")
+					models.add(`${message.provider}/${message.model}`);
+				for (const block of Array.isArray(message.content) ? message.content : []) {
+					const b = block as { type?: unknown; id?: unknown; name?: unknown; arguments?: unknown };
+					if (b.type !== "toolCall" || typeof b.id !== "string" || typeof b.name !== "string") continue;
+					const call: PdToolCall = {
+						id: b.id,
+						name: b.name,
+						arguments: (b.arguments ?? {}) as Record<string, unknown>,
+						result: null,
+					};
+					calls.push(call);
+					byId.set(b.id, call);
+				}
+			} else if (
+				record.kind === "pi.tool-result" &&
+				message.role === "toolResult" &&
+				typeof message.toolCallId === "string"
+			) {
+				const call = byId.get(message.toolCallId);
+				if (call === undefined) continue;
+				const text = (Array.isArray(message.content) ? message.content : [])
+					.map((c) =>
+						(c as { type?: unknown; text?: unknown }).type === "text" ? String((c as { text: unknown }).text) : "",
+					)
+					.join("");
+				call.result = { text, isError: message.isError === true };
+			}
+		}
+	}
+	return { offering, models: [...models], calls };
+}
+
+/** The doorbell submission for exactly this mailbox message, on the root conversation. */
+export function pdDoorbellSubmission(
+	submissions: readonly PdNativeSubmissionRow[],
+	rootConversationId: number,
+	requestId: string,
+): { status: string; record: Record<string, unknown> } | null {
+	const hits = submissions
+		.map((s) => ({ s, record: JSON.parse(s.record) as Record<string, unknown> }))
+		.filter(({ s, record }) => s.conversation_id === rootConversationId && record.requestId === requestId);
+	return hits.length === 1
+		? {
+				status: (hits[0] as { s: PdNativeSubmissionRow }).s.status,
+				record: (hits[0] as { record: Record<string, unknown> }).record,
+			}
+		: null;
+}

package/scripts/lib/pi-durable-r1.ts

@@ -0,0 +1,100 @@
+// The R1 cell's go/no-go predicates for check-pi-durable-send (#129 L-send), as pure functions so
+// the exact conditions the gate stops on can be checked on their own. Each returns the reasons it
+// refuses; an empty list is the only pass.
+
+function canonicalJson(value: unknown): string {
+	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+	if (value !== null && typeof value === "object") {
+		const entries = Object.entries(value as Record<string, unknown>).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+		return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+	}
+	return JSON.stringify(value);
+}
+
+export interface Verdict {
+	ok: boolean;
+	reasons: string[];
+}
+const verdict = (reasons: string[]): Verdict => ({ ok: reasons.length === 0, reasons });
+
+/** The reported frame: a root `pi.tool` task running in `execute`, and the same-task slot for the call. */
+export function intentFrameVerdict(frame: unknown, callId: string): Verdict {
+	const f = frame as {
+		node?: { id?: unknown; kind?: unknown; conversationId?: unknown; state?: { status?: unknown; phase?: unknown } };
+		slot?: { taskId?: unknown; name?: unknown; callId?: unknown; status?: unknown };
+	} | null;
+	const reasons: string[] = [];
+	if (f?.node?.kind !== "pi.tool") reasons.push("node is not pi.tool");
+	if (f?.node?.conversationId !== 1) reasons.push("node is not on the root conversation");
+	if (f?.node?.state?.status !== "running") reasons.push("node is not running");
+	if (f?.node?.state?.phase !== "execute") reasons.push("node phase is not execute");
+	if (f?.slot?.taskId === undefined || f.slot.taskId !== f.node?.id) reasons.push("slot taskId is not the node's");
+	if (f?.slot?.name !== "entwurf_v2") reasons.push("slot is not entwurf_v2");
+	if (f?.slot?.callId !== callId) reasons.push(`slot is not ${callId}`);
+	if (f?.slot?.status !== "running") reasons.push("slot is not running");
+	return verdict(reasons);
+}
+
+export interface PreCopyFacts {
+	/** host1's actual exit signal. */
+	hostExitSignal: string | null | undefined;
+	/** bridge1's /proc state when its counters were last read. */
+	bridgeStateAtRead: string | null;
+	bridgeGone: boolean;
+	readDelta: { rchar: number; syscr: number };
+	/** Wall-clock ms when `go` was written and when host1 was signalled. */
+	goAt: number;
+	killAt: number;
+	deadlineMs: number;
+}
+
+/** Everything that must hold before the database set is copied and the session reopened. */
+export function preCopyVerdict(f: PreCopyFacts): Verdict {
+	const reasons: string[] = [];
+	if (f.hostExitSignal !== "SIGKILL") reasons.push(`host1 exit signal is ${String(f.hostExitSignal)}, not SIGKILL`);
+	if (f.bridgeStateAtRead !== "T") reasons.push(`bridge1 state at read is ${String(f.bridgeStateAtRead)}, not T`);
+	if (!f.bridgeGone) reasons.push("bridge1 is not gone");
+	if (f.readDelta.rchar !== 0 || f.readDelta.syscr !== 0) {
+		reasons.push(`bridge1 counted reads (rchar +${f.readDelta.rchar}, syscr +${f.readDelta.syscr})`);
+	}
+	const elapsed = f.killAt - f.goAt;
+	if (!(elapsed >= 0 && elapsed <= f.deadlineMs)) {
+		reasons.push(`go→kill took ${elapsed}ms, outside the ${f.deadlineMs}ms validity cutoff`);
+	}
+	return verdict(reasons);
+}
+
+export interface CheckpointFacts {
+	row: { id?: unknown; conversation_id?: unknown; status?: unknown } | null;
+	record: {
+		id?: unknown;
+		kind?: unknown;
+		conversationId?: unknown;
+		input?: { callId?: unknown };
+		state?: { status?: unknown; checkpoint?: { phase?: unknown; replay?: unknown; arguments?: unknown } };
+	} | null;
+	resultEntriesForCall: number;
+}
+
+/** The copied database holds THIS call's committed, unsafe intent and no result for it. */
+export function checkpointVerdict(
+	f: CheckpointFacts,
+	expect: { nodeId: number; callId: string; args: unknown },
+): Verdict {
+	const reasons: string[] = [];
+	if (f.row === null || f.record === null) return verdict(["no task row for the observed task id"]);
+	if (f.row.id !== expect.nodeId) reasons.push("queried row id is not the observed task id");
+	if (f.record.id !== expect.nodeId) reasons.push("record id is not the observed task id");
+	if (f.record.kind !== "pi.tool") reasons.push("record is not pi.tool");
+	if (f.record.conversationId !== 1) reasons.push("record is not on the root conversation");
+	if (f.record.input?.callId !== expect.callId) reasons.push(`record input callId is not ${expect.callId}`);
+	if (f.record.state?.status !== "running") reasons.push("record is not running");
+	if (f.record.state?.checkpoint?.phase !== "execute") reasons.push("checkpoint phase is not execute");
+	if (f.record.state?.checkpoint?.replay !== "unsafe") reasons.push("checkpoint replay is not unsafe");
+	if (canonicalJson(f.record.state?.checkpoint?.arguments) !== canonicalJson(expect.args)) {
+		reasons.push("checkpoint arguments are not the scripted arguments");
+	}
+	if (f.resultEntriesForCall !== 0)
+		reasons.push(`${f.resultEntriesForCall} result entr(ies) already exist for the call`);
+	return verdict(reasons);
+}

package/scripts/lib/pi-durable-reap.ts

@@ -0,0 +1,27 @@
+// The cleanup verdict of check-pi-durable-send (#129 L-send), as a pure function so the exact
+// predicate the gate uses can be checked on its own.
+//
+// Green only when every owned process is gone, no signal failed, the scripted endpoint closed, and
+// every owned host's children were OBSERVED before it went away. A host that exited before /proc
+// could be asked about its children leaves an unknown, and an unknown is not a clean reap.
+
+export interface ReapFacts {
+	/** Owned processes still alive with their recorded start key. */
+	alive: readonly number[];
+	/** Signal or exit failures met while reaping. */
+	problems: readonly string[];
+	endpointClosed: boolean;
+	endpointListening: boolean;
+	/** Hosts that exited before their children were observed. */
+	observationNotes: readonly string[];
+}
+
+export function ownedReapVerdict(facts: ReapFacts): { green: boolean; reasons: string[] } {
+	const reasons = [
+		...(facts.alive.length > 0 ? [`still alive: ${facts.alive.join(",")}`] : []),
+		...facts.problems,
+		...(facts.endpointClosed && !facts.endpointListening ? [] : ["the scripted endpoint did not close"]),
+		...facts.observationNotes.map((note) => `unobserved: ${note}`),
+	];
+	return { green: reasons.length === 0, reasons };
+}

package/scripts/lib/pi-durable-receive.ts

@@ -0,0 +1,137 @@
+// The receive cell's go/no-go predicates for check-pi-durable-receive (#129 L-receive), as pure
+// functions so the exact conditions the gate stops on can be checked on their own. Each returns the
+// reasons it refuses; an empty list is the only pass. Nothing here imports the adapter: the doorbell
+// notice and the request id are recognised by the contract's public words, not by its constants.
+
+export interface Verdict {
+	ok: boolean;
+	reasons: string[];
+}
+const verdict = (reasons: string[]): Verdict => ({ ok: reasons.length === 0, reasons });
+
+/** The mailbox file a meta-mailbox ENQUEUE receipt names, or undefined when the text is not one. */
+export function enqueuedFile(receipt: string): string | undefined {
+	return /^entwurf_v2 meta-mailbox → enqueued \(([^()/]+\.msg)\)$/.exec(receipt.trim())?.[1];
+}
+
+export interface HeldCaptureFacts {
+	hostGid: string;
+	hostPid: number;
+	hostStartKey: string;
+	/** The ENQUEUE receipt's file name. */
+	enqueued: string | undefined;
+	/** The host's mailbox directory listing at the hold. */
+	listing: string[];
+	/** Bytes of `<enqueued>.delivered` at the hold, or null when absent. */
+	deliveredBody: string | null;
+	sentMessage: string;
+	signalPresent: boolean;
+	/** The host's raw receiver marker at the hold, or null when absent. */
+	receiverMarker: Record<string, unknown> | null;
+	/** The newest user message text of the held request #1. */
+	request1UserText: string;
+	/** The tool names request #1 offers. */
+	request1Tools: string[];
+}
+
+/**
+ * Everything that must hold while response #1 is withheld: the sender's ENQUEUE named a file, the
+ * host's doorbell has already stamped exactly that file `.delivered` (a wake attempt, not a read), its
+ * bytes carry the sent message, the signal and the host-owned receiver marker are in place, and the
+ * request that the root admission started is the announce — garden and tool named, body absent.
+ */
+export function heldCaptureVerdict(f: HeldCaptureFacts): Verdict {
+	const reasons: string[] = [];
+	if (f.enqueued === undefined) return verdict(["the sender's receipt is not a meta-mailbox ENQUEUE"]);
+	if (f.listing.includes(f.enqueued)) reasons.push(`${f.enqueued} is still a fresh .msg — no doorbell stamped it`);
+	if (!f.listing.includes(`${f.enqueued}.delivered`)) reasons.push(`${f.enqueued}.delivered is absent`);
+	if (f.listing.some((n) => n.endsWith(".read"))) reasons.push("a body was already archived before the hold");
+	if (f.deliveredBody === null || !f.deliveredBody.includes(f.sentMessage)) {
+		reasons.push("the delivered bytes do not carry the sent message");
+	}
+	if (!f.signalPresent) reasons.push("inbox.signal is absent");
+	const m = f.receiverMarker;
+	if (m === null) reasons.push("the host's receiver marker is absent");
+	else {
+		if (m.gardenId !== f.hostGid) reasons.push("the receiver marker names another garden");
+		if (m.ownerPid !== f.hostPid) reasons.push("the receiver marker is not owned by the spawned host");
+		if (m.ownerStartKey !== `linux:${f.hostStartKey}`)
+			reasons.push("the receiver marker's start key is not the host's");
+		if (m.ownerKind !== "pi-durable-host") reasons.push("the receiver marker is not pi-durable-host");
+	}
+	const text = f.request1UserText;
+	if (!text.startsWith("[entwurf inbox] 1 unread mailbox message available for garden ")) {
+		reasons.push("request #1's user input is not a one-message doorbell notice");
+	}
+	if (!text.includes(f.hostGid) || !text.includes("entwurf_inbox_read")) {
+		reasons.push("the notice does not name the host's garden and entwurf_inbox_read");
+	}
+	if (text.includes(f.sentMessage)) reasons.push("the notice carries the body");
+	if (!f.request1Tools.includes("entwurf_inbox_read")) reasons.push("request #1 does not offer entwurf_inbox_read");
+	return verdict(reasons);
+}
+
+/**
+ * How upstream writes the indexed `submissions.request_id` column: `JSON.stringify` of the request id
+ * (`[read packages/durable/src/storage/sqlite/storage.ts:64 encodeIndexedString, :762 insert, :442
+ * lookup]` @cd32f77), the same encoding R1 measured on `tasks.kind`. The record JSON keeps it raw.
+ */
+export const encodedRequestIdColumn = (requestId: string): string => JSON.stringify(requestId);
+
+export interface SubmissionFacts {
+	/** The `submissions` row whose parsed record carries the request id, with that record, or null. */
+	row: { id?: unknown; conversation_id?: unknown; request_id?: unknown; status?: unknown } | null;
+	record: {
+		id?: unknown;
+		conversationId?: unknown;
+		requestId?: unknown;
+		type?: unknown;
+		status?: unknown;
+		entry?: unknown;
+	} | null;
+	/** Rows whose parsed record carries the request id, over the whole table. */
+	rowsForRequest: number;
+	/** Rows whose indexed `request_id` column holds the request id as upstream encodes it. */
+	rowsForColumn: number;
+	/** The entry the record names, parsed, or null. */
+	entry: { kind?: unknown; model?: { role?: unknown; content?: unknown }[] } | null;
+}
+
+/**
+ * The copied database holds exactly one input submission for the doorbell's request id — found both
+ * by its record and by its indexed column — on the root conversation, whose row id AND record id are
+ * the id the receiver reported, placed as the root user entry carrying the notice and answered. A row
+ * still queued is reported as queued — never read as placed.
+ */
+export function submissionVerdict(
+	f: SubmissionFacts,
+	expect: { submissionId: unknown; requestId: string; notice: string },
+): Verdict {
+	const reasons: string[] = [];
+	if (f.rowsForRequest !== 1) reasons.push(`${f.rowsForRequest} records carry the request id`);
+	if (f.rowsForColumn !== 1) reasons.push(`${f.rowsForColumn} rows hold the encoded request id in the indexed column`);
+	if (f.row === null || f.record === null) return verdict([...reasons, "no submission row for the request id"]);
+	if (f.row.id !== expect.submissionId) reasons.push("the row id is not the reported submission id");
+	if (f.record.id === undefined) reasons.push("the record carries no id");
+	else if (f.record.id !== f.row.id || f.record.id !== expect.submissionId) {
+		reasons.push("the record id is not the row id and the reported submission id");
+	}
+	if (f.row.conversation_id !== 1 || f.record.conversationId !== 1)
+		reasons.push("the row is not on the root conversation");
+	if (f.row.request_id !== encodedRequestIdColumn(expect.requestId) || f.record.requestId !== expect.requestId) {
+		reasons.push("the row's request id is not the doorbell's");
+	}
+	if (f.record.type !== "input") reasons.push("the submission is not an input");
+	if (f.row.status !== f.record.status) reasons.push("the row status and the record status disagree");
+	if (f.record.status === "queued") reasons.push("the submission is still queued, not placed");
+	else if (f.record.status !== "done") reasons.push(`the submission is ${String(f.record.status)}, not done`);
+	const message = f.entry?.model?.[0];
+	if (f.entry === null) reasons.push("the record names no readable entry");
+	else {
+		if (f.entry.kind !== "pi.user") reasons.push("the placed entry is not pi.user");
+		if (message?.role !== "user" || message.content !== expect.notice) {
+			reasons.push("the placed entry's content is not the notice the model received");
+		}
+	}
+	return verdict(reasons);
+}

package/scripts/mutants/control-send-receipt.json

@@ -181,7 +181,7 @@
 			"claim": "PI-CORE-PIN-TRACKS-FLOOR",
 			"title": "the queue oracle's pi-agent-core pin drifts off the floor the rest of the pi runtime is pinned to, so the oracle keeps answering honestly — about a pi nobody in this repo runs",
 			"subject": "package.json",
-			"find": ["\"@earendil-works/pi-agent-core\": \"1.0.0\","],
+			"find": ["\"@earendil-works/pi-agent-core\": \"1.0.2\","],
 			"replace": ["\"@earendil-works/pi-agent-core\": \"0.87.1\","],
 			"gate": ["bash", "run.sh", "check-dep-versions"],
 			"timeoutSeconds": 300,

package/scripts/mutants/copilot-birth.json

@@ -133,10 +133,10 @@
 			"title": "closing the reader half leaves the writer talking to nobody — the hook writes a copilot marker, the bridge never looks in that directory, and the citizen's sends are refused as anonymous (the #46 shape, which is why writer and reader open in one change)",
 			"subject": "pi-extensions/lib/meta-sender-identity.ts",
 			"find": [
-				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\"claude-code\", \"antigravity\", \"copilot\", \"omp\"];"
+				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\n\t\"claude-code\",\n\t\"antigravity\",\n\t\"copilot\",\n\t\"omp\",\n\t\"pi-durable\",\n];"
 			],
 			"replace": [
-				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\"claude-code\", \"antigravity\", \"omp\"];"
+				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\n\t\"claude-code\",\n\t\"antigravity\",\n\t\"omp\",\n\t\"pi-durable\",\n];"
 			],
 			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
 			"timeoutSeconds": 300,

package/scripts/mutants/meta-hook-session-switch.json

@@ -182,9 +182,11 @@
 			"claim": "MHSS-JOIN-SCOPE-OWNERKIND",
 			"title": "admitting copilot-extension into the sender-marker join makes every Copilot citizen permanently mailbox-undeliverable: its watch owner is a forked child whose pid never carries a sender marker, so the join can only ever answer no",
 			"subject": "pi-extensions/lib/entwurf-deliverability.ts",
-			"find": ["export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\"];"],
+			"find": [
+				"export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\", \"pi-durable-host\"];"
+			],
 			"replace": [
-				"export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\", \"copilot-extension\"];"
+				"export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\", \"pi-durable-host\", \"copilot-extension\"];"
 			],
 			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
 			"timeoutSeconds": 300,

package/scripts/mutants/mux-fresh-call.json

@@ -151,7 +151,7 @@
 			"title": "MCP drops the required model field from fresh-call while the composition still expects one",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\tmodel: z\n\t\t\t.string()\n\t\t\t.min(1)\n\t\t\t.max(200)\n\t\t\t// The `\\[` below is USELESS TO JS AND LOAD-BEARING TO THE HOST. zod emits this source\n\t\t\t// text verbatim as the JSON Schema `pattern`, and the host's tool-schema validator is a\n\t\t\t// Rust regex engine that rejects an unescaped `[` inside a character class as \"unclosed\n\t\t\t// character class\" — a 400 on tools/list that stops EVERY Claude session from opening\n\t\t\t// (7-M-fix). Biome's safe fix removes it; do not accept that fix. The suppression must\n\t\t\t// stay on the line DIRECTLY above the expression, or it attaches to nothing and reads\n\t\t\t// as an unused suppression while the escape goes back to being fixable.\n\t\t\t// biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above\n\t\t\t.regex(/^[A-Za-z0-9][A-Za-z0-9._/:\\[\\]-]*$/)\n\t\t\t.describe(\n\t\t\t\t\"Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot/OMP/Codex model name.\",\n\t\t\t),\n"
+				"\t\tmodel: z\n\t\t\t.string()\n\t\t\t.min(1)\n\t\t\t.max(200)\n\t\t\t// The `\\[` below is USELESS TO JS AND LOAD-BEARING TO THE HOST. zod emits this source\n\t\t\t// text verbatim as the JSON Schema `pattern`, and the host's tool-schema validator is a\n\t\t\t// Rust regex engine that rejects an unescaped `[` inside a character class as \"unclosed\n\t\t\t// character class\" — a 400 on tools/list that stops EVERY Claude session from opening\n\t\t\t// (7-M-fix). Biome's safe fix removes it; do not accept that fix. The suppression must\n\t\t\t// stay on the line DIRECTLY above the expression, or it attaches to nothing and reads\n\t\t\t// as an unused suppression while the escape goes back to being fixable.\n\t\t\t// biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above\n\t\t\t.regex(/^[A-Za-z0-9][A-Za-z0-9._/:\\[\\]-]*$/)\n\t\t\t.describe(\n\t\t\t\t\"Required runtime model: canonical provider/model for pi, provider/<exact catalog model id> for pi-durable, a Claude Code model id/alias, or a Copilot/OMP/Codex model name.\",\n\t\t\t),\n"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -192,6 +192,17 @@
 			"signature": "[QK:PIIMPORT-WORK-SURFACE]",
 			"signatureSource": "run.sh"
 		},
+		{
+			"claim": "PIIMPORT-DURABLE-BOOTSTRAP-EXACT",
+			"title": "the #129 durable exception loses its file scope: the two experimental durable specifiers become allowed in every file, so a new pi private-subpath import elsewhere passes the floor",
+			"subject": "run.sh",
+			"find": ["      | sed -E \"/^pi\\/pi-durable\\/bootstrap\\.mjs:[0-9]+:/ s#"],
+			"replace": ["      | sed -E \"s#"],
+			"gate": ["bash", "run.sh", "check-pi-import-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PIIMPORT-DURABLE-BOOTSTRAP-EXACT]",
+			"signatureSource": "run.sh"
+		},
 		{
 			"claim": "VITEST-FAILED-TITLE-ATTRIBUTION",
 			"title": "the pilot's kill attribution collects PASSING test titles instead of failed ones, recreating the code-frame false-KILLED hole this lane exists to close",
@@ -323,8 +334,8 @@
 			"claim": "FRESHCALL-BACKEND-SET-SURFACE-PARITY",
 			"title": "a backend the composition can open is missing from the MCP surface enum — the capability exists and no external host can reach it",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
-			"find": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\", \"omp\", \"codex\"])"],
-			"replace": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\", \"omp\"])"],
+			"find": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\", \"omp\", \"codex\", \"pi-durable\"])"],
+			"replace": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\", \"omp\", \"pi-durable\"])"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:FRESHCALL-BACKEND-SET-SURFACE-PARITY]",
@@ -700,6 +711,61 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:FRESHCALL-CALLBACK-ENV]",
 			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PI-DURABLE-ARGV",
+			"title": "pi-durable loses its explicit task-wide width, so the packaged bootstrap refuses a launch the composition said it built",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
+			"find": ["\t\t\t\t\"--width\",\n\t\t\t\t\"task-wide\",\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-PI-DURABLE-ARGV]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PI-DURABLE-PREFLIGHT-PREMUTATION",
+			"title": "the pi-durable runtime/unit preflight is skipped, so an absent or drifted operator runtime is discovered only after a window was placed",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\tif (params.backend === \"pi-durable\") {\n"],
+			"replace": ["\tif (false) {\n"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-PI-DURABLE-PREFLIGHT-PREMUTATION]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PI-DURABLE-MANAGED-RUNTIME",
+			"title": "pi-durable opens the bare app instead of the managed `entwurf pi-durable`, so nothing verifies the operator runtime against the pin before its resolver runs",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\"pi-durable\": \"entwurf\","],
+			"replace": ["\t\"pi-durable\": \"pi\","],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-PI-DURABLE-MANAGED-RUNTIME]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PI-DURABLE-CALLBACK-DIALECT",
+			"title": "pi-durable is told the composed MCP callback name, which the durable contact never registers — the contact offers the bridge verbs under their bare names",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
+			"find": ["\t\"pi-durable\": \"entwurf_callback\","],
+			"replace": ["\t\"pi-durable\": \"mcp__entwurf-bridge__entwurf_callback\","],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-PI-DURABLE-CALLBACK-DIALECT]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "PD-FRESH-LIVE-FOREIGN-SENDER-REFUSED",
+			"title": "the pi-durable LIVE gate's Pi-side oracle drops its expected-sender check, so the exact payload relayed by any other citizen counts as pd's delivery",
+			"subject": "scripts/lib/pi-durable-fresh-live-receipts.ts",
+			"find": ["\t\tif (senders.length === 1 && senders[0] === expectedSender) hits.push({ row, index });"],
+			"replace": ["\t\tif (senders.length === 1) hits.push({ row, index });"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PD-FRESH-LIVE-FOREIGN-SENDER-REFUSED]",
+			"signatureSource": "test/pi-durable-fresh-live-receipts.test.ts"
 		}
 	]
 }

package/scripts/mutants/omp-birth.json

@@ -66,10 +66,10 @@
 			"title": "a backend whose hook writes a marker but is absent from the reader list is INVISIBLE — the bridge holds the owner pid, never looks in that directory, and every send is refused as anonymous for a reason nothing logs (the #46 defect)",
 			"subject": "pi-extensions/lib/meta-sender-identity.ts",
 			"find": [
-				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\"claude-code\", \"antigravity\", \"copilot\", \"omp\"];"
+				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\n\t\"claude-code\",\n\t\"antigravity\",\n\t\"copilot\",\n\t\"omp\",\n\t\"pi-durable\",\n];"
 			],
 			"replace": [
-				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\"claude-code\", \"antigravity\", \"copilot\"];"
+				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\n\t\"claude-code\",\n\t\"antigravity\",\n\t\"copilot\",\n\t\"pi-durable\",\n];"
 			],
 			"gate": ["bash", "run.sh", "check-omp-birth-hook"],
 			"timeoutSeconds": 300,

package/scripts/mutants/omp-fresh.json

@@ -7,9 +7,11 @@
 			"title": "a post-#82 harness admitted as a full D6 citizen while entwurf_fresh_call cannot open it — the exact state the Bundle A+B candidate shipped in, where every gate was green and only prose said the backend was unsupported. This is the defect the whole gate exists for: without it, an `unsupported` note reads as a partial-release permit",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": [
-				"export const FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"copilot\", \"omp\", \"codex\"] as const;"
+				"export const FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"copilot\", \"omp\", \"codex\", \"pi-durable\"] as const;"
+			],
+			"replace": [
+				"export const FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"copilot\", \"codex\", \"pi-durable\"] as const;"
 			],
-			"replace": ["export const FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"copilot\", \"codex\"] as const;"],
 			"gate": ["bash", "run.sh", "check-harness-admission-parity"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:ADMISSION-FRESH-PARITY]",
@@ -119,8 +121,8 @@
 			"claim": "FRESHCALL-BACKEND-SET-SURFACE-PARITY-SKILL",
 			"title": "a backend added to the composition and both schema surfaces but not to the operator skill — the third public surface step 9 names, and the one that had no gate at all. The skill is what an operator reads to decide what can be opened, so a stale list makes the backend unreachable in practice exactly the way a missing enum value makes it unreachable in schema",
 			"subject": ".claude/skills/entwurf-dev/SKILL.md",
-			"find": ["backend는 정확히 `pi | claude-code | copilot | omp | codex`이고"],
-			"replace": ["backend는 정확히 `pi | claude-code | copilot | omp`이고"],
+			"find": ["backend는 정확히 `pi | claude-code | copilot | omp | codex | pi-durable`이고"],
+			"replace": ["backend는 정확히 `pi | claude-code | copilot | omp | pi-durable`이고"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:FRESHCALL-BACKEND-SET-SURFACE-PARITY-SKILL]",

package/scripts/mutants/pack-install.json

@@ -6,7 +6,7 @@
 			"claim": "PACK-INSTALL-PIN-MATCHER-BOUNDED",
 			"title": "the pin-leak matcher loses its version boundary and blesses substring lookalikes — @0.85.10 reads as the pinned 0.85.1 and the gate announces a verified tree it never verified (independent review, 2026-08-25)",
 			"subject": "run.sh",
-			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.0\\.0(_|$)' || true"],
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.0\\.2(_|$)' || true"],
 			"replace": ["  grep '^@earendil-works+' | grep -v '@0\\.87\\.1' || true"],
 			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
 			"timeoutSeconds": 120,
@@ -17,8 +17,8 @@
 			"claim": "PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE",
 			"title": "the pin-leak matcher narrows back to the pi-* families and goes blind to a non-pi member of the same runtime closure — @earendil-works/chord (new in pi 0.85.0, a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol) floats unpinned while the gate prints a verified pin (measured 2026-09-06 on a real 0.85.1 install tree)",
 			"subject": "run.sh",
-			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.0\\.0(_|$)' || true"],
-			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@1\\.0\\.0(_|$)' || true"],
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.0\\.2(_|$)' || true"],
+			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@1\\.0\\.2(_|$)' || true"],
 			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE]",