@junghanacs/entwurf 0.30.1 → 0.32.0

package/scripts/lib/pi-durable-r1.ts

@@ -0,0 +1,100 @@
+// The R1 cell's go/no-go predicates for check-pi-durable-send (#129 L-send), as pure functions so
+// the exact conditions the gate stops on can be checked on their own. Each returns the reasons it
+// refuses; an empty list is the only pass.
+
+function canonicalJson(value: unknown): string {
+	if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+	if (value !== null && typeof value === "object") {
+		const entries = Object.entries(value as Record<string, unknown>).sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+		return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalJson(v)}`).join(",")}}`;
+	}
+	return JSON.stringify(value);
+}
+
+export interface Verdict {
+	ok: boolean;
+	reasons: string[];
+}
+const verdict = (reasons: string[]): Verdict => ({ ok: reasons.length === 0, reasons });
+
+/** The reported frame: a root `pi.tool` task running in `execute`, and the same-task slot for the call. */
+export function intentFrameVerdict(frame: unknown, callId: string): Verdict {
+	const f = frame as {
+		node?: { id?: unknown; kind?: unknown; conversationId?: unknown; state?: { status?: unknown; phase?: unknown } };
+		slot?: { taskId?: unknown; name?: unknown; callId?: unknown; status?: unknown };
+	} | null;
+	const reasons: string[] = [];
+	if (f?.node?.kind !== "pi.tool") reasons.push("node is not pi.tool");
+	if (f?.node?.conversationId !== 1) reasons.push("node is not on the root conversation");
+	if (f?.node?.state?.status !== "running") reasons.push("node is not running");
+	if (f?.node?.state?.phase !== "execute") reasons.push("node phase is not execute");
+	if (f?.slot?.taskId === undefined || f.slot.taskId !== f.node?.id) reasons.push("slot taskId is not the node's");
+	if (f?.slot?.name !== "entwurf_v2") reasons.push("slot is not entwurf_v2");
+	if (f?.slot?.callId !== callId) reasons.push(`slot is not ${callId}`);
+	if (f?.slot?.status !== "running") reasons.push("slot is not running");
+	return verdict(reasons);
+}
+
+export interface PreCopyFacts {
+	/** host1's actual exit signal. */
+	hostExitSignal: string | null | undefined;
+	/** bridge1's /proc state when its counters were last read. */
+	bridgeStateAtRead: string | null;
+	bridgeGone: boolean;
+	readDelta: { rchar: number; syscr: number };
+	/** Wall-clock ms when `go` was written and when host1 was signalled. */
+	goAt: number;
+	killAt: number;
+	deadlineMs: number;
+}
+
+/** Everything that must hold before the database set is copied and the session reopened. */
+export function preCopyVerdict(f: PreCopyFacts): Verdict {
+	const reasons: string[] = [];
+	if (f.hostExitSignal !== "SIGKILL") reasons.push(`host1 exit signal is ${String(f.hostExitSignal)}, not SIGKILL`);
+	if (f.bridgeStateAtRead !== "T") reasons.push(`bridge1 state at read is ${String(f.bridgeStateAtRead)}, not T`);
+	if (!f.bridgeGone) reasons.push("bridge1 is not gone");
+	if (f.readDelta.rchar !== 0 || f.readDelta.syscr !== 0) {
+		reasons.push(`bridge1 counted reads (rchar +${f.readDelta.rchar}, syscr +${f.readDelta.syscr})`);
+	}
+	const elapsed = f.killAt - f.goAt;
+	if (!(elapsed >= 0 && elapsed <= f.deadlineMs)) {
+		reasons.push(`go→kill took ${elapsed}ms, outside the ${f.deadlineMs}ms validity cutoff`);
+	}
+	return verdict(reasons);
+}
+
+export interface CheckpointFacts {
+	row: { id?: unknown; conversation_id?: unknown; status?: unknown } | null;
+	record: {
+		id?: unknown;
+		kind?: unknown;
+		conversationId?: unknown;
+		input?: { callId?: unknown };
+		state?: { status?: unknown; checkpoint?: { phase?: unknown; replay?: unknown; arguments?: unknown } };
+	} | null;
+	resultEntriesForCall: number;
+}
+
+/** The copied database holds THIS call's committed, unsafe intent and no result for it. */
+export function checkpointVerdict(
+	f: CheckpointFacts,
+	expect: { nodeId: number; callId: string; args: unknown },
+): Verdict {
+	const reasons: string[] = [];
+	if (f.row === null || f.record === null) return verdict(["no task row for the observed task id"]);
+	if (f.row.id !== expect.nodeId) reasons.push("queried row id is not the observed task id");
+	if (f.record.id !== expect.nodeId) reasons.push("record id is not the observed task id");
+	if (f.record.kind !== "pi.tool") reasons.push("record is not pi.tool");
+	if (f.record.conversationId !== 1) reasons.push("record is not on the root conversation");
+	if (f.record.input?.callId !== expect.callId) reasons.push(`record input callId is not ${expect.callId}`);
+	if (f.record.state?.status !== "running") reasons.push("record is not running");
+	if (f.record.state?.checkpoint?.phase !== "execute") reasons.push("checkpoint phase is not execute");
+	if (f.record.state?.checkpoint?.replay !== "unsafe") reasons.push("checkpoint replay is not unsafe");
+	if (canonicalJson(f.record.state?.checkpoint?.arguments) !== canonicalJson(expect.args)) {
+		reasons.push("checkpoint arguments are not the scripted arguments");
+	}
+	if (f.resultEntriesForCall !== 0)
+		reasons.push(`${f.resultEntriesForCall} result entr(ies) already exist for the call`);
+	return verdict(reasons);
+}

package/scripts/lib/pi-durable-reap.ts

@@ -0,0 +1,27 @@
+// The cleanup verdict of check-pi-durable-send (#129 L-send), as a pure function so the exact
+// predicate the gate uses can be checked on its own.
+//
+// Green only when every owned process is gone, no signal failed, the scripted endpoint closed, and
+// every owned host's children were OBSERVED before it went away. A host that exited before /proc
+// could be asked about its children leaves an unknown, and an unknown is not a clean reap.
+
+export interface ReapFacts {
+	/** Owned processes still alive with their recorded start key. */
+	alive: readonly number[];
+	/** Signal or exit failures met while reaping. */
+	problems: readonly string[];
+	endpointClosed: boolean;
+	endpointListening: boolean;
+	/** Hosts that exited before their children were observed. */
+	observationNotes: readonly string[];
+}
+
+export function ownedReapVerdict(facts: ReapFacts): { green: boolean; reasons: string[] } {
+	const reasons = [
+		...(facts.alive.length > 0 ? [`still alive: ${facts.alive.join(",")}`] : []),
+		...facts.problems,
+		...(facts.endpointClosed && !facts.endpointListening ? [] : ["the scripted endpoint did not close"]),
+		...facts.observationNotes.map((note) => `unobserved: ${note}`),
+	];
+	return { green: reasons.length === 0, reasons };
+}

package/scripts/lib/pi-durable-receive.ts

@@ -0,0 +1,137 @@
+// The receive cell's go/no-go predicates for check-pi-durable-receive (#129 L-receive), as pure
+// functions so the exact conditions the gate stops on can be checked on their own. Each returns the
+// reasons it refuses; an empty list is the only pass. Nothing here imports the adapter: the doorbell
+// notice and the request id are recognised by the contract's public words, not by its constants.
+
+export interface Verdict {
+	ok: boolean;
+	reasons: string[];
+}
+const verdict = (reasons: string[]): Verdict => ({ ok: reasons.length === 0, reasons });
+
+/** The mailbox file a meta-mailbox ENQUEUE receipt names, or undefined when the text is not one. */
+export function enqueuedFile(receipt: string): string | undefined {
+	return /^entwurf_v2 meta-mailbox → enqueued \(([^()/]+\.msg)\)$/.exec(receipt.trim())?.[1];
+}
+
+export interface HeldCaptureFacts {
+	hostGid: string;
+	hostPid: number;
+	hostStartKey: string;
+	/** The ENQUEUE receipt's file name. */
+	enqueued: string | undefined;
+	/** The host's mailbox directory listing at the hold. */
+	listing: string[];
+	/** Bytes of `<enqueued>.delivered` at the hold, or null when absent. */
+	deliveredBody: string | null;
+	sentMessage: string;
+	signalPresent: boolean;
+	/** The host's raw receiver marker at the hold, or null when absent. */
+	receiverMarker: Record<string, unknown> | null;
+	/** The newest user message text of the held request #1. */
+	request1UserText: string;
+	/** The tool names request #1 offers. */
+	request1Tools: string[];
+}
+
+/**
+ * Everything that must hold while response #1 is withheld: the sender's ENQUEUE named a file, the
+ * host's doorbell has already stamped exactly that file `.delivered` (a wake attempt, not a read), its
+ * bytes carry the sent message, the signal and the host-owned receiver marker are in place, and the
+ * request that the root admission started is the announce — garden and tool named, body absent.
+ */
+export function heldCaptureVerdict(f: HeldCaptureFacts): Verdict {
+	const reasons: string[] = [];
+	if (f.enqueued === undefined) return verdict(["the sender's receipt is not a meta-mailbox ENQUEUE"]);
+	if (f.listing.includes(f.enqueued)) reasons.push(`${f.enqueued} is still a fresh .msg — no doorbell stamped it`);
+	if (!f.listing.includes(`${f.enqueued}.delivered`)) reasons.push(`${f.enqueued}.delivered is absent`);
+	if (f.listing.some((n) => n.endsWith(".read"))) reasons.push("a body was already archived before the hold");
+	if (f.deliveredBody === null || !f.deliveredBody.includes(f.sentMessage)) {
+		reasons.push("the delivered bytes do not carry the sent message");
+	}
+	if (!f.signalPresent) reasons.push("inbox.signal is absent");
+	const m = f.receiverMarker;
+	if (m === null) reasons.push("the host's receiver marker is absent");
+	else {
+		if (m.gardenId !== f.hostGid) reasons.push("the receiver marker names another garden");
+		if (m.ownerPid !== f.hostPid) reasons.push("the receiver marker is not owned by the spawned host");
+		if (m.ownerStartKey !== `linux:${f.hostStartKey}`)
+			reasons.push("the receiver marker's start key is not the host's");
+		if (m.ownerKind !== "pi-durable-host") reasons.push("the receiver marker is not pi-durable-host");
+	}
+	const text = f.request1UserText;
+	if (!text.startsWith("[entwurf inbox] 1 unread mailbox message available for garden ")) {
+		reasons.push("request #1's user input is not a one-message doorbell notice");
+	}
+	if (!text.includes(f.hostGid) || !text.includes("entwurf_inbox_read")) {
+		reasons.push("the notice does not name the host's garden and entwurf_inbox_read");
+	}
+	if (text.includes(f.sentMessage)) reasons.push("the notice carries the body");
+	if (!f.request1Tools.includes("entwurf_inbox_read")) reasons.push("request #1 does not offer entwurf_inbox_read");
+	return verdict(reasons);
+}
+
+/**
+ * How upstream writes the indexed `submissions.request_id` column: `JSON.stringify` of the request id
+ * (`[read packages/durable/src/storage/sqlite/storage.ts:64 encodeIndexedString, :762 insert, :442
+ * lookup]` @cd32f77), the same encoding R1 measured on `tasks.kind`. The record JSON keeps it raw.
+ */
+export const encodedRequestIdColumn = (requestId: string): string => JSON.stringify(requestId);
+
+export interface SubmissionFacts {
+	/** The `submissions` row whose parsed record carries the request id, with that record, or null. */
+	row: { id?: unknown; conversation_id?: unknown; request_id?: unknown; status?: unknown } | null;
+	record: {
+		id?: unknown;
+		conversationId?: unknown;
+		requestId?: unknown;
+		type?: unknown;
+		status?: unknown;
+		entry?: unknown;
+	} | null;
+	/** Rows whose parsed record carries the request id, over the whole table. */
+	rowsForRequest: number;
+	/** Rows whose indexed `request_id` column holds the request id as upstream encodes it. */
+	rowsForColumn: number;
+	/** The entry the record names, parsed, or null. */
+	entry: { kind?: unknown; model?: { role?: unknown; content?: unknown }[] } | null;
+}
+
+/**
+ * The copied database holds exactly one input submission for the doorbell's request id — found both
+ * by its record and by its indexed column — on the root conversation, whose row id AND record id are
+ * the id the receiver reported, placed as the root user entry carrying the notice and answered. A row
+ * still queued is reported as queued — never read as placed.
+ */
+export function submissionVerdict(
+	f: SubmissionFacts,
+	expect: { submissionId: unknown; requestId: string; notice: string },
+): Verdict {
+	const reasons: string[] = [];
+	if (f.rowsForRequest !== 1) reasons.push(`${f.rowsForRequest} records carry the request id`);
+	if (f.rowsForColumn !== 1) reasons.push(`${f.rowsForColumn} rows hold the encoded request id in the indexed column`);
+	if (f.row === null || f.record === null) return verdict([...reasons, "no submission row for the request id"]);
+	if (f.row.id !== expect.submissionId) reasons.push("the row id is not the reported submission id");
+	if (f.record.id === undefined) reasons.push("the record carries no id");
+	else if (f.record.id !== f.row.id || f.record.id !== expect.submissionId) {
+		reasons.push("the record id is not the row id and the reported submission id");
+	}
+	if (f.row.conversation_id !== 1 || f.record.conversationId !== 1)
+		reasons.push("the row is not on the root conversation");
+	if (f.row.request_id !== encodedRequestIdColumn(expect.requestId) || f.record.requestId !== expect.requestId) {
+		reasons.push("the row's request id is not the doorbell's");
+	}
+	if (f.record.type !== "input") reasons.push("the submission is not an input");
+	if (f.row.status !== f.record.status) reasons.push("the row status and the record status disagree");
+	if (f.record.status === "queued") reasons.push("the submission is still queued, not placed");
+	else if (f.record.status !== "done") reasons.push(`the submission is ${String(f.record.status)}, not done`);
+	const message = f.entry?.model?.[0];
+	if (f.entry === null) reasons.push("the record names no readable entry");
+	else {
+		if (f.entry.kind !== "pi.user") reasons.push("the placed entry is not pi.user");
+		if (message?.role !== "user" || message.content !== expect.notice) {
+			reasons.push("the placed entry's content is not the notice the model received");
+		}
+	}
+	return verdict(reasons);
+}

package/scripts/lib/qualification-receipt.ts

@@ -38,12 +38,12 @@ import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import {
-	createRepoSnapshot,
 	type MutantSpec,
 	originHead,
 	originWorkSurfaceSha,
 	qualifyMutants,
 	reportPassed,
+	withOwnSnapshot,
 } from "./mutation-qualify.ts";
 
 export const RECEIPT_SCHEMA = "entwurf.qualification-group-receipt/v0";
@@ -471,16 +471,12 @@ export async function runGroupReceipt(
 	const declaredInputs = declaredInputPaths(repoDir, groupSpecs, gate);
 	const inputsBefore = fileFingerprints(repoDir, declaredInputs);
 
-	const snap = createRepoSnapshot(repoDir, opts.tmpRoot);
-	opts.log(
-		`[gate-qualification --group] PARTIAL: ${groupSpecs.length}/${selected.length} mutants of ${groupKey}; snapshot ${snap.repoDir} (origin HEAD ${headBefore.slice(0, 12)})`,
-	);
-	let report: Awaited<ReturnType<typeof qualifyMutants>>;
-	try {
-		report = await qualifyMutants(snap, groupSpecs, opts.log);
-	} finally {
-		fs.rmSync(snap.baseDir, { recursive: true, force: true });
-	}
+	const report = await withOwnSnapshot(repoDir, opts.tmpRoot, (snap) => {
+		opts.log(
+			`[gate-qualification --group] PARTIAL: ${groupSpecs.length}/${selected.length} mutants of ${groupKey}; snapshot ${snap.repoDir} (origin HEAD ${headBefore.slice(0, 12)})`,
+		);
+		return qualifyMutants(snap, groupSpecs, opts.log);
+	});
 
 	const headAfter = originHead(repoDir);
 	const workSurfaceAfter = originWorkSurfaceSha(repoDir);

package/scripts/mutants/control-send-receipt.json

@@ -181,7 +181,7 @@
 			"claim": "PI-CORE-PIN-TRACKS-FLOOR",
 			"title": "the queue oracle's pi-agent-core pin drifts off the floor the rest of the pi runtime is pinned to, so the oracle keeps answering honestly — about a pi nobody in this repo runs",
 			"subject": "package.json",
-			"find": ["\"@earendil-works/pi-agent-core\": \"1.0.0\","],
+			"find": ["\"@earendil-works/pi-agent-core\": \"1.0.4\","],
 			"replace": ["\"@earendil-works/pi-agent-core\": \"0.87.1\","],
 			"gate": ["bash", "run.sh", "check-dep-versions"],
 			"timeoutSeconds": 300,

package/scripts/mutants/copilot-birth.json

@@ -133,10 +133,10 @@
 			"title": "closing the reader half leaves the writer talking to nobody — the hook writes a copilot marker, the bridge never looks in that directory, and the citizen's sends are refused as anonymous (the #46 shape, which is why writer and reader open in one change)",
 			"subject": "pi-extensions/lib/meta-sender-identity.ts",
 			"find": [
-				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\"claude-code\", \"antigravity\", \"copilot\", \"omp\"];"
+				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\n\t\"claude-code\",\n\t\"antigravity\",\n\t\"copilot\",\n\t\"omp\",\n\t\"pi-durable\",\n];"
 			],
 			"replace": [
-				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\"claude-code\", \"antigravity\", \"omp\"];"
+				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\n\t\"claude-code\",\n\t\"antigravity\",\n\t\"omp\",\n\t\"pi-durable\",\n];"
 			],
 			"gate": ["bash", "run.sh", "check-copilot-birth-hook"],
 			"timeoutSeconds": 300,

package/scripts/mutants/gate-qualification.json

@@ -82,6 +82,19 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:QUALIFY-BUILD-GROUP-CONSISTENT]",
 			"signatureSource": "scripts/check-gate-qualification.ts"
+		},
+		{
+			"claim": "QUALIFY-PRIOR-RUN-EVIDENCE-KEPT",
+			"title": "the snapshot seam lists its tmp root and removes every snapshot-prefixed root before making its own — the retired ambient sweep is back, and a prior run's evidence is deleted by the qualifier instead of left to the operator (scoped to an explicit tmpRoot, which only self-test fixtures pass, so the defect never reaches the real tmp dir)",
+			"subject": "scripts/lib/mutation-qualify.ts",
+			"find": ["\tconst snap = createRepoSnapshot(originDir, tmpRoot);"],
+			"replace": [
+				"\tif (tmpRoot !== undefined) for (const name of fs.readdirSync(tmpRoot)) if (name.startsWith(SNAPSHOT_PREFIX)) fs.rmSync(path.join(tmpRoot, name), { recursive: true, force: true });\n\tconst snap = createRepoSnapshot(originDir, tmpRoot);"
+			],
+			"gate": ["bash", "run.sh", "check-gate-manifests"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:QUALIFY-PRIOR-RUN-EVIDENCE-KEPT]",
+			"signatureSource": "scripts/check-gate-qualification.ts"
 		}
 	]
 }

package/scripts/mutants/meta-hook-session-switch.json

@@ -182,9 +182,11 @@
 			"claim": "MHSS-JOIN-SCOPE-OWNERKIND",
 			"title": "admitting copilot-extension into the sender-marker join makes every Copilot citizen permanently mailbox-undeliverable: its watch owner is a forked child whose pid never carries a sender marker, so the join can only ever answer no",
 			"subject": "pi-extensions/lib/entwurf-deliverability.ts",
-			"find": ["export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\"];"],
+			"find": [
+				"export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\", \"pi-durable-host\"];"
+			],
 			"replace": [
-				"export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\", \"copilot-extension\"];"
+				"export const SENDER_JOINED_RECEIVER_OWNER_KINDS: readonly string[] = [\"claude-code-cli\", \"pi-durable-host\", \"copilot-extension\"];"
 			],
 			"gate": ["bash", "run.sh", "check-meta-hook-session-switch"],
 			"timeoutSeconds": 300,

package/scripts/mutants/mux-fresh-call.json

@@ -151,7 +151,7 @@
 			"title": "MCP drops the required model field from fresh-call while the composition still expects one",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\tmodel: z\n\t\t\t.string()\n\t\t\t.min(1)\n\t\t\t.max(200)\n\t\t\t// The `\\[` below is USELESS TO JS AND LOAD-BEARING TO THE HOST. zod emits this source\n\t\t\t// text verbatim as the JSON Schema `pattern`, and the host's tool-schema validator is a\n\t\t\t// Rust regex engine that rejects an unescaped `[` inside a character class as \"unclosed\n\t\t\t// character class\" — a 400 on tools/list that stops EVERY Claude session from opening\n\t\t\t// (7-M-fix). Biome's safe fix removes it; do not accept that fix. The suppression must\n\t\t\t// stay on the line DIRECTLY above the expression, or it attaches to nothing and reads\n\t\t\t// as an unused suppression while the escape goes back to being fixable.\n\t\t\t// biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above\n\t\t\t.regex(/^[A-Za-z0-9][A-Za-z0-9._/:\\[\\]-]*$/)\n\t\t\t.describe(\n\t\t\t\t\"Required runtime model: canonical provider/model for pi, a Claude Code model id/alias, or a Copilot/OMP/Codex model name.\",\n\t\t\t),\n"
+				"\t\tmodel: z\n\t\t\t.string()\n\t\t\t.min(1)\n\t\t\t.max(200)\n\t\t\t// The `\\[` below is USELESS TO JS AND LOAD-BEARING TO THE HOST. zod emits this source\n\t\t\t// text verbatim as the JSON Schema `pattern`, and the host's tool-schema validator is a\n\t\t\t// Rust regex engine that rejects an unescaped `[` inside a character class as \"unclosed\n\t\t\t// character class\" — a 400 on tools/list that stops EVERY Claude session from opening\n\t\t\t// (7-M-fix). Biome's safe fix removes it; do not accept that fix. The suppression must\n\t\t\t// stay on the line DIRECTLY above the expression, or it attaches to nothing and reads\n\t\t\t// as an unused suppression while the escape goes back to being fixable.\n\t\t\t// biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above\n\t\t\t.regex(/^[A-Za-z0-9][A-Za-z0-9._/:\\[\\]-]*$/)\n\t\t\t.describe(\n\t\t\t\t\"Required runtime model: canonical provider/model for pi, provider/<exact catalog model id> for pi-durable, a Claude Code model id/alias, or a Copilot/OMP/Codex model name.\",\n\t\t\t),\n"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -323,8 +323,8 @@
 			"claim": "FRESHCALL-BACKEND-SET-SURFACE-PARITY",
 			"title": "a backend the composition can open is missing from the MCP surface enum — the capability exists and no external host can reach it",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
-			"find": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\", \"omp\", \"codex\"])"],
-			"replace": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\", \"omp\"])"],
+			"find": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\", \"omp\", \"codex\", \"pi-durable\"])"],
+			"replace": ["\t\t\t.enum([\"pi\", \"claude-code\", \"copilot\", \"omp\", \"pi-durable\"])"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:FRESHCALL-BACKEND-SET-SURFACE-PARITY]",
@@ -700,6 +700,72 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:FRESHCALL-CALLBACK-ENV]",
 			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PI-DURABLE-ARGV",
+			"title": "pi-durable loses its explicit task-wide width, so the packaged bootstrap refuses a launch the composition said it built",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
+			"find": ["\t\t\t\t\"--width\",\n\t\t\t\t\"task-wide\",\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-PI-DURABLE-ARGV]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PI-DURABLE-PREFLIGHT-PREMUTATION",
+			"title": "the pi-durable preflight (model, framed input cap, carrier, units) is skipped, so a refusal it owns is discovered only after a window was placed",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\tif (params.backend === \"pi-durable\") {\n"],
+			"replace": ["\tif (false) {\n"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-PI-DURABLE-PREFLIGHT-PREMUTATION]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PI-DURABLE-MANAGED-RUNTIME",
+			"title": "pi-durable opens the bare app instead of the managed `entwurf pi-durable`, so nothing verifies the carrier and its SDK set before its resolver runs",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\"pi-durable\": \"entwurf\","],
+			"replace": ["\t\"pi-durable\": \"pi\","],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-PI-DURABLE-MANAGED-RUNTIME]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-PI-DURABLE-CALLBACK-DIALECT",
+			"title": "pi-durable is told the composed MCP callback name, which the durable contact never registers — the contact offers the bridge verbs under their bare names",
+			"subject": "pi-extensions/lib/fresh-call-composition.ts",
+			"find": ["\t\"pi-durable\": \"entwurf_callback\","],
+			"replace": ["\t\"pi-durable\": \"mcp__entwurf-bridge__entwurf_callback\","],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-PI-DURABLE-CALLBACK-DIALECT]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
+		},
+		{
+			"claim": "PD-FRESH-LIVE-FOREIGN-SENDER-REFUSED",
+			"title": "the pi-durable LIVE gate's Pi-side oracle drops its expected-sender check, so the exact payload relayed by any other citizen counts as pd's delivery",
+			"subject": "scripts/lib/pi-durable-fresh-live-receipts.ts",
+			"find": ["\t\tif (senders.length === 1 && senders[0] === expectedSender) hits.push({ row, index });"],
+			"replace": ["\t\tif (senders.length === 1) hits.push({ row, index });"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PD-FRESH-LIVE-FOREIGN-SENDER-REFUSED]",
+			"signatureSource": "test/pi-durable-fresh-live-receipts.test.ts"
+		},
+		{
+			"claim": "PIIMPORT-CARRIER-FENCE",
+			"title": "the carrier fence stops naming bare imports, so a pi-coding-agent specifier or an undeclared package in an emitted carrier file passes the floor",
+			"subject": "run.sh",
+			"find": ["if (name === \"@earendil-works/pi-coding-agent\" || !declared.has(name)) console.log("],
+			"replace": ["if (false) console.log("],
+			"gate": ["bash", "run.sh", "check-pi-import-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PIIMPORT-CARRIER-FENCE]",
+			"signatureSource": "run.sh"
 		}
 	]
 }

package/scripts/mutants/omp-birth.json

@@ -66,10 +66,10 @@
 			"title": "a backend whose hook writes a marker but is absent from the reader list is INVISIBLE — the bridge holds the owner pid, never looks in that directory, and every send is refused as anonymous for a reason nothing logs (the #46 defect)",
 			"subject": "pi-extensions/lib/meta-sender-identity.ts",
 			"find": [
-				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\"claude-code\", \"antigravity\", \"copilot\", \"omp\"];"
+				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\n\t\"claude-code\",\n\t\"antigravity\",\n\t\"copilot\",\n\t\"omp\",\n\t\"pi-durable\",\n];"
 			],
 			"replace": [
-				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\"claude-code\", \"antigravity\", \"copilot\"];"
+				"export const META_SENDER_BACKENDS: readonly MetaBackend[] = [\n\t\"claude-code\",\n\t\"antigravity\",\n\t\"copilot\",\n\t\"pi-durable\",\n];"
 			],
 			"gate": ["bash", "run.sh", "check-omp-birth-hook"],
 			"timeoutSeconds": 300,

package/scripts/mutants/omp-fresh.json

@@ -7,9 +7,11 @@
 			"title": "a post-#82 harness admitted as a full D6 citizen while entwurf_fresh_call cannot open it — the exact state the Bundle A+B candidate shipped in, where every gate was green and only prose said the backend was unsupported. This is the defect the whole gate exists for: without it, an `unsupported` note reads as a partial-release permit",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
 			"find": [
-				"export const FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"copilot\", \"omp\", \"codex\"] as const;"
+				"export const FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"copilot\", \"omp\", \"codex\", \"pi-durable\"] as const;"
+			],
+			"replace": [
+				"export const FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"copilot\", \"codex\", \"pi-durable\"] as const;"
 			],
-			"replace": ["export const FRESH_CALL_BACKENDS = [\"pi\", \"claude-code\", \"copilot\", \"codex\"] as const;"],
 			"gate": ["bash", "run.sh", "check-harness-admission-parity"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:ADMISSION-FRESH-PARITY]",
@@ -119,8 +121,8 @@
 			"claim": "FRESHCALL-BACKEND-SET-SURFACE-PARITY-SKILL",
 			"title": "a backend added to the composition and both schema surfaces but not to the operator skill — the third public surface step 9 names, and the one that had no gate at all. The skill is what an operator reads to decide what can be opened, so a stale list makes the backend unreachable in practice exactly the way a missing enum value makes it unreachable in schema",
 			"subject": ".claude/skills/entwurf-dev/SKILL.md",
-			"find": ["backend는 정확히 `pi | claude-code | copilot | omp | codex`이고"],
-			"replace": ["backend는 정확히 `pi | claude-code | copilot | omp`이고"],
+			"find": ["backend는 정확히 `pi | claude-code | copilot | omp | codex | pi-durable`이고"],
+			"replace": ["backend는 정확히 `pi | claude-code | copilot | omp | pi-durable`이고"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:FRESHCALL-BACKEND-SET-SURFACE-PARITY-SKILL]",

package/scripts/mutants/pack-install.json

@@ -6,7 +6,7 @@
 			"claim": "PACK-INSTALL-PIN-MATCHER-BOUNDED",
 			"title": "the pin-leak matcher loses its version boundary and blesses substring lookalikes — @0.85.10 reads as the pinned 0.85.1 and the gate announces a verified tree it never verified (independent review, 2026-08-25)",
 			"subject": "run.sh",
-			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.0\\.0(_|$)' || true"],
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.0\\.4(_|$)' || true"],
 			"replace": ["  grep '^@earendil-works+' | grep -v '@0\\.87\\.1' || true"],
 			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
 			"timeoutSeconds": 120,
@@ -17,8 +17,8 @@
 			"claim": "PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE",
 			"title": "the pin-leak matcher narrows back to the pi-* families and goes blind to a non-pi member of the same runtime closure — @earendil-works/chord (new in pi 0.85.0, a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol) floats unpinned while the gate prints a verified pin (measured 2026-09-06 on a real 0.85.1 install tree)",
 			"subject": "run.sh",
-			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.0\\.0(_|$)' || true"],
-			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@1\\.0\\.0(_|$)' || true"],
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.0\\.4(_|$)' || true"],
+			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@1\\.0\\.4(_|$)' || true"],
 			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE]",