@junghanacs/entwurf 0.31.0 → 0.32.0

package/scripts/mutants/pi-durable.json

@@ -2,81 +2,6 @@
 	"schemaVersion": 1,
 	"lane": "pi-durable",
 	"mutants": [
-		{
-			"claim": "PI-DURABLE-RUNTIME-UNTRACKED-DRIFT",
-			"title": "a non-ignored untracked file in the operator runtime no longer counts as pin drift",
-			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
-			"find": [" || facts.untracked !== \"\" || "],
-			"replace": [" || "],
-			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
-			"timeoutSeconds": 300,
-			"signature": "[QK:PI-DURABLE-RUNTIME-UNTRACKED-DRIFT]",
-			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
-			"build": {
-				"argv": ["bash", "scripts/build-bridge.sh"],
-				"output": "mcp/entwurf-bridge/dist"
-			}
-		},
-		{
-			"claim": "PI-DURABLE-RUNTIME-MODELDATA-DRIFT",
-			"title": "model data that is not the pinned bytes is no longer its own refusal",
-			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
-			"find": ["\t\treturn \"pi-durable-runtime-modeldata-drift\";\n"],
-			"replace": ["\t\treturn null;\n"],
-			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
-			"timeoutSeconds": 300,
-			"signature": "[QK:PI-DURABLE-RUNTIME-MODELDATA-DRIFT]",
-			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
-			"build": {
-				"argv": ["bash", "scripts/build-bridge.sh"],
-				"output": "mcp/entwurf-bridge/dist"
-			}
-		},
-		{
-			"claim": "PI-DURABLE-RUNTIME-READ-ONLY",
-			"title": "verification runs git against the operator checkout's own index instead of a private copy, so a stale stat cache is rewritten",
-			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
-			"find": ["const onCopy = { ...base, GIT_INDEX_FILE: copy };"],
-			"replace": ["const onCopy = { ...base };"],
-			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
-			"timeoutSeconds": 300,
-			"signature": "[QK:PI-DURABLE-RUNTIME-READ-ONLY]",
-			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
-			"build": {
-				"argv": ["bash", "scripts/build-bridge.sh"],
-				"output": "mcp/entwurf-bridge/dist"
-			}
-		},
-		{
-			"claim": "PI-DURABLE-RUNTIME-LOCATOR-FIXED",
-			"title": "a relative XDG_DATA_HOME is honoured, so the runtime's one fixed place follows the caller's cwd",
-			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
-			"find": [" && xdg.length > 0 && path.isAbsolute(xdg)) {"],
-			"replace": [" && xdg.length > 0) {"],
-			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
-			"timeoutSeconds": 300,
-			"signature": "[QK:PI-DURABLE-RUNTIME-LOCATOR-FIXED]",
-			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
-			"build": {
-				"argv": ["bash", "scripts/build-bridge.sh"],
-				"output": "mcp/entwurf-bridge/dist"
-			}
-		},
-		{
-			"claim": "PI-DURABLE-RUNTIME-STAGED-DRIFT",
-			"title": "the index == HEAD term leaves the verdict, so a staged change behind an equal worktree diff verifies as the pin",
-			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
-			"find": ["\tif (!facts.indexMatchesHead) return \"pi-durable-runtime-pin-drift\";\n"],
-			"replace": [""],
-			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
-			"timeoutSeconds": 300,
-			"signature": "[QK:PI-DURABLE-RUNTIME-STAGED-DRIFT]",
-			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
-			"build": {
-				"argv": ["bash", "scripts/build-bridge.sh"],
-				"output": "mcp/entwurf-bridge/dist"
-			}
-		},
 		{
 			"claim": "PI-DURABLE-ENTRY-GUARD-FLOOR-SAFE",
 			"title": "the verifier's entry guard goes back to import.meta.main, which the floor's runner can misread as the process entry",
@@ -92,38 +17,6 @@
 				"output": "mcp/entwurf-bridge/dist"
 			}
 		},
-		{
-			"claim": "PI-DURABLE-RUNTIME-CONFIG-NEUTRAL",
-			"title": "the diff's blank-context spacing is left to the runtime's git configuration again, so a config can move the verdict",
-			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
-			"find": [
-				"[\"-c\", \"core.abbrev=8\", \"-c\", \"diff.suppressBlankEmpty=false\", \"diff\", ...PI_DURABLE_DIFF_SHAPE]"
-			],
-			"replace": ["[\"-c\", \"core.abbrev=8\", \"diff\", ...PI_DURABLE_DIFF_SHAPE]"],
-			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
-			"timeoutSeconds": 300,
-			"signature": "[QK:PI-DURABLE-RUNTIME-CONFIG-NEUTRAL]",
-			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
-			"build": {
-				"argv": ["bash", "scripts/build-bridge.sh"],
-				"output": "mcp/entwurf-bridge/dist"
-			}
-		},
-		{
-			"claim": "PI-DURABLE-RUNTIME-GATES-CONSUME-INDEX-TERM",
-			"title": "the contact gate's tracked-overlay assertion loses the index term, so it certifies a runtime tree it never saw",
-			"subject": "scripts/check-pi-durable-contact.ts",
-			"find": ["facts.gitAnswered && facts.indexMatchesHead && facts.diffEqualsPatch && facts.untracked"],
-			"replace": ["facts.gitAnswered && facts.diffEqualsPatch && facts.untracked"],
-			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
-			"timeoutSeconds": 300,
-			"signature": "[QK:PI-DURABLE-RUNTIME-GATES-CONSUME-INDEX-TERM]",
-			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
-			"build": {
-				"argv": ["bash", "scripts/build-bridge.sh"],
-				"output": "mcp/entwurf-bridge/dist"
-			}
-		},
 		{
 			"claim": "PI-DURABLE-PREFLIGHT-FOUR-UNITS",
 			"title": "the receive unit stops asking whether the compiled owner join admits the durable host, so a launch proceeds to a citizen nobody can deliver to",
@@ -160,9 +53,11 @@
 			"claim": "PI-DURABLE-BOOTSTRAP-ARGV-NO-BRIDGE-ENTRY",
 			"title": "the launch argv accepts --bridge-entry, so a caller can point the contact at a bridge outside this package",
 			"subject": "pi/pi-durable/bootstrap.mjs",
-			"find": ["const VALUE_FLAGS = [\"--provider\", \"--model\", \"--width\", \"--entwurf-bootstrap\"];"],
+			"find": [
+				"const VALUE_FLAGS = [\"--provider\", \"--model\", \"--width\", \"--entwurf-bootstrap\", \"--native-module\"];"
+			],
 			"replace": [
-				"const VALUE_FLAGS = [\"--bridge-entry\", \"--provider\", \"--model\", \"--width\", \"--entwurf-bootstrap\"];"
+				"const VALUE_FLAGS = [\"--bridge-entry\", \"--provider\", \"--model\", \"--width\", \"--entwurf-bootstrap\", \"--native-module\"];"
 			],
 			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
 			"timeoutSeconds": 300,
@@ -385,6 +280,444 @@
 				"argv": ["bash", "scripts/build-bridge.sh"],
 				"output": "mcp/entwurf-bridge/dist"
 			}
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-RELOCATION-TWO-RULES",
+			"title": "a carrier file's import of a sibling keeps its .ts specifier, so the installed carrier asks Node for a file that was never emitted",
+			"subject": "pi/pi-durable/carrier-relocation.mjs",
+			"find": ["return `./${name}`;"],
+			"replace": ["return spec;"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-RELOCATION-TWO-RULES]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-RELOCATION-REFUSES",
+			"title": "the emitter stops counting specifier openings against recognized statements, so a dynamic or single-quoted import escapes the relocation unrewritten",
+			"subject": "pi/pi-durable/carrier-relocation.mjs",
+			"find": ["if (begun !== statements) {"],
+			"replace": ["if (false) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-RELOCATION-REFUSES]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-RESOLVE-DECLARED",
+			"title": "the resolver maps a declared target one directory above the package's dist, so every carrier internal import binds a file the pin never named",
+			"subject": "pi/pi-durable/carrier-relocation.mjs",
+			"find": ["return pathToFileURL(file).href;"],
+			"replace": ["return pathToFileURL(path.join(dist(), \"..\", target)).href;"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-RESOLVE-DECLARED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-RESOLVE-REFUSES",
+			"title": "the resolver only asks that a parent be somewhere under the carrier directory, so an undeclared or nested file there may reach pi-coding-agent internals",
+			"subject": "pi/pi-durable/carrier-relocation.mjs",
+			"find": ["if (!files.includes(parent)) {"],
+			"replace": ["if (parent === \"\") {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-RESOLVE-REFUSES]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-HOST-ROOT",
+			"title": "the coding-agent root is taken from any package directory above the root export, so a different package named in that place becomes the dist the carrier binds",
+			"subject": "pi/pi-durable/carrier-relocation.mjs",
+			"find": ["if (name !== CODING_AGENT) {"],
+			"replace": ["if (false) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-HOST-ROOT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-PIN-MATCHES",
+			"title": "the pin records a digest the committed carrier file does not carry, so a carrier edited after emission would still be the declared one",
+			"subject": "pi/pi-durable/overlay/upstream-pin.json",
+			"find": ["\"sha256\": \"ca0ee10dc904a57d46bb33b37fcc4efe48dfa08b2f0d10e79e7bc22136871f0a\""],
+			"replace": ["\"sha256\": \"0000000000000000000000000000000000000000000000000000000000000000\""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-PIN-MATCHES]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-PIN-MALFORMED",
+			"title": "the carrier declaration no longer requires plain file names, so a pin naming ../escape.js is accepted and the resolver answers a path outside the carrier",
+			"subject": "pi/pi-durable/carrier-relocation.mjs",
+			"find": ["if (!names?.every(plain) || names.length === 0"],
+			"replace": ["if (!names || names.length === 0"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-PIN-MALFORMED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-EMIT-NO-REPLACE",
+			"title": "the emitter reads source objects without --no-replace-objects, so a refs/replace entry in the maintainer's repository stands in for a pinned file",
+			"subject": "scripts/emit-pi-durable-carrier.ts",
+			"find": ["return [\"--no-replace-objects\", \"-C\", source, ...args];"],
+			"replace": ["return [\"-C\", source, ...args];"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-EMIT-NO-REPLACE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-VERIFIED",
+			"title": "the verifier stops walking from each member to its own member dependencies, so only the carrier's direct edges are ever compared",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["\t\tif (name in pin.members && edge.at !== null) pending.push({ name, at: edge.at });\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-VERIFIED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-PACKAGE-INCOMPLETE",
+			"title": "a missing carrier resolver or relocation grammar is no longer an incomplete package, so the launcher prints a resolver path that does not exist",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["for (const at of [layout.resolver, layout.relocation]) {"],
+			"replace": ["for (const at of [] as string[]) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-PACKAGE-INCOMPLETE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-CARRIER-DRIFT",
+			"title": "a carrier file whose bytes are not the pinned ones verifies, so an edited app runs as the emitted one",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["else if (sha256(fs.readFileSync(at)) !== file.sha256) drifted.push("],
+			"replace": ["else if (false) drifted.push("],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-CARRIER-DRIFT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-SDK-ABSENT",
+			"title": "a declared package that resolves nothing is no longer named absent and reads as a version mismatch",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["if (absent !== undefined) return { reason: \"pi-durable-sdk-absent\", detail: edgeText(absent) };"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-SDK-ABSENT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-SDK-MISMATCH",
+			"title": "only the carrier's own edges are compared, so a member binding another version of a member through its nested copy verifies",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["const mismatch = facts.edges.find((e) => e.got !== e.want || e.name !== e.to);"],
+			"replace": [
+				"const mismatch = facts.edges.find((e) => e.from === \"carrier\" && (e.got !== e.want || e.name !== e.to));"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-SDK-MISMATCH]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-SHARED-COPY-PASSES",
+			"title": "a same-version copy shared from above the package is treated as absent, so an ordinary hoisted install of the pinned set is refused",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["\t\tconst edge = resolveEdge(\"carrier\", name, want, base);\n"],
+			"replace": [
+				"\t\tconst edge = ((e) => (e.at !== null && !e.at.startsWith(layout.root) ? { ...e, got: null } : e))(resolveEdge(\"carrier\", name, want, base));\n"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-SHARED-COPY-PASSES]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-READ-ONLY",
+			"title": "verifying leaves a marker in the installed carrier directory, so a read-only check mutates the package it certifies",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["\tconst facts = inspectPiDurableRuntime(layout);\n\tconst verdict = piDurableRuntimeVerdict(facts);"],
+			"replace": [
+				"\tfs.writeFileSync(path.join(layout.carrierDir, \".verified\"), \"\");\n\tconst facts = inspectPiDurableRuntime(layout);\n\tconst verdict = piDurableRuntimeVerdict(facts);"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-READ-ONLY]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-CHECKOUT-CARRIER",
+			"title": "a committed carrier file is edited by hand after emission, so the checkout ships app bytes its pin does not record",
+			"subject": "pi/pi-durable/carrier/sessions.js",
+			"find": ["import lockfile from \"proper-lockfile\";"],
+			"replace": ["import lockfile from \"proper-lockfile\"; // edited"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-CHECKOUT-CARRIER]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-CLI-EXITS",
+			"title": "a refused carrier exits 0 from resolve, so the launcher execs node under whatever the refusal printed",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["\treturn PI_DURABLE_RUNTIME_EXIT.refused;\n}"],
+			"replace": ["\treturn PI_DURABLE_RUNTIME_EXIT.verified;\n}"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-CLI-EXITS]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-REACHABLE-CLOSURE",
+			"title": "the walk stops at the members the carrier finds itself, so a same-version nested copy's own wrong-version dependency verifies",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["\t\t\tif (edge.at !== null) pending.push({ name: dep, at: edge.at });\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-REACHABLE-CLOSURE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-PACKAGE-IDENTITY",
+			"title": "an edge is judged by version alone, so a different package that happens to carry the pinned version stands in for the member",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": [" || e.name !== e.to);"],
+			"replace": [");"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-PACKAGE-IDENTITY]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RUNTIME-SHARED-WALKED-ONCE",
+			"title": "a copy reached by two paths is walked twice, so its edges are reported twice and a member cycle never ends",
+			"subject": "pi-extensions/lib/pi-durable-runtime.ts",
+			"find": ["\t\tif (walked.has(next.at)) continue;\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RUNTIME-SHARED-WALKED-ONCE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-GATE-OPERATOR-GUARD-INVARIANT",
+			"title": "the registration snapshot keeps names but not bytes, so an edit to an existing pi-durable record under the same filename passes the guard",
+			"subject": "scripts/lib/pi-durable-operator-guard.ts",
+			"find": ["if (fs.lstatSync(file).isFile() && keep(name)) out[name] = sha256(file);"],
+			"replace": ["if (fs.lstatSync(file).isFile() && keep(name)) out[name] = \"\";"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-GATE-OPERATOR-GUARD-INVARIANT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-GATE-OPERATOR-GUARD-WIRED",
+			"title": "the contact gate compares the operator snapshot with itself, so a run that changed the operator's registrations still passes its guard",
+			"subject": "scripts/check-pi-durable-contact.ts",
+			"find": ["operatorSnapshotUnchanged(operatorBefore, operatorPiDurableSnapshot(operatorAgent)),"],
+			"replace": ["operatorSnapshotUnchanged(operatorBefore, operatorBefore),"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-GATE-OPERATOR-GUARD-WIRED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-runtime.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-ABSENT-UNCHANGED",
+			"title": "the module phase runs without a --native-module, so a launch that names no module still tries to import one",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\tconst extensions = nativeModule === undefined ? [] : [await loadNativeModule(nativeModule)];"],
+			"replace": ["\tconst extensions = false ? [] : [await loadNativeModule(nativeModule)];"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-ABSENT-UNCHANGED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-PATH-REFUSED",
+			"title": "a relative --native-module is resolved against whatever directory the launch happens to be in",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\tif (!isAbsolute(value))"],
+			"replace": ["\tif (false)"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-PATH-REFUSED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-INIT-BEFORE-RUNTIME",
+			"title": "the module initializes after the TUI is imported, so its environment arrives after the SDK modules have evaluated",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": [
+				"\tconst extensions = nativeModule === undefined ? [] : [await loadNativeModule(nativeModule)];",
+				"\t// Loaded before anything opens, as upstream main.ts imports it statically: a TUI that cannot",
+				"\t// load opens no session, mints no citizen and leaves nothing to clean up.",
+				"\tconst { runDurableTui } = await loadTui();"
+			],
+			"replace": [
+				"\t// Loaded before anything opens, as upstream main.ts imports it statically: a TUI that cannot",
+				"\t// load opens no session, mints no citizen and leaves nothing to clean up.",
+				"\tconst { runDurableTui } = await loadTui();",
+				"\tconst extensions = nativeModule === undefined ? [] : [await loadNativeModule(nativeModule)];"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-INIT-BEFORE-RUNTIME]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-IMPORT-FAILED",
+			"title": "a module that throws during initialization is treated as no module and the app opens anyway",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\t} catch (error) {", "\t\tthrow Object.assign(", "\t\t\trefuse(\"native-module-import-failed\","],
+			"replace": [
+				"\t} catch (error) {",
+				"\t\treturn undefined;",
+				"\t\tthrow Object.assign(",
+				"\t\t\trefuse(\"native-module-import-failed\","
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-IMPORT-FAILED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-IDENTITY-GUARD",
+			"title": "the identity carriers are compared only after the module ran, so a change its initialization made is never seen",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\tconst changed = identityChanges(before, identitySnapshot());"],
+			"replace": ["\tconst changed = identityChanges(identitySnapshot(), identitySnapshot());"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-IDENTITY-GUARD]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-CWD-PINNED",
+			"title": "the app is opened wherever the process is at open time, not in the caller's directory fixed before the module ran",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\tconst citizen = await openDurableCitizen({ ...args, cwd, extensions, bridgeEntry, open, contact });"],
+			"replace": ["\tconst citizen = await openDurableCitizen({ ...args, extensions, bridgeEntry, open, contact });"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-CWD-PINNED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-EXPORT-NAME",
+			"title": "a module may name its extension entwurf, coding-tools, pi-prompt or subagent, and the native registry silently replaces that extension",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\tif (RESERVED_EXTENSION_NAMES.includes(extension.name)) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-EXPORT-NAME]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-EXTENSION-ORDER",
+			"title": "the module's extension is installed before the contact",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\t\t\textensions: [contact.extension, ...extensions],"],
+			"replace": ["\t\t\textensions: [...extensions, contact.extension],"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-EXTENSION-ORDER]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
 		}
 	]
 }

package/scripts/mutants/pi-floor.json

@@ -7,15 +7,37 @@
 			"title": "one row of the pnpm workspace closure is left on the previous floor while every other surface moved — the shape a version bump actually fails in. Nothing else reads that file, so the stranded row surfaces only at install time, in a different command, far from the change that stranded it",
 			"subject": "pnpm-workspace.yaml",
 			"find": [
-				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0 || 1.0.2'"
+				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0 || 1.0.2 || 1.0.4'"
 			],
 			"replace": [
-				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0'"
+				"  - '@earendil-works/pi-telemetry@0.85.0 || 0.85.1 || 0.86.0 || 0.87.0 || 0.87.1 || 0.99.1 || 0.99.2 || 1.0.0 || 1.0.2'"
 			],
 			"gate": ["bash", "run.sh", "check-dep-versions"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:PI-FLOOR-SINGLE-SOURCE]",
 			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PI-SDK-PRODUCTION-SET",
+			"title": "the durable library's production pin falls one patch behind the SDK set the pin declares, so the carrier would bind a pi-durable nobody verified it against",
+			"subject": "package.json",
+			"find": ["\"@earendil-works/pi-durable\": \"1.0.4\","],
+			"replace": ["\"@earendil-works/pi-durable\": \"1.0.3\","],
+			"gate": ["bash", "run.sh", "check-dep-versions"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-SDK-PRODUCTION-SET]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PI-SDK-NO-DUAL-DECLARATION",
+			"title": "an @earendil-works package returns as a dev dependency beside its production pin, one name in two dependency classes",
+			"subject": "package.json",
+			"find": ["\"@biomejs/biome\": \"^2.4.13\","],
+			"replace": ["\"@biomejs/biome\": \"^2.4.13\",\n\t\t\"@earendil-works/pi-ai\": \"1.0.4\","],
+			"gate": ["bash", "run.sh", "check-dep-versions"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-SDK-NO-DUAL-DECLARATION]",
+			"signatureSource": "run.sh"
 		}
 	]
 }

package/scripts/pi-durable-contact-host.mjs

@@ -1,7 +1,7 @@
-// G-contact host half (#129 L-identity). Runs AS the durable host, under the pinned overlay
-// checkout's source resolver, and is spawned only by scripts/check-pi-durable-contact.ts:
+// G-contact host half (#129 L-identity). Runs AS the durable host, under this checkout's pi-durable
+// carrier resolver (#130), and is spawned only by scripts/check-pi-durable-contact.ts:
 //
-//   node --import <checkout>/packages/coding-agent/src/experimental/source-resolver.ts \
+//   node --import <checkout>/pi/pi-durable/carrier-resolver.mjs \
 //        scripts/pi-durable-contact-host.mjs <bridge entry> new|continue \
 //        [<sessions dir> <senders dir> <mailbox dir> <receivers dir>]
 //

package/scripts/pi-durable-receive-host.mjs

@@ -1,7 +1,7 @@
-// G-receive host half (#129 L-receive). Runs AS the durable host, under the pinned overlay checkout's
-// source resolver, and is spawned only by scripts/check-pi-durable-receive.ts:
+// G-receive host half (#129 L-receive). Runs AS the durable host, under this checkout's pi-durable
+// carrier resolver (#130), and is spawned only by scripts/check-pi-durable-receive.ts:
 //
-//   node --import <checkout>/packages/coding-agent/src/experimental/source-resolver.ts \
+//   node --import <checkout>/pi/pi-durable/carrier-resolver.mjs \
 //        scripts/pi-durable-receive-host.mjs <bridge entry>
 //
 // It opens the durable app through the production bootstrap composition — which arms the contact's