@junghanacs/entwurf 0.34.2 → 0.35.1

package/run.sh

@@ -2,10 +2,10 @@
 #
 # Model id convention (see AGENTS.md Hard Rule #1):
 #   - User-facing examples use the qualified form `entwurf/<backend-model>`
-#     (e.g. `entwurf/claude-sonnet-5`); the prefix routes to this provider
+#     (e.g. `entwurf/claude-sonnet-5-5`); the prefix routes to this provider
 #     so `--provider` is redundant and is dropped in docs.
 #   - Smoke helpers that feed `ensureBridgeSession({modelId})` directly (cancel,
-#     model-switch) pass BARE backend ids (`claude-sonnet-5`, `gpt-5.4`)
+#     model-switch) pass BARE backend ids (`claude-sonnet-5-5`, `gpt-5.4`)
 #     because the bridge library contract is bare. Smoke helpers that invoke pi
 #     via the CLI still pin `--provider entwurf` and can accept either
 #     bare or qualified model, but we keep bare here to match the bridge-level
@@ -32,7 +32,7 @@ TARGET_PROJECT_DIR=${2:-$PROJECT_DIR_DEFAULT}
 # and install path against the same scope for traceability.
 PACKAGE_NAME="@junghanacs/entwurf"
 # Runtime provider id — DO NOT change. Embedded in model strings
-# (`entwurf/claude-sonnet-5`), settings keys (`entwurfProvider`),
+# (`entwurf/claude-sonnet-5-5`), settings keys (`entwurfProvider`),
 # log prefixes (`[entwurf:bootstrap]`), and the `--provider entwurf`
 # CLI surface. Renaming this would break every consumer transcript and every
 # saved session anchor.
@@ -116,9 +116,55 @@ run_vitest() {
   (cd "$REPO_DIR" && "$bin" run "$@")
 }
 
+# A source-only UI over the existing owned developer-return procedure. No second
+# installer, npm acquisition, automatic mode switch or ownership writer lives here.
+developer_menu() {
+  [ "$#" -eq 0 ] || { echo 'usage: ./run.sh menu' >&2; return 2; }
+  if [ ! -d "$REPO_DIR/.git" ] || [ ! -f "$REPO_DIR/plugins/herdr/use-dev-checkout.sh" ]; then
+    echo '[menu] developer-checkout-source-only — run ./run.sh menu from the prepared source checkout, not the npm installation.' >&2
+    return 1
+  fi
+  if [ ! -t 0 ]; then
+    echo '[menu] menu-tty-required — interactive stdin is required; nothing was changed.' >&2
+    return 2
+  fi
+  local choice confirm
+  printf '\nHerdr — npm installation check → developer board (local checkout)\n'
+  printf 'Checkout: %s\n' "$REPO_DIR"
+  printf '  1) Readiness check — read-only (not a full certificate of installation prerequisites)\n'
+  printf '  2) Switch to the developer board — Pi / Claude Code / Herdr local link\n'
+  printf '  0) Quit — nothing is changed\n'
+  if ! IFS= read -r -p 'Choose [0/1/2]: ' choice; then
+    echo '[menu] menu-input-closed — nothing was changed.' >&2
+    return 2
+  fi
+  case "$choice" in
+    0) return 0 ;;
+    1) bash "$REPO_DIR/plugins/herdr/use-dev-checkout.sh" --check ;;
+    2)
+      # Show the real owner's readiness first. Busy sessions or bad ownership
+      # stop here; confirmation grants no authority to bypass those guards.
+      bash "$REPO_DIR/plugins/herdr/use-dev-checkout.sh" --check || return $?
+      printf '\nClose the affected sessions yourself, and start no new session while switching.\n'
+      printf 'The currently owned installation is deactivated, then this checkout is linked. There is no automatic recovery or retry.\n'
+      if ! IFS= read -r -p 'Type DEV to switch (anything else cancels): ' confirm; then
+        echo '[menu] menu-input-closed — apply was not called.' >&2
+        return 2
+      fi
+      if [ "$confirm" != DEV ]; then
+        echo '[menu] menu-cancelled — installation wiring is unchanged.'
+        return 0
+      fi
+      bash "$REPO_DIR/plugins/herdr/use-dev-checkout.sh" --apply
+      ;;
+    *) echo '[menu] invalid-menu-choice — choose 0, 1 or 2; nothing was changed.' >&2; return 2 ;;
+  esac
+}
+
 usage() {
   cat <<'EOF'
 Usage:
+  ./run.sh menu                       # source-only Herdr developer board: read-only readiness check or explicitly confirmed return to checkout wiring; never closes sessions or acquires npm artifacts
   ./run.sh setup [project-dir]        # ONE presence-driven composition (#86): per-component PASS/SKIP/FAIL for pi/claude/agy/copilot/omp/codex + stable dev bins + v2 install smoke. Codex birth/MCP/status-line atoms are composed at user scope; setup stays non-green until the operator trusts the birth declaration once in visible Codex. Absent harness = zero-state SKIP, detected-incomplete = named FAIL + nonzero exit. Never installs a harness, starts a daemon, touches credentials, or writes the vendor trust receipt
   ./run.sh release-gate [project-dir] [--cut] [--allow-skip-gemini]  # SINGLE release gate: full static (pnpm run check:full) + the v2-native live gates (v2 matrix-live, check-bridge, doctor-pi-provider, RGG) + the ACP plugin acceptance floor (12 LIVE smokes: socket-citizen/raw-turn/overlay/provider/session-reuse/carrier-augment/memory-containment/rgg/mcp/skill/bundled-mcp/v2-send) + the one surviving axis the aggregate used to omit silently (claude-native-resume; Cortex stays a documented on-demand direct call) + the cross-harness delivery chain (smoke-entwurf-chain-live) + the Codex Pi -> visible Codex -> visible Pi receipt chain (smoke-codex-fresh-live; initial Pi and the Codex it opens in one session S, explicit operator-owned app-server PID in a DIFFERENT session — that separation is the lane B claim). TWO-TIER summary: MUST (release-blocking, owns the exit code — "green" applies here) + BEHAVIOR (advisory, non-blocking: RGG positives model-in-loop turn). STEP OUTCOME protocol: every step is INVOKED and reports its own PASS / SKIP (exit 97, a prerequisite it does not have) / FAIL — a skip is never counted as a pass. Without --cut this is the unattended diagnostic (SKIPs reported, exit 0). WITH --cut it is read as release acceptance and ANY MUST SKIP is red, which is what makes "a CUT needs LIVE=1, SKIP=0" executable instead of prose. --allow-skip-gemini accepted-but-ignored (back-compat). final cut authorization is GLG's.
   ./run.sh check-bridge               # entwurf-bridge direct MCP smoke + protocol/negative-path test.sh (live substrate = v2 live smokes)
@@ -134,6 +180,7 @@ Usage:
   ./run.sh check-omp-birth-hook       # #87 gate: drives the real OMP assembler into a temp dir, imports the ASSEMBLED index.ts into a MOCK omp host and fires session_start/session_switch. tui mints one backend:"omp" record + a sender marker keyed to the host's OWN pid (the one-process join) + the garden id on the status line; print/rpc/json mint NOTHING (hasUI is true on the rpc rows, as in the vendor); switch attaches on the same native id and mints the replacement on a new one; the CERTIFIED receiver reader still finds no marker. Also the four-root joint binding: extension and omp-labeled bridge child resolve the same sessions/mailbox/senders/receivers bundle against test-built literals (never the production resolver as its own oracle), under a poisoned PI_CODING_AGENT_DIR and under four distinct ENTWURF_META_* overrides; the override grammar is absolute-or-~ and both halves plus the doctor refuse anything else by name; and a drifted provenance label selects no root policy at all. Hermetic; no omp, no model turn
   ./run.sh check-pi-durable-contact   # #129 L-identity gate, CHECKOUT-ONLY (an installed package refuses it in run_ts). Opens the REAL durable app from THIS checkout's verified carrier (pi/pi-durable/carrier/ under its resolver, against the checkout's pinned pi SDK set — refused by name first) with the pi-durable contact, births the citizen and runs its tools adapter-direct through a privately emitted branch bridge (ENTWURF_PI_DURABLE_BRIDGE_ENTRY; its registry must match this checkout). Matrix roots {default, explicit} x {fresh, --continue}: one record keyed by the durable session dir, sender marker on the spawned host pid, exactly one bridge child whose /proc PPID is that host, poisoned identity carriers kept from it, its four root carriers bound to the roots written, the receiver ARMED (raw marker owned by the host pid + start key as pi-durable-host, joined to the sender marker; removed on close), self = the record and replyable, peers from an outside bridge, same garden id on reopen; the bundle's compiled owner join must admit pi-durable-host. Reaps only the host/bridges it owns on any failure. Harness-bypassed: no model turn, no ToolTask. Missing inputs → SKIP (97), never a pass
   ./run.sh check-pi-durable-send      # #129 L-send FIRST CELL, CHECKOUT-ONLY. Same input as check-pi-durable-contact. One native durable turn: the app's own controller input → GenerationTask → ToolTask → the contact's entwurf_v2 → the private bridge → a seeded self-fetch target (C2 recipe, owned by a separate idle child). S = a 127.0.0.1 scripted OpenAI-compatible endpoint configured through the app's documented models.json (dummy key, PI_OFFLINE); H = the native ToolTask path; V (a vendor turn) is NOT run. Oracles: the wire (tools offered, v2 schema = the bridge's tools/list, exactly two requests, the tool result + receipt in the second), the raw mailbox (.msg 1, signal, sender = the host record), the native view (one call, its settled result, root current). Not exactly-once, not recovery, not a recipient turn. Missing inputs → SKIP (97)
+  ./run.sh check-demo-reproducibility # source-checkout-only: discover offline demo Node tests; no LIVE, model, render or publication
   ./run.sh check-pi-durable-beside    # #129 mutant execution coordinate (VERIFY rule 3): run_vitest over the six pi-durable beside tests (adapter, carrier/SDK-set verifier, preflight, owner join, carrier relocation/resolver/emitter/task footer, native-module file and directory ingress) — the pi-durable qualification lane's gate argv. Same files check-tests-beside-behavior already runs.
   ./run.sh check-pi-durable-receive   # #129 L-receive FIRST CELL, CHECKOUT-ONLY. Same input (the bundle must carry the pi-durable-host owner join). The host driver gives the app NO input; a seeded claude-code sender (marker owned by a separate idle child, handed to a gate-owned sending bridge through ENTWURF_META_SENDER_MARKER) enqueues one message, the host's doorbell admits its notice to the ROOT conversation, and the scripted model drains it with entwurf_inbox_read. S withholds response #1 until the ENQUEUE receipt, the .delivered bytes, the signal, the host-owned receiver marker and the notice are captured. Oracles: receiver() admission, native view, raw archive (.delivered.read + lastReadAt), wire (exactly two requests, drain result = view), and after a green reap a forensic read-only SQLite copy (submission row by request id = reported id, root, input, done, placed entry = the notice). V NOT run. Missing inputs → SKIP (97)
   ./run.sh check-copilot-receive-arm  # #82 RAIL 5 gate: the REAL receiver installer + the REAL extension.mjs forked with a stubbed SDK. Arms only after birth, marker owned by the WATCHER pid, self-fetch dispatch answer, doorbell carries the garden id and NOT the body, id-drift/foreign-parent refusals. Hermetic; no Copilot, no model turn
@@ -222,7 +269,7 @@ Usage:
   ./run.sh check-meta-manifest-schema # 0.12.2 meta-bridge: CLI-version-INDEPENDENT static guard — plugin manifests pinned to the minimal keyset that validates on the lowest supported Claude (closed-schema regression that broke 0.12.1 install on floor) + desired_mcp installed-vs-clone dual-mode. Offline (deps: python3)
   ./run.sh smoke-claude-native-resume-live # LIVE-only: Claude Code native fresh→--resume continuity + meta-record uniqueness; proves meta-bridge records identity without touching the backend resume path
 
-  ./run.sh install-meta-bridge        # INTERNAL part of `setup` (native-harness plugin) + doctor recovery path — prefer `setup`; stateful GLOBAL install (plugin + USER MCP + settings keyset, honest uninstall state)
+  ./run.sh install-meta-bridge        # INTERNAL wiring leaf: setup, the source-only developer menu and doctor recovery compose it; stateful GLOBAL install (plugin + USER MCP + settings keyset, honest uninstall state)
   ./run.sh uninstall-meta-bridge      # 1.0.0 meta-bridge Phase 2: stateful GLOBAL uninstall (restore only keys/items captured in install-state)
   ./run.sh doctor-meta-bridge         # THE RELEASE ORACLE (#51, Linux-certified repair axis). exit 0 = every required layer was MEASURED on this Linux host: toolchain + state + plugin/MCP + resolved-artifact launch-form classification (all 3 owner hooks + doorbell static contract) + synthetic owner join + store scan + hook errors + SessionStart evidence + REQUIRED live MCP↔marker join + writer-version parity. Missing live evidence is NOT CERTIFIED (open a Claude session and re-run), never a pass; Darwin is NOT CERTIFIED and stays nonzero, on ONE narrowed reason — start-key and ppid are portable there (`ps` fallback, same string the TS core mints), so what holds the lane closed is per-process environment DISCOVERY alone, pending physical-host evidence. Detection power is held by check-meta-doctor-oracle
   ./run.sh copilot [args...]          # #82 RAIL 7: the MANAGED Copilot launch. exec()s the vendor CLI in THIS terminal (cwd/pid/exit preserved) with COPILOT_CLI_ENABLED_FEATURE_FLAGS=EXTENSIONS set for that one invocation — entwurf owns no part of your shell and writes nothing to it, but it owns the process it is about to become. Without that flag Copilot skips the extension scan SILENTLY. Refuses to launch unless the receiver unit is actually installed. Injects `--model auto` when no --model was given and `--yolo` when no explicit permission/surface policy flag was given, both BEFORE any `--`; every argument you pass is forwarded byte-identical. RUNNING THIS IS YOUR CONSENT to that profile — use plain `copilot` for stock vendor behaviour. Not tmux, not fresh-call, mints no citizen (birth is still the first prompt)
@@ -290,7 +337,7 @@ Usage:
   ./run.sh check-fresh-cut-gate       # SOURCE cell of the generation-boundary proof (IN pnpm run check:full): drives real install/setup/fresh-cut in a sandbox; certification refusal is pre-write, quiescence is fail-closed, archives preserve bytes, and the #54 exit matrix distinguishes complete / no-move / usage / incomplete transition / complete-with-cleanup-residue. No model/network/cost
   ./run.sh check-pack-install         # heavy publish gate (prepublishOnly): actual npm pack + tar -tf + fresh-temp install smoke + the #116 M3-b1 herdr-plugin RUNTIME VERIFIER run against that actual installed tarball (the focused check-herdr-runtime-bootstrap drives a fixture; THIS is where the real package is proven) with the pinned pi SDK (pins derived from the package.json exact production dependency; check-dep-versions binds them) + the npm-installed bridge BOOTS (tools/list) and DELIVERS (tools/call entwurf_v2 → .msg lands) + the installed all-absent and copilot-present (four-unit fake-vendor) `entwurf setup` rows + the INSTALLED generation lifecycle on a seeded previous-generation host (REFUSE before activation writes / zero Claude invocations → installed fresh-cut archives + opens empty → install-meta-bridge PASSES) + the INSTALLED-PACKAGE branch of the Copilot and OMP birth installers actually RUN (compiled entry selected, no raw .ts, and a real birth edge mints a citizen — the half a required-artifact list can never stand in for) + the INSTALLED #129 durable bootstrap (pi/pi-durable/bootstrap.mjs) imported from node_modules: main/openDurableCitizen exported and PACKAGED_BRIDGE_ENTRY = the installed package's own dist entry — import only, no runtime/TUI/birth/bridge started + the #130 pi-durable CARRIER on actual npm consumers (Entwurf-only / aligned host / isolated global): the installed verifier, a consumer-contained resolution oracle with a same-sandbox neighbour control, every physical SDK edge at the pin, a mixed tree refused as pi-durable-sdk-mismatch though it still imports, and the public `entwurf pi-durable` reaching the app's own explicit-model refusal before any birth, also with one explicit `--native-module` (the synthetic fixture, initialized first; a reserved extension name refused before anything opens) (offline, sandbox HOME)
   ./run.sh check-install-container    # 0.12.8 (#51 C): Linux artifact-CONSUMER gate — one candidate .tgz handed read-only to a checkout-invisible node:<engines-major>-bookworm cell. Default packs once to temp; ENTWURF_CANDIDATE_TGZ=/absolute/preserved.tgz consumes those exact bytes with no re-pack and prints canonical path+sha256 for release. Non-root global PATH install, frozen package, MCP tools/list, fake-Claude install-meta-bridge, path+sha256 fence, strict doctor, and the GENERATION host-state matrix (clean / v3-only store bytes unchanged / previous-generation REFUSE→fresh-cut→retry PASS) seeded inline. Docker missing = honest SKIP; ENTWURF_REQUIRE_DOCKER=1 makes that RED (required CI)
-  ./run.sh install [project-dir]      # INTERNAL part of `setup` (project .pi/settings.json wiring) + npm-consumer entry — prefer `setup`, don't call directly for dev
+  ./run.sh install [project-dir]      # INTERNAL wiring leaf: setup/npm-consumer entry and the source-only developer menu compose it; prefer those owning procedures
   ./run.sh remove [project-dir]       # remove entwurf entries from project .pi/settings.json (project scope only; global user-scope citizen left intact)
   ./run.sh install-user-scope [--plugin-runtime <root>]  # #116 M3-b2 PLUGIN-ONLY forward seam: compose ONLY the global pi citizen (user-scope packages[] + provider), never a project `.pi/settings.json` — a Herdr plugin activation has no project and must not invent one. With --plugin-runtime the provider's managed command becomes the absolute bridge under that certified stable runtime (a clean host has nothing entwurf on PATH); without it every byte is the historical bare-bin install. Inverse: remove-user-scope
   ./run.sh herdr-plugin-activate <backend...>  # #116 M3-b2 public forward activation. Takes a subset of {pi, claude-code} and NOTHING else — the stable runtime root is DERIVED from XDG here and handed down, and both harness writers accept a named root only when it IS that derived one. Certifies the runtime-ready journal AND the installed tree, certifies the existing ledger and its recorded harness roots, plans ADD-ONLY (a backend absent from this request is retained, never removed), preflights every selected component before the first byte, then writes each component `pending` BEFORE mutating and checkpoints `active` the moment its writer returns — so a run that dies halfway leaves a record of how far it got. Which backends is M3-b3's question: this verb is handed the answer, it does not read Herdr's integration status
@@ -1029,6 +1076,37 @@ check_capability_bundle_reach() {
   run_ts scripts/check-capability-bundle-reach.ts
 }
 
+check_demo_reproducibility() {
+  # Source-only Node strip-types/CLI and subprocess fixtures, not adapter Vitest tests.
+  # Discovery lives beside demo behavior; no filename list or npm TS crossing.
+  section "demo reproducibility (offline source fixtures, no model or recording)"
+  case "$REPO_DIR" in */node_modules/*) fail "check-demo-reproducibility is source-checkout-only"; return 1 ;; esac
+  local -a tests=()
+  local f
+  while IFS= read -r f; do [ -n "$f" ] && tests+=("$f"); done < <(cd "$REPO_DIR" && find demo -type f -name '*.test.ts' -print | LC_ALL=C sort)
+  if [ "${#tests[@]}" -eq 0 ]; then
+    fail "[QK:DEMO-TEST-DISCOVERY] demo test discovery is empty — no fixtures is not a passing floor"
+    return 1
+  fi
+  (
+    local sandbox name
+    sandbox=$(mktemp -d /tmp/entwurf-demo-unit.XXXXXX)
+    trap 'rm -rf -- "$sandbox"' EXIT
+    while IFS= read -r name; do
+      case "$name" in ENTWURF_*|HERDR_*|PI_SESSION_ID|PI_AGENT_ID|CLAUDECODE|CLAUDE_CODE_SESSION_ID|TMUX|TMUX_PANE|LIVE) unset "$name" ;; esac
+    done < <(compgen -e)
+    export HOME="$sandbox/home" PI_CODING_AGENT_DIR="$sandbox/pi"
+    export XDG_CONFIG_HOME="$sandbox/config" XDG_DATA_HOME="$sandbox/data" XDG_STATE_HOME="$sandbox/state" XDG_CACHE_HOME="$sandbox/cache" XDG_RUNTIME_DIR="$sandbox/runtime"
+    mkdir -m 700 "$HOME" "$PI_CODING_AGENT_DIR" "$XDG_CONFIG_HOME" "$XDG_DATA_HOME" "$XDG_STATE_HOME" "$XDG_CACHE_HOME" "$XDG_RUNTIME_DIR" "$sandbox/bin"
+    # Take.finish records PATH versions; fixtures must not depend on an installed Pi or run it.
+    printf '#!/bin/sh\n[ "$1" = --version ] && { printf "offline-fixture\\n"; exit 0; }\nexit 81\n' > "$sandbox/bin/pi"
+    chmod +x "$sandbox/bin/pi"
+    export PATH="$sandbox/bin:$PATH"
+    cd "$REPO_DIR"
+    node --test "${tests[@]}"
+  )
+}
+
 check_bridge_delivery() {
   # demo/demo.sh scene 3, recovered as a deterministic gate. demo drove two real pi
   # panes so it proved DELIVERY through the installed binary (at model cost); what
@@ -1363,6 +1441,14 @@ check_acp_foreground_only() {
   run_vitest pi-extensions/lib/acp/backend-adapter.test.ts
 }
 
+check_acp_set_model_readback() {
+  # NOT a discovery path — check-tests-beside-behavior finds the test by glob. This case is the
+  # MUTANT EXECUTION COORDINATE for scripts/mutants/acp-set-model-readback.json (#128): the claude
+  # adapter refuses a set-model answer that does not name the requested model, before the prompt.
+  section "claude ACP set-model readback (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/acp/backend-adapter.test.ts
+}
+
 check_acp_vendor_rejection() {
   # Behaviour-adjacent tests are discovered by the glob lane. This narrow case is the
   # mutant execution coordinate: include the adapter admission and real turn pipeline,
@@ -1571,12 +1657,12 @@ check_mux_launch_tmux() {
 smoke_acp_socket_citizen_live() {
   # S1 acceptance smoke (ACP plugin on v2) — OUT of pnpm check, needs LIVE=1.
   # Spawns a REAL `pi --entwurf-control` resident on an ACP model
-  # (entwurf/claude-opus-5) and proves it is a first-class socket-citizen:
+  # (entwurf/claude-opus-5-5) and proves it is a first-class socket-citizen:
   # the control socket stands up, get_info answers with the ACP model (model-lock
   # did NOT revert — QM1), idle/cwd are reported, and the fail-loud streamSimple
   # stub never fires (turn-free launch — QM2). No prompt is sent: S1 proves
   # citizenship, never a backend turn (that is S2). Honest skip when LIVE!=1.
-  # Model override: ENTWURF_S1_MODEL (default claude-opus-5).
+  # Model override: ENTWURF_S1_MODEL (default claude-opus-5-5).
   #   LIVE=1 ./run.sh smoke-acp-socket-citizen-live
   run_ts scripts/smoke-acp-socket-citizen-live.ts
 }
@@ -1590,7 +1676,7 @@ smoke_acp_raw_turn_live() {
   # plus captured raw NDJSON bytes. NO provider/overlay/streamSimple/_meta — the
   # raw backend pipe only. Launch source must be the package bin (PATH fallback
   # fails acceptance unless ENTWURF_ACP_RAW_TURN_ALLOW_PATH_FALLBACK=1, debug).
-  # Model override: ENTWURF_ACP_RAW_TURN_MODEL (default claude-sonnet-5).
+  # Model override: ENTWURF_ACP_RAW_TURN_MODEL (default claude-sonnet-5-5).
   #   LIVE=1 ./run.sh smoke-acp-raw-turn-live
   run_ts scripts/smoke-acp-raw-turn-live.ts
 }
@@ -1608,7 +1694,7 @@ smoke_acp_overlay_live() {
   # meta-store for mailbox absence (flaky — concurrent sessions); the honest
   # claim is overlay-supplies-hooks:{}. Launch must be the package bin (PATH
   # fallback fails acceptance unless ENTWURF_ACP_OVERLAY_ALLOW_PATH_FALLBACK=1).
-  # Model override: ENTWURF_ACP_OVERLAY_MODEL (default claude-sonnet-5).
+  # Model override: ENTWURF_ACP_OVERLAY_MODEL (default claude-sonnet-5-5).
   #   LIVE=1 ./run.sh smoke-acp-overlay-live
   run_ts scripts/smoke-acp-overlay-live.ts
 }
@@ -1623,7 +1709,7 @@ smoke_acp_memory_containment_live() {
   # can stop a memory write is the lever — not us. Fails loud if engraving.md is
   # empty (carrier OFF = no containment). Launch must be the package bin (PATH
   # fallback fails acceptance unless ENTWURF_ACP_MEMORY_ALLOW_PATH_FALLBACK=1).
-  # Model override: ENTWURF_ACP_MEMORY_MODEL (default claude-sonnet-5).
+  # Model override: ENTWURF_ACP_MEMORY_MODEL (default claude-sonnet-5-5).
   #   LIVE=1 ./run.sh smoke-acp-memory-containment-live
   run_ts scripts/smoke-acp-memory-containment-live.ts
 }
@@ -1650,7 +1736,7 @@ smoke_acp_provider_live() {
   # assistant reply (live model proof) + the removed S0 stub error never appears
   # (provider path actually opened) + pi exits 0. Tool-free prompt; the
   # event-mapper gate owns the tool→notice contract.
-  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5).
+  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5-5).
   #   LIVE=1 ./run.sh smoke-acp-provider-live
   run_ts scripts/smoke-acp-provider-live.ts
 }
@@ -1664,7 +1750,7 @@ smoke_acp_session_reuse_live() {
   # is the verdict; codeword recall is supporting only (a rebuilt full transcript
   # could recall it too). The one-shot exit0 half is owned by
   # smoke-acp-provider-live.
-  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5).
+  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5-5).
   #   LIVE=1 ./run.sh smoke-acp-session-reuse-live
   run_ts scripts/smoke-acp-session-reuse-live.ts
 }
@@ -1676,7 +1762,7 @@ smoke_acp_carrier_augment_live() {
   # secret (the augment rode the wire to the model) and the EMPTY default carrier
   # must bill clean (exit 0, no HTTP-400 canary — 핀1 live). Optional tiny carrier
   # check via SMOKE_ACP_CARRIER_PRESENT=1 (non-blocking).
-  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5).
+  # Model override: ENTWURF_ACP_PROVIDER_MODEL (default claude-sonnet-5-5).
   #   LIVE=1 ./run.sh smoke-acp-carrier-augment-live
   run_ts scripts/smoke-acp-carrier-augment-live.ts
 }
@@ -1762,9 +1848,9 @@ smoke_acp_rgg_live() {
   # birth, record-keyed socket, attach-on-reopen, no pi-session-id socket) holds
   # under the ACP provider too — the logic is provider-agnostic. The POSITIVE cell
   # (one real turn completing transcriptPath/model) is the only model-in-loop part.
-  # Target override: ENTWURF_RGG_TARGET (default entwurf/claude-sonnet-5).
+  # Target override: ENTWURF_RGG_TARGET (default entwurf/claude-sonnet-5-5).
   #   ./run.sh smoke-acp-rgg-live
-  local target="${ENTWURF_RGG_TARGET:-entwurf/claude-sonnet-5}"
+  local target="${ENTWURF_RGG_TARGET:-entwurf/claude-sonnet-5-5}"
   (cd "$REPO_DIR" && ENTWURF_LIVE_TARGET="$target" SMOKE_RGG_POSITIVE=0 bash scripts/smoke-resident-garden-guard.sh)
 }
 
@@ -3614,7 +3700,7 @@ check_pack() {
     "package.json" "README.md" "LICENSE" "CHANGELOG.md"
     "protocol.js" "run.sh"
     "pi-extensions/acp-provider.ts"
-    "pi-extensions/lib/acp/models.ts" "pi-extensions/lib/acp/backend.ts"
+    "pi-extensions/lib/acp/models.ts" "pi-extensions/lib/acp/model-ids.js" "pi-extensions/lib/acp/backend.ts"
     "pi-extensions/lib/acp/overlay.ts" "pi-extensions/lib/acp/tool-surface.ts"
     "pi-extensions/lib/acp/event-mapper.ts" "pi-extensions/lib/acp/context.ts"
     "pi-extensions/entwurf-control.ts"
@@ -3756,6 +3842,8 @@ check_pack() {
     # pi-extensions/ so it also covers any future allowlist entry; `plugins/` needs no
     # companion negation because `^plugins/` above already refuses that whole tree.
     '\.test\.[cm]?[jt]s$'
+    # Maintainer take/renderer/helper TS is source-only, including non-test implementations.
+    '^demo/.*\.ts$'
   )
 
   local pass=1 f pat hit
@@ -4260,7 +4348,7 @@ _check_pack_install_impl() {
     "package.json" "README.md" "LICENSE" "CHANGELOG.md"
     "protocol.js" "run.sh"
     "pi-extensions/acp-provider.ts"
-    "pi-extensions/lib/acp/models.ts" "pi-extensions/lib/acp/backend.ts"
+    "pi-extensions/lib/acp/models.ts" "pi-extensions/lib/acp/model-ids.js" "pi-extensions/lib/acp/backend.ts"
     "pi-extensions/lib/acp/overlay.ts" "pi-extensions/lib/acp/tool-surface.ts"
     "pi-extensions/lib/acp/event-mapper.ts" "pi-extensions/lib/acp/context.ts"
     "pi-extensions/entwurf-control.ts"
@@ -4686,8 +4774,8 @@ _check_pack_install_impl() {
   loader_ids=$(awk '$1 == "entwurf" { print $2 }' <<<"$loader_out" | LC_ALL=C sort)
   loader_expected=$(printf '%s\n' \
     claude-fable-5-1 \
-    claude-opus-5 \
-    claude-sonnet-5 \
+    claude-opus-5-5 \
+    claude-sonnet-5-5 \
     cortex-auto \
     cortex-claude-opus-5 \
     cortex-claude-sonnet-5 \
@@ -4796,7 +4884,7 @@ sys.exit(0 if any(isinstance(s,str) and s.endswith('/node_modules/@junghanacs/en
     echo "$foreign_out" | tail -10 | sed 's/^/    /' >&2
     return 1
   }
-  if grep -qi "Unknown option" <<<"$foreign_out" || ! grep -q "claude-opus-5" <<<"$foreign_out"; then
+  if grep -qi "Unknown option" <<<"$foreign_out" || ! grep -q "claude-opus-5-5" <<<"$foreign_out"; then
     fail "[check-pack-install] foreign-cwd --entwurf-control did not load the entwurf extension from user scope:"
     echo "$foreign_out" | tail -10 | sed 's/^/    /' >&2
     return 1
@@ -7035,6 +7123,10 @@ release_gate() {
 
 cmd=${1:-}
 case "$cmd" in
+  menu)
+    shift
+    developer_menu "$@"
+    ;;
   setup)
     setup_all "$TARGET_PROJECT_DIR"
     ;;
@@ -7209,6 +7301,9 @@ case "$cmd" in
   check-acp-foreground-only)
     check_acp_foreground_only
     ;;
+  check-acp-set-model-readback)
+    check_acp_set_model_readback
+    ;;
   check-resume-launch-identity)
     check_resume_launch_identity
     ;;
@@ -8175,6 +8270,9 @@ case "$cmd" in
   check-pi-queue-oracle)
     check_pi_queue_oracle
     ;;
+  check-demo-reproducibility)
+    check_demo_reproducibility
+    ;;
   check-tests-beside-behavior)
     check_tests_beside_behavior
     ;;

package/scripts/check-acp-backend-preflight.ts

@@ -16,13 +16,13 @@
 
 import { strict as assert } from "node:assert";
 import { execFileSync } from "node:child_process";
-import { readdirSync, readFileSync, rmSync } from "node:fs";
+import { readdirSync, readFileSync, rmdirSync, rmSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import type { Api, AssistantMessageEvent, Model, TranscriptContext } from "@earendil-works/pi-ai";
 import { normalizeContext } from "@earendil-works/pi-ai";
 
-const model = { id: "claude-sonnet-5" } as unknown as Model<Api>;
+const model = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
 
 // Declared tools exclude `read`, but the Claude child always exposes Read →
 // declared != actual → the preflight must reject before spawning.
@@ -157,6 +157,14 @@ try {
 	);
 } finally {
 	rmSync(TMP_EMIT, { recursive: true, force: true });
+	try {
+		// Same as check-acp-cortex: the emit created `.tmp-verify/` as TMP_EMIT's parent, and
+		// check-gate-qualification's snapshot manifest walks ignored paths, so a leftover empty
+		// parent reads as a dirty tree. Remove it when empty; a sibling's emit keeps it alive.
+		rmdirSync(".tmp-verify");
+	} catch {
+		// non-empty or already gone — fine either way
+	}
 }
 
 // ---------------------------------------------------------------------------

package/scripts/check-acp-cortex.ts

@@ -53,11 +53,11 @@ import {
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { getModels } from "@earendil-works/pi-ai/compat";
 import { buildPiContextAugment } from "../pi-extensions/lib/acp/augment.ts";
 import type { AcpMcpServer } from "../pi-extensions/lib/acp/config.ts";
 import {
 	CORTEX_MODEL_PREFIX,
-	curatedClaudeModels,
 	curatedCortexModels,
 	SUPPORTED_CORTEX_MODEL_IDS,
 } from "../pi-extensions/lib/acp/models.ts";
@@ -87,12 +87,13 @@ const cortexRowIds = cortexRows.map((m) => m.id);
 assert.deepEqual(cortexRowIds, [...SUPPORTED_CORTEX_MODEL_IDS], "curated cortex rows must match the supported id set");
 // The two Claude rows ride their OWN registry bases (a fabricated row would
 // drift from the pi-ai catalog); auto/gpt ride the sonnet base as a floor.
-const claudeRows = curatedClaudeModels();
+// Cortex retains its own native 5 ids even when Claude's curated set moves to 5.5.
+const claudeRows = getModels("anthropic");
 const sonnetBase = claudeRows.find((m) => m.id === "claude-sonnet-5");
 const opusBase = claudeRows.find((m) => m.id === "claude-opus-5");
 // Plain throw (not assert.ok): an asserts-function premise makes tsc report the
 // downstream `base` const as circularly-typed (TS7022).
-if (!sonnetBase || !opusBase) throw new Error("test premise: sonnet-5/opus-5 present in curated claude surface");
+if (!sonnetBase || !opusBase) throw new Error("test premise: sonnet-5/opus-5 present in pi-ai registry");
 for (const row of cortexRows) {
 	// Explicit annotation: node:assert's asserts-typed helpers otherwise make tsc
 	// flag this flow-dependent const as circularly typed (TS7022).
@@ -480,7 +481,7 @@ try {
 	// throwing IS the anti-collision proof; we also assert the rows are present.
 	const registered = mod.allCuratedModels().map((m) => m.id);
 	for (const want of [
-		"claude-sonnet-5",
+		"claude-sonnet-5-5",
 		"cortex-auto",
 		"cortex-claude-opus-5",
 		"cortex-claude-sonnet-5",
@@ -494,12 +495,12 @@ try {
 	assert.equal(routedSonnet.adapter.backend, "cortex", "cortex-claude-sonnet-5 must route to the cortex adapter");
 	assert.equal(routedSonnet.nativeModelId, "claude-sonnet-5", "prefix strip must recover the native model id");
 	assert.equal(
-		mod.resolveAcpBackendAdapter("claude-sonnet-5").adapter.backend,
+		mod.resolveAcpBackendAdapter("claude-sonnet-5-5").adapter.backend,
 		"claude",
 		"the unprefixed claude id must still route to claude (prefix keeps the namespaces apart)",
 	);
 	assert.equal(
-		mod.cortexAdapter.routeModel("claude-sonnet-5"),
+		mod.cortexAdapter.routeModel("claude-sonnet-5-5"),
 		undefined,
 		"cortex must NOT claim the unprefixed claude id",
 	);

package/scripts/check-acp-prompt-lifecycle.ts

@@ -40,7 +40,7 @@ import type { Api, AssistantMessageEvent, Message, Model, TranscriptContext } fr
 import { normalizeContext } from "@earendil-works/pi-ai";
 import { isRetryableAssistantError } from "@earendil-works/pi-ai/compat";
 
-const sonnet = { id: "claude-sonnet-5" } as unknown as Model<Api>;
+const sonnet = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
 
 type Stream = AsyncIterable<AssistantMessageEvent>;
 
@@ -151,7 +151,7 @@ function makeHarness(recordDir: string) {
 	const makeConnection = (handlers: any) => ({
 		initialize: async () => ({ agentCapabilities: {} }),
 		newSession: async () => ({ sessionId: "ACP-1" }),
-		setSessionConfigOption: async () => ({}),
+		setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: "model", currentValue: p.value }] }),
 		prompt: ({ sessionId }: any) => {
 			promptCount++;
 			notifier = (update) => handlers.sessionUpdate({ update, sessionId });

package/scripts/check-acp-provider-surface.ts

@@ -123,7 +123,7 @@ try {
 	assert.equal(cap.cfg.apiKey, ENTWURF_ACP_NO_AUTH_SENTINEL, "entry apiKey is not the no-auth sentinel");
 	assert.equal(cap.cfg.api, "entwurf", "entry api field drifted");
 	const capIds = (cap.cfg.models ?? []).map((m) => m.id);
-	for (const want of ["claude-sonnet-5", CURATED_ANCHOR_MODEL_ID]) {
+	for (const want of ["claude-sonnet-5-5", CURATED_ANCHOR_MODEL_ID]) {
 		assert.ok(capIds.includes(want), `entry model surface missing ${want} (got: ${capIds.join(", ") || "none"})`);
 	}
 

package/scripts/check-acp-session-reuse.ts

@@ -51,8 +51,8 @@ function tctx(messages: Context["messages"]): TranscriptContext {
 	return normalizeContext({ tools: PI_DECLARED_TOOLS, messages });
 }
 
-const sonnet = { id: "claude-sonnet-5" } as unknown as Model<Api>;
-const opus = { id: "claude-opus-5" } as unknown as Model<Api>;
+const sonnet = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
+const opus = { id: "claude-opus-5-5" } as unknown as Model<Api>;
 
 type Stream = AsyncIterable<AssistantMessageEvent> & {
 	result: () => Promise<{ stopReason: string; errorMessage?: string }>;
@@ -154,7 +154,7 @@ function makeHarness(recordDir: string, config: any = DEFAULT_RESOLVED_CONFIG, e
 			newSessionSeq++;
 			return { sessionId: `ACP-${newSessionSeq}` };
 		},
-		setSessionConfigOption: async () => ({}),
+		setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: "model", currentValue: p.value }] }),
 		prompt: async ({ sessionId, prompt }: any) => {
 			promptCalls.push({ sessionId, text: prompt.map((b: { text: string }) => b.text).join("\n") });
 			if (block) await block;
@@ -505,7 +505,7 @@ try {
 		);
 		const d1 = deltaText(t1);
 		const iPrep = d1.indexOf("[acp: preparing claude session]");
-		const iReady = d1.indexOf("[acp: session ready model=claude-sonnet-5]");
+		const iReady = d1.indexOf("[acp: session ready model=claude-sonnet-5-5]");
 		const iSent = d1.indexOf("[acp: sending prompt]");
 		assert.ok(
 			iPrep >= 0 && iReady > iPrep && iSent > iReady,
@@ -533,7 +533,7 @@ try {
 		const ctxWithNotice = tctx([
 			{ role: "user", content: "real user line", timestamp: 0 },
 			mkAssistant([
-				{ type: "text", text: "\n[acp: session ready model=claude-sonnet-5]\n", textSignature: MARKER },
+				{ type: "text", text: "\n[acp: session ready model=claude-sonnet-5-5]\n", textSignature: MARKER },
 				{ type: "text", text: "real assistant line" },
 			]),
 		]);

package/scripts/check-acp-stop-reason.ts

@@ -55,7 +55,7 @@ import { pathToFileURL } from "node:url";
 import type { Api, AssistantMessageEvent, Model } from "@earendil-works/pi-ai";
 import { normalizeContext } from "@earendil-works/pi-ai";
 
-const sonnet = { id: "claude-sonnet-5" } as unknown as Model<Api>;
+const sonnet = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
 
 type Stream = AsyncIterable<AssistantMessageEvent> & {
 	result: () => Promise<{ stopReason: string; errorMessage?: string }>;
@@ -124,7 +124,7 @@ function makeHarness(recordDir: string, wireReason: string | null) {
 		createConnection: (_child: any, handlers: any) => ({
 			initialize: async () => ({ agentCapabilities: {} }),
 			newSession: async () => ({ sessionId: "ACP-1" }),
-			setSessionConfigOption: async () => ({}),
+			setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: "model", currentValue: p.value }] }),
 			prompt: async ({ sessionId }: any) => {
 				await handlers.sessionUpdate({
 					update: { sessionUpdate: "agent_message_chunk", content: { type: "text", text: "PARTIAL" } },

package/scripts/check-acp-stream-hooks.ts

@@ -35,7 +35,7 @@ import { pathToFileURL } from "node:url";
 import type { Api, AssistantMessageEvent, Message, Model, TranscriptContext } from "@earendil-works/pi-ai";
 import { normalizeContext } from "@earendil-works/pi-ai";
 
-const sonnet = { id: "claude-sonnet-5" } as unknown as Model<Api>;
+const sonnet = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
 
 type Stream = AsyncIterable<AssistantMessageEvent>;
 
@@ -93,7 +93,7 @@ function makeHarness(recordDir: string) {
 	const makeConnection = (_handlers: any) => ({
 		initialize: async () => ({ agentCapabilities: {} }),
 		newSession: async () => ({ sessionId: "ACP-1" }),
-		setSessionConfigOption: async () => ({}),
+		setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: "model", currentValue: p.value }] }),
 		prompt: async (params: any) => {
 			// Deep-cloned: the capture must be the bytes that crossed the seam, not a
 			// live reference a later mutation could rewrite.

package/scripts/check-acp-usage-accounting.ts

@@ -61,7 +61,7 @@ import type {
 import { isContextOverflow, normalizeContext } from "@earendil-works/pi-ai";
 import { calculateContextTokens } from "@earendil-works/pi-coding-agent";
 
-const claude = { id: "claude-sonnet-5" } as unknown as Model<Api>;
+const claude = { id: "claude-sonnet-5-5" } as unknown as Model<Api>;
 const cortex = { id: "cortex-auto" } as unknown as Model<Api>;
 
 type Stream = AsyncIterable<AssistantMessageEvent>;
@@ -160,7 +160,7 @@ function makeHarness(recordDir: string, scripts: TurnScript[]) {
 			newSessionCalls++;
 			return { sessionId: "ACP-1" };
 		},
-		setSessionConfigOption: async () => ({}),
+		setSessionConfigOption: async (p: any) => ({ configOptions: [{ id: "model", currentValue: p.value }] }),
 		prompt: async ({ sessionId }: any) => {
 			const script = scripts[turnIndex++] ?? {};
 			const update: Record<string, unknown> = { sessionUpdate: "usage_update" };

package/scripts/check-fresh-call-dispatch.ts

@@ -26,6 +26,8 @@
  *   FCD-RENDER-PER-RAIL       each rail renders its own receipt; no universal tmux prose
  *   FCD-HERDR-VIEW-NOT-ADDRESS  the herdr receipt says its coordinates are a view
  *   FCD-RECOVERY-VISIBLE      a post-split failure shows closed vs orphan-unreclaimed:reason
+ *   FCD-ACP-MODEL-EXACT       a pi `entwurf/<id>` that is not an exact curated ACP id refuses on
+ *                             either rail before anything runs (#128)
  */
 
 import assert from "node:assert/strict";
@@ -112,10 +114,18 @@ async function main(): Promise<void> {
 	// Up to the FIRST statement of the tmux path, which is the target capability question
 	// (#95 lane B added a caller-side one beside it, so `const missing =` is no longer the
 	// boundary — it is the line that FOLDS the two).
-	const herdrBranch = dispatchCode.slice(
-		dispatchCode.indexOf('if (selectFreshCallRail(env) === "herdr")'),
-		dispatchCode.indexOf("\tconst targetMissing ="),
-	);
+	// Fail closed on the anchors: a renamed or reordered line would otherwise slice an EMPTY branch,
+	// and every negative `!herdrBranch.includes(…)` below would pass on nothing (#128 review D2).
+	// The slice ends at the herdr branch's OWN return, not at a tmux-path statement, so a mutant
+	// that edits the tmux path cannot move this boundary and fail this cell for its reason.
+	const herdrStart = dispatchCode.indexOf('if (selectFreshCallRail(env) === "herdr")');
+	const herdrReturn = 'return { rail: "herdr", result: await herdrFreshCall(';
+	const herdrReturnAt = dispatchCode.indexOf(herdrReturn);
+	const herdrBranch =
+		herdrStart >= 0 && herdrReturnAt > herdrStart
+			? dispatchCode.slice(herdrStart, herdrReturnAt + herdrReturn.length)
+			: "";
+	const herdrBranchLocated = herdrBranch.includes("herdrFreshCall(");
 
 	// ── no fallback, either direction ────────────────────────────────────────────────────
 	const incomplete = await dispatchFreshCall(REQUEST, { HERDR_ENV: "1" }, recordingSpawn().spawn);
@@ -124,6 +134,37 @@ async function main(): Promise<void> {
 		incomplete.rail === "herdr" && !incomplete.result.ok && incomplete.result.reason === "herdr-context-missing",
 	);
 
+	// ── #128: an entwurf/<id> pi launch names an EXACT curated ACP id ───────────────────────
+	{
+		const herdrSpawn = recordingSpawn();
+		const pi = (model: string) => ({ ...REQUEST, model });
+		const herdrRetired = await dispatchFreshCall(pi("entwurf/claude-sonnet-5"), HERDR_ENV, herdrSpawn.spawn);
+		const tmuxRetired = await dispatchFreshCall(pi(" entwurf/claude-opus-5 "), {}, recordingSpawn().spawn);
+		const current = recordingSpawn();
+		const herdrCurrent = await dispatchFreshCall(pi("entwurf/claude-opus-5-5"), HERDR_ENV, current.spawn);
+		const cortex = await dispatchFreshCall(pi("entwurf/cortex-claude-sonnet-5"), {}, recordingSpawn().spawn);
+		const otherBackend = await dispatchFreshCall(
+			{ ...REQUEST, backend: "claude-code", model: "entwurf/claude-sonnet-5" },
+			{},
+			recordingSpawn().spawn,
+		);
+		const reasonOf = (d: Awaited<ReturnType<typeof dispatchFreshCall>>) => (d.result.ok ? null : d.result.reason);
+		ok(
+			"[QK:FCD-ACP-MODEL-EXACT] a pi sibling under the entwurf provider must name an EXACT curated ACP id: a retired Claude 5 id refuses as acp-model-not-curated on BOTH rails (trimmed like the rails read it) before herdr is asked anything, while the 5.5 id and a Cortex id pass through and another backend is not judged — Pi would otherwise open the retired id on a Cortex row by substring",
+			herdrRetired.rail === "herdr" &&
+				reasonOf(herdrRetired) === "acp-model-not-curated" &&
+				herdrSpawn.calls.length === 0 &&
+				tmuxRetired.rail === "tmux" &&
+				reasonOf(tmuxRetired) === "acp-model-not-curated" &&
+				reasonOf(herdrCurrent) !== "acp-model-not-curated" &&
+				current.calls.length > 0 &&
+				reasonOf(cortex) !== "acp-model-not-curated" &&
+				reasonOf(otherBackend) !== "acp-model-not-curated" &&
+				renderDispatchedFreshCall(herdrRetired).text.includes("exact curated ACP id") &&
+				renderDispatchedFreshCall(tmuxRetired).text.includes("exact curated ACP id"),
+		);
+	}
+
 	const nonPilot = recordingSpawn();
 	const refused = await dispatchFreshCall({ ...REQUEST, backend: "codex" }, HERDR_ENV, nonPilot.spawn);
 	ok(
@@ -132,6 +173,7 @@ async function main(): Promise<void> {
 			!refused.result.ok &&
 			refused.result.reason === "herdr-backend-unsupported" &&
 			nonPilot.calls.length === 0 &&
+			herdrBranchLocated &&
 			// And structurally: the herdr branch names NEITHER capability preflight — not the
 			// target one, and not the caller-seat one #95 lane B put beside it.
 			!herdrBranch.includes("codexFreshPreflight") &&
@@ -153,6 +195,7 @@ async function main(): Promise<void> {
 			!durableRefused.result.ok &&
 			durableRefused.result.reason === "herdr-backend-unsupported" &&
 			durable.calls.length === 0 &&
+			herdrBranchLocated &&
 			!herdrBranch.includes("piDurable"),
 	);