@junghanacs/entwurf 0.34.2 → 0.35.1

package/scripts/mutants/demo-reproducibility.json

@@ -0,0 +1,155 @@
+{
+	"schemaVersion": 1,
+	"lane": "demo-reproducibility",
+	"mutants": [
+		{
+			"claim": "DEMO-BASELINE-ARCHIVED",
+			"title": "the archived baseline resumes launching the retired scene and can overwrite the approved GIF",
+			"subject": "demo/demo-baseline.sh",
+			"find": ["exit 2"],
+			"replace": [":"],
+			"gate": ["bash", "run.sh", "check-demo-reproducibility"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:DEMO-BASELINE-ARCHIVED]",
+			"signatureSource": "demo/maintenance-guards.test.ts"
+		},
+		{
+			"claim": "DEMO-PEER-ARCHIVED",
+			"title": "the archived peer scene becomes a second runnable v1 route again",
+			"subject": "demo/demo.sh",
+			"find": ["exit 2"],
+			"replace": [":"],
+			"gate": ["bash", "run.sh", "check-demo-reproducibility"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:DEMO-PEER-ARCHIVED]",
+			"signatureSource": "demo/maintenance-guards.test.ts"
+		},
+		{
+			"claim": "DEMO-LIVE-OPT-IN",
+			"title": "the Herdr scene reaches preflight without the explicit LIVE grant",
+			"subject": "demo/take-herdr-pi-cc.ts",
+			"find": ["if (process.env.LIVE !== \"1\")"],
+			"replace": ["if (false)"],
+			"gate": ["bash", "run.sh", "check-demo-reproducibility"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:DEMO-LIVE-OPT-IN]",
+			"signatureSource": "demo/maintenance-guards.test.ts"
+		},
+		{
+			"claim": "DEMO-PUBLISHED-PROVENANCE",
+			"title": "the tracked provenance names another GIF digest while the approved pixels stay unchanged",
+			"subject": "demo/herdr-pi-cc-20261011.provenance.json",
+			"find": ["\t\t\"sha256\": \"b686739b5c68fa458dd47c844711aea0f6ab5819eb3eb5d2850449922fa084c0\","],
+			"replace": ["\t\t\"sha256\": \"0000000000000000000000000000000000000000000000000000000000000000\","],
+			"gate": ["bash", "run.sh", "check-demo-reproducibility"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:DEMO-PUBLISHED-PROVENANCE]",
+			"signatureSource": "demo/maintenance-guards.test.ts"
+		},
+		{
+			"claim": "DEMO-PACK-SOURCE-ONLY",
+			"title": "a directory allowlist ships maintainer TypeScript as if it were an installed entrypoint",
+			"subject": "package.json",
+			"find": [
+				"\t\t\"demo/README.md\",",
+				"\t\t\"demo/herdr-pi-cc-20261011.provenance.json\",",
+				"\t\t\"!demo/**/*.ts\","
+			],
+			"replace": ["\t\t\"demo/\","],
+			"gate": ["bash", "run.sh", "check-demo-reproducibility"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:DEMO-PACK-SOURCE-ONLY]",
+			"signatureSource": "demo/maintenance-guards.test.ts"
+		},
+		{
+			"claim": "DEMO-PUBLICATION-DESTINATION",
+			"title": "a live-pass renderer can overwrite publication assets through a direct or aliased destination",
+			"subject": "demo/render-take.ts",
+			"find": ["\tif (isPublicationOutput(out))"],
+			"replace": ["\tif (false)"],
+			"gate": ["bash", "run.sh", "check-demo-reproducibility"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:DEMO-PUBLICATION-DESTINATION]",
+			"signatureSource": "demo/maintenance-guards.test.ts"
+		},
+		{
+			"claim": "DEMO-TMUX-SUBJECT-TAIL",
+			"title": "the tmux tail trimmer drops real subject text merged with the terminal teardown",
+			"subject": "demo/render-take.ts",
+			"find": ["\t\tisOnlyCsi(teardown[2])"],
+			"replace": ["\t\ttrue"],
+			"gate": ["bash", "run.sh", "check-demo-reproducibility"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:DEMO-TMUX-SUBJECT-TAIL]",
+			"signatureSource": "demo/render-take.test.ts"
+		},
+		{
+			"claim": "DEMO-RECORDING-REQUIRED",
+			"title": "no recorder means no assertion, so an empty capture again certifies live-pass",
+			"subject": "demo/lib/take-recorder.ts",
+			"find": [
+				"\t\tthis.step(",
+				"\t\t\t\"the recording ran until the take ended and the recorder stopped cleanly (no cut, no signal, exit 0)\","
+			],
+			"replace": [
+				"\t\tif (recorder) this.step(",
+				"\t\t\t\"the recording ran until the take ended and the recorder stopped cleanly (no cut, no signal, exit 0)\","
+			],
+			"gate": ["bash", "run.sh", "check-demo-reproducibility"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:DEMO-RECORDING-REQUIRED]",
+			"signatureSource": "demo/lib/take-recorder.test.ts"
+		},
+		{
+			"claim": "DEMO-TEST-DISCOVERY",
+			"title": "a dead discovery glob produces no tests but the demo floor is still invoked",
+			"subject": "run.sh",
+			"find": [
+				"  while IFS= read -r f; do [ -n \"$f\" ] && tests+=(\"$f\"); done < <(cd \"$REPO_DIR\" && find demo -type f -name '*.test.ts' -print | LC_ALL=C sort)"
+			],
+			"replace": [
+				"  while IFS= read -r f; do [ -n \"$f\" ] && tests+=(\"$f\"); done < <(cd \"$REPO_DIR\" && find demo -type f -name '*.test.NO-MATCH' -print | LC_ALL=C sort)"
+			],
+			"gate": ["bash", "run.sh", "check-demo-reproducibility"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:DEMO-TEST-DISCOVERY]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "DEMO-NO-EARLY-RESOURCES",
+			"title": "a Take allocated before missing-LIVE refusal writes resources without calling any fake tool",
+			"subject": "demo/take-pi-cc.ts",
+			"find": ["if (process.env.LIVE !== \"1\") {"],
+			"replace": [
+				"if (process.env.LIVE !== \"1\") {",
+				"\tnew Take({ label: LABEL, repo: REPO, cols: 132, rows: 38 });"
+			],
+			"gate": ["bash", "run.sh", "check-demo-reproducibility"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:DEMO-NO-EARLY-RESOURCES]",
+			"signatureSource": "demo/maintenance-guards.test.ts"
+		},
+		{
+			"claim": "DEMO-ORIGINAL-RENDER-INPUT",
+			"title": "rerendering replaces the original approved GIF's exact agg input inside the take directory",
+			"subject": "demo/render-take.ts",
+			"find": ["\tconst renderCast = path.join(path.dirname(out), `.${path.basename(out)}.${tag}.render.cast`);"],
+			"replace": ["\tconst renderCast = path.join(takeDir, \"take.render.cast\");"],
+			"gate": ["bash", "run.sh", "check-demo-reproducibility"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:DEMO-ORIGINAL-RENDER-INPUT]",
+			"signatureSource": "demo/render-take.test.ts"
+		},
+		{
+			"claim": "DEMO-RAIL-POLICY",
+			"title": "the pi-durable scene stops refusing an OpenRouter base-URL redirect, so LIVE=1 could spend a sibling turn through OpenRouter",
+			"subject": "demo/take-pi-durable.ts",
+			"find": ["const routedVia = openRouterOverride(process.env);"],
+			"replace": ["const routedVia = null;"],
+			"gate": ["bash", "run.sh", "check-demo-reproducibility"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:DEMO-RAIL-POLICY]",
+			"signatureSource": "demo/maintenance-guards.test.ts"
+		}
+	]
+}

package/scripts/mutants/fresh-call-dispatch.json

@@ -138,6 +138,17 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:FCD-NO-SYNC-SPAWN]",
 			"signatureSource": "scripts/check-fresh-call-dispatch.ts"
+		},
+		{
+			"claim": "FCD-ACP-MODEL-EXACT",
+			"title": "dropping the exact-curation check lets a retired entwurf/claude-sonnet-5 reach a rail, where Pi opens it on the Cortex row by substring",
+			"subject": "pi-extensions/lib/fresh-call-dispatch.ts",
+			"find": ["\treturn !isCuratedAcpModelId(trimmed.slice(slash + 1));"],
+			"replace": ["\treturn false;"],
+			"gate": ["bash", "run.sh", "check-fresh-call-dispatch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FCD-ACP-MODEL-EXACT]",
+			"signatureSource": "scripts/check-fresh-call-dispatch.ts"
 		}
 	]
 }

package/scripts/mutants/herdr-dev-checkout.json

@@ -0,0 +1,70 @@
+{
+	"schemaVersion": 1,
+	"lane": "herdr-dev-checkout",
+	"mutants": [
+		{
+			"claim": "DEV-MENU-EXPLICIT-CONFIRM",
+			"title": "the source menu invokes apply after an unconfirmed selection instead of requiring exact DEV; the existing helper guards do not substitute for the operator's choice",
+			"subject": "run.sh",
+			"find": ["      if [ \"$confirm\" != DEV ]; then"],
+			"replace": ["      if false; then"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:DEV-MENU-EXPLICIT-CONFIRM]",
+			"signatureSource": "plugins/herdr/use-dev-checkout.test.mjs",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "HERDR-DEV-PREPARE-BEFORE-TEARDOWN",
+			"title": "deactivation must be preceded by a successful source bridge proof, not merely a build",
+			"subject": "plugins/herdr/use-dev-checkout.sh",
+			"find": ["(cd \"$ROOT\" && pnpm run build-bridge)", "\"$ROOT/run.sh\" check-bridge"],
+			"replace": ["(cd \"$ROOT\" && pnpm run build-bridge)", ":"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signatureSource": "plugins/herdr/use-dev-checkout.test.mjs",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			},
+			"signature": "[QK:HERDR-DEV-PREPARE-BEFORE-TEARDOWN]"
+		},
+		{
+			"claim": "HERDR-DEV-RECHECK-BEFORE-TEARDOWN",
+			"title": "an old-runtime process appearing during source preparation must refuse before the owner is deactivated",
+			"subject": "plugins/herdr/use-dev-checkout.sh",
+			"find": ["quiescent", "", "stage=owned-deactivate"],
+			"replace": [":", "", "stage=owned-deactivate"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signatureSource": "plugins/herdr/use-dev-checkout.test.mjs",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			},
+			"signature": "[QK:HERDR-DEV-RECHECK-BEFORE-TEARDOWN]"
+		},
+		{
+			"claim": "HERDR-DEV-NO-SUCCESS-ON-DRIFT",
+			"title": "actual Pi model-id drift must remain non-green rather than claiming successful developer wiring",
+			"subject": "plugins/herdr/use-dev-checkout.sh",
+			"find": [
+				"[ \"$ACTUAL_IDS\" = \"$SOURCE_IDS\" ] || { echo '[use-dev-checkout] actual Pi model IDs differ from the explicit checkout provider; not accepted.' >&2; exit 1; }"
+			],
+			"replace": [
+				"true || { echo '[use-dev-checkout] actual Pi model IDs differ from the explicit checkout provider; not accepted.' >&2; exit 1; }"
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signatureSource": "plugins/herdr/use-dev-checkout.test.mjs",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			},
+			"signature": "[QK:HERDR-DEV-NO-SUCCESS-ON-DRIFT]"
+		}
+	]
+}

package/scripts/mutants/pi-durable.json

@@ -277,6 +277,123 @@
 				"output": "mcp/entwurf-bridge/dist"
 			}
 		},
+		{
+			"claim": "PI-DURABLE-RECEIVER-READ-WITHDRAWS-STALE",
+			"title": "an inbox read no longer withdraws the notices its drain made stale, so each still-queued notice is placed later as its own run and an empty read (#140)",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["\t\t\t\tawait withdrawDrained(context);\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RECEIVER-READ-WITHDRAWS-STALE]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RECEIVER-FOREIGN-GARDEN-READ-KEEPS",
+			"title": "the per-notice file predicate is bypassed, so any read — another garden's included — withdraws notices whose own mail is still unread, and that mail is never announced again",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["\t\t\tif (notice.fresh.some((name) => unread.has(`${name}.delivered`))) continue;\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RECEIVER-FOREIGN-GARDEN-READ-KEEPS]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RECEIVER-PARTIAL-DRAIN-WITHDRAWS-ONLY-ARCHIVED",
+			"title": "the withdrawal runs only after a successful read, so a drain that failed part-way leaves the notices of the mail it already archived queued, stale",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": [
+				"\t\t\treturn await call();\n\t\t} finally {\n\t\t\ttry {\n\t\t\t\tawait withdrawDrained(context);\n\t\t\t} finally {\n\t\t\t\tleaveGate();\n\t\t\t}\n\t\t}\n"
+			],
+			"replace": [
+				"\t\t\tconst answered = await call();\n\t\t\tif (!answered.isError) await withdrawDrained(context);\n\t\t\treturn answered;\n\t\t} finally {\n\t\t\tleaveGate();\n\t\t}\n"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RECEIVER-PARTIAL-DRAIN-WITHDRAWS-ONLY-ARCHIVED]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RECEIVER-READ-SERIALIZED",
+			"title": "an inbox read no longer waits for the doorbell's gate, so a drain that overtakes an admission in flight withdraws before that notice's handle exists and the notice stays queued, stale",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["\t\tawait enterGate();\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RECEIVER-READ-SERIALIZED]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RECEIVER-ARRIVAL-DURING-READ-ANNOUNCED",
+			"title": "the gate opening after a read forgets the signal that landed while it was held, so mail that arrived after the drain is never announced until another arrival",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["\t\tif (pending) void ring(\"signal\");\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RECEIVER-ARRIVAL-DURING-READ-ANNOUNCED]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RECEIVER-WITHDRAW-FAILURE-KEEPS-READ",
+			"title": "a notice whose native withdraw rejected is put back among the held ones, so every later read retries that withdraw and names the same failure again",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": [
+				"\t\t\t\tnoteWithdrawalFailure({ reason: \"abort-failed\", requestId: notice.requestId, detail: describeError(error) });\n"
+			],
+			"replace": [
+				"\t\t\t\tnoteWithdrawalFailure({ reason: \"abort-failed\", requestId: notice.requestId, detail: describeError(error) });\n\t\t\t\tnotices.push(notice);\n"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RECEIVER-WITHDRAW-FAILURE-KEEPS-READ]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-RECEIVER-INSPECTION-FAILURE-KEEPS-NOTICES",
+			"title": "a mailbox that could not be listed is judged as if it held no unread mail, so every held notice is withdrawn while its mail may still be unread",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": [
+				"\t\t\tnoteWithdrawalFailure({ reason: \"inspection-failed\", detail: `${inbox}: ${describeError(error)}` });\n\t\t\treturn;\n"
+			],
+			"replace": [
+				"\t\t\tnoteWithdrawalFailure({ reason: \"inspection-failed\", detail: `${inbox}: ${describeError(error)}` });\n\t\t\tunread = new Set();\n"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-RECEIVER-INSPECTION-FAILURE-KEEPS-NOTICES]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
 		{
 			"claim": "PI-DURABLE-CARRIER-RELOCATION-TWO-RULES",
 			"title": "a carrier file's import of a sibling keeps its .ts specifier, so the installed carrier asks Node for a file that was never emitted",

package/scripts/mutants/release-gate.json

@@ -151,8 +151,12 @@
 			"claim": "QUALIFY-FILTER-READS-PUSH-RANGE",
 			"title": "the filter reads the tip commit instead of the two-dot push range - the exact misreading that once concluded four of the five historical qualification reds would have been skipped",
 			"subject": "scripts/ci-qualify-decide.sh",
-			"find": ["CHANGED=\"$(git -C \"$REPO_DIR\" diff --name-only \"$BEFORE\"..\"$HEAD_SHA\" 2>/dev/null)\""],
-			"replace": ["CHANGED=\"$(git -C \"$REPO_DIR\" diff --name-only \"$HEAD_SHA~1\"..\"$HEAD_SHA\" 2>/dev/null)\""],
+			"find": [
+				"CHANGED=\"$(git -C \"$REPO_DIR\" diff --no-renames --no-ext-diff --no-textconv --name-only \"$BEFORE\"..\"$HEAD_SHA\" 2>/dev/null)\""
+			],
+			"replace": [
+				"CHANGED=\"$(git -C \"$REPO_DIR\" diff --no-renames --no-ext-diff --no-textconv --name-only \"$HEAD_SHA~1\"..\"$HEAD_SHA\" 2>/dev/null)\""
+			],
 			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
 			"timeoutSeconds": 180,
 			"signature": "[QK:QUALIFY-FILTER-READS-PUSH-RANGE]",
@@ -169,6 +173,28 @@
 			"signature": "[QK:QUALIFY-FILTER-REPLAYS-PAST-CATCHES]",
 			"signatureSource": "scripts/check-release-gate-outcomes.ts"
 		},
+		{
+			"claim": "QUALIFY-FILTER-SUBJECT-HUNKS",
+			"title": "data-subject hunk refinement collapses back to file identity, so a version-only pin repeats the unchanged mutant body",
+			"subject": "scripts/ci-qualify-decide.sh",
+			"find": ["\t\t\t\tif subject_find_untouched \"$file\"; then"],
+			"replace": ["\t\t\t\tif false; then"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:QUALIFY-FILTER-SUBJECT-HUNKS]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
+		{
+			"claim": "QUALIFY-FILTER-TOML-ONLY-REFINEMENT",
+			"title": "Markdown/JSON data re-enter hunk refinement, so an out-of-find presence restatement or later duplicate JSON key skips a body whose mutant now survives",
+			"subject": "scripts/ci-qualify-decide.sh",
+			"find": ["\t\t\t\t\t*.toml) ;;"],
+			"replace": ["\t\t\t\t\t*.toml|*.json|*.md) ;;"],
+			"gate": ["bash", "run.sh", "check-release-gate-outcomes"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:QUALIFY-FILTER-TOML-ONLY-REFINEMENT]",
+			"signatureSource": "scripts/check-release-gate-outcomes.ts"
+		},
 		{
 			"claim": "MUX-LIFECYCLE-IS-RELEASE-MUST",
 			"title": "the integrated mux lifecycle stays listed but bypasses run_live_step, so a missing prerequisite returns SKIP into a branch that never classifies it and the cut reads green",

package/scripts/mutants/resume-launch-identity.json

@@ -91,6 +91,21 @@
 			"timeoutSeconds": 60,
 			"signature": "[QK:RESUME-ID-SESSION-ABSOLUTE]",
 			"signatureSource": "scripts/check-resume-launch-identity.ts"
+		},
+		{
+			"claim": "RESUME-ID-ACP-EXACT-CURATION",
+			"title": "judging the RECORDED provider instead of the emitted one lets a bare Claude 5 id recorded under another provider reopen under entwurf on a Cortex row",
+			"subject": "pi-extensions/lib/resume-launch-identity.ts",
+			"find": [
+				"\tif (provider === PROVIDER_ID && !isCuratedAcpModelId(model)) throw new AcpModelNotCuratedError(model);"
+			],
+			"replace": [
+				"\tif (identity.provider === PROVIDER_ID && !isCuratedAcpModelId(model)) throw new AcpModelNotCuratedError(model);"
+			],
+			"gate": ["bash", "run.sh", "check-resume-launch-identity"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:RESUME-ID-ACP-EXACT-CURATION]",
+			"signatureSource": "scripts/check-resume-launch-identity.ts"
 		}
 	]
 }

package/scripts/mutants/v2-visible-resume.json

@@ -210,6 +210,17 @@
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-SHARED-ID-GRAMMAR]",
 			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-ACP-MODEL-REFUSED",
+			"title": "not matching AcpModelNotCuratedError turns the named refusal into a raw error escaping the resume verb",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\tif (err instanceof AcpModelNotCuratedError) {"],
+			"replace": ["\t\t\tif (err instanceof AcpModelNotCuratedError && false) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-ACP-MODEL-REFUSED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		}
 	]
 }

package/scripts/resolve-acp-bridge.ts

@@ -16,7 +16,7 @@ import type { ResolvedTarget } from "../pi-extensions/lib/entwurf-core.ts";
 import { getRegistryRouting } from "../pi-extensions/lib/entwurf-core.ts";
 
 const isRemote = process.argv[2] === "remote";
-const target: ResolvedTarget = { provider: "entwurf", model: "claude-sonnet-5", explicitOnly: false };
+const target: ResolvedTarget = { provider: "entwurf", model: "claude-sonnet-5-5", explicitOnly: false };
 
 // Throws EntwurfRoutingError (non-zero exit) when the bridge cannot be resolved —
 // exactly the fail-fast the smoke wants to observe as a failure, not a pass.

package/scripts/smoke-acp-bundled-mcp-live.ts

@@ -56,7 +56,7 @@ import { skipLive } from "./lib/live-skip.ts";
 import { PI_BOOT_TIMEOUT_MS, waitForPiRecord } from "./lib/pi-record-discovery.ts";
 
 const ACP_PROVIDER = "entwurf";
-const ACP_MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5";
+const ACP_MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5-5";
 
 const REAL_CONTROL_DIR = path.join(os.homedir(), ".pi", "entwurf-control");
 const SOCKET_SUFFIX = ".sock";

package/scripts/smoke-acp-carrier-augment-live.ts

@@ -48,7 +48,7 @@ import { fileURLToPath } from "node:url";
 import { skipLive } from "./lib/live-skip.ts";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5";
+const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5-5";
 const PROVIDER = "entwurf";
 const TURN_TIMEOUT_MS = Number(process.env.ENTWURF_ACP_PROVIDER_TIMEOUT_MS) || 240_000;
 

package/scripts/smoke-acp-long-turn-live.ts

@@ -44,7 +44,7 @@ import { fileURLToPath } from "node:url";
 import { skipLive } from "./lib/live-skip.ts";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const MODEL = process.env.ENTWURF_ACP_LONG_TURN_MODEL?.trim() || "claude-sonnet-5";
+const MODEL = process.env.ENTWURF_ACP_LONG_TURN_MODEL?.trim() || "claude-sonnet-5-5";
 const PROVIDER = "entwurf";
 
 /** The cutoff this cut removed. The turn must outlive it. */

package/scripts/smoke-acp-mcp-live.ts

@@ -30,7 +30,7 @@ import { skipLive } from "./lib/live-skip.ts";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const PROBE_SERVER = join(REPO_ROOT, "scripts", "fixtures", "probe-mcp-server.ts");
-const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5";
+const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5-5";
 const PROVIDER = "entwurf";
 const TURN_TIMEOUT_MS = Number(process.env.ENTWURF_ACP_PROVIDER_TIMEOUT_MS) || 240_000;
 

package/scripts/smoke-acp-memory-containment-live.ts

@@ -70,7 +70,7 @@ import {
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
 import { skipLive } from "./lib/live-skip.ts";
 
-const REQUESTED_MODEL_ID = process.env.ENTWURF_ACP_MEMORY_MODEL ?? "claude-sonnet-5";
+const REQUESTED_MODEL_ID = process.env.ENTWURF_ACP_MEMORY_MODEL ?? "claude-sonnet-5-5";
 const ALLOW_PATH_FALLBACK = process.env.ENTWURF_ACP_MEMORY_ALLOW_PATH_FALLBACK === "1";
 const RAW_TAIL_CAP = 64 * 1024;
 

package/scripts/smoke-acp-ordering-probe-live.ts

@@ -93,7 +93,7 @@ const SHIM_RUNTIME_FILES: readonly string[] = [
 	join(REPO_ROOT, "scripts", "lib", "probe-cli-target.ts"),
 	join(REPO_ROOT, "scripts", "lib", "probe-event-log.ts"),
 ];
-const MODEL_ID = process.env.ENTWURF_ACP_PROBE_MODEL?.trim() || "claude-sonnet-5";
+const MODEL_ID = process.env.ENTWURF_ACP_PROBE_MODEL?.trim() || "claude-sonnet-5-5";
 const D1_MS = Number(process.env.PROBE_D1_MS ?? "2000") || 2000;
 const D2_MS = Number(process.env.PROBE_D2_MS ?? "8000") || 8000;
 const TEXT_TAIL_CAP = 400;

package/scripts/smoke-acp-overlay-live.ts

@@ -57,7 +57,7 @@ import {
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
 import { skipLive } from "./lib/live-skip.ts";
 
-const REQUESTED_MODEL_ID = process.env.ENTWURF_ACP_OVERLAY_MODEL ?? "claude-sonnet-5";
+const REQUESTED_MODEL_ID = process.env.ENTWURF_ACP_OVERLAY_MODEL ?? "claude-sonnet-5-5";
 const ALLOW_PATH_FALLBACK = process.env.ENTWURF_ACP_OVERLAY_ALLOW_PATH_FALLBACK === "1";
 const RAW_TAIL_CAP = 64 * 1024;
 

package/scripts/smoke-acp-provider-live.ts

@@ -29,7 +29,7 @@ import { fileURLToPath } from "node:url";
 import { skipLive } from "./lib/live-skip.ts";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5";
+const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5-5";
 const PROVIDER = "entwurf";
 const TURN_TIMEOUT_MS = Number(process.env.ENTWURF_ACP_PROVIDER_TIMEOUT_MS) || 240_000;
 

package/scripts/smoke-acp-raw-turn-live.ts

@@ -36,7 +36,7 @@ import { connectAcpClient } from "../pi-extensions/lib/acp/acp-client.ts";
 import { terminateChild } from "./lib/acp-child-cleanup.ts";
 import { skipLive } from "./lib/live-skip.ts";
 
-const REQUESTED_MODEL_ID = process.env.ENTWURF_ACP_RAW_TURN_MODEL ?? "claude-sonnet-5";
+const REQUESTED_MODEL_ID = process.env.ENTWURF_ACP_RAW_TURN_MODEL ?? "claude-sonnet-5-5";
 const ALLOW_PATH_FALLBACK = process.env.ENTWURF_ACP_RAW_TURN_ALLOW_PATH_FALLBACK === "1";
 const RAW_TAIL_CAP = 64 * 1024; // cap captured raw NDJSON to 64KB tail on report.
 

package/scripts/smoke-acp-session-reuse-live.ts

@@ -36,7 +36,7 @@ import { normalizeContext } from "@earendil-works/pi-ai";
 import { skipLive } from "./lib/live-skip.ts";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5";
+const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5-5";
 // The pi built-ins the Claude child also exposes natively. pi declares its tool surface on
 // every turn, and since 0.86 that declaration reaches a provider as the leading system
 // message's `toolsAdded` (`normalizeContext`), which backend.ts replays for the exclude-tools

package/scripts/smoke-acp-skill-live.ts

@@ -31,7 +31,7 @@ import { fileURLToPath } from "node:url";
 import { skipLive } from "./lib/live-skip.ts";
 
 const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
-const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5";
+const MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5-5";
 const PROVIDER = "entwurf";
 const TURN_TIMEOUT_MS = Number(process.env.ENTWURF_ACP_PROVIDER_TIMEOUT_MS) || 240_000;
 

package/scripts/smoke-acp-socket-citizen-live.ts

@@ -20,7 +20,7 @@
 // LIVE-only (spawns a real pi + opens a real socket) — kept OUT of `pnpm check`;
 // honest skip when LIVE!=1 (skip = CI safety, NOT an acceptance PASS).
 //   LIVE=1 ./run.sh smoke-acp-socket-citizen-live
-//   override model via ENTWURF_S1_MODEL (default claude-opus-5).
+//   override model via ENTWURF_S1_MODEL (default claude-opus-5-5).
 
 import { type ChildProcess, spawn } from "node:child_process";
 import { existsSync } from "node:fs";
@@ -35,7 +35,7 @@ import { skipLive } from "./lib/live-skip.ts";
 import { PI_BOOT_TIMEOUT_MS, waitForPiRecord } from "./lib/pi-record-discovery.ts";
 
 const ACP_PROVIDER = "entwurf";
-const ACP_MODEL = process.env.ENTWURF_S1_MODEL?.trim() || "claude-opus-5";
+const ACP_MODEL = process.env.ENTWURF_S1_MODEL?.trim() || "claude-opus-5-5";
 
 const REAL_CONTROL_DIR = path.join(os.homedir(), ".pi", "entwurf-control");
 const SOCKET_SUFFIX = ".sock";

package/scripts/smoke-acp-v2-send-live.ts

@@ -89,7 +89,7 @@ import { skipLive } from "./lib/live-skip.ts";
 import { PI_BOOT_TIMEOUT_MS, waitForPiRecord } from "./lib/pi-record-discovery.ts";
 
 const ACP_PROVIDER = "entwurf";
-const ACP_MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5";
+const ACP_MODEL = process.env.ENTWURF_ACP_PROVIDER_MODEL?.trim() || "claude-sonnet-5-5";
 
 const REAL_CONTROL_DIR = path.join(os.homedir(), ".pi", "entwurf-control");
 const SOCKET_SUFFIX = ".sock";

package/scripts/smoke-entwurf-chain-live.ts

@@ -74,7 +74,7 @@ const REAL_CONTROL_DIR = path.join(os.homedir(), ".pi", "entwurf-control");
 const SOCKET_SUFFIX = ".sock";
 
 const GPT_TARGET = process.env.ENTWURF_CHAIN_GPT_TARGET?.trim() || "openai-codex/gpt-5.6-luna";
-const ACP_TARGET = process.env.ENTWURF_CHAIN_ACP_TARGET?.trim() || "entwurf/claude-sonnet-5";
+const ACP_TARGET = process.env.ENTWURF_CHAIN_ACP_TARGET?.trim() || "entwurf/claude-sonnet-5-5";
 const BOOT_TIMEOUT_MS = 45_000;
 const CLAUDE_TURN_TIMEOUT_MS = Number(process.env.ENTWURF_CHAIN_CLAUDE_TIMEOUT_MS) || 240_000;
 const CHAIN_TIMEOUT_MS = Number(process.env.ENTWURF_CHAIN_TIMEOUT_MS) || 420_000;

package/scripts/smoke-mux-lifecycle-live.ts

@@ -109,7 +109,7 @@ const BRIDGE_LAUNCHER = path.join(REPO, "mcp", "entwurf-bridge", "start.sh");
 /** The two pi shapes. They differ in exactly one thing that matters here — whether the record
  * carries `provider=entwurf`, which is what makes the resume argv re-inject the bridge (#29). */
 const PI_NATIVE_MODEL = "openai-codex/gpt-6-luna";
-const PI_ACP_MODEL = "entwurf/claude-sonnet-5";
+const PI_ACP_MODEL = "entwurf/claude-sonnet-5-5";
 const CLAUDE_MODEL = "claude-sonnet-5";
 
 // Bounded waits — harness-side only. Each names what it is waiting FOR, so a red run says which

package/scripts/tsconfig.json

@@ -27,6 +27,7 @@
 	"include": [
 		"./**/*.ts",
 		"../test/**/*.ts",
+		"../demo/**/*.ts",
 		"../pi-extensions/lib/**/*.ts",
 		// The behavior-adjacent tests the root config just excluded (#119 V2). Listed at
 		// pi-extensions/** rather than pi-extensions/lib/** so a test beside an extension