@junghanacs/entwurf 0.37.0 → 0.37.1

package/AGENTS.md

@@ -91,10 +91,10 @@ implement → affected focused gates → independent review → one amendment bu
           → affected qualification PARTIAL once if gate/mutant/matrix changed → full floor once on frozen candidate → commit
 ```
 
-- GLG-requested branch checkpoint commits keep completed subject/proof bundles small: scoped review, affected focused checks and normal hooks/shared scanner before each checkpoint, with known RED/unmeasured boundaries recorded. A checkpoint is not frozen-candidate acceptance. The sequence above owns final candidate acceptance: the affected qualification PARTIAL, frozen FULL and native/LIVE/release floors remain mandatory before landing, and the prepared SHA's CI qualification body before shipment, never inherited from an interim commit.
+- GLG-requested branch checkpoint commits keep completed subject/proof bundles small: scoped review, affected focused checks and normal hooks/shared scanner before each checkpoint, with known RED/unmeasured boundaries recorded. A checkpoint is not frozen-candidate acceptance. The sequence above owns final candidate acceptance: the affected qualification PARTIAL, frozen FULL and native/LIVE/release floors remain mandatory before landing, and the prepared SHA's exact-SHA CI push run (its four required jobs; the qualification body is no longer a release axis, #144) before shipment, never inherited from an interim commit.
 - Inner loop runs only affected gates; review and its corrections finish before the full floor.
 - A changed contract names a production subject and independent oracle; its focused assertion has a stable QK and exact-once mutant. Matrices change by their declared axes/cells, not appended anecdotes.
-- Development never runs the whole qualification body. A changed gate/mutant/matrix runs its affected exact-argv groups once, after review and amendment, as PARTIAL receipts (`./run.sh check-gate-qualification --group '<argv JSON>' --receipt <absolute path outside the repo>`); the manifest head stays in the deterministic floor. The whole body runs once per cut, in the prepared SHA's CI: a prepared state awaits it and is never presumed PASS, and a release requires the exact-SHA evidence VERIFY names, never a nearby green run or a PARTIAL.
+- Development never runs the whole qualification body. A changed gate/mutant/matrix runs its affected exact-argv groups once, after review and amendment, as PARTIAL receipts (`./run.sh check-gate-qualification --group '<argv JSON>' --receipt <absolute path outside the repo>`); the manifest head stays in the deterministic floor. Since #144 (GLG, 2026-10-16) the whole body is not a release axis: it runs only on the weekly schedule or a manual `qualify=true` dispatch, as a drift diagnostic no cut waits for, and no cut owes a local whole body either. A release states that kill-power was not re-measured at its SHA and lists any earlier-candidate PARTIAL with its own candidate; a PARTIAL never stands for the release, and the release still requires the exact-SHA evidence VERIFY names, never a nearby green run.
 - Freeze the candidate while the full floor runs; any worktree/index movement voids that receipt. Pre-commit is not the full floor.
 - LIVE/release floors are not lowered by a shorter inner loop. Failed gate or evidence downgrade blocks the relevant commit/release decision.
 

package/CHANGELOG.md

@@ -4,6 +4,211 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.37.1 - 2026-10-16
+
+### Verification
+
+- **The native-module ingress claims get their own mutant coordinate (#144).** The 13
+  `PI-DURABLE-MODULE-*` claims carry their QKs only in `pi-durable-native-module.test.ts`, and a
+  kill is attributed from the mutant's own QK, yet each of them re-ran all six pi-durable beside
+  tests. `./run.sh check-pi-durable-native-module` runs that one file and is now their gate argv;
+  `check-pi-durable-beside` no longer runs it. No claim, find/replace, signature or build changes.
+- **The carrier claims get their own mutant coordinate too (#144).** The 30 claims whose QKs live
+  only in `pi-durable-carrier.test.ts` move to `./run.sh check-pi-durable-carrier`, which runs that
+  file alone; `check-pi-durable-beside` keeps the adapter, verifier, preflight and owner-join files
+  and their 39 claims. All three coordinates stay in `check:contracts`, and every claim keeps its
+  subject, find/replace, signature and bridge build (the carrier test reaches the bridge through the
+  bootstrap). Measured once on one host, on an isolated copy of `5e1e629` (M1, a composition
+  measurement, not a kill run): the six files together took 24.5s, the carrier file alone 17.6s and
+  the native-module file alone 1.7s, so before the split every mutant of the former six-file
+  `check-pi-durable-beside` group (82; the two `check-node-floor-coherence` claims were never in it)
+  paid the carrier's time. Those seconds are local, not CI timing. A moved mutant no longer runs beside the other
+  files; that was incidental exposure, never the ground of a kill, which is attributed only from the
+  mutant's own QK.
+- **The whole qualification body is no longer a release axis (#144).** By GLG's decision of
+  2026-10-16 (split local gates from CI; a named loss of verification is accepted to stop paying for
+  the same proof twice), no push runs the body any more and no cut waits for it. Measured from the
+  GitHub API over one cut window (v0.36.1 push `cab1b9f` through the Herdr 0.37.0 snapshot `5e1e629`,
+  six `ci.yml` runs): the body ran five times on five SHAs for 506.3 minutes of `check`-step time,
+  once as a dispatch that re-bought it for a SHA whose push had skipped it, while a push run without
+  it took 10.9 minutes wall. That is the cost before this change, not a measured saving. The body now
+  runs only on the weekly schedule or a manual `qualify=true` dispatch, as a drift diagnostic. The
+  push-range filter that decided when it ran (`scripts/ci-qualify-decide.sh`, its replay fixture, and
+  the five `QUALIFY-FILTER-*` claims) is retired with it, and the release skill no longer dispatches
+  the body.
+- **The release oracle takes the push run as its only witness, and no longer reads the body
+  (#144).** `verify-exact-ci.sh` asks for push runs of the exact SHA (`--event push`, and a jq that
+  keeps only push runs) and judges the four required jobs. Its fourth axis, the body step, is
+  removed with `RELEASE-SHA-QUALIFIED-IN-CI`, and its PASS prints that the body is not a release
+  axis instead of a body success line. `check-release-gate-outcomes` drives the shipped script
+  through a fake `gh`: `RELEASE-WITNESS-IS-PUSH-RUN` pins the one `run list` call it sends (the
+  fake evaluates no jq, and GitHub's own filtering is not observed), `RELEASE-ORACLE-REFUSES-NON-SUCCESS-JOB`
+  refuses each required job that is absent, failed, skipped, cancelled or unconcluded, and
+  `RELEASE-ORACLE-CLAIMS-NO-BODY` passes the four jobs whether the body step is skipped, absent or
+  green without ever naming it. The `release-gate` lane is 21 claims.
+- **Named loss.** A release no longer re-measures the kill-power of the committed claims at its SHA.
+  Its section says so (`Kill-power re-measured at this shipped SHA: none`), and lists a PARTIAL
+  receipt only with its own candidate, never summed into a count for the release. The weekly run is
+  a drift window, not a guarantee for any commit.
+- **The mux lifecycle LIVE runs on a different native model, and before the ACP tier.** In 0.37.0's
+  first LIVE run and in this cut's first one, `smoke-mux-lifecycle-live` went red the same way: its
+  pi-native sibling (`openai-codex/gpt-6-luna`) was alive, ran shell no-ops, answered "ACK" and never
+  called the callback tool within 300 s. The cause is not determined; one instrumented diagnostic run
+  saw the callback declared in the first request and called back in about 4 s, so the failure did
+  not reproduce. The test's native model is now `openai-codex/gpt-6.1-sol:low` (`VERIFY.md` names it), and
+  `release-gate` runs this step right after the v2 matrix, before the ACP tier, so a red answer comes
+  before the ACP turns are spent. This is a test-model and order change, not a fix: the `gpt-6-luna`
+  cause stays undetermined. In this cut's second and third LIVE runs the step passed on the new
+  model and order; those are two observations, and neither proves the earlier cause.
+- **The Codex first-admission LIVE now says the id prefixes are part of the ids.** In this cut's
+  second LIVE run the moved mux step passed, and `smoke-codex-fresh-live` failed on its last check:
+  the Codex sibling's final `entwurf_v2` arguments carried `PI_SESSION_ID=485` and
+  `PI_WINDOW_ID=1130` where the launch receipt printed `$485` and `@1130`, with every other field
+  exact. Its instruction named the `$` and `@` only inside the placeholder text; it now tells the
+  sibling to copy both ids byte for byte from the receipt's `window:` line, keeping each leading
+  prefix. The exact-argument comparison is unchanged and nothing is stripped. That the wording
+  invited the drop is a hypothesis: the same code and model passed in 0.37.0. In this cut's third
+  LIVE run the step passed with both prefixes exact (`$488`, `@1136`); that is one run, and it does
+  not prove that the wording caused the earlier drop or rule out model variation.
+
+
+### Release boundary and verification
+
+- **Scope.** A core patch over `v0.37.0` for #144: `1df7926` (the pi-durable native-module and
+  carrier mutant coordinates, and the release oracle's job refusal driven through a fake `gh`) and
+  `c208d37` (the whole qualification body retired as a release axis). The Herdr plugin snapshot
+  `v2026.10.15-herdr.0.37.0` at `5e1e629` is unchanged; pi 1.3.0 (#145) is not in this cut.
+- **Kill-power re-measured at this shipped SHA: none (all 979 committed claims not re-proved,
+  #144).**
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 5e1e629a5826 surface
+  e907429b9c00 -- `check-pi-durable-native-module` 13/13 receipt e0f96c3374de
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 5e1e629a5826 surface
+  e907429b9c00 -- `check-pi-durable-beside` 69/69 receipt 36e46bdd4cf0
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 5e1e629a5826 surface
+  ea26d369b1af -- `check-pi-durable-carrier` 30/30 receipt 01f9096a8eb5
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 5e1e629a5826 surface
+  ea26d369b1af -- `check-pi-durable-beside` 39/39 receipt 93d9f5cdf699
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 5e1e629a5826 surface
+  980384f2532f -- `check-release-gate-outcomes` 25/25 receipt eedfb075bf07
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 5e1e629a5826 surface
+  980384f2532f -- `check-gate-manifests` 52/52 receipt 8a976415c566
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 5e1e629a5826 surface
+  980384f2532f -- `check-gate-qualification.ts --attribution-self-test` 1/1 receipt 3edfa0af9d3a
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 1df7926257a9 surface
+  106c59c5cb99 -- `check-release-gate-outcomes` 21/21 receipt c869965b8dbc
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 1df7926257a9 surface
+  106c59c5cb99 -- `check-gate-manifests` 52/52 receipt 08eae97d65b0
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head 1df7926257a9 surface
+  106c59c5cb99 -- `check-gate-qualification.ts --attribution-self-test` 1/1 receipt 276118d0ba9b
+- Earlier-candidate PARTIAL (operator-attested, not this SHA): head c208d37f1442 surface
+  d941509e2e9e -- `check-release-gate-outcomes` 21/21 receipt cd0a59e12569 (taken after the
+  mux model/order change and before the Codex id-prefix sentence; kept locally under
+  `.tmp-verify/release-0.37.1/fix-mux-first/partial-evidence/`)
+- **Not re-measured for the Codex id-prefix sentence.** The five mutants whose subject is
+  `scripts/lib/codex-fresh-live-protocol.ts` were reviewed as lying outside the changed bytes, and
+  their `check-mux-fresh-call` group (150 mutants over 18 subjects) was not run, so those five
+  kills are not re-measured on the new bytes. The new sentence has no deterministic assertion of
+  its own: deleting it would leave the deterministic suite green, and only a LIVE run would see it.
+- **Where those receipts are published.** Each receipt above except the newest (`cd0a59e12569`) is
+  listed with its candidate in a #144 checkpoint comment, so another host can trace it without this
+  operator's paths; the newest is local and operator-attested only, in no #144 comment. A′
+  ([#144 comment 6195663856](https://github.com/junghan0611/entwurf/issues/144#issuecomment-6195663856)),
+  B ([6196318282](https://github.com/junghan0611/entwurf/issues/144#issuecomment-6196318282)),
+  RO-1 ([6200017214](https://github.com/junghan0611/entwurf/issues/144#issuecomment-6200017214)) and
+  P1 ([6202638853](https://github.com/junghan0611/entwurf/issues/144#issuecomment-6202638853)).
+  The links add location only; they prove nothing new.
+- **Branch CI, not this SHA.** The pushed branch head `c208d37` ran the new policy's first push CI
+  (run 38811304369): the four required jobs green, the body step skipped, created to last required
+  job 645 s. That run is evidence for `c208d37`; the prepared SHA owes its own.
+- **Unpublished candidate carrier.** As in 0.37.0, `plugins/herdr/runtime-lock.json` names the
+  closed `herdr-checkout` source, because 0.37.1 has no published integrity yet and the runtime
+  refuses an npm lock whose version is not the checkout's (`scripts/herdr-runtime.mjs:355-358`).
+  The npm 0.37.0 bytes and every existing tag are unchanged; re-pinning registry bytes is a later,
+  separate Herdr snapshot.
+- **No local static floor; it is the exact CI's.** `check:hermetic` carries
+  `check-herdr-plugin-build` and `check-herdr-sandbox`, which must not run on the operator host,
+  and `release-gate`'s first MUST step is `pnpm run check:full`. By GLG's decision of 2026-10-16
+  for this cut (a new approval, not inherited from 0.37.0), `check:full` is not run locally at P4,
+  at P5's first step or at M0, and is owed whole to the prepared SHA's CI.
+- **LIVE, taken step by step, not as `release-gate --cut`.** The gate's 23 non-static MUST steps
+  and its BEHAVIOR step ran in the gate's own order, command, environment and working directory,
+  stopping at the first red, with each run's candidate fingerprint the same at freeze, before and
+  after. The first run (`c208d37` with this preparation's first edits) passed 18 MUST steps and
+  failed `smoke-mux-lifecycle-live` at its old position; the second (with the model and order
+  change) passed 21 and failed `smoke-codex-fresh-live` on the dropped id prefixes. Both red
+  receipts are kept. The third ran on the tested bytes, `c208d37` with this cut's source and package
+  edits; after it only `CHANGELOG.md` and `NEXT.md` changed, to record these results. It ran every
+  step itself, none reused: **MUST 23/23 PASS, FAIL 0, SKIP 0;
+  BEHAVIOR 1/1 PASS.** `smoke-mux-lifecycle-live` passed 81 checks as step 5,
+  `smoke-codex-fresh-live` 66 assertions against one owned app-server in its own tmux session
+  (named pane pid with its recorded start time, `gpt-5.6-luna` and `openai-codex/gpt-5.6-luna`,
+  stopped by one TERM after the run with its subtree, listener and control alias gone), and
+  `smoke-pi-durable-fresh-live` 36 assertions. Receipts on the operator host, under
+  `.tmp-verify/release-0.37.1/`: the third run's freeze fingerprint `3a90e3f1f2a2`, gate log
+  `94d14b3d42af` and step-log manifest `ded0d693c3ff` (24 logs); the red runs' gate logs
+  `3e16e8964f9e` and `da9622fb5312`. This is local LIVE evidence, not a release-gate verdict, and
+  no static CI result is claimed by it.
+- **Publication boundary.** The LIVE and PARTIAL lines above are local preparation evidence.
+  Shipping this version separately requires the prepared SHA's exact CI (the four required jobs), a
+  preserved accepted candidate made from that SHA, and the tag and GitHub Release cut from it; npm
+  publication is the operator's.
+
+## v2026.10.15-herdr.0.37.0 — Herdr Entwurf plugin 0.37.0
+
+A separate Herdr plugin snapshot, not another core release: core package 0.37.0 and
+its `v0.37.0` tag remain unchanged. The operator has published the core to npm.
+
+### Herdr plugin
+
+- **Re-pin the published core 0.37.0 and close the checkout window.**
+  `plugins/herdr/runtime-lock.json` returns from the `herdr-checkout` carrier that 0.36.1 and
+  0.37.0 rode to production npm source `@junghanacs/entwurf@0.37.0` with the registry's
+  measured sha512 (`sha512-ETVgzMWf…7964A==`). The plugin manifest moves 0.36.0 → 0.37.0;
+  admission remains Herdr >= 0.9.0 and the one-build/one-pane/Linux shape is unchanged.
+- **The same core capability through Herdr.** The runtime this snapshot acquires carries core
+  0.36.1 and 0.37.0: the Claude ACP driver on 0.90.0, Codex app-server socket ownership read
+  from the kernel, the durable app's transport and compaction tuning (#143) and its project
+  skill list (`4968ffd`). The measured Herdr is the 0.9.5 pin that landed in core 0.37.0
+  (`d8cd8f3`). This snapshot changes no rail, gate or mutant, and Pi's accepted range is the
+  same as 0.36.0's.
+- **Upgrade by acquisition source, not just version.** A settled npm-source 0.36.0 installation
+  can rebind under the plugin README's ownership conditions. A host that installed an
+  intervening `herdr-checkout` candidate must explicitly deactivate by its own absolute runtime
+  path before reinstalling the npm-source snapshot. No operator installation or active session
+  is rewired by this release work.
+
+### Source-specific verification
+
+- Registry metadata reports version/latest 0.37.0, repair 0.12.8-repair.1. The downloaded
+  tarball is 11144951 bytes, SHA256
+  `d127a927e6a9f9c6561f86975dc30697aebaa5eeb2de463e8f0d765ff12035ee`, byte-identical to the
+  preserved accepted core candidate; independently computed sha512 equals `dist.integrity`, and
+  the registry-shipped runtime helper is byte-equal to this checkout's.
+- The exact registry tarball passed the required Docker consumer without repacking
+  (`node:24-bookworm`, repoDigest `node@sha256:6dac556d…`).
+- **The npm runtime swap against the real registry**, by the registry-shipped helper in sandboxed
+  user roots, 20/20 checks. The 0.36.0 runtime was seeded from its own committed lock; the swap
+  to 0.37.0 took one acquisition, the cached tarball's sha512 equals the lock and its sha256
+  equals the ready journal's observed digest and the accepted candidate. The `installing`
+  journal carried the 0.36.0 identity as `previousRuntime` and the `runtime-ready` journal
+  carries `null`; when acquisition began the 0.36.0 tree was still at the active address. A
+  manually seeded torn swap (the active tree moved to the backup address with a half candidate
+  in staging; not a killed process) was restored before acquisition and reported
+  `recovered: torn-swap-with-candidate`. An exact re-request acquired nothing and left journal
+  and tree byte-identical, and the owned removal reclaimed cache, runtime and journal. Not
+  certified by these cells: Herdr's install/update relocation, harness wiring, the installed
+  CLI's deactivate path, a model turn, or recovery from a real kill.
+- **Focused gates on the branch**, with HEAD, index and work surface unchanged across them:
+  `check-herdr-supply` (11 assertions), `check-herdr-plugin` (49),
+  `check-herdr-plugin-profile` (14), `check-herdr-runtime-bootstrap` (31),
+  `check-herdr-activation` (33), `check-herdr-placement` (25), `check-herdr-fresh-call` (45)
+  and `check-gate-manifests` (982 committed mutants across 72 lanes validated, none executed).
+  `check-herdr-plugin-build` and `check-herdr-sandbox` were not run locally because they run
+  the operator's own herdr; they ride the pushed SHA's FULL floor in CI.
+- Pending, and not claimed here: the pushed SHA's four-job CI with the qualification body, and
+  the public-ref install/use/deactivate journey on Herdr 0.9.5. Earlier npm or checkout-carrier
+  receipts cannot certify these source-specific axes.
+
 ## 0.37.0 - 2026-10-15
 
 ### pi-durable

package/CONTRIBUTING.md

@@ -30,7 +30,7 @@ pnpm check              # everyday core (prints wall time; <=60s on the referenc
 pnpm run check:full     # full deterministic floor — the required PR gate
 ```
 
-The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory; zero COMMITTED mutants executed — the self-test runs only its synthetic fixture mutants in tmp fixture repos — ~20s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on a branch push whose diff touched the qualification surface (and unconditionally on dispatch or the weekly schedule). Development never runs that whole body: a gate, mutant or matrix change runs only its affected exact-argv groups once, as PARTIAL receipts (`./run.sh check-gate-qualification --group '<argv JSON>' --receipt <absolute path outside the repo>`), and the whole body runs once per cut, in the prepared SHA's CI. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling"). No install or build lifecycle script installs git hooks: a global `core.hooksPath` guard that chains to repository-local hooks runs its own checks, then delegates — to `.husky/pre-commit` here, unless an executable `.git/hooks/pre-commit` takes precedence.
+The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory; zero COMMITTED mutants executed — the self-test runs only its synthetic fixture mutants in tmp fixture repos — ~20s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs only on the weekly schedule or a manual `qualify=true` dispatch, as a drift diagnostic outside release acceptance (#144). Development never runs that whole body: a gate, mutant or matrix change runs only its affected exact-argv groups once, as PARTIAL receipts (`./run.sh check-gate-qualification --group '<argv JSON>' --receipt <absolute path outside the repo>`), and no cut waits for the whole body. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling"). No install or build lifecycle script installs git hooks: a global `core.hooksPath` guard that chains to repository-local hooks runs its own checks, then delegates — to `.husky/pre-commit` here, unless an executable `.git/hooks/pre-commit` takes precedence.
 
 For changes that touch backend launch, session lifecycle, or `_meta` shape, also run
 the live ACP smokes that cover the touched rail — at minimum:

package/VERIFY.md

@@ -95,8 +95,7 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 ### The canonical floor — two entry points
 
 - **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. One core member assumes a build output: the beside test `pi-extensions/entwurf-control.test.ts` (reached through `check-tests-beside-behavior`) registers the COMPILED bridge and refuses by name when it is absent. `prepare` normally builds it at install; after an `--ignore-scripts` install or a bridge source change, run `pnpm run build-bridge` (in the sandbox candidate when verifying one) before the core. The FULL tier carries the qualification HEAD (`check-gate-manifests`, through `check:hermetic`); the everyday core does not, and neither tier carries the separately scheduled mutant-executing body (`check-gate-qualification`).
-- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: the whole body runs only as the bare call — in the CI `check` job on a branch push that touched the qualification surface, and — for a cut — at the prepared SHA, where the exact-SHA release oracle requires that CI step once and the prepared state awaits it, never presumed PASS; a cut therefore batches its commits into that one prepared push (#132 took the cut's body off the local `release-gate`). Development runs no whole body (#133): a lane that changes a gate/mutant/matrix runs its affected exact-argv groups once, after review, as PARTIAL receipts — `./run.sh check-gate-qualification --group '<argv JSON>' --receipt <absolute path outside the repo>`, whose arguments reach the runner's parser unchanged and are refused there by name, before any body or snapshot, when malformed, missing or repeated. A receipt is a measurement of one group, never a qualification pass. Neither form is inside the default check chains; a semver TAG push triggers no CI at all, and the exact-SHA evidence a release quotes is whichever run at that commit CARRIES the body — the branch run when the push touched the qualification surface, else a dispatch run; a push that touched none of the qualification surface skips the body, and `workflow_dispatch -f qualify=true` plus a weekly `schedule` run it unconditionally — the exact-SHA release oracle refuses a SHA whose body step did not conclude success) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT). The gate's HEAD is separable and IS in the floor: `check-gate-manifests` runs the runner self-test, validates the committed manifest set against the origin index, and asserts the declared lane inventory, while executing zero COMMITTED mutants (the self-test runs only its synthetic fixture mutants, in tmp fixture repos) and never snapshotting the repo — three of the five reds qualification has ever produced in CI died in that head, in under five seconds.
-  - **Push matching is conservative and hunk-aware (#137).** Git ranges read mutant manifests from the named HEAD commit, not a later working tree. Signature sources and the existing deciding machinery always match at file level, including paths that are also subjects. Only TOML subjects (`.toml`) may skip, and only when every mutant's joined `find` span occurs exactly once on both blobs, stays on the same lines, and intersects no zero-context diff hunk. Markdown, JSON, code and unknown subject types remain file-level. An outside-find early return/import/caller change can weaken a code mutant without editing its literal find. A presence/`includes` oracle whose required literal is shorter than the find can be re-satisfied by an out-of-span restatement; a scratch-repo probe measured exactly that false SKIP for `ADMISSION-LEGACY-DOCUMENTED` in `DELIVERY.md`. A later duplicate JSON key wins under `JSON.parse`, which every current JSON data oracle uses. TOML refuses a redefined key, and the current TOML oracles are exact-count/absence checks; a future TOML subject with a presence oracle reopens this boundary. `QUALIFY-FILTER-TOML-ONLY-REFINEMENT` pins Markdown/JSON at file level. Moved, absent, ambiguous, binary or unreadable spans/diffs/manifests run the body with a named reason; renames are compared as delete/add. `--files-from` has no hunk evidence and retains path identity. There is no Herdr filename or release-shape exemption. Span matching is not proof of unchanged kill-power. The rule narrows per-push qualification to those declared TOML spans; forced/scheduled and exact-SHA release qualification remain the backstop. This narrows redundant data-only pushes, never the FULL floor or exact-SHA release body's obligation; a body-less plugin SHA cannot supply the core SHA's evidence.
+- **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: the whole body runs only as the bare call — in the CI `check` job on the weekly `schedule` or a `workflow_dispatch -f qualify=true`, never on a push. It is a drift diagnostic, not a release axis (#144): no cut waits for it and the exact-SHA release oracle reads only the push run's four required jobs. Development runs no whole body (#133): a lane that changes a gate/mutant/matrix runs its affected exact-argv groups once, after review, as PARTIAL receipts — `./run.sh check-gate-qualification --group '<argv JSON>' --receipt <absolute path outside the repo>`, whose arguments reach the runner's parser unchanged and are refused there by name, before any body or snapshot, when malformed, missing or repeated. A receipt is a measurement of one group on its own candidate, never a qualification pass and never coverage of a release. Neither form is inside the default check chains; a semver TAG push triggers no CI at all) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT). The gate's HEAD is separable and IS in the floor: `check-gate-manifests` runs the runner self-test, validates the committed manifest set against the origin index, and asserts the declared lane inventory, while executing zero COMMITTED mutants (the self-test runs only its synthetic fixture mutants, in tmp fixture repos) and never snapshotting the repo — three of the five reds qualification has ever produced in CI died in that head, in under five seconds.
   - **The snapshot is source-only (#125).** It replicates the git work surface and never copies an ignored artifact from the checkout. A gate that consumes an ignored build output — the compiled `entwurf-bridge` a pi citizen registers — declares it on each of its mutants (`"build": {"argv": [...], "output": "<dir>"}`, one declaration per gate group). For that group only, the runner builds the output from the snapshot's own bytes before the control, rebuilds it after every mutation and from the restored bytes before the post-control (which must reproduce the baseline digest), never counts a build red as a kill, voids a run whose gate writes into the output, and removes the output when the group ends. The runner self-test owns this as `[QK:QUALIFY-BUILD-*]`.
 - **Live floor:** `LIVE=1 ./run.sh release-gate <scratch-project-dir> --cut` — `pnpm run check:full` + the v2-native live gates + the ACP plugin acceptance floor. It reports a **two-tier summary**:
   - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, `doctor-pi-provider` (#81 — `check-bridge` proves the launcher this checkout SHIPS; this proves the invocation the operator's pi provider actually EXECS, by booting it and requiring the entwurf verb set back, because `command -v` answers yes for a command that exits 127; wired as a step on 2026-08-19 after a relocated pnpm cmd-shim cost a cut sixteen LIVE steps before the same fact surfaced at `smoke-acp-bundled-mcp-live`), the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end — the integrated `smoke-mux-lifecycle-live` (its own note below), and the two OMP steps 0.16.0 wired: `smoke-omp-receive-live` (the addressed roundtrip into a live omp citizen; it reads the capability registry and decides its own outcome rather than passing by default) and `smoke-omp-fresh-live` (the clause 7 receipt the release stop now requires). (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
@@ -116,7 +115,7 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 >
 > A cut that touches the prompt-lifecycle contract (no wall clock on a running turn) owes one long-turn acceptance the aggregate floor is too short to carry: `LIVE=1 ./run.sh smoke-acp-long-turn-live` drives a real turn whose tool work outlasts the retired 600s cutoff and requires exactly one cold ACP bootstrap in the transcript. It takes >12 minutes by construction and is on-demand, not part of `release-gate`.
 >
-> **The integrated mux lifecycle IS a release-gate MUST.** `LIVE=1 ./run.sh smoke-mux-lifecycle-live` enters through a real MCP `tools/call` on the shipped bridge launcher and follows one citizen the whole way: fresh-call launch receipt, the sibling's own nonce callback whose SENDER ENVELOPE is the address, an `entwurf_v2` control-socket send that lands in the sibling's own transcript, `entwurf_resume_call` REFUSED while that citizen is live, a stable-handle close proving pane and socket gone with the record preserved, delivery to the dormant citizen refused honestly, then the public `entwurf_resume_call` — whose LAUNCH and OBSERVATION receipts stay apart — and finally an `entwurf_v2` send the resumed session answers with a fact it was told BEFORE the window closed. That last step is the point: a socket answering under the same garden id proves a process stood up at that address, and only the recall proves the same conversation came back. Both pi provider shapes are driven to it (native `openai-codex/gpt-6-luna` and recorded-ACP `entwurf/claude-sonnet-5-5`, the only shape that re-injects a bridge extension), and the Claude Code cell ends where its capability ends: its resume is refused as `target-not-pi` with no window opened and no lock residue (the per-gid coordination lock is released).
+> **The integrated mux lifecycle IS a release-gate MUST.** `LIVE=1 ./run.sh smoke-mux-lifecycle-live` enters through a real MCP `tools/call` on the shipped bridge launcher and follows one citizen the whole way: fresh-call launch receipt, the sibling's own nonce callback whose SENDER ENVELOPE is the address, an `entwurf_v2` control-socket send that lands in the sibling's own transcript, `entwurf_resume_call` REFUSED while that citizen is live, a stable-handle close proving pane and socket gone with the record preserved, delivery to the dormant citizen refused honestly, then the public `entwurf_resume_call` — whose LAUNCH and OBSERVATION receipts stay apart — and finally an `entwurf_v2` send the resumed session answers with a fact it was told BEFORE the window closed. That last step is the point: a socket answering under the same garden id proves a process stood up at that address, and only the recall proves the same conversation came back. Both pi provider shapes are driven to it (native `openai-codex/gpt-6.1-sol:low` and recorded-ACP `entwurf/claude-sonnet-5-5`, the only shape that re-injects a bridge extension), and the Claude Code cell ends where its capability ends: its resume is refused as `target-not-pi` with no window opened and no lock residue (the per-gid coordination lock is released).
 >
 > One cell cannot be fully fenced, and that is recorded rather than glossed: the recorded-ACP pi cell runs under the operator's REAL home, because its provider spawns `claude` as a child that authenticates from there — measured, a fenced HOME kills that turn with `Authentication required` before the model is ever reached, and `CLAUDE_CONFIG_DIR` alone does not fix it. That is the same trade `smoke-acp-bundled-mcp-live` already makes. While that cell runs, its citizen's control socket and per-gid lock exist under the operator's own `~/.pi/entwurf-control` and `~/.pi/entwurf-v2-locks`; its meta store stays fixture, so no garden record is minted outside the fixture, and the run ends by proving all six real roots hold the entry sets they started with, with no fixture garden id and no leftover lock.
 >
@@ -210,16 +209,19 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 
 Do not collapse source, package, fixture, and native-host evidence into one “green.”
 
-**Native durable contact (#129, #130 carrier).** `check-pi-durable-beside` is the deterministic
-beside-test/mutant coordinate in `check:contracts`: the adapter, the installed carrier/SDK-set
-verifier, the preflight, the owner join, the carrier's relocation grammar, resolver and
-maintainer emitter (its `--check` reads only the owned in-repo source, #141; the overlay patch is
-retired, and `--origin <clone>` checks provenance only), and the bootstrap's explicit `--native-module` ingress
-(#130 P2) with its paired `--native-module-dir` (#134), driven through the packaged `main`'s own
+**Native durable contact (#129, #130 carrier).** Three deterministic beside-test/mutant
+coordinates in `check:contracts` split the durable contact by the file that carries each claim's QK
+(#144): a carrier or native-module mutant runs its one file, the rest run four. `check-pi-durable-beside` holds the adapter, the installed
+carrier/SDK-set verifier, the preflight and the owner join. `check-pi-durable-carrier` holds the
+carrier's relocation grammar, resolver and maintainer emitter (its `--check` reads only the owned
+in-repo source, #141; the overlay patch is retired, and `--origin <clone>` checks provenance only)
+and the task footer and sandboxed children described below. `check-pi-durable-native-module` is the coordinate of
+the bootstrap's explicit `--native-module` ingress
+(#130 P2) with its paired `--native-module-dir` (#134). That ingress is driven through the packaged `main`'s own
 seams: initialization before the TUI and the open, named refusals, the identity and directory
 guards, the top-level `*.extension.mjs` filter and byte-wise order, cross-module name refusals, the
-contact-first order by reference, and the bridge spawn *spec* (not the child's inheritance). The
-carrier's task footer (#134) is observed in ONE sandboxed child that loads the committed carrier
+contact-first order by reference, and the bridge spawn *spec* (not the child's inheritance). In
+`check-pi-durable-carrier`, the carrier's task footer (#134) is observed in ONE sandboxed child that loads the committed carrier
 through its own resolver: the real carrier runtime opened and closed with no model (graph observed
 for the session, `/tasks` toggling only the panel), then continued after one native background task
 was committed into that session through the SDK's public `Conversation.commit` (the carrier's graph
@@ -235,7 +237,7 @@ continuation and the reference compaction policy (no background summary; blockin
 kept, #143); the other renders the carrier prompt's skills section with no model, against a fixture
 of both settings scopes, an absolute entry, a same-name pair and a wrong-base decoy.
 `check-pi-runtime-version` asks the
-same verifier whether this checkout resolves exactly the pinned SDK set (the native set; the PATH
+same installed verifier (`check-pi-durable-beside`) whether this checkout resolves exactly the pinned SDK set (the native set; the PATH
 host is setup's subject), and `check-pi-import-surface` asserts the carrier fence. The separate
 `check-pi-durable-contact`, `check-pi-durable-send` and `check-pi-durable-receive` are
 CHECKOUT-ONLY SDK/contact gates: they run the checkout's own carrier — verified first, refused by
@@ -260,7 +262,7 @@ initializing only its top-level `*.extension.mjs` (#134) and a directory without
 before anything opens — and the HOST kept a separate subject — a real pi 1.1.0
 binary (the previous generation) beside the pinned native set is a named pi FAIL with zero Pi wiring while pi-durable still
 PASSes — not native admission. The carrier's rebuild
-equality is the owned source's emission (#141): the beside claim `PI-DURABLE-CARRIER-EMIT-SOURCE-EQUAL`
+equality is the owned source's emission (#141): the carrier claim `PI-DURABLE-CARRIER-EMIT-SOURCE-EQUAL`
 on every floor, `emit-pi-durable-carrier --check` as its CLI. The emitter's exact Node is red in the CI
 `check` job (`ENTWURF_REQUIRE_EMITTER_NODE=1`) and a named SKIP on a host running another Node, not
 acceptance there. First-release visible fresh/callback and native
@@ -269,10 +271,10 @@ caller/target/cross-harness LIVE are owed by `smoke-pi-durable-fresh-live`, a re
 
 | Axis | Required proof | Limit |
 |---|---|---|
-| Source | `pnpm run check:full` + the prepared SHA's CI `./run.sh check-gate-qualification` step | Does not prove an installed consumer. |
+| Source | `pnpm run check:full` in the prepared SHA's CI `check` job | Does not prove an installed consumer. Kill-power of the committed claims is not re-measured per release (#144); the release record says so and lists any earlier-candidate PARTIAL separately. |
 | Packed install | `check-pack-install` | Real tarball, but checkout-visible. |
 | Linux artifact consumer | required `check-install-container` CI job against one preserved candidate | Fixtures prove package/oracle shape, not a real Claude lifecycle. |
-| Exact release commit | all required CI jobs green, and the `check` job's qualification body step concluded success, at the exact SHA | A different green SHA is not transferable evidence. |
+| Exact release commit | the exact SHA's push run: all four required CI jobs green (the qualification body is not read, #144) | A different green SHA is not transferable evidence. |
 | macOS Entwurf-only install | required `macos-install-surface` CI job at the exact release SHA | Shape-only, CERTIFIED (CI): certifies the Entwurf-only install path on macOS only — never Claude/Copilot/OMP/agy wiring, the pi rail, ACP or mux. Promoted from non-voting (`continue-on-error`) to required in 0.20.0 after its first CERTIFIED (CI) green on a GitHub Actions `macos-latest` runner (not a physical host): run 34303884286 @ `70eda03` (2026-09-09), 65s, all 10 steps success — the packed candidate installed clean, `entwurf --help` and `entwurf check-bridge` ran (the latter listing the seven current `entwurf-bridge` MCP tools), an all-harness-absent `entwurf setup` reached `result: green` across the five documented SKIP probes (`pi`/`claude`/`agy`/`copilot`/`omp`), and five checked paths (`.pi`, `settings.json`, `.gemini`, `.copilot`, `auth.json.bak`) plus a byte-identical `auth.json` proved zero harness/credential writes. A macOS runner failure now blocks every release cut, the same as any other required job. |
 | LIVE runtime | `LIVE=1 ./run.sh release-gate <scratch> --cut` plus any shipped on-demand backend axis | `--cut` enforces `SKIP=0`; a red wired gate blocks the cut. |
 | Native Claude host | installed strict doctor against a new real session | Missing live join is `NOT CERTIFIED`, not a fixture PASS. |
@@ -515,7 +517,7 @@ Pass: user/assistant turns accumulate normally; the transcript is not broken/emp
 
 The minimum passing bar:
 
-1. **Deterministic floor green:** `pnpm run check:full` passes (the core tier plus the hermetic-integration and package/install tiers, incl. `check-pack`), plus the `./run.sh check-gate-qualification` step green in the exact-SHA CI run of the same prepared candidate (criterion 2's run).
+1. **Deterministic floor green:** `pnpm run check:full` passes (the core tier plus the hermetic-integration and package/install tiers, incl. `check-pack`), in the exact-SHA CI push run of the same prepared candidate (criterion 2's run). The qualification body is not a criterion (#144).
 2. **All four required CI jobs green on the exact release commit:** `check`, `install-surface`, the required Linux `artifact-consumer`, and `macos-install-surface` — promoted from non-voting to required in 0.20.0 (see the release acceptance axes table above for what its green run does and does not certify); preserve the Linux artifact-consumer's tarball digest and image identity. A macOS runner failure now blocks the cut like any other required job.
 3. **Live floor MUST green:** `LIVE=1 ./run.sh release-gate <dir> --cut` exits 0 reporting `MUST PASS=N FAIL=0 SKIP=0`; with `--cut` a single SKIP is red, so the exit code itself now carries this condition. A BEHAVIOR FAIL is advisory, not blocking.
 4. **Native-host doctor green where the Claude meta-bridge is claimed:** a new post-install Claude session exists, live evidence is present, and the installed `doctor-meta-bridge` exits 0. `NOT CERTIFIED` is a release failure for that host, not a skip.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.37.0",
+	"version": "0.37.1",
 	"description": "Visible sibling sessions across independent agent harnesses: launch in Herdr or tmux, reopen pi in tmux, and deliver messages by garden id; native bridges and Claude/Cortex ACP adapters.",
 	"license": "MIT",
 	"author": {
@@ -194,7 +194,7 @@
 		"check:core": "pnpm run check:toolchain && pnpm run check:vitest && pnpm run check:contracts",
 		"check:toolchain": "pnpm lint && pnpm typecheck",
 		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior",
-		"check:contracts": "./run.sh check-demo-reproducibility && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-set-model-readback && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-pi-durable-beside",
+		"check:contracts": "./run.sh check-demo-reproducibility && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-set-model-readback && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-pi-durable-beside && ./run.sh check-pi-durable-carrier && ./run.sh check-pi-durable-native-module",
 		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-pi-launch && ./run.sh check-codex-app-server-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-birth-hook && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-peer-facts && ./run.sh check-herdr-plugin && ./run.sh check-herdr-plugin-profile && ./run.sh check-herdr-plugin-build && ./run.sh check-herdr-runtime-bootstrap && ./run.sh check-herdr-activation && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-typing-call-fence && ./run.sh check-gate-manifests && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex && ./run.sh check-codex-bridge-identity && ./run.sh check-pi-bridge-sender && ./run.sh check-pi-mcp-register && ./run.sh check-pi-mcp-bridge && ./run.sh check-codex-birth-hook && ./run.sh smoke-codex-config-state && ./run.sh smoke-codex-birth && ./run.sh check-herdr-sandbox",
 		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-pack-consumer-roots && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},

package/run.sh

@@ -181,7 +181,9 @@ Usage:
   ./run.sh check-pi-durable-contact   # #129 L-identity gate, CHECKOUT-ONLY (an installed package refuses it in run_ts). Opens the REAL durable app from THIS checkout's verified carrier (pi/pi-durable/carrier/ under its resolver, against the checkout's pinned pi SDK set — refused by name first) with the pi-durable contact, births the citizen and runs its tools adapter-direct through a privately emitted branch bridge (ENTWURF_PI_DURABLE_BRIDGE_ENTRY; its registry must match this checkout). Matrix roots {default, explicit} x {fresh, --continue}: one record keyed by the durable session dir, sender marker on the spawned host pid, exactly one bridge child whose /proc PPID is that host, poisoned identity carriers kept from it, its four root carriers bound to the roots written, the receiver ARMED (raw marker owned by the host pid + start key as pi-durable-host, joined to the sender marker; removed on close), self = the record and replyable, peers from an outside bridge, same garden id on reopen; the bundle's compiled owner join must admit pi-durable-host. Reaps only the host/bridges it owns on any failure. Harness-bypassed: no model turn, no ToolTask. Missing inputs → SKIP (97), never a pass
   ./run.sh check-pi-durable-send      # #129 L-send FIRST CELL, CHECKOUT-ONLY. Same input as check-pi-durable-contact. One native durable turn: the app's own controller input → GenerationTask → ToolTask → the contact's entwurf_v2 → the private bridge → a seeded self-fetch target (C2 recipe, owned by a separate idle child). S = a 127.0.0.1 scripted OpenAI-compatible endpoint configured through the app's documented models.json (dummy key, PI_OFFLINE); H = the native ToolTask path; V (a vendor turn) is NOT run. Oracles: the wire (tools offered, v2 schema = the bridge's tools/list, exactly two requests, the tool result + receipt in the second), the raw mailbox (.msg 1, signal, sender = the host record), the native view (one call, its settled result, root current). Not exactly-once, not recovery, not a recipient turn. Missing inputs → SKIP (97)
   ./run.sh check-demo-reproducibility # source-checkout-only: discover offline demo Node tests; no LIVE, model, render or publication
-  ./run.sh check-pi-durable-beside    # #129 mutant execution coordinate (VERIFY rule 3): run_vitest over the six pi-durable beside tests (adapter, carrier/SDK-set verifier, preflight, owner join, carrier relocation/resolver, owned-source emission and typecheck fence, task footer, native-module file and directory ingress) — the pi-durable qualification lane's gate argv. Same files check-tests-beside-behavior already runs.
+  ./run.sh check-pi-durable-beside    # #129 mutant execution coordinate (VERIFY rule 3): run_vitest over four pi-durable beside tests (adapter, carrier/SDK-set verifier, preflight, owner join) — a pi-durable qualification lane gate argv. Same files check-tests-beside-behavior already runs.
+  ./run.sh check-pi-durable-carrier   # #144 mutant execution coordinate (VERIFY rule 3): run_vitest over the carrier test alone (relocation/resolver, owned-source emission and typecheck fence, package file list, task footer, the real bootstrap on the 1.2 SDK, stream transport, skills prompt) — the gate argv of the carrier claims, whose QKs live only in that file. Same file check-tests-beside-behavior already runs.
+  ./run.sh check-pi-durable-native-module # #144 mutant execution coordinate (VERIFY rule 3): run_vitest over the bootstrap's native-module file and directory ingress test alone — the gate argv of the ingress claims, whose QKs live only in that file. Same file check-tests-beside-behavior already runs.
   ./run.sh check-pi-durable-receive   # #129 L-receive FIRST CELL, CHECKOUT-ONLY. Same input (the bundle must carry the pi-durable-host owner join). The host driver gives the app NO input; a seeded claude-code sender (marker owned by a separate idle child, handed to a gate-owned sending bridge through ENTWURF_META_SENDER_MARKER) enqueues one message, the host's doorbell admits its notice to the ROOT conversation, and the scripted model drains it with entwurf_inbox_read. S withholds response #1 until the ENQUEUE receipt, the .delivered bytes, the signal, the host-owned receiver marker and the notice are captured. Oracles: receiver() admission, native view, raw archive (.delivered.read + lastReadAt), wire (exactly two requests, drain result = view), and after a green reap a forensic read-only SQLite copy (submission row by request id = reported id, root, input, done, placed entry = the notice). V NOT run. Missing inputs → SKIP (97)
   ./run.sh check-copilot-receive-arm  # #82 RAIL 5 gate: the REAL receiver installer + the REAL extension.mjs forked with a stubbed SDK. Arms only after birth, marker owned by the WATCHER pid, self-fetch dispatch answer, doorbell carries the garden id and NOT the body, id-drift/foreign-parent refusals. Hermetic; no Copilot, no model turn
   ./run.sh check-copilot-launch       # #82 RAIL 7 gate: the MANAGED launch `entwurf copilot`, driven through its public address against a FAKE VENDOR on a sandbox PATH. Receiver precondition refusals, EXTENSIONS token + operator token preservation, injected defaults before the `--` terminator, byte-identical argv, the 11 explicit permission/surface policy overrides that suppress `--yolo`, exec (not fork) pid identity, exit passthrough, recursion refusal. Hermetic; no Copilot, no model turn
@@ -254,8 +256,8 @@ Usage:
   ./run.sh smoke-omp-receive-live      # #87 bundle B acceptance: another harness wakes an ALREADY-OPEN omp citizen, which reads its inbox and answers in the same session. Decides its own outcome from the capability registry — omp without a drainable mailbox is a protocol SKIP (no receiver unit exists to arm), which an unattended release-gate reports and `--cut` reads as RED; a registry that claims a receive rail with no acceptance body here is a FAIL
   ./run.sh smoke-entwurf-chain-live    # LIVE cross-harness delivery chain: native Claude Code -> pi GPT -> pi ACP Sonnet -> mailbox terminus, proving sender identity/replyable at every hop and a real read receipt at the end. Prerequisites (claude on PATH, pi credentials per backend) report protocol SKIP, never a pass
   ./run.sh check-release-gate-outcomes  # release-gate STEP OUTCOME protocol (P1): one skip exit code shared by the shell + TS halves, classifier never rounds a skip up to a pass, `--cut` refuses a MUST SKIP while a bare diagnostic stays exit 0, no LIVE smoke keeps the old exit-0 skip shape, and both real skip surfaces are INVOKED and observed to propagate the code
-  ./run.sh check-gate-manifests         # the HEAD of that qualification, on its own: runner self-test + the committed manifests validated against the origin index + the declared lane inventory. Executes ZERO committed mutants (only the self-test's synthetic fixture mutants, in tmp fixture repos) and never snapshots this repo (~20s), which is why it lives in check:hermetic while the body stays on CI/release-gate — three of the five reds qualification ever produced in CI died right here, before a mutant gate ran (#99 B-3)
-  ./run.sh check-gate-qualification    # kill-proof qualification (the gate-of-gates): runner self-test (classifier truth table + synthetic negatives incl. wrong-reason/hang/control-red/impurity) + committed mutant manifests (scripts/mutants/*.json) run in an isolated snapshot repo under control→mutant→restore→control; the real checkout is never written. Evidence = claim IDs + killed mutant IDs, never assertion counts. Bare = the whole body (the prepared SHA's CI call); `--group '<argv JSON>' --receipt <abs path outside the repo>` = one affected exact-argv group, a PARTIAL receipt (development's run, #133)
+  ./run.sh check-gate-manifests         # the HEAD of that qualification, on its own: runner self-test + the committed manifests validated against the origin index + the declared lane inventory. Executes ZERO committed mutants (only the self-test's synthetic fixture mutants, in tmp fixture repos) and never snapshots this repo (~20s), which is why it lives in check:hermetic while the body runs only as the optional CI schedule/manual-dispatch drift diagnostic (#144) — three of the five reds qualification ever produced in CI died right here, before a mutant gate ran (#99 B-3)
+  ./run.sh check-gate-qualification    # kill-proof qualification (the gate-of-gates): runner self-test (classifier truth table + synthetic negatives incl. wrong-reason/hang/control-red/impurity) + committed mutant manifests (scripts/mutants/*.json) run in an isolated snapshot repo under control→mutant→restore→control; the real checkout is never written. Evidence = claim IDs + killed mutant IDs, never assertion counts. Bare = the whole body (the CI schedule/dispatch drift diagnostic, #144); `--group '<argv JSON>' --receipt <abs path outside the repo>` = one affected exact-argv group, a PARTIAL receipt (development's run, #133)
   ./run.sh check-probe-ordering        # §11-7 ordering-probe deterministic gate: raw-client SAMENESS pinned to backend.ts (sequence/args/timeouts/permission policy — the probe may never measure a lookalike), phase attribution incl. set-model, probe-mode fixture wire markers (delay honored, probeRunId REQUIRED, smoke-acp-mcp-live legacy compat), event-log door integrity (reserved keys refused at write; unknown marker name, broken sort axis, or a payload the classifier cannot judge on is MALFORMED, never a quiet event), and the §11-7 paired-verdict truth table (P0/I0 outside the space, phase-qualified D, B promotion ladder, C, A two-delay rule). Offline/deterministic; one product claim (no production prompt cutoff) is replant-qualified via scripts/mutants/probe-ordering.json, while the other assertions are direct [CHECK:*] contracts
   ./run.sh check-probe-cli-shim        # §11-7-c B-name-snapshot PRODUCER gate: the CLI shim driven as a REAL process against fake CLIs (no API, no cost). Proves what a defect would buy — FABRICATED evidence (a malformed init is never reported as an empty name set; the boot report carries the true target path+sha256 the classifier verifies against the roster), a DESTROYED turn (byte transparency across mid-UTF8/CRLF/oversized/unterminated framing, exit-code fidelity, signal re-raise, inbound signal forwarding, stderr passthrough, stdout backpressure), and LEAKED operator state (exact-allowlist env scrub, no argv/env/prompt body in the log). Offline/deterministic; 20 direct [CHECK:*] contracts, deliberately no longer replant-qualified after #70 subtraction
   ./run.sh smoke-agy-statusline-state # agy ambient garden-id statusLine install/doctor/inverse regression. Offline/deterministic
@@ -1606,12 +1608,30 @@ check_pi_durable_beside() {
   # #129: the pi-durable qualification lane's execution coordinate (VERIFY 「Four rules」 rule 3). It is
   # not a discovery path — check-tests-beside-behavior already finds these files. It exists because the
   # qualification runner re-invokes a gate argv once per mutant, and the narrow filter keeps one mutant
-  # from re-running every beside test. The six files are one contact: the adapter and its packaged
+  # from re-running every beside test. The four files are one contact: the adapter and its packaged
   # bootstrap, the installed carrier/SDK-set verifier (which also reads the three checkout gates as
-  # SOURCE), the fresh preflight, the owner join that admits the durable host, the carrier's
-  # relocation grammar, resolver, owned-source emitter (#130, #141) and source fence with the carrier's task footer (#134),
-  # and the bootstrap's explicit --native-module ingress (#130 P2) and its --native-module-dir (#134).
-  run_vitest pi-extensions/meta-bridge-pi-durable.test.ts pi-extensions/lib/pi-durable-runtime.test.ts pi-extensions/lib/pi-durable-fresh-preflight.test.ts pi-extensions/lib/entwurf-deliverability.owner-join.test.ts pi-extensions/lib/pi-durable-carrier.test.ts pi-extensions/lib/pi-durable-native-module.test.ts
+  # SOURCE), the fresh preflight, and the owner join that admits the durable host. The carrier and the
+  # bootstrap's native-module ingress have their own coordinates, check-pi-durable-carrier and
+  # check-pi-durable-native-module (#144).
+  run_vitest pi-extensions/meta-bridge-pi-durable.test.ts pi-extensions/lib/pi-durable-runtime.test.ts pi-extensions/lib/pi-durable-fresh-preflight.test.ts pi-extensions/lib/entwurf-deliverability.owner-join.test.ts
+}
+
+check_pi_durable_carrier() {
+  # #144: the execution coordinate for the carrier — its relocation grammar, resolver, owned-source
+  # emitter (#130, #141), source fence and package file list, its task footer (#134), and the real
+  # bootstrap driving it on the 1.2 SDK, the stream transport and the skills prompt (#141, #143). Every
+  # claim on it carries its QK only in this one file, and a kill is attributed from the mutant's own QK,
+  # so its mutants run this file alone. The file reaches the bridge through the bootstrap, so its
+  # mutants still declare the bridge build. Not a discovery path either.
+  run_vitest pi-extensions/lib/pi-durable-carrier.test.ts
+}
+
+check_pi_durable_native_module() {
+  # #144: the execution coordinate for the bootstrap's explicit --native-module ingress (#130 P2) and its
+  # --native-module-dir (#134). Every claim on that ingress carries its QK only in this one file, and a
+  # kill is attributed from the mutant's own QK, so its mutants run this file alone rather than
+  # re-running the carrier and adapter tests once per mutant. Not a discovery path either.
+  run_vitest pi-extensions/lib/pi-durable-native-module.test.ts
 }
 
 smoke_mux_fresh_call_live() {
@@ -6999,11 +7019,10 @@ release_gate() {
     results+=("FAIL  static (pnpm run check:full)"); failc=$((failc + 1))
   fi
 
-  # 1b. Discriminating power is NOT re-proven here. A cut re-proves that the gates still kill
-  # what they claim exactly once: the qualification BODY step of the exact-SHA CI run at the
-  # prepared SHA, which the release oracle (verify-exact-ci.sh) requires before any candidate
-  # exists (#132 / #133 — a local BODY here repeated that ~100-minute proof on a SHA nobody ships).
-  # Its head still rides check:full as check-gate-manifests.
+  # 1b. Discriminating power is NOT re-proven here (#132 / #133), and since #144 not by the
+  # release at all: the whole qualification body is a schedule/dispatch drift diagnostic that
+  # no cut waits for, and the release oracle (verify-exact-ci.sh) reads only the push run's
+  # four required jobs. Its head still rides check:full as check-gate-manifests.
 
   # 2. (gemini-availability step removed — claude-only floor; gemini CLI is
   #    deprecated, so the gate no longer asserts a three-backend claim.)
@@ -7071,6 +7090,9 @@ release_gate() {
   #     → first-user augment delivery + empty-carrier billing-clean (핀1) →
   #     ACP-target garden guard (deterministic half). Opt-in LIVE: LIVE!=1 is an
   #     HONEST SKIP via run_live_step (see its note) — a CUT needs LIVE=1, SKIP=0.
+  # The mux lifecycle runs before the ACP tier (0.37.1): its pi-native callback is the step
+  # that went red in the last two cuts, so a red answer must come before the ACP tier spends its turns.
+  run_live_step "smoke-mux-lifecycle-live (mux public-harness lifecycle: fresh -> send -> dormant -> same-id visible resume -> recall)" gate bash "$self" smoke-mux-lifecycle-live
   run_live_step "smoke-acp-socket-citizen-live (S1: turn-free socket citizenship)"        gate bash "$self" smoke-acp-socket-citizen-live
   run_live_step "smoke-acp-raw-turn-live (S2a: pinned ACP pipe + local auth)"             gate bash "$self" smoke-acp-raw-turn-live
   run_live_step "smoke-acp-overlay-live (S2b: config overlay + hooks:{} + tool meta)"     gate bash "$self" smoke-acp-overlay-live
@@ -7099,7 +7121,6 @@ release_gate() {
   #     is either wired here or excluded by a reason the docs still carry.
   run_live_step "smoke-claude-native-resume-live (native Claude Code resume + meta-bridge neutrality)" gate bash "$self" smoke-claude-native-resume-live
   run_live_step "smoke-entwurf-chain-live (P3: Claude Code -> pi GPT -> pi ACP Sonnet -> mailbox, identity + receipt)" gate bash "$self" smoke-entwurf-chain-live
-  run_live_step "smoke-mux-lifecycle-live (mux public-harness lifecycle: fresh -> send -> dormant -> same-id visible resume -> recall)" gate bash "$self" smoke-mux-lifecycle-live
   # #87 bundle B: MUST, and since bundle B moved omp's wakeMode to self-fetch this is a
   # REAL demand under LIVE=1, not a standing SKIP — it reads the registry, so an honest
   # SKIP now only ever names a missing prerequisite, and a registry claiming a receive
@@ -7399,6 +7420,12 @@ case "$cmd" in
   check-pi-durable-beside)
     check_pi_durable_beside
     ;;
+  check-pi-durable-carrier)
+    check_pi_durable_carrier
+    ;;
+  check-pi-durable-native-module)
+    check_pi_durable_native_module
+    ;;
   check-mux-resume-call)
     check_mux_resume_call
     ;;
@@ -7684,8 +7711,8 @@ case "$cmd" in
     # Arguments reach the runner's own parser unchanged (#133): `--group '<argv JSON>'
     # --receipt <abs path>` is the affected PARTIAL a development lane runs, and a malformed,
     # missing or repeated flag is refused there before any body or snapshot. Dropping them
-    # turned a requested PARTIAL into the whole body. Bare, it stays the whole body — the
-    # prepared SHA's CI call. Never retry bare after a refusal.
+    # turned a requested PARTIAL into the whole body. Bare, it stays the whole body — the CI
+    # schedule/dispatch diagnostic (#144). Never retry bare after a refusal.
     shift || true
     run_ts scripts/check-gate-qualification.ts "$@"
     ;;

package/scripts/check-gate-qualification.ts

@@ -1214,7 +1214,7 @@ function buildDeclaredOutputFixture(): string {
 	const partial = viaDoor(requested);
 	const bare = viaDoor([]);
 	ok(
-		"[QK:QUALIFY-DOOR-FORWARDS-ARGV] run.sh check-gate-qualification hands --group/--receipt to the parser unchanged (a space and a glob inside the argv JSON included) and the parser reads one PARTIAL group; called bare it still reads the whole body — the prepared SHA's CI call",
+		"[QK:QUALIFY-DOOR-FORWARDS-ARGV] run.sh check-gate-qualification hands --group/--receipt to the parser unchanged (a space and a glob inside the argv JSON included) and the parser reads one PARTIAL group; called bare it still reads the whole body — the CI schedule/dispatch diagnostic (#144)",
 		partial.status === 0 &&
 			JSON.stringify(partial.started?.argv) === JSON.stringify(requested) &&
 			partial.started?.parsed.mode === "group" &&
@@ -3496,7 +3496,7 @@ let manifestCount: number;
 		"omp-fresh": 24,
 		"omp-receive": 11,
 		"probe-ordering": 1,
-		"release-gate": 24,
+		"release-gate": 21,
 		"retired-sent-surface": 2,
 		"resume-args": 6,
 		"resume-launch-identity": 7,