@junghanacs/entwurf 0.39.0 → 0.41.0

package/scripts/mutants/remote-pair-send.json

@@ -0,0 +1,194 @@
+{
+	"schemaVersion": 1,
+	"lane": "remote-pair-send",
+	"mutants": [
+		{
+			"claim": "REMOTE-ROUTE-UNDECLARED-LOCAL-UNCHANGED",
+			"title": "a declared route captures every target, so a gid the declaration never named is sent to the other host instead of the local decider",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["\tif (route === null || params.target !== route.remoteGardenId) {"],
+			"replace": ["\tif (route === null) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUTE-UNDECLARED-LOCAL-UNCHANGED]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUTE-LOCAL-CONFLICT-FAILS-CLOSED",
+			"title": "a declared remote gid that this host also answers to is sent away anyway, so two hosts' citizens share one address and the sender silently picks the remote",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["\tif (await opts.localTrace(route.remoteGardenId)) {"],
+			"replace": ["\tif (Boolean(0)) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUTE-LOCAL-CONFLICT-FAILS-CLOSED]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUTE-SENDER-MUST-BE-DECLARED",
+			"title": "any present envelope may use the route, so an anonymous caller or another citizen on this host speaks to the other host as the declared sender",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["\tif (!sender || sender.origin === \"external-mcp\" || sender.sessionId !== route.localGardenId) {"],
+			"replace": ["\tif (!sender || Boolean(0)) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUTE-SENDER-MUST-BE-DECLARED]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUTE-EXACT-ARGV-ONCE",
+			"title": "the transport runs ssh without BatchMode, so a missing key turns into an interactive prompt nobody can answer instead of a bounded failure",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["\t\t\"BatchMode=yes\","],
+			"replace": ["\t\t\"BatchMode=no\","],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUTE-EXACT-ARGV-ONCE]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUTE-NO-RETRY",
+			"title": "the send runs the transport a second time, so an uncertain first attempt can enqueue the same message twice on the other host",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["\tconst result = await opts.transport.run("],
+			"replace": [
+				"\tawait opts.transport.run(remoteReceiveArgv(route), JSON.stringify(claim), 1);\n\tconst result = await opts.transport.run("
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUTE-NO-RETRY]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-RECEIPT-EXIT-AND-KIND-AGREE",
+			"title": "an accepted-looking JSON line counts as accepted whatever the exit code says, so a refusal or a crash after printing reads as delivery",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": [
+				"\tif (r.exitCode === 0 && keys === \"isError,kind,text\" && o.kind === \"dispatched\" && o.isError === false) {"
+			],
+			"replace": ["\tif (keys === \"isError,kind,text\" && o.kind === \"dispatched\" && o.isError === false) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-RECEIPT-EXIT-AND-KIND-AGREE]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUTE-DECL-NO-QUOTING-NEEDED",
+			"title": "the remote declaration path may carry spaces or shell metacharacters, which ssh joins into the remote shell string and the other host reinterprets",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["const REMOTE_PATH = /^\\/[A-Za-z0-9._/-]+$/;"],
+			"replace": ["const REMOTE_PATH = /^\\/.+$/;"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUTE-DECL-NO-QUOTING-NEEDED]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUTE-LOCAL-TRACE-ANY-STATE",
+			"title": "a socket at the gid's control path in a named socket dir is not counted as a local trace, so a live local citizen without a record is bypassed for the remote",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["\t\t\tif (inspection.kind !== \"absent\") return true;"],
+			"replace": ["\t\t\tif (false) return true;"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUTE-LOCAL-TRACE-ANY-STATE]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUTE-RECEIPT-PATHS-OTHER-HOST",
+			"title": "the accepted receipt drops the note that its paths are on the other host, so the other host's messagePath reads as a file the sender could open",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["read/answer unknown until a reply arrives; paths below are on the other host)"],
+			"replace": ["read/answer unknown until a reply arrives)"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUTE-RECEIPT-PATHS-OTHER-HOST]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-PAIR-OPT-IN-ABSENT-IS-OFF",
+			"title": "an absent opt-in file throws instead of meaning off, so every local send on a host that never opted in fails",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["\t\tif ((err as NodeJS.ErrnoException).code === \"ENOENT\") return null;"],
+			"replace": ["\t\tif (false) return null;"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-PAIR-OPT-IN-ABSENT-IS-OFF]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-PAIR-OPT-IN-BROKEN-REFUSED",
+			"title": "a symlinked or non-regular opt-in is followed, so the route the bridge walks is whatever the link points at today",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["\tif (!st.isFile()) {\n\t\tthrow new RemoteRouteDeclarationError(`remote pair opt-in"],
+			"replace": ["\tif (false) {\n\t\tthrow new RemoteRouteDeclarationError(`remote pair opt-in"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-PAIR-OPT-IN-BROKEN-REFUSED]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-REPORTED-ERROR-NO-DELIVERY-INFERENCE",
+			"title": "an error the other host reports after a possible write is headed as a non-delivery, inviting a resend that would deliver twice",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": [
+				"\t\t\t\ttext: `entwurf_v2 remote ${via} → the other host reported an error while processing; read its receipt below, delivery is not inferred from this line; not retried (paths below are on the other host)\\n${o.text}`,"
+			],
+			"replace": [
+				"\t\t\t\ttext: `entwurf_v2 remote ${via} → the other host did not deliver (paths below are on the other host)\\n${o.text}`,"
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-REPORTED-ERROR-NO-DELIVERY-INFERENCE]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		}
+	]
+}

package/scripts/mutants/remote-pair-transport.json

@@ -0,0 +1,66 @@
+{
+	"schemaVersion": 1,
+	"lane": "remote-pair-transport",
+	"mutants": [
+		{
+			"claim": "REMOTE-TRANSPORT-NO-SHELL-SEPARATE-STREAMS",
+			"title": "the transport runs its argv through a shell, so a remote declaration word is expanded on the sending host before ssh ever sees it",
+			"subject": "pi-extensions/lib/remote-pair-transport.ts",
+			"find": ["{ shell: false, stdio: [\"pipe\", \"pipe\", \"pipe\"] }"],
+			"replace": ["{ shell: true, stdio: [\"pipe\", \"pipe\", \"pipe\"] }"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-TRANSPORT-NO-SHELL-SEPARATE-STREAMS]",
+			"signatureSource": "pi-extensions/lib/remote-pair-transport.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-TRANSPORT-TIMEOUT-REAPS-OWN-CHILD",
+			"title": "the bound only sends TERM, so an ssh child that ignores it outlives the send and the call never returns",
+			"subject": "pi-extensions/lib/remote-pair-transport.ts",
+			"find": ["\t\t\t\t\tchild.kill(\"SIGKILL\");"],
+			"replace": ["\t\t\t\t\tvoid 0;"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-TRANSPORT-TIMEOUT-REAPS-OWN-CHILD]",
+			"signatureSource": "pi-extensions/lib/remote-pair-transport.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-TRANSPORT-SPAWN-FAILURE-INDETERMINATE",
+			"title": "a child that never started reports exit 0, so a missing ssh binary reads as a clean exit instead of an unknown outcome",
+			"subject": "pi-extensions/lib/remote-pair-transport.ts",
+			"find": ["\t\t\t\t\texitCode: spawnError ? null : code,"],
+			"replace": ["\t\t\t\t\texitCode: spawnError ? 0 : code,"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-TRANSPORT-SPAWN-FAILURE-INDETERMINATE]",
+			"signatureSource": "pi-extensions/lib/remote-pair-transport.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-TRANSPORT-HELD-PIPES-STILL-SETTLE",
+			"title": "the send waits for a close that a pipe-holding descendant never lets happen, so one stuck remote leaves entwurf_v2 hanging forever",
+			"subject": "pi-extensions/lib/remote-pair-transport.ts",
+			"find": ["\t\t\t\t\tfinalTimer = setTimeout(() => {"],
+			"replace": ["\t\t\t\t\tfinalTimer = setTimeout(() => {\n\t\t\t\t\t\treturn;"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-TRANSPORT-HELD-PIPES-STILL-SETTLE]",
+			"signatureSource": "pi-extensions/lib/remote-pair-transport.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		}
+	]
+}

package/scripts/mutants/resume-launch-identity.json

@@ -55,14 +55,8 @@
 			"claim": "RESUME-ID-GATE-SSOT",
 			"title": "the preserved leaf's header stops naming the gate that certifies it, so a consumer-zero identity module ships on prose again",
 			"subject": "pi-extensions/lib/resume-launch-identity.ts",
-			"find": [
-				" * So this leaf is preserved deliberately, with no consumer in the shipped tree today.",
-				" * `check-resume-launch-identity` holds its contract so the record-integrity rules below —"
-			],
-			"replace": [
-				" * So this leaf is preserved deliberately for the later visible lane.",
-				" * The record-integrity rules below —"
-			],
+			"find": [" * `check-resume-launch-identity` holds the record-integrity rules below — the transcript header id"],
+			"replace": [" * the record-integrity rules below — the transcript header id"],
 			"gate": ["bash", "run.sh", "check-resume-launch-identity"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:RESUME-ID-GATE-SSOT]",
@@ -106,6 +100,39 @@
 			"timeoutSeconds": 60,
 			"signature": "[QK:RESUME-ID-ACP-EXACT-CURATION]",
 			"signatureSource": "scripts/check-resume-launch-identity.ts"
+		},
+		{
+			"claim": "RESUME-ID-CC-RESOLVES",
+			"title": "a claude-code record falls back to the out-of-domain refusal, so the widened domain exists only in prose",
+			"subject": "pi-extensions/lib/resume-launch-identity.ts",
+			"find": ["\tif (record.backend === \"claude-code\") return resolveClaudeCodeLaunchIdentity(gardenId, record);"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-resume-launch-identity"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:RESUME-ID-CC-RESOLVES]",
+			"signatureSource": "scripts/check-resume-launch-identity.ts"
+		},
+		{
+			"claim": "RESUME-ID-CC-SESSION-GRAMMAR",
+			"title": "a recorded Claude Code session id outside the UUID grammar reaches claude --resume, where a value like --dangerously-skip-permissions would be read as a flag",
+			"subject": "pi-extensions/lib/resume-launch-identity.ts",
+			"find": ["\tif (!CLAUDE_SESSION_ID.test(record.nativeSessionId)) {"],
+			"replace": ["\tif (false && !CLAUDE_SESSION_ID.test(record.nativeSessionId)) {"],
+			"gate": ["bash", "run.sh", "check-resume-launch-identity"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:RESUME-ID-CC-SESSION-GRAMMAR]",
+			"signatureSource": "scripts/check-resume-launch-identity.ts"
+		},
+		{
+			"claim": "RESUME-ID-CC-TRANSCRIPT-PRESENT",
+			"title": "a Claude Code record whose transcript is gone still resolves, so the window opens on a session the vendor cannot find",
+			"subject": "pi-extensions/lib/resume-launch-identity.ts",
+			"find": ["\tif (!isFile) {"],
+			"replace": ["\tif (false && !isFile) {"],
+			"gate": ["bash", "run.sh", "check-resume-launch-identity"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:RESUME-ID-CC-TRANSCRIPT-PRESENT]",
+			"signatureSource": "scripts/check-resume-launch-identity.ts"
 		}
 	]
 }

package/scripts/mutants/retirement-event.json

@@ -0,0 +1,195 @@
+{
+	"schemaVersion": 1,
+	"lane": "retirement-event",
+	"mutants": [
+		{
+			"claim": "RETIRE-EVENT-FD-KIND",
+			"title": "an opened non-regular inode passes admission and reaches write",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\t\tif (!st.isFile()) throw new RetirementEventError(`${path.basename(file)} is not a regular file`);"],
+			"replace": ["\t\t// MUTANT: opened inode kind is not checked."],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-FD-KIND]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-CLOSED-KEYS",
+			"title": "serialized event grows an undeclared field",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\tconst base = { v, kind, eventId, at, actorGardenId, targetGardenId, targetBackend };"],
+			"replace": [
+				"\tconst base = { v, kind, eventId, at, actorGardenId, targetGardenId, targetBackend, extra: true };"
+			],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-CLOSED-KEYS]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-FORBIDDEN",
+			"title": "free text is admitted as a retirement reason",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\tif (reason !== null && (typeof reason !== \"string\" || !REASON_RE.test(reason))) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-FORBIDDEN]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-INSTANT",
+			"title": "calendar rollover is accepted as an ISO instant",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\treturn !Number.isNaN(ms) && new Date(ms).toISOString() === value;"],
+			"replace": ["\treturn !Number.isNaN(ms);"],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-INSTANT]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-BACKEND-DOMAIN",
+			"title": "one backend records the other backend's outcome as its own",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\tconst allowed: readonly unknown[] = RETIREMENT_OUTCOME_STATUSES_BY_BACKEND[targetBackend];"],
+			"replace": [
+				"\tconst allowed: readonly unknown[] = [\"shutdown-requested\", \"exited\", \"refused\", \"not-signalled\", \"unknown\"];"
+			],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-BACKEND-DOMAIN]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-SNAPSHOT",
+			"title": "foreign prototypes stop being refused at the snapshot boundary",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": [
+				"\tif (proto !== Object.prototype && proto !== null) throw new RetirementEventError(`${what} must be a plain object`);"
+			],
+			"replace": ["\t// MUTANT: foreign prototype admitted."],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-SNAPSHOT]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-ONE-SNAPSHOT",
+			"title": "filename re-reads the original object after validating a different target snapshot",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\tconst file = retirementEventFile(retirementsDir, targetGardenId);"],
+			"replace": ["\tconst file = retirementEventFile(retirementsDir, event.targetGardenId);"],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-ONE-SNAPSHOT]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-APPEND",
+			"title": "an append opens at offset zero and overwrites the preserved prefix",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\tconst fd = fs.openSync(file, O_WRONLY | O_APPEND | O_CREAT | O_NOFOLLOW | O_NONBLOCK, 0o600);"],
+			"replace": ["\tconst fd = fs.openSync(file, O_WRONLY | O_CREAT | O_NOFOLLOW | O_NONBLOCK, 0o600);"],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-APPEND]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-CREATE",
+			"title": "new event files abandon the literal target-gid JSONL filename contract",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["export const RETIREMENT_EVENT_SUFFIX = \".jsonl\";"],
+			"replace": ["export const RETIREMENT_EVENT_SUFFIX = \".log\";"],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-CREATE]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-NOFOLLOW",
+			"title": "a final symlink is followed and its victim is appended to",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\tconst fd = fs.openSync(file, O_WRONLY | O_APPEND | O_CREAT | O_NOFOLLOW | O_NONBLOCK, 0o600);"],
+			"replace": ["\tconst fd = fs.openSync(file, O_WRONLY | O_APPEND | O_CREAT | O_NONBLOCK, 0o600);"],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-NOFOLLOW]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-NONREGULAR",
+			"title": "a multiply linked event inode can be appended to",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": [
+				"\t\tif (st.nlink !== 1) throw new RetirementEventError(`${path.basename(file)} has ${st.nlink} links; refusing`);"
+			],
+			"replace": ["\t\t// MUTANT: hardlink guard omitted."],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-NONREGULAR]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-DIR",
+			"title": "a symlinked retirement directory is admitted",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\tif (st.isSymbolicLink() || !st.isDirectory()) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-DIR]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-PATH",
+			"title": "a relative sessions directory becomes an ambient-CWD-dependent path",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": [
+				"\tif (!path.isAbsolute(sessionsDir)) throw new RetirementEventError(\"sessionsDir must be an absolute path\");"
+			],
+			"replace": ["\t// MUTANT: relative sessions directory admitted."],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-PATH]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-NO-AMBIENT",
+			"title": "the append leaf begins reading ambient environment",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["export function retirementsDirBesideSessions(sessionsDir: string): string {"],
+			"replace": [
+				"export function retirementsDirBesideSessions(sessionsDir: string): string {",
+				"\tvoid process.env.HOME;"
+			],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-NO-AMBIENT]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-PRIMITIVES",
+			"title": "FIFO admission loses NONBLOCK without a semantic open-flag assertion",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\tconst fd = fs.openSync(file, O_WRONLY | O_APPEND | O_CREAT | O_NOFOLLOW | O_NONBLOCK, 0o600);"],
+			"replace": ["\tconst fd = fs.openSync(file, O_WRONLY | O_APPEND | O_CREAT | O_NOFOLLOW, 0o600);"],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-PRIMITIVES]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-FAILURE-MATRIX",
+			"title": "the file flush disappears so a flush failure cannot be reported",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\t\tfs.fsyncSync(fd);"],
+			"replace": ["\t\t// MUTANT: file flush omitted."],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-FAILURE-MATRIX]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		}
+	]
+}

package/scripts/mutants/v2-surface.json

@@ -2,6 +2,22 @@
 	"schemaVersion": 1,
 	"lane": "v2-surface",
 	"mutants": [
+		{
+			"claim": "V2SURF-RESUME-HINT-SCOPE",
+			"title": "the dormant capability hint returns to a Pi-only automatic-resume invitation",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": [
+				"\t\t\t\t\"Only on an explicit operator request, use entwurf_resume_call {target} for Pi or Claude Code; \" +",
+				"\t\t\t\t\"it submits no prompt. This capability hint is not permission to resume automatically.\""
+			],
+			"replace": [
+				"\t\t\t\t\"Reopen the citizen with entwurf_resume_call {target} (pi targets only; it runs no turn), then dispatch again.\""
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2SURF-RESUME-HINT-SCOPE]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
 		{
 			"claim": "V2SURF-MCP-LOCK-DOMAIN",
 			"title": "MCP long description reverts to the false \"socket paths take a per-target lock\" claim",