@junghanacs/entwurf 0.40.0 → 0.41.1

package/scripts/mutants/retirement-event.json

@@ -0,0 +1,195 @@
+{
+	"schemaVersion": 1,
+	"lane": "retirement-event",
+	"mutants": [
+		{
+			"claim": "RETIRE-EVENT-FD-KIND",
+			"title": "an opened non-regular inode passes admission and reaches write",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\t\tif (!st.isFile()) throw new RetirementEventError(`${path.basename(file)} is not a regular file`);"],
+			"replace": ["\t\t// MUTANT: opened inode kind is not checked."],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-FD-KIND]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-CLOSED-KEYS",
+			"title": "serialized event grows an undeclared field",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\tconst base = { v, kind, eventId, at, actorGardenId, targetGardenId, targetBackend };"],
+			"replace": [
+				"\tconst base = { v, kind, eventId, at, actorGardenId, targetGardenId, targetBackend, extra: true };"
+			],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-CLOSED-KEYS]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-FORBIDDEN",
+			"title": "free text is admitted as a retirement reason",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\tif (reason !== null && (typeof reason !== \"string\" || !REASON_RE.test(reason))) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-FORBIDDEN]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-INSTANT",
+			"title": "calendar rollover is accepted as an ISO instant",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\treturn !Number.isNaN(ms) && new Date(ms).toISOString() === value;"],
+			"replace": ["\treturn !Number.isNaN(ms);"],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-INSTANT]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-BACKEND-DOMAIN",
+			"title": "one backend records the other backend's outcome as its own",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\tconst allowed: readonly unknown[] = RETIREMENT_OUTCOME_STATUSES_BY_BACKEND[targetBackend];"],
+			"replace": [
+				"\tconst allowed: readonly unknown[] = [\"shutdown-requested\", \"exited\", \"refused\", \"not-signalled\", \"unknown\"];"
+			],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-BACKEND-DOMAIN]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-SNAPSHOT",
+			"title": "foreign prototypes stop being refused at the snapshot boundary",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": [
+				"\tif (proto !== Object.prototype && proto !== null) throw new RetirementEventError(`${what} must be a plain object`);"
+			],
+			"replace": ["\t// MUTANT: foreign prototype admitted."],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-SNAPSHOT]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-ONE-SNAPSHOT",
+			"title": "filename re-reads the original object after validating a different target snapshot",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\tconst file = retirementEventFile(retirementsDir, targetGardenId);"],
+			"replace": ["\tconst file = retirementEventFile(retirementsDir, event.targetGardenId);"],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-ONE-SNAPSHOT]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-APPEND",
+			"title": "an append opens at offset zero and overwrites the preserved prefix",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\tconst fd = fs.openSync(file, O_WRONLY | O_APPEND | O_CREAT | O_NOFOLLOW | O_NONBLOCK, 0o600);"],
+			"replace": ["\tconst fd = fs.openSync(file, O_WRONLY | O_CREAT | O_NOFOLLOW | O_NONBLOCK, 0o600);"],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-APPEND]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-CREATE",
+			"title": "new event files abandon the literal target-gid JSONL filename contract",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["export const RETIREMENT_EVENT_SUFFIX = \".jsonl\";"],
+			"replace": ["export const RETIREMENT_EVENT_SUFFIX = \".log\";"],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-CREATE]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-NOFOLLOW",
+			"title": "a final symlink is followed and its victim is appended to",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\tconst fd = fs.openSync(file, O_WRONLY | O_APPEND | O_CREAT | O_NOFOLLOW | O_NONBLOCK, 0o600);"],
+			"replace": ["\tconst fd = fs.openSync(file, O_WRONLY | O_APPEND | O_CREAT | O_NONBLOCK, 0o600);"],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-NOFOLLOW]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-NONREGULAR",
+			"title": "a multiply linked event inode can be appended to",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": [
+				"\t\tif (st.nlink !== 1) throw new RetirementEventError(`${path.basename(file)} has ${st.nlink} links; refusing`);"
+			],
+			"replace": ["\t\t// MUTANT: hardlink guard omitted."],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-NONREGULAR]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-DIR",
+			"title": "a symlinked retirement directory is admitted",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\tif (st.isSymbolicLink() || !st.isDirectory()) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-DIR]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-PATH",
+			"title": "a relative sessions directory becomes an ambient-CWD-dependent path",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": [
+				"\tif (!path.isAbsolute(sessionsDir)) throw new RetirementEventError(\"sessionsDir must be an absolute path\");"
+			],
+			"replace": ["\t// MUTANT: relative sessions directory admitted."],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-PATH]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-NO-AMBIENT",
+			"title": "the append leaf begins reading ambient environment",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["export function retirementsDirBesideSessions(sessionsDir: string): string {"],
+			"replace": [
+				"export function retirementsDirBesideSessions(sessionsDir: string): string {",
+				"\tvoid process.env.HOME;"
+			],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-NO-AMBIENT]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-PRIMITIVES",
+			"title": "FIFO admission loses NONBLOCK without a semantic open-flag assertion",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\tconst fd = fs.openSync(file, O_WRONLY | O_APPEND | O_CREAT | O_NOFOLLOW | O_NONBLOCK, 0o600);"],
+			"replace": ["\tconst fd = fs.openSync(file, O_WRONLY | O_APPEND | O_CREAT | O_NOFOLLOW, 0o600);"],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-PRIMITIVES]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		},
+		{
+			"claim": "RETIRE-EVENT-FAILURE-MATRIX",
+			"title": "the file flush disappears so a flush failure cannot be reported",
+			"subject": "pi-extensions/lib/retirement-event.ts",
+			"find": ["\t\tfs.fsyncSync(fd);"],
+			"replace": ["\t\t// MUTANT: file flush omitted."],
+			"gate": ["bash", "run.sh", "check-retirement-event"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:RETIRE-EVENT-FAILURE-MATRIX]",
+			"signatureSource": "pi-extensions/lib/retirement-event.test.ts"
+		}
+	]
+}

package/scripts/mutants/v2-surface.json

@@ -2,6 +2,22 @@
 	"schemaVersion": 1,
 	"lane": "v2-surface",
 	"mutants": [
+		{
+			"claim": "V2SURF-RESUME-HINT-SCOPE",
+			"title": "the dormant capability hint returns to a Pi-only automatic-resume invitation",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": [
+				"\t\t\t\t\"Only on an explicit operator request, use entwurf_resume_call {target} for Pi or Claude Code; \" +",
+				"\t\t\t\t\"it submits no prompt. This capability hint is not permission to resume automatically.\""
+			],
+			"replace": [
+				"\t\t\t\t\"Reopen the citizen with entwurf_resume_call {target} (pi targets only; it runs no turn), then dispatch again.\""
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2SURF-RESUME-HINT-SCOPE]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
 		{
 			"claim": "V2SURF-MCP-LOCK-DOMAIN",
 			"title": "MCP long description reverts to the false \"socket paths take a per-target lock\" claim",

package/scripts/mutants/v2-visible-resume.json

@@ -73,8 +73,16 @@
 			"claim": "V2RESUME-OBSERVE-IS-BOUNDED-WAIT",
 			"title": "the observation becomes a single immediate probe, which reports every real resume as unobserved (the socket answers ~2-4s later)",
 			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
-			"find": ["\t\tawait deps.sleep(intervalMs);"],
-			"replace": ["\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"],
+			"find": [
+				"\t\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };",
+				"\t\t}",
+				"\t\tawait deps.sleep(intervalMs);"
+			],
+			"replace": [
+				"\t\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };",
+				"\t\t}",
+				"\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"
+			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-OBSERVE-IS-BOUNDED-WAIT]",
@@ -106,8 +114,8 @@
 			"claim": "V2RESUME-ARGV-FROM-RECORD",
 			"title": "the launcher is handed the caller's own directory instead of the record's, so the citizen returns in the wrong project",
 			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
-			"find": ["\t\tconst launched = deps.launch({ cwd: identity.cwd, runtimeArgs });"],
-			"replace": ["\t\tconst launched = deps.launch({ cwd: process.cwd(), runtimeArgs });"],
+			"find": ["\t\tconst launched = deps.launch({ backend: \"pi\", cwd: identity.cwd, runtimeArgs });"],
+			"replace": ["\t\tconst launched = deps.launch({ backend: \"pi\", cwd: process.cwd(), runtimeArgs });"],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-ARGV-FROM-RECORD]",
@@ -117,9 +125,11 @@
 			"claim": "V2RESUME-RECEIPTS-SEPARATE",
 			"title": "the launch receipt absorbs the observation, so 'a window opened' and 'the citizen is back' become one claim",
 			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
-			"find": ["\t\t\tlaunch: { targetGardenId, sessionFile: identity.sessionFile, handle: launched.handle },"],
+			"find": [
+				"\t\t\tlaunch: { backend: \"pi\", targetGardenId, sessionFile: identity.sessionFile, handle: launched.handle },"
+			],
 			"replace": [
-				"\t\t\tlaunch: { targetGardenId, sessionFile: identity.sessionFile, handle: launched.handle, kind: observation.kind } as ResumeLaunchReceipt,"
+				"\t\t\tlaunch: { backend: \"pi\", targetGardenId, sessionFile: identity.sessionFile, handle: launched.handle, kind: observation.kind } as ResumeLaunchReceipt,"
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
@@ -156,7 +166,8 @@
 			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
 			"find": ["\t\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"],
 			"replace": [
-				"\t\t\t(deps as VisibleResumeDeps).launch({ cwd: \"/tmp\", runtimeArgs: [] });\n\t\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"
+				"\t\t\t(deps as VisibleResumeDeps).launch({ backend: \"pi\", cwd: \"/tmp\", runtimeArgs: [] });",
+				"\t\t\treturn { kind: \"resume-unobserved\", socketPath, waitedMs: deps.now() - started };"
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
@@ -175,29 +186,29 @@
 			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
-			"claim": "V2RESUME-NOT-PI-REFUSED",
+			"claim": "V2RESUME-BACKEND-UNSUPPORTED-REFUSED",
 			"title": "an out-of-domain backend is reported as an error instead of a named refusal, so a fine record reads as a broken one",
 			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
 			"find": ["\t\t\tif (err instanceof ResumeBackendUnsupportedError) {"],
 			"replace": ["\t\t\tif (false && err instanceof ResumeBackendUnsupportedError) {"],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
-			"signature": "[QK:V2RESUME-NOT-PI-REFUSED]",
+			"signature": "[QK:V2RESUME-BACKEND-UNSUPPORTED-REFUSED]",
 			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
-			"claim": "V2RESUME-NOT-PI-BY-FIELD",
+			"claim": "V2RESUME-BACKEND-UNSUPPORTED-BY-FIELD",
 			"title": "the backend is re-derived instead of taken from the typed error, which is the second read this rail refuses",
 			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
 			"find": [
-				"\t\t\t\t\t\t`${targetGardenId} is a ${err.backend} citizen; only pi citizens stand a control socket up, ` +"
+				"\t\t\t\t\t\t`${targetGardenId} is a ${err.backend} citizen; only pi and Claude Code citizens can be reopened ` +"
 			],
 			"replace": [
-				"\t\t\t\t\t\t`${targetGardenId} is a citizen of another backend; only pi citizens stand a control socket up, ` +"
+				"\t\t\t\t\t\t`${targetGardenId} is a citizen of another backend; only pi and Claude Code citizens can be reopened ` +"
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
-			"signature": "[QK:V2RESUME-NOT-PI-BY-FIELD]",
+			"signature": "[QK:V2RESUME-BACKEND-UNSUPPORTED-BY-FIELD]",
 			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		},
 		{
@@ -221,6 +232,265 @@
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-ACP-MODEL-REFUSED]",
 			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-DEAD-OWNER-LAUNCHES",
+			"title": "a Claude Code resume is launched as `claude --continue`, which reopens whichever session the vendor picks rather than the one the record names",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\truntimeArgs: [\"--resume\", current.nativeSessionId],"],
+			"replace": ["\t\truntimeArgs: [\"--continue\"],"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-DEAD-OWNER-LAUNCHES]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-LIVE-REFUSED",
+			"title": "a live Claude Code owner stops being refused as live, so the caller is told to wait on an inconclusive probe instead of sending to the running session",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (before.owner === \"live\") {"],
+			"replace": ["\tif (before.owner === (\"never\" as string)) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-LIVE-REFUSED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-UNCERTAIN-REFUSED",
+			"title": "an owner the shared rule cannot judge is treated as dormant, which can open a second process on a session that is still running",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (before.owner !== \"dead\") {"],
+			"replace": ["\tif (before.owner === (\"never\" as string)) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-UNCERTAIN-REFUSED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-ABSENT-REFUSED",
+			"title": "a Claude Code citizen with no receiver marker is not refused by name, so a session nothing proves dormant falls through the dormancy proof",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (before.kind === \"absent\") {"],
+			"replace": ["\tif (before.kind === (\"never\" as string)) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-ABSENT-REFUSED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-CORRUPT-REFUSED",
+			"title": "an unreadable receiver marker is not refused by name, so a marker whose owner cannot be judged falls through the dormancy proof",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (before.kind === \"corrupt\") {"],
+			"replace": ["\tif (before.kind === (\"never\" as string)) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-CORRUPT-REFUSED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-MISMATCH-REFUSED",
+			"title": "a dead marker for ANOTHER native session is accepted as this session's dormancy proof",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tmarker.backend !== \"claude-code\" ||", "\t\tmarker.nativeSessionId !== identity.nativeSessionId"],
+			"replace": ["\t\tmarker.backend !== \"claude-code\" ||", "\t\tfalse"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-MISMATCH-REFUSED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-OBSERVES-NEW-OWNER",
+			"title": "the observation accepts the previous owner's marker as the resumed session coming back",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": [
+				"\t\t\t(seen.marker.ownerPid !== previous.ownerPid || seen.marker.ownerStartKey !== previous.ownerStartKey) &&"
+			],
+			"replace": ["\t\t\ttrue &&"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-OBSERVES-NEW-OWNER]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-RECORD-DRIFT-UNOBSERVED",
+			"title": "the observation stops checking that the record still names the same session with the same createdAt",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\t\tcurrent.createdAt === identity.createdAt &&"],
+			"replace": ["\t\t\t\ttrue &&"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-RECORD-DRIFT-UNOBSERVED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-MARKER-READ-RAW",
+			"title": "the receiver marker is read through a path that follows symlinks instead of the no-follow fd reader, so a link to another citizen's marker answers for this one",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tbytes = readStoreRecordFile(markerPath);"],
+			"replace": ["\t\tbytes = process.getBuiltinModule(\"node:fs\").readFileSync(markerPath, \"utf8\");"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-MARKER-READ-RAW]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-PI-NEVER-READS-RECEIVER",
+			"title": "the pi path consults a Claude Code receiver marker, mixing the two backends' dormancy proofs",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tconst launched = deps.launch({ backend: \"pi\", cwd: identity.cwd, runtimeArgs });"],
+			"replace": [
+				"\t\tdeps.inspectReceiver(targetGardenId);",
+				"\t\tconst launched = deps.launch({ backend: \"pi\", cwd: identity.cwd, runtimeArgs });"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-PI-NEVER-READS-RECEIVER]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-RENDER",
+			"title": "the Claude Code launch receipt stops saying it asked for claude --resume, so a reader cannot tell which session the window was asked to open",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": [
+				"\t\t\t\t`LAUNCH receipt: tmux created that window and was asked to start claude --resume on the session above.\\n` +"
+			],
+			"replace": ["\t\t\t\t`LAUNCH receipt: tmux created that window.\\n` +"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-RENDER]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-OBSERVE-HELPER-BOUNDED",
+			"title": "the Claude Code observation's deadline reports the previous owner as re-armed instead of unobserved",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\treturn { kind: \"resume-unobserved\", waitedMs: deps.now() - started };"],
+			"replace": [
+				"\t\t\treturn { kind: \"receiver-armed\", ownerPid: previous.ownerPid, waitedMs: deps.now() - started };"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-OBSERVE-HELPER-BOUNDED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-BINDING-REREAD",
+			"title": "the binding is compared against the FIRST record read, so an arm committed between that read and the dead verdict is bound by a stale value",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tconst current = deps.resolveIdentity(targetGardenId);"],
+			"replace": ["\tconst current = identity;"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-BINDING-REREAD]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-UNBOUND-LEGACY",
+			"title": "a record or marker with no binding (null) passes the binding check, so null == null reads as a match",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (current.attachIncarnation === null || marker.attachIncarnation === null) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-UNBOUND-LEGACY]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-UNBOUND-STALE",
+			"title": "a dead marker whose binding is older than the record's still authorises a launch",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (current.attachIncarnation !== marker.attachIncarnation) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-UNBOUND-STALE]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-UNBOUND-RECORD-MOVED",
+			"title": "a record whose createdAt changed between the two reads is still bound",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tcurrent.createdAt !== identity.createdAt"],
+			"replace": ["\t\tfalse"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-UNBOUND-RECORD-MOVED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-OBSERVE-PANE-JOIN",
+			"title": "the observation accepts a live owner anywhere, not only the pane this call opened",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\tString(seen.marker.ownerPid) === panePid &&"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-OBSERVE-PANE-JOIN]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-OBSERVE-BACKEND",
+			"title": "the observation accepts a live receiver marker of another backend",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\tseen.marker.backend === \"claude-code\" &&"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-OBSERVE-BACKEND]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-OBSERVE-FRESH-BINDING",
+			"title": "the observation accepts a new owner still showing the binding the dormancy proof bound",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\tseen.marker.attachIncarnation !== previous.attachIncarnation"],
+			"replace": ["\t\t\ttrue"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-OBSERVE-FRESH-BINDING]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-OBSERVE-RECORD-BINDING",
+			"title": "the observation stops requiring the current record to carry the marker's binding",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\t\tcurrent.attachIncarnation === seen.marker.attachIncarnation"],
+			"replace": ["\t\t\t\ttrue"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-OBSERVE-RECORD-BINDING]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-OBSERVE-RECORD-UNREADABLE",
+			"title": "a record defect during the observation is swallowed into the bounded wait instead of stopping it as record-unreadable",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": [
+				"\t\t\t\treturn {",
+				"\t\t\t\t\tkind: \"record-unreadable\",",
+				"\t\t\t\t\tcause: err instanceof Error ? err.message : String(err),",
+				"\t\t\t\t\twaitedMs: deps.now() - started,",
+				"\t\t\t\t};"
+			],
+			"replace": ["\t\t\t\tcurrent = identity;"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-OBSERVE-RECORD-UNREADABLE]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-MARKER-BINDING-READ",
+			"title": "the receiver-marker validator drops the marker's binding, so every marker reads as unbound",
+			"subject": "pi-extensions/lib/meta-session.ts",
+			"find": [
+				"\t\tattachIncarnation: requireAttachIncarnation(raw.attachIncarnation === undefined ? null : raw.attachIncarnation),"
+			],
+			"replace": ["\t\tattachIncarnation: null,"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-MARKER-BINDING-READ]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		}
 	]
 }

package/scripts/probe-bridge-command.ts

@@ -67,6 +67,7 @@ export const EXPECTED_TOOLS = [
 	"entwurf_register_native",
 	"entwurf_fresh_call",
 	"entwurf_resume_call",
+	"entwurf_retire_call",
 	"entwurf_callback",
 ] as const;
 const DEFAULT_TIMEOUT_MS = 10_000;

package/scripts/smoke-agy-install-state.sh

@@ -67,7 +67,7 @@ write_mcp_fake() {   # $1 = path
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_retire_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE
@@ -89,7 +89,7 @@ if [ "${REVIEW_ENV:-}" = "fail" ]; then echo configured-env-failure >&2; exit 24
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_retire_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE

package/scripts/smoke-codex-fresh-live.ts

@@ -1082,7 +1082,8 @@ async function run(): Promise<void> {
 	const codexWaitToken = `CODEX-WAIT-${Math.random().toString(36).slice(2, 10).toUpperCase()}`;
 	const finalToken = `CODEX-PI-FINAL-${Math.random().toString(36).slice(2, 10).toUpperCase()}`;
 	expectedReportTokens.push(finalToken);
-	const outboundPiTask = "After your automatic callback succeeds, answer ACK and stop. Do not open another sibling.";
+	const outboundPiTask =
+		"Your automatic callback is the whole task and there is no result to send. After it succeeds, end the turn: no message, no report, no further tool call. Do not open another sibling.";
 	const codexTask =
 		`After your required callback receipt, end the turn and wait passively for the addressed instruction containing ${codexWaitToken}. ` +
 		"Do not call shell, sleep, terminal, or any tool to wait.";

package/scripts/smoke-copilot-mcp-state.sh

@@ -26,7 +26,7 @@ write_mcp_fake() {
 while IFS= read -r line; do
   case "$line" in
     *'"id":1'*) printf '%s\n' '{"jsonrpc":"2.0","id":1,"result":{"protocolVersion":"2024-11-05","capabilities":{},"serverInfo":{"name":"fake-entwurf-bridge","version":"0"}}}' ;;
-    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_callback"}]}}' ;;
+    *'"id":2'*) printf '%s\n' '{"jsonrpc":"2.0","id":2,"result":{"tools":[{"name":"entwurf_v2"},{"name":"entwurf_self"},{"name":"entwurf_peers"},{"name":"entwurf_inbox_read"},{"name":"entwurf_register_native"},{"name":"entwurf_fresh_call"},{"name":"entwurf_resume_call"},{"name":"entwurf_retire_call"},{"name":"entwurf_callback"}]}}' ;;
   esac
 done
 FAKE