@junghanacs/entwurf 0.41.0 → 0.41.2

package/scripts/lib/codex-fresh-live-protocol.ts

@@ -52,8 +52,9 @@ export function buildCodexInstruction(input: CodexInstructionInput): string {
 		// DIRECTORY must come from this Codex's own record (#95 lane C), which is a fact only
 		// because its thread now opens where its pane is rather than where the app-server sits.
 		// Omitting the parameter is the whole point — passing one would prove neither.
-		'NO cwd parameter and NO placement parameter, and task "After your automatic callback succeeds, answer ACK and ' +
-		'stop. Do not open another sibling."\n' +
+		'NO cwd parameter and NO placement parameter, and task "Your automatic callback is the whole task and there is ' +
+		"no result to send. After it succeeds, end the turn: no message, no report, no further tool call. Do not open " +
+		'another sibling."\n' +
 		"2. Stop and wait for the Pi callback delivered into this Codex thread. Accept only a callback whose body " +
 		"repeats the exact nonce from your LAUNCH receipt and whose sender envelope carries a garden id on its `session:` line.\n" +
 		`3. Only after that match, call public mcp__entwurf_bridge__entwurf_v2 once with target ${input.callerGid}, ` +
@@ -69,6 +70,36 @@ export function buildCodexInstruction(input: CodexInstructionInput): string {
 	);
 }
 
+/**
+ * The initial Pi's own fresh-call task: its bootstrap, then a passive wait.
+ *
+ * `[GLG 직접, 2026-10-24]` a fresh sibling may check its caller with the public read-only listing,
+ * then calls back, then works — the same promise the shared framing makes. This task used to say
+ * "Your FIRST tool call must be … callback … and nothing before it" and forbade rechecking
+ * "identity with shell or other tools", which forbade the very check the framing offers. What it
+ * still asks for is narrower and fixture-specific: no shell recheck of what session-info already
+ * says, the zero-argument callback (no target or nonce to copy — the address rides the launch
+ * env), no other tool before it, and no tool used to wait. `[측정 2026-10-24, r3]` a `bash true`
+ * before the callback is still refused by the order audit (`assertBootstrapOrder`).
+ *
+ * THIS ONE LAUNCH TAKES THE OPTION. `[GLG 직접, 2026-10-24]` the shared framing OFFERS the check; the
+ * four impact LIVEs that followed measured it taken zero times, so the positive path had only unit
+ * evidence. This guided task asks the initial Pi to take it — one peers call, its result, then the
+ * callback — and the smoke requires a peers prefix of at least one (`minPeersPrefix`). It is a
+ * fixture's choice of the offered option, not a product rule, and a PASS here is evidence that the
+ * path works end to end, not evidence of any sibling's own judgement.
+ */
+export function buildInitialPiBootstrapTask(initialPiWaitToken: string): string {
+	return (
+		"Session-info already supplies device, time and cwd; do not recheck them with shell. " +
+		"This launch is a guided caller check: first call mcp__entwurf_bridge__entwurf_peers once (read-only, no " +
+		"arguments) to corroborate your caller, and only after its result call mcp__entwurf_bridge__entwurf_callback " +
+		"with no arguments. Use no other tool before the callback. " +
+		`After your required callback receipt, end the turn and wait passively for one addressed message containing ${initialPiWaitToken}. ` +
+		"That message is the only authority to open the Codex sibling. Do not call shell, sleep, terminal, or any tool to wait."
+	);
+}
+
 export interface InitialPiPhaseOneInput {
 	initialPiWaitToken: string;
 	codexWaitToken: string;

package/scripts/lib/codex-fresh-source-receipts.ts

@@ -9,6 +9,11 @@ export interface SourceToolReceipt {
 	text: string;
 	status: SourceToolStatus;
 	isError: boolean;
+	/** Pi only: the transcript row index of this call's assistant message. Rows are appended in
+	 * order, so this is a source fact about WHEN the call was recorded. Codex leaves it unset. */
+	callOrdinal?: number;
+	/** Pi only: the transcript row index of this call's toolResult. Unset while pending and on Codex. */
+	resultOrdinal?: number;
 }
 
 export interface ExpectedSourceToolCall {
@@ -104,6 +109,107 @@ export function assertExactSourceToolCalls(
 	if (remaining.length > 0) throw new Error(`${label}: missing source calls ${JSON.stringify(remaining)}`);
 }
 
+/** The callback a fresh sibling makes before its task, and the one read-only check it may make first. */
+export interface BootstrapOrderExpectation {
+	/** Exact arguments of the read-only `entwurf_peers` check the framing offers before the callback. */
+	peersArguments: Record<string, unknown>;
+	/** The callback role: zero-argument `entwurf_callback`, or Codex's `entwurf_v2` to the caller. */
+	callback: ExpectedSourceToolCall;
+	/** A GUIDED launch that asked for the check requires at least this many peers checks. Absent = 0:
+	 * the check is optional everywhere else, and a fixture's guided task is not a product rule. */
+	minPeersPrefix?: number;
+}
+
+/**
+ * Bootstrap arguments: `entwurf_v2` keeps its schema default (absent `wants_reply` IS false — see
+ * `normalizeSourceArguments`), because Codex's callback IS that verb and a model that omits the key
+ * has obeyed it. Every other verb compared here is byte-exact: `entwurf_callback` is ZERO-argument,
+ * so `{ wants_reply: false }` is a model supplying a parameter the verb does not have, and the peers
+ * check is held to the exact call the framing offers.
+ */
+function bootstrapArgumentsMatch(toolName: string, expected: Record<string, unknown>, actual: Record<string, unknown>) {
+	return toolName === "entwurf_v2" ? sourceArgumentsMatch(expected, actual) : isDeepStrictEqual(expected, actual);
+}
+
+/**
+ * The bootstrap order of one fresh sibling, judged on its source receipts IN CALL ORDER:
+ * zero or more successful exact `entwurf_peers` checks, then exactly one successful exact callback,
+ * then the rest — which is returned for the existing exact-once role audit. `[GLG 직접, 2026-10-24]`
+ * checking the caller and then calling back is the right order; nothing else may come first.
+ *
+ * Refused: any other call before the callback (a `bash true`, a task role), a peers check with other
+ * arguments or that did not succeed, a missing / pending / failed callback, a callback with drifted
+ * arguments, a peers check or a second exact callback AFTER the callback, and — where the source
+ * records it — a callback CALLED before a peers check's RESULT was recorded, or a later call recorded
+ * before the callback's RESULT.
+ *
+ * WHAT THE ORDER PROVES DEPENDS ON THE SOURCE. Pi rows carry `callOrdinal`/`resultOrdinal`, so on Pi
+ * this proves every peers result was recorded before the callback was called, and the callback's
+ * result before every later call. Codex `thread/read` gives item order and a status read at audit
+ * time, nothing more, so on Codex this proves CALL ORDER and completion-at-audit only; that a peers
+ * result preceded the callback call, and that the callback result preceded the next call, are both
+ * UNVERIFIED there.
+ * The peers check is never filtered out by position: it is admitted only as a prefix.
+ *
+ * SCOPE. This is the audit's condition for the short fixture tasks that call it ("use no other tool
+ * before the callback"), not a universal list of what a fresh sibling may do; a sibling whose own
+ * check does not hold up may also hold the callback, which these fixtures then see as no callback.
+ */
+export function assertBootstrapOrder(
+	receipts: readonly SourceToolReceipt[],
+	expected: BootstrapOrderExpectation,
+	label: string,
+): SourceToolReceipt[] {
+	let at = 0;
+	for (; at < receipts.length && receipts[at]?.toolName === "entwurf_peers"; at++) {
+		const check = receipts[at] as SourceToolReceipt;
+		if (!isDeepStrictEqual(check.arguments, expected.peersArguments))
+			throw new Error(
+				`${label}: pre-callback entwurf_peers arguments differ\nexpected=${JSON.stringify(expected.peersArguments)}\nactual=${JSON.stringify(check.arguments)}`,
+			);
+		if (check.status !== "completed" || check.isError)
+			throw new Error(`${label}: pre-callback entwurf_peers ${check.isError ? "failed" : check.status}`);
+	}
+	const callback = receipts[at];
+	if (callback === undefined) throw new Error(`${label}: no callback after ${at} pre-callback check(s)`);
+	const minPeers = expected.minPeersPrefix ?? 0;
+	if (at < minPeers)
+		throw new Error(`${label}: the guided caller check was not made (peers prefix=${at}, required ≥ ${minPeers})`);
+	const role = expected.callback;
+	if (
+		callback.toolName !== role.toolName ||
+		!bootstrapArgumentsMatch(role.toolName, role.arguments, callback.arguments)
+	)
+		throw new Error(
+			`${label}: unexpected pre-callback call ${callback.toolName} ${JSON.stringify(callback.arguments)} — only the read-only entwurf_peers check may precede ${role.toolName} ${JSON.stringify(role.arguments)}`,
+		);
+	if (callback.status !== "completed" || callback.isError)
+		throw new Error(`${label}: the callback ${callback.isError ? "failed" : `remained ${callback.status}`}`);
+	// A check is a check only if its answer was in hand before the callback was made.
+	for (const check of receipts.slice(0, at)) {
+		if (
+			check.resultOrdinal !== undefined &&
+			callback.callOrdinal !== undefined &&
+			!(check.resultOrdinal < callback.callOrdinal)
+		)
+			throw new Error(`${label}: ${callback.toolName} was called before the entwurf_peers result was recorded`);
+	}
+	const rest = receipts.slice(at + 1);
+	for (const later of rest) {
+		if (later.toolName === "entwurf_peers")
+			throw new Error(`${label}: entwurf_peers after the callback — the check is offered only before it`);
+		if (later.toolName === role.toolName && bootstrapArgumentsMatch(role.toolName, role.arguments, later.arguments))
+			throw new Error(`${label}: duplicate callback ${later.toolName}`);
+		if (
+			callback.resultOrdinal !== undefined &&
+			later.callOrdinal !== undefined &&
+			later.callOrdinal < callback.resultOrdinal
+		)
+			throw new Error(`${label}: ${later.toolName} was called before the callback result was recorded`);
+	}
+	return rest;
+}
+
 /** The only production leaf that turns joined source receipts into cleanup window authority. */
 export function sourceCleanupWindows(receipts: readonly SourceToolReceipt[]): string[] {
 	const windows: string[] = [];
@@ -199,9 +305,9 @@ function piSourceVerb(nativeName: string): string {
 /** Join Pi's own toolCall and toolResult rows by native id, retaining pending calls.
  * Native-name equality is checked before translating the exact current Pi dialect. */
 export function piSourceToolReceipts(entries: readonly unknown[]): SourceToolReceipt[] {
-	const calls = new Map<string, { toolName: string; arguments: Record<string, unknown> }>();
-	const results = new Map<string, { toolName: string; text: string; isError: boolean }>();
-	for (const raw of entries) {
+	const calls = new Map<string, { toolName: string; arguments: Record<string, unknown>; callOrdinal: number }>();
+	const results = new Map<string, { toolName: string; text: string; isError: boolean; resultOrdinal: number }>();
+	for (const [ordinal, raw] of entries.entries()) {
 		if (typeof raw !== "object" || raw === null) continue;
 		const entry = raw as { type?: unknown; message?: unknown };
 		if (entry.type !== "message" || typeof entry.message !== "object" || entry.message === null) continue;
@@ -229,6 +335,7 @@ export function piSourceToolReceipts(entries: readonly unknown[]): SourceToolRec
 				calls.set(block.id, {
 					toolName: block.name,
 					arguments: block.arguments as Record<string, unknown>,
+					callOrdinal: ordinal,
 				});
 			}
 		}
@@ -242,6 +349,7 @@ export function piSourceToolReceipts(entries: readonly unknown[]): SourceToolRec
 				toolName: message.toolName,
 				text: textContent(message.content),
 				isError: message.isError,
+				resultOrdinal: ordinal,
 			});
 		}
 	}
@@ -263,6 +371,7 @@ export function piSourceToolReceipts(entries: readonly unknown[]): SourceToolRec
 			text: result.text,
 			status: result.isError ? "failed" : "completed",
 			isError: result.isError,
+			resultOrdinal: result.resultOrdinal,
 		});
 	}
 	return joined;

package/scripts/lib/pi-durable-fresh-live-receipts.ts

@@ -11,8 +11,12 @@
  * its entry kinds — `pi.system` (tool offering, applied as toolsAdded/toolsRemoved in order),
  * `pi.assistant` (the model that answered, and the tool calls in order) and `pi.tool-result` (each
  * call's settled result, joined by toolCallId).
+ *
+ * Each call also carries the native ENTRY ids of its call and of its result (`callOrdinal` /
+ * `resultOrdinal`). Entries are read in id order, so the ids order what the store recorded — the same
+ * fact Pi's transcript row index gives the bootstrap-order leaf (`assertBootstrapOrder`).
  */
-import { piCallbackSenders } from "./codex-fresh-source-receipts.ts";
+import { piCallbackSenders, type SourceToolReceipt } from "./codex-fresh-source-receipts.ts";
 
 /** The one Pi transcript row whose exact payload arrived from `expectedSender`, or null. */
 export function piExactDeliveryRow(
@@ -43,6 +47,10 @@ export interface PdToolCall {
 	name: string;
 	arguments: Record<string, unknown>;
 	result: { text: string; isError: boolean } | null;
+	/** Native entry id of the assistant row that made this call. */
+	callOrdinal: number;
+	/** Native entry id of the tool-result row joined to it, or null while none is recorded. */
+	resultOrdinal: number | null;
 }
 export interface PdRootView {
 	offering: string[];
@@ -98,6 +106,8 @@ export function pdRootView(entries: readonly PdNativeRow[], rootConversationId:
 						name: b.name,
 						arguments: (b.arguments ?? {}) as Record<string, unknown>,
 						result: null,
+						callOrdinal: row.id,
+						resultOrdinal: null,
 					};
 					calls.push(call);
 					byId.set(b.id, call);
@@ -115,12 +125,30 @@ export function pdRootView(entries: readonly PdNativeRow[], rootConversationId:
 					)
 					.join("");
 				call.result = { text, isError: message.isError === true };
+				call.resultOrdinal = row.id;
 			}
 		}
 	}
 	return { offering, models: [...models], calls };
 }
 
+/**
+ * The root calls as source receipts, in call order, for the bootstrap-order leaf: a call with no joined
+ * result is PENDING, an errored result is FAILED. pd's verbs are its own bare tool names, so no
+ * dialect translation happens here.
+ */
+export function pdSourceToolReceipts(calls: readonly PdToolCall[]): SourceToolReceipt[] {
+	return calls.map((call) => ({
+		toolName: call.name,
+		arguments: call.arguments,
+		text: call.result?.text ?? "",
+		status: call.result === null ? "pending" : call.result.isError ? "failed" : "completed",
+		isError: call.result?.isError ?? false,
+		callOrdinal: call.callOrdinal,
+		...(call.resultOrdinal === null ? {} : { resultOrdinal: call.resultOrdinal }),
+	}));
+}
+
 /** The doorbell submission for exactly this mailbox message, on the root conversation. */
 export function pdDoorbellSubmission(
 	submissions: readonly PdNativeSubmissionRow[],

package/scripts/mutants/chain-terminus-publication.json

@@ -0,0 +1,17 @@
+{
+	"schemaVersion": 1,
+	"lane": "chain-terminus-publication",
+	"mutants": [
+		{
+			"claim": "CHAIN-TERMINUS-WAITS-FOR-SIGNAL",
+			"title": "the terminus wait stops at the first body again, so smoke-entwurf-chain-live checks the doorbell while enqueueMetaMessage is still between its .msg write and its inbox.signal write and reports a false RED",
+			"subject": "scripts/lib/chain-terminus-publication.ts",
+			"find": ["\t\tif (msgs.length > 0 && signalled) break;"],
+			"replace": ["\t\tif (msgs.length > 0) break;"],
+			"gate": ["bash", "run.sh", "check-chain-terminus-publication"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:CHAIN-TERMINUS-WAITS-FOR-SIGNAL]",
+			"signatureSource": "test/chain-terminus-publication.test.ts"
+		}
+	]
+}

package/scripts/mutants/codex-native.json

@@ -1066,6 +1066,104 @@
 			"timeoutSeconds": 180,
 			"signature": "[QK:CODEX-SOCKET-LISTEN-ROW-ONLY]",
 			"signatureSource": "test/codex-socket-listener.test.ts"
+		},
+		{
+			"claim": "BOOTSTRAP-PEERS-PREFIX-THEN-EXACT-CALLBACK",
+			"title": "the bootstrap ORDER removed: everything before the first callback is skipped instead of only an exact peers check, so `bash true → callback → task` — the r3 RED — passes again, and a task call made before the callback is no longer refused",
+			"subject": "scripts/lib/codex-fresh-source-receipts.ts",
+			"find": ["\tfor (; at < receipts.length && receipts[at]?.toolName === \"entwurf_peers\"; at++) {"],
+			"replace": [
+				"\tfor (; at < receipts.length && receipts[at]?.toolName !== expected.callback.toolName; at++) {\n\t\tif (receipts[at]?.toolName !== \"entwurf_peers\") continue;"
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:BOOTSTRAP-PEERS-PREFIX-THEN-EXACT-CALLBACK]",
+			"signatureSource": "test/codex-fresh-live-protocol.test.ts"
+		},
+		{
+			"claim": "BOOTSTRAP-PEERS-ONLY-AS-PREFIX",
+			"title": "the peers check filtered out wherever it appears instead of admitted only as a prefix — a check after the callback disappears from the audit, which is the position-independent filter the contract forbids",
+			"subject": "scripts/lib/codex-fresh-source-receipts.ts",
+			"find": ["\tconst rest = receipts.slice(at + 1);"],
+			"replace": ["\tconst rest = receipts.slice(at + 1).filter((r) => r.toolName !== \"entwurf_peers\");"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:BOOTSTRAP-PEERS-ONLY-AS-PREFIX]",
+			"signatureSource": "test/codex-fresh-live-protocol.test.ts"
+		},
+		{
+			"claim": "BOOTSTRAP-ZERO-ARG-CALLBACK-STRICT",
+			"title": "the v2 wants_reply default stretched over the zero-argument callback: `entwurf_callback {wants_reply:false}` reads as `{}`, so a model supplying a parameter the verb does not have passes as the exact callback",
+			"subject": "scripts/lib/codex-fresh-source-receipts.ts",
+			"find": [
+				"\treturn toolName === \"entwurf_v2\" ? sourceArgumentsMatch(expected, actual) : isDeepStrictEqual(expected, actual);"
+			],
+			"replace": ["\treturn sourceArgumentsMatch(expected, actual);"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:BOOTSTRAP-ZERO-ARG-CALLBACK-STRICT]",
+			"signatureSource": "test/codex-fresh-live-protocol.test.ts"
+		},
+		{
+			"claim": "BOOTSTRAP-CODEX-V2-CALLBACK-DEFAULT",
+			"title": "deep-strict comparison forced onto Codex's entwurf_v2 callback too — a Codex callback that omits wants_reply (schema default false) is refused, resurrecting the 2026-09-16 default-false RED",
+			"subject": "scripts/lib/codex-fresh-source-receipts.ts",
+			"find": [
+				"\treturn toolName === \"entwurf_v2\" ? sourceArgumentsMatch(expected, actual) : isDeepStrictEqual(expected, actual);"
+			],
+			"replace": ["\treturn isDeepStrictEqual(expected, actual);"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:BOOTSTRAP-CODEX-V2-CALLBACK-DEFAULT]",
+			"signatureSource": "test/codex-fresh-live-protocol.test.ts"
+		},
+		{
+			"claim": "BOOTSTRAP-PI-RESULT-BEFORE-TASK-CALL",
+			"title": "the Pi result-ordinal check dropped: a task call made in the same assistant row as the callback — before the callback result existed — passes on call order alone",
+			"subject": "scripts/lib/codex-fresh-source-receipts.ts",
+			"find": ["\t\t\tcallback.resultOrdinal !== undefined &&"],
+			"replace": ["\t\t\tfalse &&"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:BOOTSTRAP-PI-RESULT-BEFORE-TASK-CALL]",
+			"signatureSource": "test/codex-fresh-live-protocol.test.ts"
+		},
+		{
+			"claim": "CODEX-LIVE-INITIAL-PI-BOOTSTRAP-TASK",
+			"title": "the initial Pi's task restored to the retired forced-first wording — `Your FIRST tool call must be … callback … and nothing before it` with a blanket identity-recheck ban — so the LIVE task forbids the read-only caller check the shared framing offers and the order audit admits",
+			"subject": "scripts/lib/codex-fresh-live-protocol.ts",
+			"find": [
+				"\t\t\"This launch is a guided caller check: first call mcp__entwurf_bridge__entwurf_peers once (read-only, no \" +\n\t\t\"arguments) to corroborate your caller, and only after its result call mcp__entwurf_bridge__entwurf_callback \" +\n\t\t\"with no arguments. Use no other tool before the callback. \" +"
+			],
+			"replace": [
+				"\t\t\"Do not recheck identity with other tools. Your FIRST tool call must be mcp__entwurf_bridge__entwurf_callback with no arguments, and nothing before it. \" +"
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:CODEX-LIVE-INITIAL-PI-BOOTSTRAP-TASK]",
+			"signatureSource": "test/codex-fresh-live-protocol.test.ts"
+		},
+		{
+			"claim": "BOOTSTRAP-PI-PEERS-RESULT-BEFORE-CALLBACK",
+			"title": "the peers-result-before-callback ordinal check dropped: a callback made in the same assistant row as the peers check — before its answer existed — passes as if the caller had been checked",
+			"subject": "scripts/lib/codex-fresh-source-receipts.ts",
+			"find": ["\t\t\tcheck.resultOrdinal !== undefined &&"],
+			"replace": ["\t\t\tfalse &&"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:BOOTSTRAP-PI-PEERS-RESULT-BEFORE-CALLBACK]",
+			"signatureSource": "test/codex-fresh-live-protocol.test.ts"
+		},
+		{
+			"claim": "BOOTSTRAP-GUIDED-PEERS-REQUIRED",
+			"title": "the guided launch's required check ignored: a guided initial Pi that called back without the peers check it was asked for passes, so a zero-check PASS is counted as the positive path",
+			"subject": "scripts/lib/codex-fresh-source-receipts.ts",
+			"find": ["\tif (at < minPeers)"],
+			"replace": ["\tif (false && at < minPeers)"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:BOOTSTRAP-GUIDED-PEERS-REQUIRED]",
+			"signatureSource": "test/codex-fresh-live-protocol.test.ts"
 		}
 	]
 }

package/scripts/mutants/control-send-receipt.json

@@ -166,10 +166,10 @@
 			"title": "the pi queue oracle's public coordinate is dropped from `check:vitest`, so the file that proves every claim the receipt makes about a receiver's queues is green only when somebody runs `pnpm test` by hand — the discovery door deliberately does not select `test/**`, so nothing else would notice",
 			"subject": "package.json",
 			"find": [
-				"\"check:vitest\": \"./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit\""
+				"\"check:vitest\": \"./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit && ./run.sh check-chain-terminus-publication\""
 			],
 			"replace": [
-				"\"check:vitest\": \"./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit\""
+				"\"check:vitest\": \"./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit && ./run.sh check-chain-terminus-publication\""
 			],
 			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
 			"timeoutSeconds": 600,
@@ -181,7 +181,7 @@
 			"claim": "PI-CORE-PIN-TRACKS-FLOOR",
 			"title": "the queue oracle's pi-agent-core pin drifts off the floor the rest of the pi runtime is pinned to, so the oracle keeps answering honestly — about a pi nobody in this repo runs",
 			"subject": "package.json",
-			"find": ["\"@earendil-works/pi-agent-core\": \"1.3.0\","],
+			"find": ["\"@earendil-works/pi-agent-core\": \"1.4.0\","],
 			"replace": ["\"@earendil-works/pi-agent-core\": \"0.87.1\","],
 			"gate": ["bash", "run.sh", "check-dep-versions"],
 			"timeoutSeconds": 300,

package/scripts/mutants/mux-fresh-call.json

@@ -69,7 +69,9 @@
 			"claim": "FRESHCALL-CALLBACK-PRECEDES-TASK",
 			"title": "the task is framed before the callback instruction, so a sibling that stalls in the task never names itself",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
-			"find": ["\t\t\t\t\t`FIRST ACTION, before reading files or anything else: call ${birthTool} with no arguments.`"],
+			"find": [
+				"\t\t\t\t\t`BEFORE THE TASK, and before reading files or running commands: call ${birthTool} with no arguments.`"
+			],
 			"replace": ["\t\t\t\t\t`FINAL ACTION, after completing the task: call ${birthTool} with no arguments.`"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 120,
@@ -766,6 +768,19 @@
 			"timeoutSeconds": 60,
 			"signature": "[QK:PIIMPORT-CARRIER-FENCE]",
 			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PD-FRESH-LIVE-BOOTSTRAP-ORDER",
+			"title": "a pd call with no joined result read as COMPLETED instead of pending, so a callback whose result the native store never recorded passes pd's bootstrap order",
+			"subject": "scripts/lib/pi-durable-fresh-live-receipts.ts",
+			"find": ["\t\tstatus: call.result === null ? \"pending\" : call.result.isError ? \"failed\" : \"completed\","],
+			"replace": [
+				"\t\tstatus: call.result === null ? \"completed\" : call.result.isError ? \"failed\" : \"completed\","
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PD-FRESH-LIVE-BOOTSTRAP-ORDER]",
+			"signatureSource": "test/pi-durable-fresh-live-receipts.test.ts"
 		}
 	]
 }

package/scripts/mutants/native-push-paused.json

@@ -0,0 +1,17 @@
+{
+	"schemaVersion": 1,
+	"lane": "native-push-paused",
+	"mutants": [
+		{
+			"claim": "AGY-NATIVE-PUSH-PAUSED",
+			"title": "the paused native-push backend set is emptied, so agy dispatch, sender replyability and register_native reach the agy language server again, whose measured external callers were refused for a missing CSRF token (#128, #152)",
+			"subject": "pi-extensions/lib/entwurf-v2-contract.ts",
+			"find": ["export const NATIVE_PUSH_PAUSED_BACKENDS: readonly NativePushBackend[] = [\"antigravity\"];"],
+			"replace": ["export const NATIVE_PUSH_PAUSED_BACKENDS: readonly NativePushBackend[] = [];"],
+			"gate": ["bash", "run.sh", "check-native-push-paused"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:AGY-NATIVE-PUSH-PAUSED]",
+			"signatureSource": "pi-extensions/lib/native-push/paused.test.ts"
+		}
+	]
+}

package/scripts/mutants/omp-fresh.json

@@ -169,8 +169,8 @@
 			"claim": "OMP-BOOTSTRAP-CALLBACK-ONLY",
 			"title": "the task folded back into the stage-one prompt, so the sibling is asked to call back AND to work in one message. This is the prompt the failed LIVE actually ran, minus the missing tool: a competing goal beside the callback is what the two-stage split exists to remove, and nothing about argv or readiness would notice it coming back",
 			"subject": "pi-extensions/meta-bridge-omp.ts",
-			"find": ["\t\t\tsend(buildOmpCallbackOnlyPrompt());"],
-			"replace": ["\t\t\tsend(`${buildOmpCallbackOnlyPrompt()}\\n\\n${payload.task}`);"],
+			"find": ["\t\t\tsend(buildOmpCallbackOnlyPrompt(opts.callerGardenId));"],
+			"replace": ["\t\t\tsend(`${buildOmpCallbackOnlyPrompt(opts.callerGardenId)}\\n\\n${payload.task}`);"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:OMP-BOOTSTRAP-CALLBACK-ONLY]",
@@ -295,6 +295,17 @@
 			"timeoutSeconds": 300,
 			"signature": "[QK:OMP-BOOTSTRAP-EPOCH-ENDS-BEFORE-ENVELOPE]",
 			"signatureSource": "test/omp-fresh-bootstrap.contract.test.ts"
+		},
+		{
+			"claim": "OMP-BOOTSTRAP-CALLER-TARGET-REQUIRED",
+			"title": "a requested omp bootstrap with no well-formed caller target proceeds anyway — the stage silently drops the caller check (or names `undefined` as the caller) and the task is still released, instead of a named refusal",
+			"subject": "pi-extensions/meta-bridge-omp.ts",
+			"find": ["\tif (!caller.ok) {"],
+			"replace": ["\tif (false && !caller.ok) {"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:OMP-BOOTSTRAP-CALLER-TARGET-REQUIRED]",
+			"signatureSource": "test/omp-fresh-bootstrap.contract.test.ts"
 		}
 	]
 }

package/scripts/mutants/pack-install.json

@@ -6,8 +6,8 @@
 			"claim": "PACK-INSTALL-PIN-MATCHER-BOUNDED",
 			"title": "the pin-leak matcher loses its version boundary and blesses substring lookalikes \u2014 @0.85.10 reads as the pinned 0.85.1 and the gate announces a verified tree it never verified (independent review, 2026-08-25)",
 			"subject": "run.sh",
-			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.3\\.0(_|$)' || true"],
-			"replace": ["  grep '^@earendil-works+' | grep -v '@0\\.87\\.1' || true"],
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.4\\.0(_|$)' || true"],
+			"replace": ["  grep '^@earendil-works+' | grep -v '@1\\.4\\.0' || true"],
 			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:PACK-INSTALL-PIN-MATCHER-BOUNDED]",
@@ -17,8 +17,8 @@
 			"claim": "PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE",
 			"title": "the pin-leak matcher narrows back to the pi-* families and goes blind to a non-pi member of the same runtime closure \u2014 @earendil-works/chord (new in pi 0.85.0, a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol) floats unpinned while the gate prints a verified pin (measured 2026-09-06 on a real 0.85.1 install tree)",
 			"subject": "run.sh",
-			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.3\\.0(_|$)' || true"],
-			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@1\\.3\\.0(_|$)' || true"],
+			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.4\\.0(_|$)' || true"],
+			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@1\\.4\\.0(_|$)' || true"],
 			"gate": ["bash", "run.sh", "check-pack-pin-matcher"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE]",
@@ -60,6 +60,52 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:WIN32-PACK-DIGEST]",
 			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PACK-INSTALL-ARGV-LEAK-CAUGHT",
+			"title": "the dispatcher-verb refusal goes back to the retired verdict, `printf | grep -qF` under pipefail refusing only when that pipeline exits 0, so a leak ahead of more output SIGPIPEs the producer and the cell passes \u2014 killed deterministically only because the self-test front-loads the leak ahead of ~260 KB, past the default 64 KiB pipe buffer (its teeth control measures that); on the real small stand-in output the same restoration would survive",
+			"subject": "run.sh",
+			"find": ["  grep -qF -- \"$token\" <<<\"$out\" || argv_search_rc=$?"],
+			"replace": ["  printf '%s' \"$out\" | grep -qF -- \"$token\" || argv_search_rc=1"],
+			"gate": ["bash", "run.sh", "check-pack-argv-matcher"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PACK-INSTALL-ARGV-LEAK-CAUGHT]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PACK-INSTALL-ARGV-CLEAN-PASSES",
+			"title": "the dispatcher-verb refusal stops accepting a clean search (grep rc=1), so every installed copilot / codex-app-server launch is refused, silently",
+			"subject": "run.sh",
+			"find": ["    1) return 0 ;;"],
+			"replace": ["    1) ;;"],
+			"gate": ["bash", "run.sh", "check-pack-argv-matcher"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PACK-INSTALL-ARGV-CLEAN-PASSES]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PACK-INSTALL-ARGV-SEARCH-ERROR-REFUSED",
+			"title": "a failed dispatcher-verb search (grep rc=2) is accepted as clean, so a search that never ran lets the leak refusal pass",
+			"subject": "run.sh",
+			"find": [
+				"    *) fail \"[check-pack-install] installed 'entwurf $label': the dispatcher-verb search itself failed (rc=$argv_search_rc) \u2014 refused, never read as no leak\" ;;"
+			],
+			"replace": ["    *) return 0 ;;"],
+			"gate": ["bash", "run.sh", "check-pack-argv-matcher"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PACK-INSTALL-ARGV-SEARCH-ERROR-REFUSED]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PACK-INSTALL-ARGV-CELLS-BOUND",
+			"title": "the copilot leak refusal of check-pack-install goes back to its own `printf | grep -qF` instead of returning through the proved verdict, so the self-test stays green while the heavy cell regains the SIGPIPE window (the codex-app-server call is held by the same text check, with no mutant of its own)",
+			"subject": "run.sh",
+			"find": ["  pack_install_refuse_argv_leak copilot \"$op_out\" 'ARG<copilot>' || return 1"],
+			"replace": ["  if printf '%s' \"$op_out\" | grep -qF 'ARG<copilot>'; then return 1; fi"],
+			"gate": ["bash", "run.sh", "check-pack-argv-matcher"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PACK-INSTALL-ARGV-CELLS-BOUND]",
+			"signatureSource": "run.sh"
 		}
 	]
 }

package/scripts/mutants/pi-durable.json

@@ -1207,6 +1207,66 @@
 			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
 			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
 		},
+		{
+			"claim": "PI-DURABLE-TASK-SLEEPING-COUNTED",
+			"title": "the badge stops naming sleeping tasks: a background task in its durable backoff is counted but said to be nothing",
+			"subject": "pi/pi-durable/carrier/tui.js",
+			"find": ["\t\t\t...tally(\"sleeping\", (node) => !node.abortRequested && node.state.status === \"sleeping\"),"],
+			"replace": ["\t\t\t// sleeping is not named"],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-TASK-SLEEPING-COUNTED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-TASK-SLEEPING-SHOWN",
+			"title": "a sleeping task's panel line drops its wake time, so nothing on screen says when the sleeping work comes back",
+			"subject": "pi/pi-durable/carrier/tui.js",
+			"find": ["\t\t\t\t\t? `sleeping ${state.phase} until ${localTime(state.until)}`"],
+			"replace": ["\t\t\t\t\t? `sleeping ${state.phase}`"],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-TASK-SLEEPING-SHOWN]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-TASK-BLOCKED-SHOWN",
+			"title": "the panel stops marking blocked tasks: a task the SDK will not run reads as ordinary pending work",
+			"subject": "pi/pi-durable/carrier/tui.js",
+			"find": ["\t\tnode.blocked !== undefined ? `blocked:${node.blocked}` : \"\","],
+			"replace": ["\t\t\"\","],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-TASK-BLOCKED-SHOWN]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-TASK-BLOCKED-REASON",
+			"title": "every blocked task is said to be parked by the restart limit, whatever reason the SDK gave",
+			"subject": "pi/pi-durable/carrier/tui.js",
+			"find": ["\t\tnode.blocked !== undefined ? `blocked:${node.blocked}` : \"\","],
+			"replace": ["\t\tnode.blocked !== undefined ? `blocked:restart_limit` : \"\","],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-TASK-BLOCKED-REASON]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-TEST-FIXTURES-NOT-SHIPPED",
+			"title": "package.json drops its fixture negation, so every published tarball carries the test goldens under pi-extensions/**/fixtures/",
+			"subject": "package.json",
+			"find": ["\t\t\"!pi-extensions/**/*.test.ts\",", "\t\t\"!pi-extensions/**/fixtures/**\""],
+			"replace": ["\t\t\"!pi-extensions/**/*.test.ts\""],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-TEST-FIXTURES-NOT-SHIPPED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
 		{
 			"claim": "PI-DURABLE-STREAM-TRANSPORT-WIRE",
 			"title": "the Harness settings stop carrying the transport: the provider never continues a response, so every request of a long session resends the whole conversation",