@junghanacs/entwurf 0.41.1 → 0.45.0

package/scripts/mutants/mux-fresh-call.json

@@ -69,7 +69,9 @@
 			"claim": "FRESHCALL-CALLBACK-PRECEDES-TASK",
 			"title": "the task is framed before the callback instruction, so a sibling that stalls in the task never names itself",
 			"subject": "pi-extensions/lib/fresh-call-composition.ts",
-			"find": ["\t\t\t\t\t`FIRST ACTION, before reading files or anything else: call ${birthTool} with no arguments.`"],
+			"find": [
+				"\t\t\t\t\t`BEFORE THE TASK, and before reading files or running commands: call ${birthTool} with no arguments.`"
+			],
 			"replace": ["\t\t\t\t\t`FINAL ACTION, after completing the task: call ${birthTool} with no arguments.`"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 120,
@@ -125,7 +127,7 @@
 			"title": "the fresh-call surface drops the optional cwd from its schema, so cross-repo fresh silently cannot exist from any caller — pi included, which reaches this bridge since #125",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\tcwd: z\n\t\t\t.string()\n\t\t\t.optional()\n\t\t\t.describe(\n\t\t\t\t\"Optional literal ABSOLUTE path of an existing directory to start the sibling in (cross-repo fresh). Omit or pass \\\"\\\" to start where the CALLER is — this agent's own cwd on BOTH rails, or for a Codex caller its own record directory, because this bridge is the app-server's child and that process's directory is not the caller's. Taken exactly as given: no trim, no realpath, no project-name resolution. '#' is refused on the tmux rail only, because tmux format-expands a start directory; inside herdr it is an ordinary path character. The receipt echoes the directory that was REQUESTED or the caller record it came from, never an observation of where the pane landed.\",\n\t\t\t),\n"
+				"\t\tcwd: z.string().optional().describe(ENTWURF_TOOL_GUIDANCE.entwurf_fresh_call.parameters[\"cwd\"]),\n"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -151,7 +153,7 @@
 			"title": "MCP drops the required model field from fresh-call while the composition still expects one",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\tmodel: z\n\t\t\t.string()\n\t\t\t.min(1)\n\t\t\t.max(200)\n\t\t\t// The `\\[` below is USELESS TO JS AND LOAD-BEARING TO THE HOST. zod emits this source\n\t\t\t// text verbatim as the JSON Schema `pattern`, and the host's tool-schema validator is a\n\t\t\t// Rust regex engine that rejects an unescaped `[` inside a character class as \"unclosed\n\t\t\t// character class\" — a 400 on tools/list that stops EVERY Claude session from opening\n\t\t\t// (7-M-fix). Biome's safe fix removes it; do not accept that fix. The suppression must\n\t\t\t// stay on the line DIRECTLY above the expression, or it attaches to nothing and reads\n\t\t\t// as an unused suppression while the escape goes back to being fixable.\n\t\t\t// biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above\n\t\t\t.regex(/^[A-Za-z0-9][A-Za-z0-9._/:\\[\\]-]*$/)\n\t\t\t.describe(\n\t\t\t\t\"Required runtime model: canonical provider/model for pi (a bare alias is refused), provider/<exact catalog model id> for pi-durable, a Claude Code model id/alias, or a Copilot/OMP/Codex model name. Neither pi nor pi-durable may name the openrouter provider.\",\n\t\t\t),\n"
+				"\t\tmodel: z\n\t\t\t.string()\n\t\t\t.min(1)\n\t\t\t.max(200)\n\t\t\t// The `\\[` below is USELESS TO JS AND LOAD-BEARING TO THE HOST. zod emits this source\n\t\t\t// text verbatim as the JSON Schema `pattern`, and the host's tool-schema validator is a\n\t\t\t// Rust regex engine that rejects an unescaped `[` inside a character class as \"unclosed\n\t\t\t// character class\" — a 400 on tools/list that stops EVERY Claude session from opening\n\t\t\t// (7-M-fix). Biome's safe fix removes it; do not accept that fix. The suppression must\n\t\t\t// stay on the line DIRECTLY above the expression, or it attaches to nothing and reads\n\t\t\t// as an unused suppression while the escape goes back to being fixable.\n\t\t\t// biome-ignore lint/complexity/noUselessEscapeInRegex: emitted to a Rust regex validator, see above\n\t\t\t.regex(/^[A-Za-z0-9][A-Za-z0-9._/:\\[\\]-]*$/)\n\t\t\t.describe(ENTWURF_TOOL_GUIDANCE.entwurf_fresh_call.parameters[\"model\"]),\n"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -512,7 +514,7 @@
 			"title": "the fresh-call surface drops the optional seat from its schema, so opening a sibling in the operator's project session silently cannot exist from any caller",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\tplacement: z\n\t\t\t.object({\n\t\t\t\ttmuxSession: z\n\t\t\t\t\t.string()\n\t\t\t\t\t.describe(\n\t\t\t\t\t\t\"EXACT name of an EXISTING session on this agent's own tmux server. Nothing is created: an absent session is refused as tmux-session-missing, and a name outside [A-Za-z0-9][A-Za-z0-9_-]* as tmux-session-name-invalid.\",\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.optional()\n\t\t\t.describe(\n\t\t\t\t\"Optional expert seat override, TMUX ONLY: open the sibling in ONE EXISTING tmux session of this agent's own server, and it always wins. When omitted the seat follows the CALLER, never the backend being opened: a Codex CALLER opens beside its own TUI pane, matched by thread-id in that pane's terminal title (0 or 2+ matching panes refuse, never fall back); every other caller opens in its own session. A pane title is a placement input only — never an address, liveness or delivery fact. Nothing is ever created. Inside herdr this field is refused by name — placement there belongs to herdr, and a tmux session name would silently place the sibling somewhere else. Independent of cwd; neither is inferred from the other. The receipt reports the selected name (absent for the caller-pane rule, which observed a session rather than requesting a name), its source, and resolved target session id.\",\n\t\t\t),\n"
+				"\t\tplacement: z\n\t\t\t.object({\n\t\t\t\ttmuxSession: z.string().describe(ENTWURF_TOOL_GUIDANCE.entwurf_fresh_call.parameters[\"placement.tmuxSession\"]),\n\t\t\t})\n\t\t\t.optional()\n\t\t\t.describe(ENTWURF_TOOL_GUIDANCE.entwurf_fresh_call.parameters[\"placement\"]),\n"
 			],
 			"replace": [""],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
@@ -766,6 +768,30 @@
 			"timeoutSeconds": 60,
 			"signature": "[QK:PIIMPORT-CARRIER-FENCE]",
 			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PD-FRESH-LIVE-BOOTSTRAP-ORDER",
+			"title": "a pd call with no joined result read as COMPLETED instead of pending, so a callback whose result the native store never recorded passes pd's bootstrap order",
+			"subject": "scripts/lib/pi-durable-fresh-live-receipts.ts",
+			"find": ["\t\tstatus: call.result === null ? \"pending\" : call.result.isError ? \"failed\" : \"completed\","],
+			"replace": [
+				"\t\tstatus: call.result === null ? \"completed\" : call.result.isError ? \"failed\" : \"completed\","
+			],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PD-FRESH-LIVE-BOOTSTRAP-ORDER]",
+			"signatureSource": "test/pi-durable-fresh-live-receipts.test.ts"
+		},
+		{
+			"claim": "FRESHCALL-LAUNCH-REJECT-HINTS-FROM-ROOT",
+			"title": "one static tmux launch-stage hint is inlined as a literal one byte away from the Root text, so the reader and its byte oracle stay green and only the rendered refusal can disagree with Root",
+			"subject": "pi-extensions/lib/mux-fresh-call.ts",
+			"find": ["\t\"anchor-malformed\": ENTWURF_FRESH_LAUNCH_REJECT_HINTS[\"anchor-malformed\"],"],
+			"replace": ["\t\"anchor-malformed\": \"TMUX_PANE is not a native  pane id\","],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FRESHCALL-LAUNCH-REJECT-HINTS-FROM-ROOT]",
+			"signatureSource": "test/mux-fresh-call.test.ts"
 		}
 	]
 }

package/scripts/mutants/mux-resume-call.json

@@ -98,12 +98,12 @@
 		{
 			"claim": "MUXRESUME-DESC-CONTRACT-MCP",
 			"title": "the MCP description drops the dormant-only scope, inviting callers to aim the verb at live citizens it will refuse",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\"Reopen ONE DORMANT pi or Claude Code citizen under its OWN garden id, in a visible window in the operator's \" +"
+				"Only on an explicit operator request, reopen ONE DORMANT pi or Claude Code citizen under its OWN garden id, in a visible window in the operator's "
 			],
 			"replace": [
-				"\t\"Reopen ONE pi or Claude Code citizen under its OWN garden id, in a visible window in the operator's \" +"
+				"Only on an explicit operator request, reopen ONE pi or Claude Code citizen under its OWN garden id, in a visible window in the operator's "
 			],
 			"gate": ["bash", "run.sh", "check-mux-resume-call"],
 			"timeoutSeconds": 60,
@@ -155,6 +155,31 @@
 			"timeoutSeconds": 60,
 			"signature": "[QK:MUXRESUME-ARGV-IDENTITY-SCRUB]",
 			"signatureSource": "scripts/check-mux-resume-call.ts"
+		},
+		{
+			"claim": "MUXRESUME-LAUNCH-REJECT-HINTS-FROM-ROOT",
+			"title": "one launch-stage resume hint is inlined as a literal one byte away from the Root text, so the reader and its byte oracle stay green and only the table-to-Root wiring can disagree",
+			"subject": "pi-extensions/lib/mux-resume-call.ts",
+			"find": ["\t\"anchor-malformed\": ENTWURF_RESUME_LAUNCH_REJECT_HINTS[\"anchor-malformed\"],"],
+			"replace": ["\t\"anchor-malformed\": \"TMUX_PANE is not a native  pane id\","],
+			"gate": ["bash", "run.sh", "check-mux-resume-call"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:MUXRESUME-LAUNCH-REJECT-HINTS-FROM-ROOT]",
+			"signatureSource": "scripts/check-mux-resume-call.ts"
+		},
+		{
+			"claim": "MUXRESUME-IMPORT-SET",
+			"title": "the resume composition gains a bare side-effect import, the weakest static form, which loads and runs fine, so only the exact import-set parser can see the new lane",
+			"subject": "pi-extensions/lib/mux-resume-call.ts",
+			"find": ["import { ENTWURF_RESUME_LAUNCH_REJECT_HINTS } from \"./agent-guidance.ts\";"],
+			"replace": [
+				"import { ENTWURF_RESUME_LAUNCH_REJECT_HINTS } from \"./agent-guidance.ts\";",
+				"import \"node:path\";"
+			],
+			"gate": ["bash", "run.sh", "check-mux-resume-call"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:MUXRESUME-IMPORT-SET]",
+			"signatureSource": "scripts/check-mux-resume-call.ts"
 		}
 	]
 }

package/scripts/mutants/native-push-paused.json

@@ -0,0 +1,17 @@
+{
+	"schemaVersion": 1,
+	"lane": "native-push-paused",
+	"mutants": [
+		{
+			"claim": "AGY-NATIVE-PUSH-PAUSED",
+			"title": "the paused native-push backend set is emptied, so agy dispatch, sender replyability and register_native reach the agy language server again, whose measured external callers were refused for a missing CSRF token (#128, #152)",
+			"subject": "pi-extensions/lib/entwurf-v2-contract.ts",
+			"find": ["export const NATIVE_PUSH_PAUSED_BACKENDS: readonly NativePushBackend[] = [\"antigravity\"];"],
+			"replace": ["export const NATIVE_PUSH_PAUSED_BACKENDS: readonly NativePushBackend[] = [];"],
+			"gate": ["bash", "run.sh", "check-native-push-paused"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:AGY-NATIVE-PUSH-PAUSED]",
+			"signatureSource": "pi-extensions/lib/native-push/paused.test.ts"
+		}
+	]
+}

package/scripts/mutants/omp-fresh.json

@@ -169,8 +169,8 @@
 			"claim": "OMP-BOOTSTRAP-CALLBACK-ONLY",
 			"title": "the task folded back into the stage-one prompt, so the sibling is asked to call back AND to work in one message. This is the prompt the failed LIVE actually ran, minus the missing tool: a competing goal beside the callback is what the two-stage split exists to remove, and nothing about argv or readiness would notice it coming back",
 			"subject": "pi-extensions/meta-bridge-omp.ts",
-			"find": ["\t\t\tsend(buildOmpCallbackOnlyPrompt());"],
-			"replace": ["\t\t\tsend(`${buildOmpCallbackOnlyPrompt()}\\n\\n${payload.task}`);"],
+			"find": ["\t\t\tsend(buildOmpCallbackOnlyPrompt(opts.callerGardenId));"],
+			"replace": ["\t\t\tsend(`${buildOmpCallbackOnlyPrompt(opts.callerGardenId)}\\n\\n${payload.task}`);"],
 			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:OMP-BOOTSTRAP-CALLBACK-ONLY]",
@@ -295,6 +295,17 @@
 			"timeoutSeconds": 300,
 			"signature": "[QK:OMP-BOOTSTRAP-EPOCH-ENDS-BEFORE-ENVELOPE]",
 			"signatureSource": "test/omp-fresh-bootstrap.contract.test.ts"
+		},
+		{
+			"claim": "OMP-BOOTSTRAP-CALLER-TARGET-REQUIRED",
+			"title": "a requested omp bootstrap with no well-formed caller target proceeds anyway — the stage silently drops the caller check (or names `undefined` as the caller) and the task is still released, instead of a named refusal",
+			"subject": "pi-extensions/meta-bridge-omp.ts",
+			"find": ["\tif (!caller.ok) {"],
+			"replace": ["\tif (false && !caller.ok) {"],
+			"gate": ["bash", "run.sh", "check-mux-fresh-call"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:OMP-BOOTSTRAP-CALLER-TARGET-REQUIRED]",
+			"signatureSource": "test/omp-fresh-bootstrap.contract.test.ts"
 		}
 	]
 }

package/scripts/mutants/pack-install.json

@@ -60,6 +60,52 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:WIN32-PACK-DIGEST]",
 			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PACK-INSTALL-ARGV-LEAK-CAUGHT",
+			"title": "the dispatcher-verb refusal goes back to the retired verdict, `printf | grep -qF` under pipefail refusing only when that pipeline exits 0, so a leak ahead of more output SIGPIPEs the producer and the cell passes \u2014 killed deterministically only because the self-test front-loads the leak ahead of ~260 KB, past the default 64 KiB pipe buffer (its teeth control measures that); on the real small stand-in output the same restoration would survive",
+			"subject": "run.sh",
+			"find": ["  grep -qF -- \"$token\" <<<\"$out\" || argv_search_rc=$?"],
+			"replace": ["  printf '%s' \"$out\" | grep -qF -- \"$token\" || argv_search_rc=1"],
+			"gate": ["bash", "run.sh", "check-pack-argv-matcher"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PACK-INSTALL-ARGV-LEAK-CAUGHT]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PACK-INSTALL-ARGV-CLEAN-PASSES",
+			"title": "the dispatcher-verb refusal stops accepting a clean search (grep rc=1), so every installed copilot / codex-app-server launch is refused, silently",
+			"subject": "run.sh",
+			"find": ["    1) return 0 ;;"],
+			"replace": ["    1) ;;"],
+			"gate": ["bash", "run.sh", "check-pack-argv-matcher"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PACK-INSTALL-ARGV-CLEAN-PASSES]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PACK-INSTALL-ARGV-SEARCH-ERROR-REFUSED",
+			"title": "a failed dispatcher-verb search (grep rc=2) is accepted as clean, so a search that never ran lets the leak refusal pass",
+			"subject": "run.sh",
+			"find": [
+				"    *) fail \"[check-pack-install] installed 'entwurf $label': the dispatcher-verb search itself failed (rc=$argv_search_rc) \u2014 refused, never read as no leak\" ;;"
+			],
+			"replace": ["    *) return 0 ;;"],
+			"gate": ["bash", "run.sh", "check-pack-argv-matcher"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PACK-INSTALL-ARGV-SEARCH-ERROR-REFUSED]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "PACK-INSTALL-ARGV-CELLS-BOUND",
+			"title": "the copilot leak refusal of check-pack-install goes back to its own `printf | grep -qF` instead of returning through the proved verdict, so the self-test stays green while the heavy cell regains the SIGPIPE window (the codex-app-server call is held by the same text check, with no mutant of its own)",
+			"subject": "run.sh",
+			"find": ["  pack_install_refuse_argv_leak copilot \"$op_out\" 'ARG<copilot>' || return 1"],
+			"replace": ["  if printf '%s' \"$op_out\" | grep -qF 'ARG<copilot>'; then return 1; fi"],
+			"gate": ["bash", "run.sh", "check-pack-argv-matcher"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:PACK-INSTALL-ARGV-CELLS-BOUND]",
+			"signatureSource": "run.sh"
 		}
 	]
 }

package/scripts/mutants/pi-durable.json

@@ -2,6 +2,20 @@
 	"schemaVersion": 1,
 	"lane": "pi-durable",
 	"mutants": [
+		{
+			"claim": "PI-DURABLE-DESCRIPTION-DRIFT-REFUSED",
+			"title": "schema comparison ignores description-only drift while still comparing structural schema fields",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["canonicalJson(found.inputSchema) !== canonicalJson(PI_DURABLE_TOOL_SCHEMAS[name])"],
+			"replace": [
+				"canonicalJson(JSON.parse(JSON.stringify(found.inputSchema, (key, value) => key === \"description\" ? undefined : value))) !== canonicalJson(JSON.parse(JSON.stringify(PI_DURABLE_TOOL_SCHEMAS[name], (key, value) => key === \"description\" ? undefined : value)))"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-DESCRIPTION-DRIFT-REFUSED]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
 		{
 			"claim": "PI-DURABLE-RETIRE-CALL",
 			"title": "retirement alone drops the actual request cancellation signal",
@@ -24,13 +38,11 @@
 		{
 			"claim": "PI-DURABLE-RETIRE-POLICY",
 			"title": "the native retirement description treats actor identity as a standing grant",
-			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\t\"Only when the human operator explicitly requested this particular target/work: make ONE retirement attempt for that request \" +"
-			],
-			"replace": [
-				"\t\t\"A caller record alone authorizes this target/work: make ONE retirement attempt for that request \" +"
+				"Only when the human operator explicitly requested this particular target/work: make ONE retirement attempt for that request "
 			],
+			"replace": ["A caller record alone authorizes this target/work: make ONE retirement attempt for that request "],
 			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:PI-DURABLE-RETIRE-POLICY]",

package/scripts/mutants/remote-pair-display.json

@@ -10,7 +10,7 @@
 			"replace": [
 				"\tconst remote = !replyable ? (sender.remote ?? { via: \"?\", replyRoute: \"none\" as const }) : undefined;"
 			],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-DISPLAY-LOCAL-UNCHANGED]",
 			"signatureSource": "pi-extensions/lib/meta-mailbox-body.test.ts",
@@ -25,7 +25,7 @@
 			"subject": "pi-extensions/lib/meta-mailbox-body.ts",
 			"find": ["\"reply route declared, not probed\""],
 			"replace": ["\"reply via entwurf_v2 to this sessionId\""],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-DISPLAY-SESSIONLINE]",
 			"signatureSource": "pi-extensions/lib/meta-mailbox-body.test.ts",
@@ -40,7 +40,7 @@
 			"subject": "pi-extensions/lib/meta-mailbox-body.ts",
 			"find": ["\tconst where = remote ? `${sender.cwd} (sender-host path)` : abbreviateHome(sender.cwd);"],
 			"replace": ["\tconst where = abbreviateHome(sender.cwd);"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-DISPLAY-SENDER-HOST-CWD]",
 			"signatureSource": "pi-extensions/lib/meta-mailbox-body.test.ts",

package/scripts/mutants/remote-pair-receive.json

@@ -6,9 +6,9 @@
 			"claim": "REMOTE-PAIR-FROM-OUTSIDE-NO-MUTATION",
 			"title": "the receiving entry stops checking the claimed sender against the declared pair, so any gid the SSH account writes is dispatched into the declared target's mailbox",
 			"subject": "pi-extensions/lib/remote-pair-receive.ts",
-			"find": ["\tif (claim.from !== decl.remoteGardenId) {"],
+			"find": ["\tif (fromRoutes.length === 0) {"],
 			"replace": ["\tif (false) {"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-PAIR-FROM-OUTSIDE-NO-MUTATION]",
 			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
@@ -21,9 +21,9 @@
 			"claim": "REMOTE-PAIR-TARGET-OUTSIDE-NO-MUTATION",
 			"title": "the receiving entry stops checking the claimed target against the declared pair, so a declared remote can reach every deliverable citizen on this host",
 			"subject": "pi-extensions/lib/remote-pair-receive.ts",
-			"find": ["\tif (claim.target !== decl.localGardenId) {"],
-			"replace": ["\tif (false) {"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"find": ["\tconst decl = fromRoutes.find((d) => d.localGardenId === claim.target);"],
+			"replace": ["\tconst decl = fromRoutes.find((d) => d.localGardenId === claim.target) ?? fromRoutes[0];"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-PAIR-TARGET-OUTSIDE-NO-MUTATION]",
 			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
@@ -38,7 +38,7 @@
 			"subject": "pi-extensions/lib/remote-pair-receive.ts",
 			"find": ["\t\tsessionId: claim.from,"],
 			"replace": ["\t\tsessionId: process.env.PI_SESSION_ID ?? claim.from,"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-PAIR-IGNORES-AMBIENT-SENDER]",
 			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
@@ -53,7 +53,7 @@
 			"subject": "pi-extensions/lib/remote-pair-receive.ts",
 			"find": ["\t\treplyable: false,"],
 			"replace": ["\t\treplyable: true,"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-PAIR-MATCH-DISPATCHES-ONCE]",
 			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
@@ -68,7 +68,7 @@
 			"subject": "pi-extensions/lib/remote-pair-receive.ts",
 			"find": ["\tif (got.length !== want.length || got.some((k, i) => k !== want[i])) {"],
 			"replace": ["\tif (false) {"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-PAIR-CLAIM-EXACT-SHAPE]",
 			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
@@ -83,7 +83,7 @@
 			"subject": "scripts/remote-pair-receive.ts",
 			"find": ["emit(receipt, receipt.kind === \"rejected\" ? 3 : receipt.isError ? 4 : 0);"],
 			"replace": ["emit(receipt, receipt.kind === \"rejected\" ? 0 : receipt.isError ? 4 : 0);"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-PAIR-ENTRY-REFUSES-OUTSIDE]",
 			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
@@ -98,7 +98,7 @@
 			"subject": "scripts/remote-pair-receive.ts",
 			"find": ["\tif (!path.isAbsolute(pairFile) || path.normalize(pairFile) !== own) {"],
 			"replace": ["\tif (false) {"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-PAIR-ENTRY-USAGE]",
 			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
@@ -113,7 +113,7 @@
 			"subject": "scripts/remote-pair-receive.ts",
 			"find": ["\treplyRoute: \"declared\","],
 			"replace": ["\treplyRoute: \"none\","],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-PAIR-ENTRY-REPLY-ROUTE-DECLARED]",
 			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
@@ -121,6 +121,36 @@
 				"argv": ["bash", "scripts/build-bridge.sh"],
 				"output": "mcp/entwurf-bridge/dist"
 			}
+		},
+		{
+			"claim": "REMOTE-PAIR-CROSS-PAIR-REFUSED",
+			"title": "the two ends are checked as independent memberships, so a sender declared in one route reaches the local citizen of another route",
+			"subject": "pi-extensions/lib/remote-pair-receive.ts",
+			"find": ["\tconst decl = fromRoutes.find((d) => d.localGardenId === claim.target);"],
+			"replace": ["\tconst decl = decls.some((d) => d.localGardenId === claim.target) ? fromRoutes[0] : undefined;"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-PAIR-CROSS-PAIR-REFUSED]",
+			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-PAIR-SELECTED-ROUTE-LABEL",
+			"title": "the body is labelled with the first declared route, so a message that came over one host is shown as arriving over another",
+			"subject": "pi-extensions/lib/remote-pair-receive.ts",
+			"find": ["\tconst sender = buildRemoteSenderEnvelope(claim, picked.decl,"],
+			"replace": ["\tconst sender = buildRemoteSenderEnvelope(claim, decls[0],"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-PAIR-SELECTED-ROUTE-LABEL]",
+			"signatureSource": "pi-extensions/lib/remote-pair-receive.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
 		}
 	]
 }

package/scripts/mutants/remote-pair-roundtrip.json

@@ -6,9 +6,9 @@
 			"claim": "REMOTE-ROUNDTRIP-A-TO-B",
 			"title": "the bridge never reads the opt-in, so a declared remote target falls through to the local decider as bad-target",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
-			"find": ["\t\t\t\t\troute: readRemotePairOptIn(remotePairOptInPath()),"],
-			"replace": ["\t\t\t\t\troute: null,"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"find": ["\t\t\t\t\toptIn: readRemotePairOptIn(remotePairOptInPath()),"],
+			"replace": ["\t\t\t\t\toptIn: null,"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-ROUNDTRIP-A-TO-B]",
 			"signatureSource": "pi-extensions/lib/remote-pair-roundtrip.test.ts",
@@ -25,7 +25,7 @@
 			"replace": [
 				"\t\t\t\t\ttransport: { run: async () => ({ exitCode: 1, signal: null, timedOut: false, stdout: \"\", stderr: \"\" }) },"
 			],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-ROUNDTRIP-REVERSE-DISPATCH]",
 			"signatureSource": "pi-extensions/lib/remote-pair-roundtrip.test.ts",
@@ -40,7 +40,7 @@
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": ["\t\t\t\t\trunLocal: (params, opts) => runAndRenderEntwurfV2FromSurface(params, opts),"],
 			"replace": ["\t\t\t\t\trunLocal: async () => ({ isError: false, text: \"local skipped\" }),"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-ROUNDTRIP-OPT-IN-ABSENT-OFF]",
 			"signatureSource": "pi-extensions/lib/remote-pair-roundtrip.test.ts",
@@ -55,7 +55,7 @@
 			"subject": "pi-extensions/lib/remote-pair-send.ts",
 			"find": ["refused by the other host's pair: ${o.reason} (${o.detail})"],
 			"replace": ["failed"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-ROUNDTRIP-OTHER-HOST-REFUSES]",
 			"signatureSource": "pi-extensions/lib/remote-pair-roundtrip.test.ts",
@@ -70,7 +70,7 @@
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": ["\t\t\t\t\t\tcontrolSocketDirs: [CONTROL_SOCKET_DIR, ENTWURF_DIR],"],
 			"replace": ["\t\t\t\t\t\tcontrolSocketDirs: [ENTWURF_DIR],"],
-			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
 			"timeoutSeconds": 600,
 			"signature": "[QK:REMOTE-ROUNDTRIP-LOCAL-TRACE-BOTH-SOCKET-DIRS]",
 			"signatureSource": "pi-extensions/lib/remote-pair-roundtrip.test.ts",
@@ -78,6 +78,66 @@
 				"argv": ["bash", "scripts/build-bridge.sh"],
 				"output": "mcp/entwurf-bridge/dist"
 			}
+		},
+		{
+			"claim": "REMOTE-ROUNDTRIP-MULTI-INDEPENDENT",
+			"title": "the receiving entry reads only the first route of its file, so a second citizen paired with this host is refused as an undeclared sender",
+			"subject": "scripts/remote-pair-receive.ts",
+			"find": ["\tdecls = optIn.routes.map("],
+			"replace": ["\tdecls = optIn.routes.slice(0, 1).map("],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUNDTRIP-MULTI-INDEPENDENT]",
+			"signatureSource": "pi-extensions/lib/remote-pair-roundtrip.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUNDTRIP-MULTI-REVERSE",
+			"title": "the receiving side recognizes only the first route's remote as a sender, so a claim from a second host lands on the wrong route or is refused",
+			"subject": "pi-extensions/lib/remote-pair-receive.ts",
+			"find": ["\tconst fromRoutes = decls.filter((d) => d.remoteGardenId === claim.from);"],
+			"replace": ["\tconst fromRoutes = decls.filter((d) => d.remoteGardenId === decls[0].remoteGardenId);"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUNDTRIP-MULTI-REVERSE]",
+			"signatureSource": "pi-extensions/lib/remote-pair-roundtrip.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUNDTRIP-MULTI-UNDECLARED-SENDER-ZERO-SSH",
+			"title": "a sender with no route to a declared remote borrows another sender's route, so ssh runs and the other host is asked to accept a pair nobody declared",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": ["? declared.find((r) => r.localGardenId === sender.sessionId) :"],
+			"replace": ["? (declared.find((r) => r.localGardenId === sender.sessionId) ?? declared[0]) :"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUNDTRIP-MULTI-UNDECLARED-SENDER-ZERO-SSH]",
+			"signatureSource": "pi-extensions/lib/remote-pair-roundtrip.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "REMOTE-ROUNDTRIP-MULTI-CROSS-CLAIM-REFUSED",
+			"title": "the target is matched against every route rather than the sender's own, so a peer that declares an extra pair on its side widens this host's",
+			"subject": "pi-extensions/lib/remote-pair-receive.ts",
+			"find": ["\tconst decl = fromRoutes.find((d) => d.localGardenId === claim.target);"],
+			"replace": ["\tconst decl = decls.find((d) => d.localGardenId === claim.target);"],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-ROUNDTRIP-MULTI-CROSS-CLAIM-REFUSED]",
+			"signatureSource": "pi-extensions/lib/remote-pair-roundtrip.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
 		}
 	]
 }