@junghanacs/entwurf 0.41.2 → 0.45.0

package/scripts/mutants/v2-surface.json

@@ -5,13 +5,12 @@
 		{
 			"claim": "V2SURF-RESUME-HINT-SCOPE",
 			"title": "the dormant capability hint returns to a Pi-only automatic-resume invitation",
-			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\t\t\t\"Only on an explicit operator request, use entwurf_resume_call {target} for Pi or Claude Code; \" +",
-				"\t\t\t\t\"it submits no prompt. This capability hint is not permission to resume automatically.\""
+				"Only on an explicit operator request, use entwurf_resume_call {target} for Pi or Claude Code; it submits no prompt. This capability hint is not permission to resume automatically."
 			],
 			"replace": [
-				"\t\t\t\t\"Reopen the citizen with entwurf_resume_call {target} (pi targets only; it runs no turn), then dispatch again.\""
+				"Reopen the citizen with entwurf_resume_call {target} (pi targets only; it runs no turn), then dispatch again."
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
@@ -21,12 +20,11 @@
 		{
 			"claim": "V2SURF-MCP-LOCK-DOMAIN",
 			"title": "MCP long description reverts to the false \"socket paths take a per-target lock\" claim",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\t\"LOCK: taken for a control-socket-DOMAIN dispatch. The \" +",
-				"\t\t\"mailbox and native-push rails are lock-free — deliverability and the adapter probe guard them. mode \" +"
+				"LOCK: taken for a control-socket-DOMAIN dispatch. The mailbox and native-push rails are lock-free — deliverability and the adapter probe guard them. mode "
 			],
-			"replace": ["\t\t\"LOCK POLICY: socket paths take a per-target lock; the mailbox path does not. mode \" +"],
+			"replace": ["LOCK POLICY: socket paths take a per-target lock; the mailbox path does not. mode "],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-MCP-LOCK-DOMAIN]",
@@ -57,15 +55,9 @@
 		{
 			"claim": "V2SURF-MODE-SCOPE",
 			"title": "the bridge mode param (the one every caller reads, pi included since #125) reverts to \"Delivery mode for a live send\" (false for native-push) (#120 P2: the description was rewritten to stop claiming an interrupt, so the mutation now strips the rail scope from the corrected sentence)",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
-			"find": [
-				"\t\t\t\t\"Injection style for a CONTROL-SOCKET send only: steer (ask the receiver's steering queue) or follow_up (ask its follow-up queue). NEITHER is an interrupt: a busy receiver drains steering after each turn and follow-ups only when its inner loop ends, so a later steer overtakes every earlier follow_up and there is no order between the two. Both queues are volatile process memory — an abort drops what is in them. The receipt names which queue accepted the message (`queued-steer` / `queued-follow-up`); an idle receiver answers `sent`, meaning the turn was TRIGGERED, not that the model has seen the text. \" +",
-				"\t\t\t\t\t\"The mailbox and native-push plans carry no mode, so it has no effect on those rails.\","
-			],
-			"replace": [
-				"\t\t\t\t\"Delivery mode for a live send: steer (ask the steering queue) or follow_up (ask the follow-up queue). \" +",
-				"\t\t\t\t\t\"Both queues are volatile process memory.\","
-			],
+			"subject": "ENTWURF.json",
+			"find": ["Injection style for a CONTROL-SOCKET send only:"],
+			"replace": ["Delivery mode for a live send:"],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-MODE-SCOPE]",
@@ -74,19 +66,11 @@
 		{
 			"claim": "V2SURF-INBOX-SCOPE-HONESTY",
 			"title": "entwurf_inbox_read reverts to the false \"drains your own inbox\" access claim (SCOPE paragraph gone)",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\t\"doorbell is only a wake attempt, not a read. An empty inbox mutates nothing. \" +",
-				"\t\t\"SCOPE — read this literally: the garden id is CALLER-SUPPLIED and is NOT verified against \" +",
-				"\t\t\"your own identity (a host with no garden record of its own can call this too). So passing \" +",
-				"\t\t\"another citizen's garden id drains THEIR mail and stamps THEIR receipt, and they will never \" +",
-				"\t\t\"see those messages. Pass only the id from your own doorbell notice or your own meta-record; \" +",
-				"\t\t\"use entwurf_self if you need to confirm which id that is. \" +"
-			],
-			"replace": [
-				"\t\t\"doorbell is only a wake attempt, not a read. An empty inbox mutates nothing. \" +",
-				"\t\t\"This tool drains your own meta-bridge inbox and stamps the read receipt on your meta-record. \" +"
+				"SCOPE — read this literally: the garden id is CALLER-SUPPLIED and is NOT verified against your own identity"
 			],
+			"replace": ["This tool drains your own meta-bridge inbox and stamps the read receipt on your meta-record"],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-INBOX-SCOPE-HONESTY]",
@@ -95,15 +79,12 @@
 		{
 			"claim": "V2SURF-DORMANT-HONESTY",
 			"title": "MCP long description advertises owned-outcome as a selectable dormant verb again and drops the reason a dormant target actually returns",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\t\"DORMANT IS UNREACHABLE: a socket-domain citizen that is not running gets dormant-fire-forget-unsupported \" +",
-				"\t\t\"— same receiver rule as the mailbox, no active drainer means no delivery. \" +",
-				"\t\t\"The intent that used to answer there, owned-outcome, resumed it by launching a hidden background child \" +",
-				"\t\t\"and was withdrawn under the visible-first rule — re-open the session yourself, then dispatch again. \" +"
+				"A dormant socket rejects this delivery verb as dormant-fire-forget-unsupported. owned-outcome was withdrawn. Only on an explicit operator request, entwurf_resume_call may visibly reopen a proven-dormant Pi or Claude Code citizen under the same id, submitting no prompt; that lifecycle is separate from delivery. "
 			],
 			"replace": [
-				"\t\t\"owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY and is never auto-converted. \" +"
+				"owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY and is never auto-converted. "
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
@@ -113,45 +94,35 @@
 		{
 			"claim": "V2SURF-INDETERMINATE-NO-START",
 			"title": "the indeterminate hint reverts to a socket that \"answered\" and drops the no-start facts — overclaiming a reply that a permission-refused or timed-out probe never got",
-			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\tcase \"indeterminate-no-spawn\":",
-				"\t\t\t// The socket probe did not settle, so liveness is UNKNOWN — an unestablished probe",
-				"\t\t\t// is not a measured death, and dispatching into it could double-deliver. Say",
-				"\t\t\t// \"the PROBE was inconclusive\", never \"the socket answered inconclusively\":",
-				"\t\t\t// `indeterminate` also covers a probe that got no answer at all, was refused by",
-				"\t\t\t// permissions, or timed out, and \"answered\" claims a reply that may never have",
-				"\t\t\t// existed. The wire id is FROZEN and still spells \"-no-spawn\"; it names the rule",
-				"\t\t\t// (never dispatch into an indeterminate target), not a capability that still",
-				"\t\t\t// exists. So the hint's job is to say plainly what did NOT happen: nothing",
-				"\t\t\t// delivered, nothing started.",
-				"\t\t\treturn (",
-				"\t\t\t\t\"the control-socket probe was inconclusive, so the target's liveness is UNKNOWN — this is not a \" +",
-				"\t\t\t\t\"measured death. NOTHING was delivered and NO process was started (the reason id keeps its frozen \" +",
-				"\t\t\t\t\"'-no-spawn' wire spelling from an era when one could be; entwurf_v2 starts nothing on any rail). \" +",
-				"\t\t\t\t\"Re-run entwurf_peers to re-probe; if it stays indeterminate, check for a stale socket file left at \" +",
-				"\t\t\t\t\"that garden id by a session that died without cleaning up.\"",
-				"\t\t\t);"
-			],
-			"replace": [
-				"\t\tcase \"indeterminate-no-spawn\":",
-				"\t\t\treturn \"the target's control socket answered inconclusively; retry.\";"
+				"the control-socket probe was inconclusive, so the target's liveness is UNKNOWN — this is not a measured death. NOTHING was delivered and NO process was started (the reason id keeps its frozen '-no-spawn' wire spelling from an era when one could be; entwurf_v2 starts nothing on any rail). Re-run entwurf_peers to re-probe; if it stays indeterminate, check for a stale socket file left at that garden id by a session that died without cleaning up."
 			],
+			"replace": ["the target's control socket answered inconclusively; retry."],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-INDETERMINATE-NO-START]",
 			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
 		},
+		{
+			"claim": "V2SURF-REJECT-HINTS-FROM-ROOT",
+			"title": "the surface stops returning the Root hint for one declared reason, so a native-push caller loses its next step while the Root text itself still looks perfect",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": ["\t\t\treturn ENTWURF_REJECT_HINTS[\"native-push-probe-indeterminate\"];"],
+			"replace": ["\t\t\treturn undefined;"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2SURF-REJECT-HINTS-FROM-ROOT]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
 		{
 			"claim": "V2SURF-PEERS-DEAD-ROW",
 			"title": "entwurf_peers drops the dead-row sentence, so a dormant citizen is listed with nothing saying it is unreachable",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\t\"row. A `dead` row is a REPORTED FACT and nothing more: that citizen is dormant and is \" +",
-				"\t\t\"currently unreachable by any verb, so listing it grants no action — appearing here is not \" +",
-				"\t\t\"an invitation to dispatch. In particular `unsupported` does NOT mean mailbox: it means this backend has no \" +"
+				"row. A `dead` socket row is a REPORTED FACT: no entwurf_v2 delivery is available while it is dormant. Listing it grants no action and is not an invitation to dispatch. Only on an explicit operator request, the separate entwurf_resume_call may visibly reopen a proven-dormant Pi or Claude Code citizen under the same id, submitting no prompt. In particular"
 			],
-			"replace": ["\t\t\"row. In particular `unsupported` does NOT mean mailbox: it means this backend has no \" +"],
+			"replace": ["row. In particular"],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-PEERS-DEAD-ROW]",
@@ -160,12 +131,12 @@
 		{
 			"claim": "V2SURF-DESC-FITS-HOST-CAP",
 			"title": "the v2 tool description grows back past the host's 2048-char cap — the INTENT contract is silently cut off before the model that must choose an intent ever reads it",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id \" +"
+				"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id "
 			],
 			"replace": [
-				"\t\"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +"
+				"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING "
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
@@ -223,6 +194,21 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:NATIVE-PUSH-RETRY-BYTE-IDENTITY]",
 			"signatureSource": "pi-extensions/lib/entwurf-v2-native-push.test.ts"
+		},
+		{
+			"claim": "V2SURF-RECORD-LESS-SOCKET-HINT-FROM-ROOT",
+			"title": "the record-less-socket hint returns a hand-kept copy of its text, one byte off the Root segments, instead of composing them with the owner's command: every phrase the 2C cell checks still reads, so only the whole-string comparison against Root can see the drift",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": [
+				"\t\t\treturn `${hint.beforeFreshCutPrescription}${FRESH_CUT_PRESCRIPTION}${hint.afterFreshCutPrescription}`;"
+			],
+			"replace": [
+				"\t\t\treturn `a control socket exists at this garden id but NO meta-record claims it — the record is the sole address authority, so a bare socket is not an addressable citizen. If a pre-record-era resident owns that socket, restart it under the current runtime (session_start births its record); if the store predates the current generation, quiesce and archive it with ${FRESH_CUT_PRESCRIPTION}. A stale/forged socket should be  removed.`;"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2SURF-RECORD-LESS-SOCKET-HINT-FROM-ROOT]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
 		}
 	]
 }

package/scripts/mutants/v2-visible-resume.json

@@ -491,6 +491,17 @@
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-CC-MARKER-BINDING-READ]",
 			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-REJECT-HINTS-FROM-ROOT",
+			"title": "one static rejection hint is re-authored as a code literal instead of the root ENTWURF.json text, so the reader stays exact while the rendered rejection no longer carries it",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\"target-locked\": ENTWURF_RESUME_REJECT_HINTS[\"target-locked\"],"],
+			"replace": ["\t\"target-locked\": \"another resume or dispatch holds this citizen's lock\","],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-REJECT-HINTS-FROM-ROOT]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		}
 	]
 }