@junghanacs/entwurf 0.41.2 → 0.45.0

package/scripts/check-entwurf-v2-surface.ts

@@ -21,6 +21,12 @@ import assert from "node:assert/strict";
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { fileURLToPath } from "node:url";
+import {
+	ENTWURF_DELIVERY_RESULT_CLAUSES,
+	ENTWURF_REJECT_HINTS,
+	ENTWURF_SLOTTED_REJECT_HINTS,
+	ENTWURF_TOOL_GUIDANCE,
+} from "../pi-extensions/lib/agent-guidance.ts";
 import type { EntwurfV2RunResult } from "../pi-extensions/lib/entwurf-v2-runner.ts";
 import {
 	actionableRejectHint,
@@ -28,17 +34,7 @@ import {
 	type SurfaceEntwurfV2Params,
 	toDispatchInput,
 } from "../pi-extensions/lib/entwurf-v2-surface.ts";
-
-/** Cut ONE model-facing string out of a registration block so two descriptions in the same
- * block cannot satisfy an assertion for each other (round-4 masking, 2026-07-27). Returns ""
- * when either marker is missing, which the callers' `length > 120` guard turns into a loud
- * failure rather than a silent pass. */
-function sliceDescription(block: string, startMarker: string, endMarker: string): string {
-	const s = block.indexOf(startMarker);
-	if (s === -1) return "";
-	const e = block.indexOf(endMarker, s + startMarker.length);
-	return e === -1 ? "" : block.slice(s, e);
-}
+import { FRESH_CUT_PRESCRIPTION } from "../pi-extensions/lib/meta-session.ts";
 
 let passed = 0;
 function ok(label: string, cond: boolean): void {
@@ -47,17 +43,6 @@ function ok(label: string, cond: boolean): void {
 	passed++;
 }
 
-/**
- * Collapse a model-facing string's SOURCE form into the text the model actually reads:
- * drop TS string-concat glue between adjacent literals and normalize whitespace.
- */
-function modelText(slice: string): string {
-	return slice
-		.replace(/["']\s*\+\s*["']/g, "")
-		.replace(/\s+/g, " ")
-		.trim();
-}
-
 /**
  * F-2 (2026-07-27): the two model-facing surfaces described the lock, `mode`, and the
  * unsupported-citizen outcome set in ways the code does not support. Measured against
@@ -77,13 +62,11 @@ function modelText(slice: string): string {
  * Applied to BOTH surfaces from one predicate so they cannot drift apart again.
  */
 function assertRailSemantics(tag: string, longDescRaw: string, intentDescRaw: string, modeDescRaw: string): void {
-	// Compare the text the MODEL reads, not the shape the author happened to type. pi-native
-	// wraps inside one template literal; the MCP surface wraps by `+`-concatenating literals.
-	// Without this normalization the same sentence matches on one surface and not the other,
-	// and the assertion silently measures line-wrapping instead of meaning.
-	const longDesc = modelText(longDescRaw);
-	const intentDesc = modelText(intentDescRaw);
-	const modeDesc = modelText(modeDescRaw);
+	// Inputs are decoded product strings, not TS scaffolding. Keep these semantic predicates
+	// separate from the exact, unnormalized pre-extraction byte oracle beside the reader.
+	const longDesc = longDescRaw;
+	const intentDesc = intentDescRaw;
+	const modeDesc = modeDescRaw;
 	ok(
 		`${tag} — long description scopes the per-target lock to the control-socket DOMAIN [QK:V2SURF-MCP-LOCK-DOMAIN]`,
 		/control-socket-DOMAIN\s+dispatch/.test(longDesc) && /lock-free/.test(longDesc),
@@ -155,7 +138,7 @@ function assertRailSemantics(tag: string, longDescRaw: string, intentDescRaw: st
  * DORMANT HONESTY — the model-facing replacement for the retired `V2SURF-MERGED-REJECT` claim,
  * whose subject (two distinct OWNED rejects) left with the `owned-outcome` intent.
  *
- * After the visible-first cut a dormant socket-domain citizen is unreachable by every verb, and
+ * After the visible-first cut a dormant socket-domain citizen rejects delivery by v2, and
  * these four strings are the only place a caller learns that BEFORE spending a dispatch. So each
  * one must, on its own:
  *   - name the reason it will actually get back (`dormant-fire-forget-unsupported`);
@@ -175,7 +158,7 @@ function assertRailSemantics(tag: string, longDescRaw: string, intentDescRaw: st
  * run unlabelled behind it — still real assertions, just not this claim's signature.
  */
 function assertDormantHonesty(tag: string, rawText: string): void {
-	const text = modelText(rawText);
+	const text = rawText;
 	const at = text.indexOf("owned-outcome");
 	ok(
 		`${tag} — names the withdrawn intent owned-outcome and says "withdrawn" beside it (not as an offer) [QK:V2SURF-DORMANT-HONESTY]`,
@@ -192,18 +175,23 @@ function assertDormantHonesty(tag: string, rawText: string): void {
  * PEERS DEAD-ROW HONESTY. `entwurf_peers` is a FACT surface and stays one: this claim must never
  * be satisfiable by adding a per-row action/routing field, which is why it is asserted on the
  * DESCRIPTION and paired with a negative that forbids the row-level fix. What the description owes
- * a caller is that `dead` is a reported fact carrying no invitation — the citizen is dormant and,
- * since the visible-first cut, reachable by no verb at all.
+ * a caller is that `dead` is a reported fact carrying no delivery invitation. A separately
+ * requested, proven-dormant Pi/Claude lifecycle can reopen the same id without submitting a prompt.
  */
 function assertPeersDeadRowHonesty(tag: string, rawBlock: string): void {
-	const text = modelText(rawBlock);
+	const text = rawBlock;
 	ok(
-		`${tag} — entwurf_peers says a dead/dormant row is a REPORTED FACT that grants no action [QK:V2SURF-PEERS-DEAD-ROW]`,
-		/REPORTED FACT/.test(text) && /grants no action/.test(text) && /not an invitation to dispatch/.test(text),
+		`${tag} — entwurf_peers reports dead delivery unavailable, no action grant, and separate explicit-operator promptless resume [QK:V2SURF-PEERS-DEAD-ROW]`,
+		/REPORTED FACT/.test(text) &&
+			/grants no action/.test(text) &&
+			/not an invitation to dispatch/.test(text) &&
+			/no entwurf_v2 delivery is available while it is dormant/.test(text) &&
+			/Only on an explicit operator request, the separate entwurf_resume_call/.test(text) &&
+			/proven-dormant Pi or Claude Code citizen under the same id, submitting no prompt/.test(text),
 	);
 	ok(
-		`${tag} — entwurf_peers calls a dead row currently unreachable by any verb`,
-		/dormant/.test(text) && /unreachable by any verb/.test(text),
+		`${tag} — entwurf_peers does not turn delivery dormancy into a ban on every lifecycle verb`,
+		/dormant/.test(text) && !/unreachable by any verb/.test(text),
 	);
 	// The forbidden repair: teaching the row itself to carry a verb. The facts-only rule is what
 	// keeps this surface from becoming a second dispatch table, so a description that promised a
@@ -214,14 +202,6 @@ function assertPeersDeadRowHonesty(tag: string, rawBlock: string): void {
 	);
 }
 
-/**
- * Containment-disjointness is NOT enough to prove a description slice is tight. Round 5
- * (2026-07-27) shipped a "long description" slice of 4,468 chars that SPANNED the parameter
- * entries because a bare `description:` marker matched the `target` param first — and two
- * over-wide slices can still be mutually non-containing. So pin the ABSENCE of every
- * parameter marker in the long-description slice: if the slice ever swallows the schema
- * again, this fails instead of silently satisfying the schema's own text.
- */
 /**
  * HOST TRUNCATION CAP. Measured 2026-07-30 on both Claude ACP and stock Claude Code: a tool
  * description longer than this is cut mid-sentence and the tail is replaced with `… [truncated]`.
@@ -230,30 +210,12 @@ function assertPeersDeadRowHonesty(tag: string, rawBlock: string): void {
  * to choose an intent. Every other assertion in this file checks that a sentence is PRESENT in
  * source; none of them can see that the host threw half of it away. This one can.
  *
- * Judged on `modelText` (the rendered string), not the source slice: pi-native wraps inside one
- * template literal and the MCP surface `+`-concatenates, so only the normalized text has the
- * length the host actually measures.
+ * Judged on the decoded JSON string, with no source scaffolding or whitespace normalization.
+ * Exact current fields are checked separately against frozen originals plus reviewed literal amendments.
  */
 const HOST_DESCRIPTION_CAP = 2048;
 
-/**
- * The string the HOST measures, recovered from either surface's source scaffolding: drop the
- * `description:` key and the outer template-literal / string-literal fence, and unescape `\"`.
- * Counting the raw slice instead would charge the text for punctuation the model never sees —
- * and the two surfaces carry DIFFERENT punctuation, so the cap would mean two different things.
- */
-function renderedDescription(raw: string): string {
-	const flat = modelText(raw);
-	// Anchor on the description's own first word rather than on scaffolding: the two surfaces put
-	// DIFFERENT preludes in front of it (the MCP slice starts at the tool name), and counting those
-	// would report a number the host never measures — a cap gate that cites the wrong length gets
-	// quoted as if it were the real one.
-	const from = flat.indexOf("CANONICAL");
-	return (from >= 0 ? flat.slice(from) : flat).replace(/[`"],?$/, "").replace(/\\"/g, '"');
-}
-
-function assertDescriptionFitsHostCap(tag: string, longDescRaw: string): void {
-	const rendered = renderedDescription(longDescRaw);
+function assertDescriptionFitsHostCap(tag: string, rendered: string): void {
 	ok(
 		`${tag} — long description fits the host's ${HOST_DESCRIPTION_CAP}-char cap (${rendered.length}) ` +
 			"[QK:V2SURF-DESC-FITS-HOST-CAP]",
@@ -261,12 +223,6 @@ function assertDescriptionFitsHostCap(tag: string, longDescRaw: string): void {
 	);
 }
 
-function assertLongDescExcludesParams(tag: string, longDesc: string, markers: readonly string[]): void {
-	for (const marker of markers) {
-		ok(`${tag} — long description slice excludes the \`${marker}\` parameter marker`, !longDesc.includes(marker));
-	}
-}
-
 const HERE = path.dirname(fileURLToPath(import.meta.url));
 const REPO = path.join(HERE, "..");
 const SURFACE_SRC = path.join(REPO, "pi-extensions/lib/entwurf-v2-surface.ts");
@@ -587,9 +543,24 @@ async function main(): Promise<void> {
 				!/DELIVERED|\bdelivered\b/.test(dirtyRefused.text) &&
 				// and every one of them keeps the thing the operator must act on
 				[dirtyBusy, dirtyMailbox, dirtyRefused].every(
-					(r) => r.isError && r.text.includes("DIRTY") && r.text.includes("do NOT retry"),
+					(r) =>
+						r.isError &&
+						r.text.includes("DIRTY") &&
+						r.text.includes("do NOT retry automatically") &&
+						r.text.includes("operator resolve the lock") &&
+						!r.text.includes("would double-deliver"),
 				),
 		);
+		// #154 E1a: the two static clauses of this receipt are authored in root ENTWURF.json; the
+		// syntax around them stays here, so the whole rendered line is compared, not a fragment.
+		const dirtyClause = ENTWURF_DELIVERY_RESULT_CLAUSES["dirty-lock"];
+		ok(
+			"[QK:V2SURF-DELIVERY-RESULT-CLAUSES-FROM-ROOT] the dirty-lock receipt renders the root finalized-rejected and dirty-lock clauses byte for byte inside its code-owned syntax",
+			dirtyBusy.text ===
+				`entwurf_v2 control-socket finalized as queued-steer, and ${dirtyClause}\n  error: release boom` &&
+				dirtyRefused.text ===
+					`entwurf_v2 control-socket finalized as rejected (compacting) — ${ENTWURF_DELIVERY_RESULT_CLAUSES["finalized-rejected"]}, and ${dirtyClause}\n  error: release boom`,
+		);
 
 		// plain execution-failed → error
 		const failed: EntwurfV2RunResult = {
@@ -683,6 +654,25 @@ async function main(): Promise<void> {
 				rls.includes("restart it under the current runtime") &&
 				rls.includes("meta-bridge-fresh-cut"),
 		);
+		// #154 E1b: the text on either side of the fix command is authored in root ENTWURF.json and the
+		// command comes from its owner, so the WHOLE hint is compared against that composition — the
+		// phrase checks above stay, and a hand-kept copy of the text that still carries them dies here.
+		const rlsRoot = ENTWURF_SLOTTED_REJECT_HINTS["record-less-socket"];
+		ok(
+			"[QK:V2SURF-RECORD-LESS-SOCKET-HINT-FROM-ROOT] the record-less-socket hint is exactly the root text before the fix command, the command from its meta-session owner, and the root text after it",
+			rls === `${rlsRoot.beforeFreshCutPrescription}${FRESH_CUT_PRESCRIPTION}${rlsRoot.afterFreshCutPrescription}`,
+		);
+		// #154 C1-B: the five static hints are authored in root ENTWURF.json. This is the WIRING
+		// claim — what the surface returns is the Root value for every declared reason — compared
+		// against the loaded Root, never a fixture, so a Root prose mutant still dies at its own
+		// semantic QK above. The C0 byte oracle lives beside the reader (GUIDANCE-REJECT-HINTS-ORIGINAL).
+		const unwired = Object.entries(ENTWURF_REJECT_HINTS)
+			.filter(([reason, text]) => actionableRejectHint(reason) !== text)
+			.map(([reason]) => reason);
+		ok(
+			`2D: every static reject hint the surface renders is the root ENTWURF.json value [QK:V2SURF-REJECT-HINTS-FROM-ROOT] (unwired: ${JSON.stringify(unwired)})`,
+			Object.keys(ENTWURF_REJECT_HINTS).length === 5 && unwired.length === 0,
+		);
 	}
 
 	// ── 6: RETIRED — parseEntwurfPrefixRootsEnv / ENTWURF_PREFIX_ROOTS ────────
@@ -776,14 +766,10 @@ async function main(): Promise<void> {
 		// Same shipped-rail completeness rule as the pi-native surface (4), and split the SAME
 		// two ways: the long tool description and the `intent` param description must EACH be
 		// true on their own (see the round-4 masking note in block 4).
-		// Same fail-loud rule as block 4: a missing marker would make `slice(0, -1)` return
-		// nearly the whole block and sail past the length guard, so assert the boundary first.
-		const mcpSchemaStart = v2Block.indexOf("\t{");
-		ok("5: MCP — schema boundary marker is present (slice cannot silently widen)", mcpSchemaStart > 0);
-		const mcpLongDesc = v2Block.slice(0, mcpSchemaStart);
-		const mcpIntentDesc = sliceDescription(v2Block, "intent: z", "message: z");
+		const mcpLongDesc = ENTWURF_TOOL_GUIDANCE.entwurf_v2.descriptions.mcp;
+		const mcpIntentDesc = ENTWURF_TOOL_GUIDANCE.entwurf_v2.parameters.intent;
 		ok(
-			"5: MCP — long/intent slices are disjoint (neither can satisfy the other's claim)",
+			"5: MCP — long/intent strings are disjoint (neither can satisfy the other's claim)",
 			mcpLongDesc.length > 0 &&
 				mcpIntentDesc.length > 0 &&
 				!mcpLongDesc.includes(mcpIntentDesc) &&
@@ -799,11 +785,12 @@ async function main(): Promise<void> {
 		}
 		ok("5: MCP — long description denies native-push a mailbox", /NO mailbox/.test(mcpLongDesc));
 		ok(
-			"5: MCP — long description steers live/alive peer → fire-and-forget",
-			/liveness=alive/.test(mcpLongDesc) && /fire-and-forget/.test(mcpLongDesc),
+			"5: MCP — long description says a live socket can receive fire-and-forget, and unsupported is not reachability",
+			/A live socket can receive fire-and-forget/.test(mcpLongDesc) &&
+				/not reachability/.test(mcpLongDesc) &&
+				!/liveness=alive\s*→\s*fire-and-forget/.test(mcpLongDesc),
 		);
-		assertLongDescExcludesParams("5: MCP", mcpLongDesc, ["target: z", "intent: z", "mode: z", "wants_reply: z"]);
-		const mcpModeDesc = sliceDescription(v2Block, "mode: z", "wants_reply: z");
+		const mcpModeDesc = ENTWURF_TOOL_GUIDANCE.entwurf_v2.parameters.mode;
 		assertRailSemantics("5: MCP", mcpLongDesc, mcpIntentDesc, mcpModeDesc);
 		assertDescriptionFitsHostCap("5: MCP", mcpLongDesc);
 
@@ -817,21 +804,20 @@ async function main(): Promise<void> {
 			"5: MCP — entwurf_peers block has a REAL end boundary (next server.tool present)",
 			peersStart !== -1 && peersAfter > peersStart,
 		);
-		const peersBlock = src.slice(peersStart, peersAfter);
-		ok("5: MCP — entwurf_peers block is isolated (non-vacuous)", peersBlock.length > 200);
+		const peersText = ENTWURF_TOOL_GUIDANCE.entwurf_peers.descriptions.mcp;
 		ok(
 			"5: MCP — entwurf_peers names the THIRD answer (a reject), not just the two allow rails",
-			/mailbox-undeliverable/.test(peersBlock) && /native-push-target-dead/.test(peersBlock),
+			/mailbox-undeliverable/.test(peersText) && /native-push-target-dead/.test(peersText),
 		);
 		ok(
 			"5: MCP — entwurf_peers no longer claims `unsupported` does NOT mean unreachable",
-			!/does NOT mean unreachable/.test(peersBlock),
+			!/does NOT mean unreachable/.test(peersText),
 		);
 		// Visible-first cut, operator-surface half: a dormant citizen still gets a row here, and a
 		// caller who reads "it is in the list" as "I can dispatch to it" spends a dispatch to find
 		// out otherwise. The FACT stays a fact — no per-row action field, no routing verb, which is
 		// the rule this surface exists under — so the correction has to live in the description.
-		assertPeersDeadRowHonesty("5: MCP", peersBlock);
+		assertPeersDeadRowHonesty("5: MCP", peersText);
 
 		// F-7: entwurf_inbox_read described itself as draining "your own" inbox while the handler
 		// passes the CALLER-SUPPLIED gardenId straight to readMetaInbox with no comparison against
@@ -845,7 +831,7 @@ async function main(): Promise<void> {
 			inboxStart !== -1 && inboxAfter > inboxStart,
 		);
 		const inboxBlock = src.slice(inboxStart, inboxAfter);
-		const inboxText = modelText(inboxBlock);
+		const inboxText = ENTWURF_TOOL_GUIDANCE.entwurf_inbox_read.descriptions.mcp;
 		ok("5: MCP — entwurf_inbox_read block is isolated (non-vacuous)", inboxText.length > 200);
 		ok(
 			"5: MCP — entwurf_inbox_read states the garden id is CALLER-SUPPLIED and unverified [QK:V2SURF-INBOX-SCOPE-HONESTY]",
@@ -971,20 +957,27 @@ async function main(): Promise<void> {
 	// rail's four boundaries are the ONLY receiver-acceptance values; a mailbox answers with an
 	// ENQUEUE receipt and native-push with an INJECTION, and folding those into the boundary union
 	// would tell a caller that `mailbox-enqueued` is something a receiver observed about its own
-	// queues. Missing either rail is red — the earlier draft listed `mailbox-enqueued` beside the
+	// queues. The socket dispatch may re-resolve to a mailbox leg and report mailbox-enqueued;
+	// that exception must name the leg, not silently invent a fifth receiver queue boundary.
+	// Missing either rail is red — the earlier draft listed `mailbox-enqueued` beside the
 	// four and left native-push out entirely, and nothing noticed.
 	{
-		const outcomeSites = ["mcp/entwurf-bridge/src/index.ts"];
+		const outcomeSites = [
+			{
+				rel: "ENTWURF.json tools.entwurf_v2.descriptions.mcp",
+				text: ENTWURF_TOOL_GUIDANCE.entwurf_v2.descriptions.mcp,
+			},
+		];
 		const missing: string[] = [];
-		for (const rel of outcomeSites) {
-			const text = await fs.readFile(path.join(REPO, rel), "utf8");
+		for (const { rel, text } of outcomeSites) {
 			const at = text.indexOf("reports ONE");
 			const blurb = at < 0 ? "" : text.slice(at, at + 900);
 			if (!/acceptance boundary/i.test(blurb)) missing.push(`${rel}: control receiver acceptance boundary`);
 			for (const b of ["sent", "queued-steer", "queued-follow-up", "accepted-unknown-boundary"]) {
 				if (!blurb.includes(b)) missing.push(`${rel}: boundary ${b}`);
 			}
-			if (!/those four only/i.test(blurb)) missing.push(`${rel}: the four-only scope of the boundary union`);
+			if (!blurb.includes("those four, or `mailbox-enqueued` on a re-resolved mailbox leg"))
+				missing.push(`${rel}: the four receiver boundaries and the explicitly re-resolved mailbox leg`);
 			if (!/mailbox ENQUEUE/i.test(blurb)) missing.push(`${rel}: mailbox enqueue receipt`);
 			if (!/native-push INJECTION/i.test(blurb)) missing.push(`${rel}: native-push injection`);
 			if (!/rejection|rejected/i.test(blurb)) missing.push(`${rel}: rejection`);
@@ -994,7 +987,7 @@ async function main(): Promise<void> {
 			}
 		}
 		ok(
-			`[QK:SEND-OUTCOME-LIST-NAMES-EVERY-RAIL] the tool description names each rail's own result — the control receiver's four acceptance boundaries (and that those four are the whole union), the mailbox ENQUEUE receipt, the native-push INJECTION, a rejection, and accepted-but-lock-dirty — so a caller is never told that one rail's vocabulary describes another's (missing: ${JSON.stringify(missing)})`,
+			`[QK:SEND-OUTCOME-LIST-NAMES-EVERY-RAIL] the tool description names each rail's own result — the control receiver's four acceptance boundaries (or mailbox-enqueued on an explicitly re-resolved mailbox leg), the mailbox ENQUEUE receipt, the native-push INJECTION, a rejection, and accepted-but-lock-dirty — so a caller is never told that one rail's vocabulary describes another's (missing: ${JSON.stringify(missing)})`,
 			missing.length === 0,
 		);
 	}
@@ -1029,7 +1022,10 @@ async function main(): Promise<void> {
 		];
 		const gaps: string[] = [];
 		for (const rel of sites) {
-			const text = await fs.readFile(path.join(REPO, rel), "utf8");
+			const text =
+				rel === "mcp/entwurf-bridge/src/index.ts"
+					? ENTWURF_TOOL_GUIDANCE.entwurf_v2.parameters.mode
+					: await fs.readFile(path.join(REPO, rel), "utf8");
 			for (const axis of axes) if (!axis.holds(text)) gaps.push(`${rel}: ${axis.name}`);
 			if (/steer \((?:interrupt|immediate)|interrupt the current turn|steer = interrupt/i.test(text)) {
 				gaps.push(`${rel}: still claims steer interrupts`);

package/scripts/check-gate-qualification.ts

@@ -3446,6 +3446,7 @@ let manifestCount: number;
 		"acp-stream-hooks": 10,
 		"acp-usage-accounting": 12,
 		"acp-vendor-rejection": 4,
+		"agent-guidance": 14,
 		"agy-permission": 6,
 		"bridge-boot-resume": 5,
 		"bridge-command-boot": 12,
@@ -3453,12 +3454,13 @@ let manifestCount: number;
 		"cc-retire-request": 15,
 		"entwurf-v2-retire": 32,
 		"capability-cache": 3,
+		"capability-bundle-reach": 7,
 		"codex-app-server-launch": 10,
 		"codex-caller-seat": 28,
 		"pi-retire-request": 6,
 		"retirement-event": 16,
 		"control-retire": 9,
-		"control-send-receipt": 19,
+		"control-send-receipt": 20,
 		"codex-native": 95,
 		"native-push-paused": 1,
 		"chain-terminus-publication": 1,
@@ -3472,7 +3474,7 @@ let manifestCount: number;
 		"pi-bridge-sender": 4,
 		"pi-mcp-bridge": 2,
 		"pi-mcp-register": 3,
-		"pi-durable": 94,
+		"pi-durable": 95,
 		"copilot-receive": 20,
 		"entwurf-peers": 1,
 		"fresh-call-dispatch": 15,
@@ -3493,13 +3495,13 @@ let manifestCount: number;
 		"meta-identity": 9,
 		"meta-retire": 4,
 		"mux-boundary": 16,
-		"mux-fresh-call": 66,
+		"mux-fresh-call": 67,
 		"mux-launcher-fence": 8,
 		"mux-parent-artifact": 3,
 		"pack-install": 9,
 		"pi-package-ownership": 8,
 		"qualification-ledger": 42,
-		"mux-resume-call": 13,
+		"mux-resume-call": 15,
 		"omp-birth": 13,
 		"omp-fresh": 25,
 		"omp-receive": 11,
@@ -3509,7 +3511,7 @@ let manifestCount: number;
 		"remote-pair-installed-audit": 2,
 		"remote-pair-receive": 10,
 		"remote-pair-roundtrip": 9,
-		"remote-pair-send": 21,
+		"remote-pair-send": 22,
 		"remote-pair-transport": 4,
 		"retired-sent-surface": 2,
 		"resume-args": 6,
@@ -3518,8 +3520,8 @@ let manifestCount: number;
 		"setup-verdict": 14,
 		"source-install": 8,
 		"typing-call-fence": 1,
-		"v2-surface": 14,
-		"v2-visible-resume": 40,
+		"v2-surface": 16,
+		"v2-visible-resume": 41,
 		"win32-preview": 19,
 	};
 	const laneTally: Record<string, number> = {};

package/scripts/check-mux-resume-call.ts

@@ -36,6 +36,7 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
+import { ENTWURF_RESUME_LAUNCH_REJECT_HINTS, ENTWURF_TOOL_GUIDANCE } from "../pi-extensions/lib/agent-guidance.ts";
 import { classifyTmuxCwd } from "../pi-extensions/lib/classify-tmux-cwd.ts";
 import type { Placement } from "../pi-extensions/lib/mux-placement.ts";
 import {
@@ -216,6 +217,12 @@ function main(): void {
 			"every reject reason has a hint a caller can act on — a reason without one is a reason they will guess about",
 			reasons.every((r) => typeof RESUME_CALL_REJECT_HINT[r] === "string" && RESUME_CALL_REJECT_HINT[r].length > 0),
 		);
+		ok(
+			"[QK:MUXRESUME-LAUNCH-REJECT-HINTS-FROM-ROOT] every launch-stage resume hint is the root ENTWURF.json text for its own reason, and the table names exactly the verb's reasons",
+			reasons.every((r) => RESUME_CALL_REJECT_HINT[r] === ENTWURF_RESUME_LAUNCH_REJECT_HINTS[r]) &&
+				JSON.stringify(Object.keys(RESUME_CALL_REJECT_HINT).sort()) === JSON.stringify([...reasons].sort()) &&
+				JSON.stringify(Object.keys(ENTWURF_RESUME_LAUNCH_REJECT_HINTS).sort()) === JSON.stringify([...reasons].sort()),
+		);
 		ok(
 			"[QK:MUXRESUME-RUNTIME-TABLE] the runtime is a closed per-backend table, pi → pi and claude-code → claude — never a command a caller supplies",
 			JSON.stringify(RESUME_CALL_RUNTIME) === JSON.stringify({ pi: "pi", "claude-code": "claude" }),
@@ -227,9 +234,19 @@ function main(): void {
 			"[QK:MUXRESUME-NO-IDENTITY] the module never mentions a garden id, a record, a lock or a transcript — it opens a place at a directory and knows nothing about whose citizen it is",
 			!/gardenId|readAddressableMetaIdentity|acquireLock|transcriptPath/.test(SRC),
 		);
+		// Every static form (from / bare / export-from) is parsed and dynamic loading is refused, so a
+		// fourth lane cannot enter through a shape the parser does not see. The one non-mux member is the
+		// node:fs-only guidance reader (#154 C1-D), whose own leaf-ness is GUIDANCE-READER-LEAF-IMPORTS.
+		const resumeImports = [
+			...SRC.matchAll(/^\s*(?:import|export)\s[^;]*?\sfrom\s+["']([^"']+)["']/gm),
+			...SRC.matchAll(/^\s*import\s+["']([^"']+)["']/gm),
+		].map((m) => m[1]);
 		ok(
-			"it imports only the mux lane — no entwurf core, no delivery",
-			!/from "\.\/entwurf-/.test(SRC) && !/meta-session/.test(SRC),
+			"[QK:MUXRESUME-IMPORT-SET] it imports exactly the mux lane plus the guidance reader — no entwurf core, no delivery, no dynamic import",
+			JSON.stringify([...resumeImports].sort()) ===
+				JSON.stringify(["./agent-guidance.ts", "./classify-tmux-cwd.ts", "./mux-launch.ts", "./mux-placement.ts"]) &&
+				!/\bimport\s*\(|\brequire\s*\(/.test(SRC) &&
+				!/meta-session/.test(SRC),
 		);
 		ok(
 			"it uses the SHARED APPEND_FORMAT rather than adding a start-path field: `-P -F` prints its row BEFORE the child chdirs (measured — pane_current_path there still reports the CALLER's cwd), so a path field would be both free-form in a `|`-joined row and racy",
@@ -273,7 +290,7 @@ function main(): void {
 
 		// ── the description contract ────────────────────────────────────────────────
 		// Not prose parity — three claims an operator acts on, plus the host's own cap.
-		const MCP_DESC = (MCP_SURFACE.split('"entwurf_resume_call",')[1] ?? "").split("{")[0];
+		const MCP_DESC = ENTWURF_TOOL_GUIDANCE.entwurf_resume_call.descriptions.mcp;
 		const statesTheContract = (text: string): boolean =>
 			/dormant/i.test(text) && /submits NO prompt/i.test(text) && /observation/i.test(text) && /launch/i.test(text);
 

package/scripts/mutants/agent-guidance.json

@@ -0,0 +1,160 @@
+{
+	"schemaVersion": 1,
+	"lane": "agent-guidance",
+	"mutants": [
+		{
+			"claim": "GUIDANCE-REVIEWED-REVISION",
+			"title": "a valid Root revision advances beyond the independently reviewed payload revision while every history entry and decoded tool string remains valid",
+			"subject": "ENTWURF.json",
+			"find": ["\t\"revision\": 11,", "\t\"history\": ["],
+			"replace": ["\t\"revision\": 12,", "\t\"history\": ["],
+			"gate": ["bash", "run.sh", "check-agent-guidance-beside"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:GUIDANCE-REVIEWED-REVISION]",
+			"signatureSource": "pi-extensions/lib/agent-guidance.test.ts"
+		},
+		{
+			"claim": "GUIDANCE-CURRENT-DECODED-BYTES",
+			"title": "a valid authored parameter gains one space, so normalized/shared-constant comparisons would hide a reviewed-current byte break",
+			"subject": "ENTWURF.json",
+			"find": ["Target garden id (use entwurf_peers to discover)"],
+			"replace": ["Target  garden id (use entwurf_peers to discover)"],
+			"gate": ["bash", "run.sh", "check-agent-guidance-beside"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:GUIDANCE-CURRENT-DECODED-BYTES]",
+			"signatureSource": "pi-extensions/lib/agent-guidance.test.ts"
+		},
+		{
+			"claim": "GUIDANCE-REJECT-HINTS-ORIGINAL",
+			"title": "a valid static reject hint gains one space in the real JSON, which the reader and the surface wiring both carry faithfully, so only the C0 plus reviewed-revision-6 byte oracle can disagree",
+			"subject": "ENTWURF.json",
+			"find": ["native-push for this backend is paused (#152):"],
+			"replace": ["native-push for this backend is  paused (#152):"],
+			"gate": ["bash", "run.sh", "check-agent-guidance-beside"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:GUIDANCE-REJECT-HINTS-ORIGINAL]",
+			"signatureSource": "pi-extensions/lib/agent-guidance.test.ts"
+		},
+		{
+			"claim": "GUIDANCE-RESUME-REJECT-HINTS-ORIGINAL",
+			"title": "a valid static visible-resume reject hint gains one space in the real JSON, which the reader and the visible-resume wiring both carry faithfully, so only the C0 byte oracle can disagree",
+			"subject": "ENTWURF.json",
+			"find": ["tmux was never asked to open a window"],
+			"replace": ["tmux was never  asked to open a window"],
+			"gate": ["bash", "run.sh", "check-agent-guidance-beside"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:GUIDANCE-RESUME-REJECT-HINTS-ORIGINAL]",
+			"signatureSource": "pi-extensions/lib/agent-guidance.test.ts"
+		},
+		{
+			"claim": "GUIDANCE-RUNTIME-REVIEWED-FIELDS",
+			"title": "valid callback prose changes in the real JSON and reaches source tools/list, whose C0 plus reviewed-delta expectation must disagree",
+			"subject": "ENTWURF.json",
+			"find": ["No arguments, no fallback to a model-supplied target."],
+			"replace": ["No arguments, automatic fallback to a model-supplied target."],
+			"gate": ["bash", "run.sh", "check-agent-guidance-beside"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:GUIDANCE-RUNTIME-REVIEWED-FIELDS]",
+			"signatureSource": "pi-extensions/lib/agent-guidance.test.ts"
+		},
+		{
+			"claim": "GUIDANCE-DURABLE-REVIEWED-FIELDS",
+			"title": "the actual durable short variant changes without touching the independent C0 plus reviewed-delta contact expectation",
+			"subject": "ENTWURF.json",
+			"find": ["Return this durable host's garden identity envelope"],
+			"replace": ["Return this durable host's alternate identity envelope"],
+			"gate": ["bash", "run.sh", "check-agent-guidance-beside"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:GUIDANCE-DURABLE-REVIEWED-FIELDS]",
+			"signatureSource": "pi-extensions/lib/agent-guidance.test.ts"
+		},
+		{
+			"claim": "GUIDANCE-DUPLICATE-DECODED-KEYS",
+			"title": "grammar-only parsing skips the original token walk and accepts last-key-wins data",
+			"subject": "pi-extensions/lib/agent-guidance.ts",
+			"find": ["rejectDuplicateKeys(source);"],
+			"replace": ["// duplicate-key check removed by data-integrity mutant"],
+			"gate": ["bash", "run.sh", "check-agent-guidance-beside"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:GUIDANCE-DUPLICATE-DECODED-KEYS]",
+			"signatureSource": "pi-extensions/lib/agent-guidance.test.ts"
+		},
+		{
+			"claim": "GUIDANCE-STRICT-SHAPE",
+			"title": "the shape reader no longer rejects missing or unknown members",
+			"subject": "pi-extensions/lib/agent-guidance.ts",
+			"find": ["actual.length !== wanted.length || actual.some((key, i) => key !== wanted[i])"],
+			"replace": ["false"],
+			"gate": ["bash", "run.sh", "check-agent-guidance-beside"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:GUIDANCE-STRICT-SHAPE]",
+			"signatureSource": "pi-extensions/lib/agent-guidance.test.ts"
+		},
+		{
+			"claim": "GUIDANCE-INDEPENDENT-REVISION",
+			"title": "history length becomes payload revision, so history-only annotation silently changes it",
+			"subject": "pi-extensions/lib/agent-guidance.ts",
+			"find": ["freeze(data);"],
+			"replace": ["data.revision = data.history.length;\n\tfreeze(data);"],
+			"gate": ["bash", "run.sh", "check-agent-guidance-beside"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:GUIDANCE-INDEPENDENT-REVISION]",
+			"signatureSource": "pi-extensions/lib/agent-guidance.test.ts"
+		},
+		{
+			"claim": "GUIDANCE-FIXED-MODULE-ROOT",
+			"title": "an ambient path selects replacement guidance instead of the module's fixed packaged source",
+			"subject": "pi-extensions/lib/agent-guidance.ts",
+			"find": ["new URL(\"../../ENTWURF.json\", import.meta.url)"],
+			"replace": ["process.env.ENTWURF_GUIDANCE_PATH ?? new URL(\"../../ENTWURF.json\", import.meta.url)"],
+			"gate": ["bash", "run.sh", "check-agent-guidance-beside"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:GUIDANCE-FIXED-MODULE-ROOT]",
+			"signatureSource": "pi-extensions/lib/agent-guidance.test.ts"
+		},
+		{
+			"claim": "GUIDANCE-LAUNCH-REJECT-HINTS-ORIGINAL",
+			"title": "a valid static tmux launch-stage hint gains one space in the real JSON, which the reader, the fresh renderer and the compiled reader all carry faithfully, so only the C0 per-verb byte oracle can disagree",
+			"subject": "ENTWURF.json",
+			"find": ["the requested tmux session name is outside the shape"],
+			"replace": ["the requested tmux  session name is outside the shape"],
+			"gate": ["bash", "run.sh", "check-agent-guidance-beside"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:GUIDANCE-LAUNCH-REJECT-HINTS-ORIGINAL]",
+			"signatureSource": "pi-extensions/lib/agent-guidance.test.ts"
+		},
+		{
+			"claim": "GUIDANCE-DELIVERY-RESULT-CLAUSES-ORIGINAL",
+			"title": "a valid static delivery-result clause gains one space in the real JSON, which the reader, the v2-surface and remote-pair renderers and the compiled reader all carry faithfully, so only the 94d0594 byte oracle can disagree",
+			"subject": "ENTWURF.json",
+			"find": ["the receiver refused it; nothing was accepted"],
+			"replace": ["the receiver  refused it; nothing was accepted"],
+			"gate": ["bash", "run.sh", "check-agent-guidance-beside"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:GUIDANCE-DELIVERY-RESULT-CLAUSES-ORIGINAL]",
+			"signatureSource": "pi-extensions/lib/agent-guidance.test.ts"
+		},
+		{
+			"claim": "GUIDANCE-READER-LEAF-IMPORTS",
+			"title": "the reader gains a bare side-effect import, the weakest static form, which loads and runs fine, so only the leaf import-set parser can see the new dependency",
+			"subject": "pi-extensions/lib/agent-guidance.ts",
+			"find": ["import { readFileSync } from \"node:fs\";"],
+			"replace": ["import { readFileSync } from \"node:fs\";", "import \"node:path\";"],
+			"gate": ["bash", "run.sh", "check-agent-guidance-beside"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:GUIDANCE-READER-LEAF-IMPORTS]",
+			"signatureSource": "pi-extensions/lib/agent-guidance.test.ts"
+		},
+		{
+			"claim": "GUIDANCE-SLOTTED-REJECT-HINTS-ORIGINAL",
+			"title": "a valid record-less-socket segment gains one space in the real JSON, which the reader and the surface composition both carry faithfully, so only the C0 segment and template oracle can disagree",
+			"subject": "ENTWURF.json",
+			"find": ["If a pre-record-era resident owns that socket"],
+			"replace": ["If a pre-record-era  resident owns that socket"],
+			"gate": ["bash", "run.sh", "check-agent-guidance-beside"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:GUIDANCE-SLOTTED-REJECT-HINTS-ORIGINAL]",
+			"signatureSource": "pi-extensions/lib/agent-guidance.test.ts"
+		}
+	]
+}