@junghanacs/entwurf 0.41.2 → 0.50.0

package/scripts/mutants/pi-durable.json

@@ -2,6 +2,20 @@
 	"schemaVersion": 1,
 	"lane": "pi-durable",
 	"mutants": [
+		{
+			"claim": "PI-DURABLE-DESCRIPTION-DRIFT-REFUSED",
+			"title": "schema comparison ignores description-only drift while still comparing structural schema fields",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["canonicalJson(found.inputSchema) !== canonicalJson(PI_DURABLE_TOOL_SCHEMAS[name])"],
+			"replace": [
+				"canonicalJson(JSON.parse(JSON.stringify(found.inputSchema, (key, value) => key === \"description\" ? undefined : value))) !== canonicalJson(JSON.parse(JSON.stringify(PI_DURABLE_TOOL_SCHEMAS[name], (key, value) => key === \"description\" ? undefined : value)))"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-DESCRIPTION-DRIFT-REFUSED]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
 		{
 			"claim": "PI-DURABLE-RETIRE-CALL",
 			"title": "retirement alone drops the actual request cancellation signal",
@@ -24,13 +38,11 @@
 		{
 			"claim": "PI-DURABLE-RETIRE-POLICY",
 			"title": "the native retirement description treats actor identity as a standing grant",
-			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\t\"Only when the human operator explicitly requested this particular target/work: make ONE retirement attempt for that request \" +"
-			],
-			"replace": [
-				"\t\t\"A caller record alone authorizes this target/work: make ONE retirement attempt for that request \" +"
+				"Only when the human operator explicitly requested this particular target/work: make ONE retirement attempt for that request "
 			],
+			"replace": ["A caller record alone authorizes this target/work: make ONE retirement attempt for that request "],
 			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:PI-DURABLE-RETIRE-POLICY]",
@@ -513,7 +525,7 @@
 			"claim": "PI-DURABLE-CARRIER-PIN-MATCHES",
 			"title": "the pin records a digest the committed carrier file does not carry, so a carrier edited after emission would still be the declared one",
 			"subject": "pi/pi-durable/overlay/upstream-pin.json",
-			"find": ["\"sha256\": \"725757156580ad2a2d170c790440763371bb8035052a0c6caae6af5159d4718f\""],
+			"find": ["\"sha256\": \"437834997b9870ab0383aea7d86ff7880ef7e2ebbbfe4c6360f67d8d36f777ec\""],
 			"replace": ["\"sha256\": \"0000000000000000000000000000000000000000000000000000000000000000\""],
 			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
 			"timeoutSeconds": 300,
@@ -1339,6 +1351,66 @@
 			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
 			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
 		},
+		{
+			"claim": "PI-DURABLE-SESSION-ARGUMENT-REFUSED",
+			"title": "a fresh-only flag beside --session is no longer refused: the named session is reopened with an argument it silently drops",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\tif (session !== undefined && fresh.length > 0) {"],
+			"replace": ["\tif (session !== undefined && fresh.length > FRESH_ONLY_FLAGS.length) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-SESSION-ARGUMENT-REFUSED]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-SESSION-ID-MALFORMED-REFUSED",
+			"title": "a separator check stands in for the session grammar: a malformed --session name reaches the operator's module, the TUI and the app",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\t\tif (!isSessionName(args.session)) {"],
+			"replace": ["\t\tif (args.session.includes(\"/\")) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-SESSION-ID-MALFORMED-REFUSED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-SESSION-OPENS-NAMED",
+			"title": "--session opens this directory's newest session instead of the one it names",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\tif (session !== undefined) return { session, ...nativeModule };"],
+			"replace": ["\tif (session !== undefined) return { continueSession: true, ...nativeModule };"],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-SESSION-OPENS-NAMED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-SESSION-NOT-HERE-REFUSED",
+			"title": "a well-formed session id is trusted without its directory: an id this directory does not hold is opened anyway",
+			"subject": "pi/pi-durable/carrier/sessions.js",
+			"find": ["\t\tif (chosen === undefined || !(await statIfPresent(chosen))?.isDirectory()) {"],
+			"replace": ["\t\tif (chosen === undefined) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-SESSION-NOT-HERE-REFUSED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-SESSION-BEFORE-OPERATOR-ENV",
+			"title": "the bootstrap loads the session store before reading the --session grammar, and the store's SDK config import fixes package state before the operator module prepares the environment",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\t\tconst { isSessionName } = await import(SESSION_NAME);"],
+			"replace": ["\t\tconst { isSessionName } = await import(SESSIONS).then(() => import(SESSION_NAME));"],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-SESSION-BEFORE-OPERATOR-ENV]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
 		{
 			"claim": "PI-DURABLE-RESUME-CALL-EXPOSED",
 			"title": "entwurf_resume_call drops out of the durable contact's tools, so the coordinator citizen cannot reopen a dormant pi sibling",
@@ -1362,6 +1434,924 @@
 			"signature": "[QK:PI-DURABLE-RESUME-CALL-REACHES-BRIDGE]",
 			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
 			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDL-COMMIT-BINDS-PAIR",
+			"title": "the birth stops minting the record's binding: the carrier names an incarnation the record never carried",
+			"subject": "pi-extensions/lib/pi-durable-location.ts",
+			"find": ["input: { ...input, attachIncarnation },"],
+			"replace": ["input: { ...input },"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDL-COMMIT-BINDS-PAIR]",
+			"signatureSource": "pi-extensions/lib/pi-durable-location.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDL-NATIVE-DIRECTORY-REALPATH",
+			"title": "the birth records the session directory as spelled, so an alias is written where the directory itself belongs",
+			"subject": "pi-extensions/lib/pi-durable-location.ts",
+			"find": ["nativeDirectory = fs.realpathSync(opts.sessionDirectory);"],
+			"replace": ["nativeDirectory = path.resolve(opts.sessionDirectory);"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDL-NATIVE-DIRECTORY-REALPATH]",
+			"signatureSource": "pi-extensions/lib/pi-durable-location.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDL-ROOT-ISOLATION",
+			"title": "the location directory moves inside the receivers root, where fresh-cut walks every entry as a marker",
+			"subject": "pi-extensions/lib/pi-durable-location.ts",
+			"find": ["return path.join(path.dirname(receiversDir), PI_DURABLE_LOCATION_DIRNAME);"],
+			"replace": ["return path.join(receiversDir, PI_DURABLE_LOCATION_DIRNAME);"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDL-ROOT-ISOLATION]",
+			"signatureSource": "pi-extensions/lib/pi-durable-location.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDL-REFUSES-BEFORE-WRITE",
+			"title": "the birth stops checking that the session directory is a directory, and writes a record and a carrier naming a file",
+			"subject": "pi-extensions/lib/pi-durable-location.ts",
+			"find": ["if (!fs.statSync(nativeDirectory).isDirectory()) throw new Error(\"not a directory\");"],
+			"replace": ["void nativeDirectory;"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDL-REFUSES-BEFORE-WRITE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-location.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDL-ARM-LOCK-BUSY-KEEPS-OLD-PAIR",
+			"title": "the birth takes the record-arm lock under another valid garden id, so a lock held on its own garden no longer stops the minted write",
+			"subject": "pi-extensions/lib/pi-durable-location.ts",
+			"find": ["const acquired = acquireLock(existing.gardenId, { dir: lockDir });"],
+			"replace": ["const acquired = acquireLock(\"20000101T000000-000000\", { dir: lockDir });"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDL-ARM-LOCK-BUSY-KEEPS-OLD-PAIR]",
+			"signatureSource": "pi-extensions/lib/pi-durable-location.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDL-CARRIER-WRITE-FAILS-MISMATCH",
+			"title": "a failed carrier write leaves its tmp beside the final name",
+			"subject": "pi-extensions/lib/pi-durable-location.ts",
+			"find": ["fs.rmSync(tmp, { force: true });"],
+			"replace": ["void tmp;"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDL-CARRIER-WRITE-FAILS-MISMATCH]",
+			"signatureSource": "pi-extensions/lib/pi-durable-location.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDL-VERIFY-CARRIER-REFUSALS",
+			"title": "the read stops comparing attachIncarnation, so a carrier from an older binding passes",
+			"subject": "pi-extensions/lib/pi-durable-location.ts",
+			"find": ["([\"nativeSessionId\", \"cwd\", \"attachIncarnation\"] as const)"],
+			"replace": ["([\"nativeSessionId\", \"cwd\"] as const)"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDL-VERIFY-CARRIER-REFUSALS]",
+			"signatureSource": "pi-extensions/lib/pi-durable-location.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDL-VERIFY-ENTRY-REFUSALS",
+			"title": "the read follows a symlink and opens any entry at the carrier's name",
+			"subject": "pi-extensions/lib/pi-durable-location.ts",
+			"find": ["text = readStoreRecordFile(file);"],
+			"replace": ["text = fs.readFileSync(file, \"utf8\");"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDL-VERIFY-ENTRY-REFUSALS]",
+			"signatureSource": "pi-extensions/lib/pi-durable-location.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDL-READ-RETAINS",
+			"title": "the read starts clearing a carrier whose record is gone",
+			"subject": "pi-extensions/lib/pi-durable-location.ts",
+			"find": ["\t\treturn {\n\t\t\tok: false,\n\t\t\treason: \"record-unaddressable\","],
+			"replace": [
+				"\t\tfs.rmSync(piDurableLocationPath(opts.gardenId, opts.receiversDir), { force: true });\n\t\treturn {\n\t\t\tok: false,\n\t\t\treason: \"record-unaddressable\","
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDL-READ-RETAINS]",
+			"signatureSource": "pi-extensions/lib/pi-durable-location.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-BIRTH-LOCATION-BOUND",
+			"title": "the contact hands the binding its cwd instead of the durable session directory",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["sessionDirectory: session.directory,"],
+			"replace": ["sessionDirectory: cwd,"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-BIRTH-LOCATION-BOUND]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-BIRTH-LOCATION-FAILURE-FAILS-BIRTH",
+			"title": "the contact falls back to binding under a lock nobody holds when the birth's own binding cannot commit, and the bridge starts",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["const upsert = commitPiDurableBirth({"],
+			"replace": [
+				"const upsert = ((o: Parameters<typeof commitPiDurableBirth>[0]) => { try { return commitPiDurableBirth(o); } catch { return commitPiDurableBirth({ ...o, receiversDir: path.join(o.receiversDir, \"unbound-fallback\") }); } })({"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-BIRTH-LOCATION-FAILURE-FAILS-BIRTH]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-CLOSE-RETAINS-LOCATION",
+			"title": "closing the contact removes the location evidence along with the doorbell",
+			"subject": "pi-extensions/meta-bridge-pi-durable.ts",
+			"find": ["const problems = retire(\"closed\", \"the contact closed\");"],
+			"replace": [
+				"if (options.receiversDir !== undefined) fs.rmSync(path.join(path.dirname(path.resolve(options.receiversDir)), \"meta-pi-durable-locations\"), { recursive: true, force: true }); const problems = retire(\"closed\", \"the contact closed\");"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CLOSE-RETAINS-LOCATION]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDL-REFUSES-IMPLAUSIBLE-OWNER-PID",
+			"title": "the writer checks only that the owner pid is an integer, so pid 1 is written into a carrier the parser refuses",
+			"subject": "pi-extensions/lib/pi-durable-location.ts",
+			"find": ["if (!isPlausibleOwnerPid(opts.ownerPid)) {"],
+			"replace": ["if (!Number.isSafeInteger(opts.ownerPid)) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDL-REFUSES-IMPLAUSIBLE-OWNER-PID]",
+			"signatureSource": "pi-extensions/lib/pi-durable-location.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDL-REFUSES-RELATIVE-CWD",
+			"title": "the writer stops requiring an absolute cwd, so a relative cwd reaches the record write",
+			"subject": "pi-extensions/lib/pi-durable-location.ts",
+			"find": ["if (typeof opts.cwd !== \"string\" || !path.isAbsolute(opts.cwd)) {"],
+			"replace": ["if (typeof opts.cwd !== \"string\") {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDL-REFUSES-RELATIVE-CWD]",
+			"signatureSource": "pi-extensions/lib/pi-durable-location.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-ADMIT-FRESH",
+			"title": "a D this call created is recorded as unarmed-existing participation, so a fresh enrollment reads like a takeover of an old directory",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\t\tconst from = created ? \"fresh\" : \"unarmed-existing\";"],
+			"replace": ["\t\t\tconst from = created ? \"unarmed-existing\" : \"unarmed-existing\";"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDF-ADMIT-FRESH]",
+			"signatureSource": "pi-extensions/lib/pi-durable-owner-fence.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-ADMIT-UNARMED",
+			"title": "an existing D without a claim is recorded as a fresh participation, so an unarmed directory reads as one this fence created",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\t\tconst from = created ? \"fresh\" : \"unarmed-existing\";"],
+			"replace": ["\t\t\tconst from = created ? \"fresh\" : \"fresh\";"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDF-ADMIT-UNARMED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-owner-fence.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-UNARMED-LEGACY-LEASE",
+			"title": "the lease presence test is negated: an unarmed D whose lease a legacy opener holds is admitted, and the library's stale takeover runs on it",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\t\tif ((claim !== undefined || !created) && leasePresent(directory)) {"],
+			"replace": ["\t\t\tif ((claim !== undefined || !created) && !leasePresent(directory)) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDF-UNARMED-LEGACY-LEASE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-owner-fence.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-LIVE-NO-SELF-REENTRY",
+			"title": "a claim this very process owns is let through as if it were dead, so a process re-enters its own open or close-failed directory",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tif (!proven) {"],
+			"replace": ["\t\tif (!proven && claim.owner.pid !== process.pid) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDF-LIVE-NO-SELF-REENTRY]",
+			"signatureSource": "pi-extensions/lib/pi-durable-owner-fence.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-UNKNOWN-FAILS-CLOSED",
+			"title": "an owner that is only not proven live is treated as dead, so an uncertain owner's directory is reclaimed",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tconst proven = verdict === \"dead\";"],
+			"replace": ["\t\tconst proven = verdict !== \"live\";"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDF-UNKNOWN-FAILS-CLOSED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-owner-fence.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-DEAD-RECLAIM",
+			"title": "a reclaim no longer records what it took over: the claim says fenced with no trace of the dead owner or its lease",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\t\t...(reclaimedFrom === undefined ? {} : { reclaimedFrom }),"],
+			"replace": ["\t\t\t...(reclaimedFrom === undefined ? {} : {}),"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDF-DEAD-RECLAIM]",
+			"signatureSource": "pi-extensions/lib/pi-durable-owner-fence.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-DEAD-LEASE-UNATTRIBUTED",
+			"title": "a failed release counts as an attributed lease, so a present lease after a dead owner's failed release is taken over without proof it was that owner's",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tconst attributed = claim.lease === \"held\" || claim.lease === \"unknown\";"],
+			"replace": [
+				"\t\tconst attributed = claim.lease === \"held\" || claim.lease === \"unknown\" || claim.lease === \"failed\";"
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDF-DEAD-LEASE-UNATTRIBUTED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-owner-fence.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-ALIAS-NOT-ABSENT",
+			"title": "a claim selected under another session id is read as absent, so an alias of a live owner's D is admitted over it",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tif (claim === undefined || claim.state === \"closed\") {"],
+			"replace": ["\t\tif (claim === undefined || claim.selected.n !== selectedN || claim.state === \"closed\") {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDF-ALIAS-NOT-ABSENT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-owner-fence.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-RESOURCE-MISMATCH-REFUSED",
+			"title": "a claim naming another resource falls through to the absent row, so a copied D's claim is overwritten instead of refused",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": [
+				"\t\tif (read !== undefined && read.resource !== resource) {",
+				"\t\t\tthrow refuse(\"claim-resource-mismatch\", `the claim in ${directory} names ${read.resource}, not ${resource}`);",
+				"\t\t}",
+				"\t\t// Only a claim for THIS resource is judged below; a mismatched one was refused above, never read as absent.",
+				"\t\tconst claim = read;"
+			],
+			"replace": ["\t\tconst claim = read?.resource === resource ? read : undefined;"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDF-RESOURCE-MISMATCH-REFUSED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-owner-fence.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-GENERATION-EXACT",
+			"title": "the generation comparison is inverted: a stale ticket transitions over a claim another write already replaced",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\t\tif (current.generation !== last.generation) {"],
+			"replace": ["\t\t\tif (current.generation === last.generation) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDF-GENERATION-EXACT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-owner-fence.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-TX-OWN-RELEASED",
+			"title": "the holder no longer unlinks its own transaction file, so every later claim write in that D waits out the bound and refuses",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tleaveTx(tx, held, stepError);"],
+			"replace": ["\t\tvoid [held, stepError];"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDF-TX-OWN-RELEASED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-owner-fence.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-TX-RESIDUE-FAILS-CLOSED",
+			"title": "the busy path removes a transaction file it did not create, taking over another holder's or a crash's S_D",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tif (attempt >= TX_ATTEMPTS) {"],
+			"replace": ["\t\tif (attempt >= TX_ATTEMPTS) {", "\t\t\tfs.rmSync(tx, { force: true });"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDF-TX-RESIDUE-FAILS-CLOSED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-owner-fence.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-CLOSED-RECEIPT-KEPT",
+			"title": "the close transition unlinks the claim, so a clean end leaves no receipt and the next opener reads the directory as never armed",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tawait this.#end([\"leased\", \"storage-open\"], \"closed\", checked);"],
+			"replace": [
+				"\t\tawait this.#end([\"leased\", \"storage-open\"], \"closed\", checked);",
+				"\t\tfs.rmSync(path.join(this.#resource, PI_DURABLE_OWNER_CLAIM));"
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDF-CLOSED-RECEIPT-KEPT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-owner-fence.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-TMP-INERT",
+			"title": "the reader takes the newest atomic temp for the claim, so a crash's leftover temp decides admission",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\tconst file = path.join(resource, PI_DURABLE_OWNER_CLAIM);"],
+			"replace": [
+				"\tconst file = path.join(resource, fs.readdirSync(resource).filter((name) => name.startsWith(PI_DURABLE_OWNER_TMP_PREFIX)).sort().at(-1) ?? PI_DURABLE_OWNER_CLAIM);"
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDF-TMP-INERT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-owner-fence.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-SQLITE-NAMESPACE",
+			"title": "the atomic temp moves under the SDK's session.sqlite prefix, where its files and the fence's would share one namespace",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["export const PI_DURABLE_OWNER_TMP_PREFIX = `${PI_DURABLE_OWNER_CLAIM}.tmp-`;"],
+			"replace": ["export const PI_DURABLE_OWNER_TMP_PREFIX = \"session.sqlite-entwurf.tmp-\";"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDF-SQLITE-NAMESPACE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-owner-fence.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-ADMIT-BEFORE-LEASE",
+			"title": "the fence is asked only after the native lease is taken, so the lease it is meant to precede already exists at admission",
+			"subject": "pi/pi-durable/carrier/sessions.js",
+			"find": [
+				"\tconst ticket = await fence.admit({ directory, selectedN: basename(directory), created, profile });",
+				"\t// A lock left by a crashed process goes stale after 10 s; wait that long before giving up.",
+				"\tconst lease = lockfile.lock(directory, {",
+				"\t\trealpath: false,",
+				"\t\tretries: { retries: 12, minTimeout: 1000, maxTimeout: 1000 },",
+				"\t});"
+			],
+			"replace": [
+				"\t// A lock left by a crashed process goes stale after 10 s; wait that long before giving up.",
+				"\tconst lease = lockfile.lock(directory, {",
+				"\t\trealpath: false,",
+				"\t\tretries: { retries: 12, minTimeout: 1000, maxTimeout: 1000 },",
+				"\t});",
+				"\tawait lease.catch(() => {});",
+				"\tconst ticket = await fence.admit({ directory, selectedN: basename(directory), created, profile });"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PDF-ADMIT-BEFORE-LEASE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-INIT-NEVER-OPENED-CLOSED",
+			"title": "an init failure before any storage open is recorded with an unknown storage, so a clean never-opened end becomes close-failed",
+			"subject": "pi/pi-durable/carrier/runtime.js",
+			"find": ["\t\tlet storage                      = ticket.storageOpenAttempted ? \"unknown\" : \"never-opened\";"],
+			"replace": ["\t\tlet storage                      = ticket.storageOpenAttempted ? \"unknown\" : \"unknown\";"],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PDF-INIT-NEVER-OPENED-CLOSED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-INIT-ATTEMPTED-NOT-CLOSED",
+			"title": "the attempt is recorded only after the storage open resolves, so a rejected open reads as never attempted and ends closed",
+			"subject": "pi/pi-durable/carrier/runtime.js",
+			"find": [
+				"\t\tticket.storageOpenAttempted = true;",
+				"\t\tconst backend = await openNodeSqliteStorage(location.database);"
+			],
+			"replace": [
+				"\t\tconst backend = await openNodeSqliteStorage(location.database);",
+				"\t\tticket.storageOpenAttempted = true;"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PDF-INIT-ATTEMPTED-NOT-CLOSED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-FIRST-CLOSE-FAILURE-STICKY",
+			"title": "close() is no longer memoized: a second call runs the close again, releasing and recording a second time over the first failure",
+			"subject": "pi/pi-durable/carrier/runtime.js",
+			"find": ["\t\t\t\tclosing ??= (async () => {"],
+			"replace": ["\t\t\t\tclosing = (async () => {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PDF-FIRST-CLOSE-FAILURE-STICKY]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-CLOSE-FAIL-KEEPS-CLAIM",
+			"title": "the close-failed write is skipped: a failed close leaves the claim at storage-open under an owner that has released its lease",
+			"subject": "pi/pi-durable/carrier/runtime.js",
+			"find": ["\t\t\t\t\t\telse await ticket.closeFailed(record);"],
+			"replace": ["\t\t\t\t\t\telse void record;"],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PDF-CLOSE-FAIL-KEEPS-CLAIM]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-ENV-CLEANUP-SEPARATE",
+			"title": "an env cleanup failure is taken for a resource failure: a verified storage close and release is recorded as close-failed",
+			"subject": "pi/pi-durable/carrier/runtime.js",
+			"find": ["\t\t\t\t\t\tif (storage === \"closed\" && lease === \"released\") await ticket.closed(record);"],
+			"replace": [
+				"\t\t\t\t\t\tif (storage === \"closed\" && lease === \"released\" && envCleanup === undefined) await ticket.closed(record);"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PDF-ENV-CLEANUP-SEPARATE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-FENCE-REQUIRED",
+			"title": "a JS caller without a fence is no longer refused: the session root is created and the open fails later, unnamed",
+			"subject": "pi/pi-durable/carrier/runtime.js",
+			"find": ["\tif (options.fence === undefined) {"],
+			"replace": ["\tif (options.fence === null) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PDF-FENCE-REQUIRED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-TMP-COLLISION-NOT-OURS",
+			"title": "the failed write removes its temp path whether or not it created it, so a file already holding that name is deleted",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tif (created) fs.rmSync(tmp, { force: true });"],
+			"replace": ["\t\tfs.rmSync(tmp, { force: true });"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDF-TMP-COLLISION-NOT-OURS]",
+			"signatureSource": "pi-extensions/lib/pi-durable-owner-fence.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-INIT-HARNESS-OPEN-CLOSES-HANDLE",
+			"title": "an init failure closes only a Harness that opened, so the storage handle a rejecting Harness.open was handed is never closed and its close outcome never observed",
+			"subject": "pi/pi-durable/carrier/runtime.js",
+			"find": ["\t\tconst closable = harness ?? backendHandle;"],
+			"replace": ["\t\tconst closable = harness;"],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PDF-INIT-HARNESS-OPEN-CLOSES-HANDLE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PI-DURABLE-PREFLIGHT-OWNER-FENCE-UNIT",
+			"title": "the preflight stops asking for the compiled owner fence, so a package without the unit its bootstrap imports passes as ready and opens a window that cannot load",
+			"subject": "pi-extensions/lib/pi-durable-fresh-preflight.ts",
+			"find": ["\tif (!existsSync(layout.ownerFence)) return \"pi-durable-owner-fence-missing\";\n"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-PREFLIGHT-OWNER-FENCE-UNIT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-fresh-preflight.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDL-TMP-COLLISION-NOT-OURS",
+			"title": "a failed carrier write removes its tmp name whether or not it created it, so an entry already holding that name is deleted",
+			"subject": "pi-extensions/lib/pi-durable-location.ts",
+			"find": ["\t\t\tif (created) fs.rmSync(tmp, { force: true });"],
+			"replace": ["\t\t\tfs.rmSync(tmp, { force: true });"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDL-TMP-COLLISION-NOT-OURS]",
+			"signatureSource": "pi-extensions/lib/pi-durable-location.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-RAW-PROFILE-CAPTURED",
+			"title": "the open hands its fence the resolved spelling of the agent directory, so the claim records a normalized profile instead of the value its directory was joined from",
+			"subject": "pi/pi-durable/carrier/sessions.js",
+			"find": ["\treturn { cwd, root, profile: agentDir };"],
+			"replace": ["\treturn { cwd, root, profile: resolve(agentDir) };"],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PDR-RAW-PROFILE-CAPTURED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-V2-READER-STRICT",
+			"title": "the schema 2 reader compares the joined directory with itself, so a claim whose directory was not joined from its profile reads as valid",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": [
+				"\t\tif (joined !== directory) throw bad(\"selected.directory is not joined from selected.profile and selected.n\");"
+			],
+			"replace": [
+				"\t\tif (joined !== joined) throw bad(\"selected.directory is not joined from selected.profile and selected.n\");"
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-V2-READER-STRICT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-owner-fence.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-V1-UNATTRIBUTED",
+			"title": "the reserve guesses a schema 1 donor's profile from four dirnames of its directory, so the guess passes the P-rules and the named profile-unattributed refusal is lost; the writer then refuses the schema 1 selection as transition-invalid, so nothing is reserved either way",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\tconst recorded = selected.profile;"],
+			"replace": [
+				"\tconst recorded = selected.profile ?? path.dirname(path.dirname(path.dirname(path.dirname(selected.directory))));"
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-V1-UNATTRIBUTED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-ADOPT-BINDING-CHANGED",
+			"title": "the adoption compares the reservation's binding with itself, so a child adopts a reservation whose record was bound again after it was taken",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tif (record.attachIncarnation !== reservation.attachIncarnation) {"],
+			"replace": ["\t\tif (reservation.attachIncarnation !== reservation.attachIncarnation) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-ADOPT-BINDING-CHANGED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-ARM-BEFORE-SD",
+			"title": "the reserve runs its S_D decision and write before it takes the record-arm lock, so a busy arm refuses only after the claim was already rewritten",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": [
+				"\tconst arm = takeRecordArm(gardenId, roots);",
+				"\tlet reserved: PiDurableReservation;",
+				"\ttry {",
+				"\t\treserved = await reserveInPair(gardenId, roots, metaRoot, owner);"
+			],
+			"replace": [
+				"\tlet reserved: PiDurableReservation;",
+				"\treserved = await reserveInPair(gardenId, roots, metaRoot, owner);",
+				"\tconst arm = takeRecordArm(gardenId, roots);",
+				"\ttry {"
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-ARM-BEFORE-SD]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-ROW-ORDER",
+			"title": "the reserve judges the P-rules before the holder row, so a live holder is refused by a profile rule instead of as owner-live",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tif (claim.state !== \"closed\") requireHolderGone(claim, resource, owner.hostname);"],
+			"replace": [
+				"\t\trequireProfile(donorOf(claim), pair, resource);",
+				"\t\tif (claim.state !== \"closed\") requireHolderGone(claim, resource, owner.hostname);"
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-ROW-ORDER]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-HOST-BEFORE-LIVENESS",
+			"title": "the reserve probes a holder's pid on this host before its host, so another host's holder is refused by this host's liveness of a pid that is not its own",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\tconst verdict = otherHost ? \"other-host\" : holderVerdict(claim.owner);"],
+			"replace": [
+				"\tconst verdict = holderVerdict(claim.owner) === \"dead\" && otherHost ? \"other-host\" : holderVerdict(claim.owner);"
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-HOST-BEFORE-LIVENESS]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-DONOR-ATTRIBUTION",
+			"title": "the reserve attributes a dead reservation's donor to its current holder, so a parent's reservation is judged as if the parent had been the native owner",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tconst profile = requireProfile(donor, pair, resource);"],
+			"replace": ["\t\tconst profile = requireProfile({ ...donor, owner: claim.owner }, pair, resource);"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-DONOR-ATTRIBUTION]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-LEASE-SNAPSHOT",
+			"title": "the adoption reads the donor's own lease instead of the reservation's snapshot, so a lease that appeared after a reservation saw none is adopted when the donor once held one",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tif (reservation.nativeLease === \"absent\" && leasePresent(directory)) {"],
+			"replace": ["\t\tif (reservation.from.lease !== \"held\" && leasePresent(directory)) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-LEASE-SNAPSHOT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-LEASE-NO-LAUNDER",
+			"title": "a re-reserve retakes the snapshot from the donor's lease, so a lease that appeared after a reservation saw none is laundered into an attributed one",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\t\tif (before === \"absent\" && sidecar) {"],
+			"replace": ["\t\t\tif (!leaseAttributed(donor.lease) && sidecar) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-LEASE-NO-LAUNDER]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-LEASE-SIDECAR-SELECTION",
+			"title": "the reserve takes its lease snapshot beside the physical directory instead of the donor's selection, so under an alias it sees a lock nobody's SDK takes and misses the one it does",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tconst sidecar = leasePresent(donor.selected.directory);"],
+			"replace": ["\t\tconst sidecar = leasePresent(resource);"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-LEASE-SIDECAR-SELECTION]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-SNAPSHOT-ATTRIBUTION-READER",
+			"title": "the reader accepts a present-attributed snapshot for any donor, so a reservation attributes a lease to a donor that released it or never held one",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\tconst attributable = leaseAttributed(donor.lease);"],
+			"replace": ["\tconst attributable = true;"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-SNAPSHOT-ATTRIBUTION-READER]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-RESERVE-CLEAN-ONLY",
+			"title": "the clean test on a closed donor fires only for a storage failure no closed row can carry, so a closed row whose storage never opened is reserved as if it had closed clean",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tif (claim.state === \"closed\" && claim.end?.storage !== \"closed\") {"],
+			"replace": ["\t\tif (claim.state === \"closed\" && claim.end?.storage === \"failed\") {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-RESERVE-CLEAN-ONLY]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-RESERVED-ROW",
+			"title": "the reader refuses only a reservation on another state, so a reserved claim that carries no reservation reads as valid",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\tif ((claim.state === \"reserved\") !== (value.reservation !== undefined)) {"],
+			"replace": [
+				"\tif ((claim.state === \"reserved\") !== (value.reservation !== undefined) && value.reservation !== undefined) {"
+			],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-RESERVED-ROW]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-ADOPT-EXACT",
+			"title": "the adoption compares the claim's generation with itself, so a child adopts a reservation at a generation it was not launched for",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tif (claim.generation !== adoption.sourceGeneration) {"],
+			"replace": ["\t\tif (claim.generation !== claim.generation) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-ADOPT-EXACT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-ADOPT-NOT-RESERVED",
+			"title": "the adoption refuses only a missing claim, so a claim no longer reserved is not refused as adopt-not-reserved",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tif (claim === undefined || claim.state !== \"reserved\") {"],
+			"replace": ["\t\tif (claim === undefined) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-ADOPT-NOT-RESERVED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-WITHDRAW-PROJECTION",
+			"title": "the withdrawal restores the donor's row under the parent's owner, so a schema-valid claim names the withdrawing parent as the native owner it never was",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\t\towner: donor.owner,"],
+			"replace": ["\t\t\towner: claim.owner,"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-WITHDRAW-PROJECTION]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-WITHDRAW-OWN-GEN",
+			"title": "the withdrawal compares this owner with itself, so a process withdraws another owner's reservation",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tif (!sameOwner(claim.owner, owner)) {"],
+			"replace": ["\t\tif (!sameOwner(owner, owner)) {"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-WITHDRAW-OWN-GEN]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-ADOPTED-EVIDENCE-KEPT",
+			"title": "an adopted owner's next transition drops its adoptedFrom, so the adoption evidence is lost before the owner ends",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\t\t\t...(last.adoptedFrom === undefined ? {} : { adoptedFrom: last.adoptedFrom }),"],
+			"replace": ["\t\t\t\t...(last.adoptedFrom === undefined ? {} : {}),"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-ADOPTED-EVIDENCE-KEPT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-OBSERVATION-CLASSES",
+			"title": "an observation classifies a claim the strict reader refused as lost, so an unreadable claim is reported as a lost reservation instead of unobserved",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\t\treturn { class: \"unobserved\", reason: error.reason, detail: error.message };"],
+			"replace": ["\t\t\treturn { class: \"lost\" };"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-OBSERVATION-CLASSES]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-ADOPT-PATH-FRESH",
+			"title": "the adoption compares the reservation with the resource the pair named instead of its directory resolved in the hold, so an alias retargeted after the hold was entered is adopted",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\t\treal = fs.realpathSync(directory);"],
+			"replace": ["\t\t\treal = resource;"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-ADOPT-PATH-FRESH]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-ORDINARY-RESERVED-ATTRIBUTION",
+			"title": "an ordinary admission attributes a dead reservation's present-attributed snapshot to any spelling of D, so a lease beside another alias is taken over as the donor's",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": [
+				"\t\t\tsnapshot?.nativeLease === \"present-attributed\" && snapshot.from.selected.directory === directory;"
+			],
+			"replace": ["\t\t\tsnapshot?.nativeLease === \"present-attributed\";"],
+			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:PDR-ORDINARY-RESERVED-ATTRIBUTION]",
+			"signatureSource": "pi-extensions/lib/pi-durable-reservation.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-CONTEXT-CLOSED",
+			"title": "the adopt context's key test asks only for the four keys, so a context carrying any other key (a session, cwd, model, profile, prompt, module, env, nonce or callback) is decoded",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\t\tObject.keys(value).sort().join(\",\") !== ADOPT_KEYS.join(\",\")"],
+			"replace": ["\t\t!ADOPT_KEYS.every((key) => Object.hasOwn(value, key))"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PDR-CONTEXT-CLOSED]",
+			"signatureSource": "pi-extensions/meta-bridge-pi-durable.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-ADOPT-ROOTS",
+			"title": "the received-root check compares the mismatch count with itself, so an adoption opens under meta roots this process received from elsewhere",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\tif (mismatched.length > 0) {"],
+			"replace": ["\tif (mismatched.length > mismatched.length) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PDR-ADOPT-ROOTS]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-ADOPT-BEFORE-LEASE",
+			"title": "adopt mode hands the open the ordinary owner fence instead of the adoption's, so the reservation is read as a live parent's claim and the matching adoption never reaches its lease",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\tconst fence = adopt === undefined ? OWNER_FENCE : adopt.fence;"],
+			"replace": ["\tconst fence = adopt === undefined ? OWNER_FENCE : OWNER_FENCE;"],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PDR-ADOPT-BEFORE-LEASE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDF-CLOSE-RELEASES-PROVIDER-SOCKETS",
+			"title": "the owned close no longer releases the provider session resources, so a closed host keeps its Codex WebSocket and idle timer and stays alive after a normal close",
+			"subject": "pi/pi-durable/carrier/runtime.js",
+			"find": ["\t\t\t\t\t\t\tcleanupSessionResources();"],
+			"replace": ["\t\t\t\t\t\t\tvoid cleanupSessionResources;"],
+			"gate": ["bash", "run.sh", "check-pi-durable-carrier"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PDF-CLOSE-RELEASES-PROVIDER-SOCKETS]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "PDR-HOLDER-STATE-NAMED",
+			"title": "a reserve's live-holder refusal no longer names the refused claim's state, so a reservation's live parent cannot be told from a running native owner",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\tconst context = { holderState: claim.state };"],
+			"replace": ["\tconst context = {};"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PDR-HOLDER-STATE-NAMED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-release-failure.test.ts"
+		},
+		{
+			"claim": "PDR-RESERVE-TX-RELEASE-NAMES-WRITE",
+			"title": "the reserve forgets the reservation it wrote, so an S_D release failing after the write reads as a refusal that reserved nothing",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\twriteClaim(resource, body);", "\t\tcommitted = writtenOf(body);", "\t\treturn body;"],
+			"replace": ["\t\twriteClaim(resource, body);", "\t\treturn body;"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PDR-RESERVE-TX-RELEASE-NAMES-WRITE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-release-failure.test.ts"
+		},
+		{
+			"claim": "PDR-RESERVE-ARM-RELEASE-NAMES-WRITE",
+			"title": "a record-arm release failing after a clean reserve is thrown bare, without the reservation it left",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\t\tthrow afterWrite(failure, { resource, state: \"reserved\", generation, ownerPid: owner.pid });"],
+			"replace": ["\t\tthrow failure;"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PDR-RESERVE-ARM-RELEASE-NAMES-WRITE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-release-failure.test.ts"
+		},
+		{
+			"claim": "PDR-ARM-RELEASE-KEEPS-STEP-WRITE",
+			"title": "a record-arm failure wrapping an S_D failure keeps its words but drops the write that failure named",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": ["\tconst written = during instanceof PiDurableOwnerFenceError ? during.written : undefined;"],
+			"replace": ["\tconst written = undefined;"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PDR-ARM-RELEASE-KEEPS-STEP-WRITE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-release-failure.test.ts"
+		},
+		{
+			"claim": "PDR-WITHDRAW-TX-RELEASE-NAMES-WRITE",
+			"title": "the withdrawal forgets the donor row it restored, so an S_D release failing after it reads as a withdrawal that wrote nothing",
+			"subject": "pi-extensions/lib/pi-durable-owner-fence.ts",
+			"find": [
+				"\t\twriteClaim(resource, body);",
+				"\t\tcommitted = writtenOf(body);",
+				"\t}).catch((error: unknown) => {"
+			],
+			"replace": ["\t\twriteClaim(resource, body);", "\t}).catch((error: unknown) => {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:PDR-WITHDRAW-TX-RELEASE-NAMES-WRITE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-release-failure.test.ts"
 		}
 	]
 }