@junghanacs/entwurf 0.41.2 → 0.50.0

package/scripts/mutants/remote-pair-send.json

@@ -129,7 +129,7 @@
 		{
 			"claim": "REMOTE-ROUTE-RECEIPT-PATHS-OTHER-HOST",
 			"title": "the accepted receipt drops the note that its paths are on the other host, so the other host's messagePath reads as a file the sender could open",
-			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"subject": "ENTWURF.json",
 			"find": ["read/answer unknown until a reply arrives; paths below are on the other host)"],
 			"replace": ["read/answer unknown until a reply arrives)"],
 			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
@@ -141,6 +141,25 @@
 				"output": "mcp/entwurf-bridge/dist"
 			}
 		},
+		{
+			"claim": "REMOTE-DELIVERY-RESULT-CLAUSES-FROM-ROOT",
+			"title": "the accepted receipt reads a hand-kept copy of its clause, one byte off the Root text, instead of the Root lookup: it still names acceptance and still says its paths are on the other host, so only the byte comparison against Root can see the drift",
+			"subject": "pi-extensions/lib/remote-pair-send.ts",
+			"find": [
+				"\t\t\t\ttext: `entwurf_v2 remote ${via} → ${ENTWURF_DELIVERY_RESULT_CLAUSES[\"remote-accepted\"]}\\n${o.text}`,"
+			],
+			"replace": [
+				"\t\t\t\ttext: `entwurf_v2 remote ${via} → accepted by the other host (its  fact; read/answer unknown until a reply arrives; paths below are on the other host)\\n${o.text}`,"
+			],
+			"gate": ["bash", "run.sh", "check-remote-pair-beside"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:REMOTE-DELIVERY-RESULT-CLAUSES-FROM-ROOT]",
+			"signatureSource": "pi-extensions/lib/remote-pair-send.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
 		{
 			"claim": "REMOTE-PAIR-OPT-IN-ABSENT-IS-OFF",
 			"title": "an absent opt-in file throws instead of meaning off, so every local send on a host that never opted in fails",
@@ -176,7 +195,7 @@
 			"title": "an error the other host reports after a possible write is headed as a non-delivery, inviting a resend that would deliver twice",
 			"subject": "pi-extensions/lib/remote-pair-send.ts",
 			"find": [
-				"\t\t\t\ttext: `entwurf_v2 remote ${via} → the other host reported an error while processing; read its receipt below, delivery is not inferred from this line; not retried (paths below are on the other host)\\n${o.text}`,"
+				"\t\t\t\ttext: `entwurf_v2 remote ${via} → ${ENTWURF_DELIVERY_RESULT_CLAUSES[\"remote-reported-error\"]}\\n${o.text}`,"
 			],
 			"replace": [
 				"\t\t\t\ttext: `entwurf_v2 remote ${via} → the other host did not deliver (paths below are on the other host)\\n${o.text}`,"

package/scripts/mutants/self-address.json

@@ -7,19 +7,19 @@
 			"title": "entwurf_self reverts to an empty self-fetch guard + unconditional mailbox render (ordering-not-containment)",
 			"subject": "mcp/entwurf-bridge/src/index.ts",
 			"find": [
-				"\t\t\t\tif (rail === \"self-fetch\") {",
-				"\t\t\t\t\tconst mailboxPath = path.join(defaultMetaMailboxDir(), sender.sessionId);",
-				"\t\t\t\t\textra.mailboxPath = mailboxPath;",
-				"\t\t\t\t\tlines.push(`mailboxPath: ${mailboxPath}`);",
-				"\t\t\t\t} else if (rail === \"native-push\") {"
-			],
-			"replace": [
-				"\t\t\t\tif (rail === \"self-fetch\") {",
-				"\t\t\t\t}",
+				"\t\t\tif (rail === \"self-fetch\") {",
 				"\t\t\t\tconst mailboxPath = path.join(defaultMetaMailboxDir(), sender.sessionId);",
 				"\t\t\t\textra.mailboxPath = mailboxPath;",
 				"\t\t\t\tlines.push(`mailboxPath: ${mailboxPath}`);",
-				"\t\t\t\tif (rail === \"native-push\") {"
+				"\t\t\t} else if (rail === \"native-push\") {"
+			],
+			"replace": [
+				"\t\t\tif (rail === \"self-fetch\") {",
+				"\t\t\t}",
+				"\t\t\tconst mailboxPath = path.join(defaultMetaMailboxDir(), sender.sessionId);",
+				"\t\t\textra.mailboxPath = mailboxPath;",
+				"\t\t\tlines.push(`mailboxPath: ${mailboxPath}`);",
+				"\t\t\tif (rail === \"native-push\") {"
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-self-address"],
 			"timeoutSeconds": 60,

package/scripts/mutants/source-install.json

@@ -93,6 +93,41 @@
 			"timeoutSeconds": 300,
 			"signature": "[QK:SOURCE-MANIFEST-UNREADABLE-REFUSED]",
 			"signatureSource": "scripts/smoke-agy-install-state.sh"
+		},
+		{
+			"claim": "INSTALLED-DEVBIN-MUTATION-REFUSED",
+			"title": "the installed-package test never matches, so an installed root's dev-bin expose/remove again takes over a developer's links and state (#153, measured before the guard)",
+			"subject": "scripts/dev-bin.sh",
+			"find": ["    */node_modules/*)"],
+			"replace": ["    */node_modules/*/never-an-install/*)"],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 300,
+			"signatureSource": "scripts/smoke-agy-install-state.sh",
+			"signature": "[QK:INSTALLED-DEVBIN-MUTATION-REFUSED]"
+		},
+		{
+			"claim": "INSTALLED-DEVBIN-PUBLIC-STOPS",
+			"title": "the public expose-dev-bin ignores the helper's installed-package refusal and goes on to verify, exclusive and the package-manager queries",
+			"subject": "run.sh",
+			"find": ["  [ \"$rc\" -eq 4 ] && return 4"],
+			"replace": ["  : # the installed-package refusal no longer stops the wrapper"],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 300,
+			"signatureSource": "scripts/smoke-agy-install-state.sh",
+			"signature": "[QK:INSTALLED-DEVBIN-PUBLIC-STOPS]"
+		},
+		{
+			"claim": "SOURCE-DEVBIN-MOVED-CHECKOUT",
+			"title": "the moved-checkout rule is dropped while closing the installed path, so a developer's link no longer follows its own checkout to another one",
+			"subject": "scripts/dev-bin.sh",
+			"find": [
+				"    [ \"$(state_link \"$sf\")\" = \"$link\" ] && [ \"$cur\" = \"$(state_target \"$sf\")\" ] && return 0"
+			],
+			"replace": ["    :"],
+			"gate": ["bash", "run.sh", "smoke-agy-install-state"],
+			"timeoutSeconds": 300,
+			"signatureSource": "scripts/smoke-agy-install-state.sh",
+			"signature": "[QK:SOURCE-DEVBIN-MOVED-CHECKOUT]"
 		}
 	]
 }

package/scripts/mutants/v2-surface.json

@@ -5,13 +5,12 @@
 		{
 			"claim": "V2SURF-RESUME-HINT-SCOPE",
 			"title": "the dormant capability hint returns to a Pi-only automatic-resume invitation",
-			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\t\t\t\"Only on an explicit operator request, use entwurf_resume_call {target} for Pi or Claude Code; \" +",
-				"\t\t\t\t\"it submits no prompt. This capability hint is not permission to resume automatically.\""
+				"Only on an explicit operator request, use entwurf_resume_call {target} for Pi or Claude Code; it submits no prompt. This capability hint is not permission to resume automatically."
 			],
 			"replace": [
-				"\t\t\t\t\"Reopen the citizen with entwurf_resume_call {target} (pi targets only; it runs no turn), then dispatch again.\""
+				"Reopen the citizen with entwurf_resume_call {target} (pi targets only; it runs no turn), then dispatch again."
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
@@ -21,12 +20,11 @@
 		{
 			"claim": "V2SURF-MCP-LOCK-DOMAIN",
 			"title": "MCP long description reverts to the false \"socket paths take a per-target lock\" claim",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\t\"LOCK: taken for a control-socket-DOMAIN dispatch. The \" +",
-				"\t\t\"mailbox and native-push rails are lock-free — deliverability and the adapter probe guard them. mode \" +"
+				"LOCK: taken for a control-socket-DOMAIN dispatch. The mailbox and native-push rails are lock-free — deliverability and the adapter probe guard them. mode "
 			],
-			"replace": ["\t\t\"LOCK POLICY: socket paths take a per-target lock; the mailbox path does not. mode \" +"],
+			"replace": ["LOCK POLICY: socket paths take a per-target lock; the mailbox path does not. mode "],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-MCP-LOCK-DOMAIN]",
@@ -57,15 +55,9 @@
 		{
 			"claim": "V2SURF-MODE-SCOPE",
 			"title": "the bridge mode param (the one every caller reads, pi included since #125) reverts to \"Delivery mode for a live send\" (false for native-push) (#120 P2: the description was rewritten to stop claiming an interrupt, so the mutation now strips the rail scope from the corrected sentence)",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
-			"find": [
-				"\t\t\t\t\"Injection style for a CONTROL-SOCKET send only: steer (ask the receiver's steering queue) or follow_up (ask its follow-up queue). NEITHER is an interrupt: a busy receiver drains steering after each turn and follow-ups only when its inner loop ends, so a later steer overtakes every earlier follow_up and there is no order between the two. Both queues are volatile process memory — an abort drops what is in them. The receipt names which queue accepted the message (`queued-steer` / `queued-follow-up`); an idle receiver answers `sent`, meaning the turn was TRIGGERED, not that the model has seen the text. \" +",
-				"\t\t\t\t\t\"The mailbox and native-push plans carry no mode, so it has no effect on those rails.\","
-			],
-			"replace": [
-				"\t\t\t\t\"Delivery mode for a live send: steer (ask the steering queue) or follow_up (ask the follow-up queue). \" +",
-				"\t\t\t\t\t\"Both queues are volatile process memory.\","
-			],
+			"subject": "ENTWURF.json",
+			"find": ["Injection style for a CONTROL-SOCKET send only:"],
+			"replace": ["Delivery mode for a live send:"],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-MODE-SCOPE]",
@@ -74,19 +66,11 @@
 		{
 			"claim": "V2SURF-INBOX-SCOPE-HONESTY",
 			"title": "entwurf_inbox_read reverts to the false \"drains your own inbox\" access claim (SCOPE paragraph gone)",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\t\"doorbell is only a wake attempt, not a read. An empty inbox mutates nothing. \" +",
-				"\t\t\"SCOPE — read this literally: the garden id is CALLER-SUPPLIED and is NOT verified against \" +",
-				"\t\t\"your own identity (a host with no garden record of its own can call this too). So passing \" +",
-				"\t\t\"another citizen's garden id drains THEIR mail and stamps THEIR receipt, and they will never \" +",
-				"\t\t\"see those messages. Pass only the id from your own doorbell notice or your own meta-record; \" +",
-				"\t\t\"use entwurf_self if you need to confirm which id that is. \" +"
-			],
-			"replace": [
-				"\t\t\"doorbell is only a wake attempt, not a read. An empty inbox mutates nothing. \" +",
-				"\t\t\"This tool drains your own meta-bridge inbox and stamps the read receipt on your meta-record. \" +"
+				"SCOPE — read this literally: the garden id is CALLER-SUPPLIED and is NOT verified against your own identity"
 			],
+			"replace": ["This tool drains your own meta-bridge inbox and stamps the read receipt on your meta-record"],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-INBOX-SCOPE-HONESTY]",
@@ -95,15 +79,12 @@
 		{
 			"claim": "V2SURF-DORMANT-HONESTY",
 			"title": "MCP long description advertises owned-outcome as a selectable dormant verb again and drops the reason a dormant target actually returns",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\t\"DORMANT IS UNREACHABLE: a socket-domain citizen that is not running gets dormant-fire-forget-unsupported \" +",
-				"\t\t\"— same receiver rule as the mailbox, no active drainer means no delivery. \" +",
-				"\t\t\"The intent that used to answer there, owned-outcome, resumed it by launching a hidden background child \" +",
-				"\t\t\"and was withdrawn under the visible-first rule — re-open the session yourself, then dispatch again. \" +"
+				"A dormant socket rejects this delivery verb as dormant-fire-forget-unsupported. owned-outcome was withdrawn. Only on an explicit operator request, entwurf_resume_call may visibly reopen a proven-dormant Pi, pi-durable or Claude Code citizen under the same id, submitting no prompt; that lifecycle is separate from delivery. "
 			],
 			"replace": [
-				"\t\t\"owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY and is never auto-converted. \" +"
+				"owned-outcome wakes a DORMANT socket-domain citizen by spawn-bg resume ONLY and is never auto-converted. "
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
@@ -113,45 +94,35 @@
 		{
 			"claim": "V2SURF-INDETERMINATE-NO-START",
 			"title": "the indeterminate hint reverts to a socket that \"answered\" and drops the no-start facts — overclaiming a reply that a permission-refused or timed-out probe never got",
-			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\tcase \"indeterminate-no-spawn\":",
-				"\t\t\t// The socket probe did not settle, so liveness is UNKNOWN — an unestablished probe",
-				"\t\t\t// is not a measured death, and dispatching into it could double-deliver. Say",
-				"\t\t\t// \"the PROBE was inconclusive\", never \"the socket answered inconclusively\":",
-				"\t\t\t// `indeterminate` also covers a probe that got no answer at all, was refused by",
-				"\t\t\t// permissions, or timed out, and \"answered\" claims a reply that may never have",
-				"\t\t\t// existed. The wire id is FROZEN and still spells \"-no-spawn\"; it names the rule",
-				"\t\t\t// (never dispatch into an indeterminate target), not a capability that still",
-				"\t\t\t// exists. So the hint's job is to say plainly what did NOT happen: nothing",
-				"\t\t\t// delivered, nothing started.",
-				"\t\t\treturn (",
-				"\t\t\t\t\"the control-socket probe was inconclusive, so the target's liveness is UNKNOWN — this is not a \" +",
-				"\t\t\t\t\"measured death. NOTHING was delivered and NO process was started (the reason id keeps its frozen \" +",
-				"\t\t\t\t\"'-no-spawn' wire spelling from an era when one could be; entwurf_v2 starts nothing on any rail). \" +",
-				"\t\t\t\t\"Re-run entwurf_peers to re-probe; if it stays indeterminate, check for a stale socket file left at \" +",
-				"\t\t\t\t\"that garden id by a session that died without cleaning up.\"",
-				"\t\t\t);"
-			],
-			"replace": [
-				"\t\tcase \"indeterminate-no-spawn\":",
-				"\t\t\treturn \"the target's control socket answered inconclusively; retry.\";"
+				"the control-socket probe was inconclusive, so the target's liveness is UNKNOWN — this is not a measured death. NOTHING was delivered and NO process was started (the reason id keeps its frozen '-no-spawn' wire spelling from an era when one could be; entwurf_v2 starts nothing on any rail). Re-run entwurf_peers to re-probe; if it stays indeterminate, check for a stale socket file left at that garden id by a session that died without cleaning up."
 			],
+			"replace": ["the target's control socket answered inconclusively; retry."],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-INDETERMINATE-NO-START]",
 			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
 		},
+		{
+			"claim": "V2SURF-REJECT-HINTS-FROM-ROOT",
+			"title": "the surface stops returning the Root hint for one declared reason, so a native-push caller loses its next step while the Root text itself still looks perfect",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": ["\t\t\treturn ENTWURF_REJECT_HINTS[\"native-push-probe-indeterminate\"];"],
+			"replace": ["\t\t\treturn undefined;"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2SURF-REJECT-HINTS-FROM-ROOT]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
+		},
 		{
 			"claim": "V2SURF-PEERS-DEAD-ROW",
 			"title": "entwurf_peers drops the dead-row sentence, so a dormant citizen is listed with nothing saying it is unreachable",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\t\"row. A `dead` row is a REPORTED FACT and nothing more: that citizen is dormant and is \" +",
-				"\t\t\"currently unreachable by any verb, so listing it grants no action — appearing here is not \" +",
-				"\t\t\"an invitation to dispatch. In particular `unsupported` does NOT mean mailbox: it means this backend has no \" +"
+				"row. A `dead` socket row is a REPORTED FACT: no entwurf_v2 delivery is available while it is dormant. Listing it grants no action and is not an invitation to dispatch. Only on an explicit operator request, the separate entwurf_resume_call may visibly reopen a proven-dormant Pi, pi-durable or Claude Code citizen under the same id, submitting no prompt. In particular"
 			],
-			"replace": ["\t\t\"row. In particular `unsupported` does NOT mean mailbox: it means this backend has no \" +"],
+			"replace": ["row. In particular"],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2SURF-PEERS-DEAD-ROW]",
@@ -160,12 +131,12 @@
 		{
 			"claim": "V2SURF-DESC-FITS-HOST-CAP",
 			"title": "the v2 tool description grows back past the host's 2048-char cap — the INTENT contract is silently cut off before the model that must choose an intent ever reads it",
-			"subject": "mcp/entwurf-bridge/src/index.ts",
+			"subject": "ENTWURF.json",
 			"find": [
-				"\t\"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id \" +"
+				"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id "
 			],
 			"replace": [
-				"\t\"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +\n\t\t\"PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING \" +"
+				"CANONICAL DELIVERY SURFACE for garden ids: message, reply, or hand off to whoever an id names. The id PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING PADDING "
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
 			"timeoutSeconds": 60,
@@ -223,6 +194,21 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:NATIVE-PUSH-RETRY-BYTE-IDENTITY]",
 			"signatureSource": "pi-extensions/lib/entwurf-v2-native-push.test.ts"
+		},
+		{
+			"claim": "V2SURF-RECORD-LESS-SOCKET-HINT-FROM-ROOT",
+			"title": "the record-less-socket hint returns a hand-kept copy of its text, one byte off the Root segments, instead of composing them with the owner's command: every phrase the 2C cell checks still reads, so only the whole-string comparison against Root can see the drift",
+			"subject": "pi-extensions/lib/entwurf-v2-surface.ts",
+			"find": [
+				"\t\t\treturn `${hint.beforeFreshCutPrescription}${FRESH_CUT_PRESCRIPTION}${hint.afterFreshCutPrescription}`;"
+			],
+			"replace": [
+				"\t\t\treturn `a control socket exists at this garden id but NO meta-record claims it — the record is the sole address authority, so a bare socket is not an addressable citizen. If a pre-record-era resident owns that socket, restart it under the current runtime (session_start births its record); if the store predates the current generation, quiesce and archive it with ${FRESH_CUT_PRESCRIPTION}. A stale/forged socket should be  removed.`;"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-surface"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2SURF-RECORD-LESS-SOCKET-HINT-FROM-ROOT]",
+			"signatureSource": "scripts/check-entwurf-v2-surface.ts"
 		}
 	]
 }

package/scripts/mutants/v2-visible-resume.json

@@ -114,8 +114,8 @@
 			"claim": "V2RESUME-ARGV-FROM-RECORD",
 			"title": "the launcher is handed the caller's own directory instead of the record's, so the citizen returns in the wrong project",
 			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
-			"find": ["\t\tconst launched = deps.launch({ backend: \"pi\", cwd: identity.cwd, runtimeArgs });"],
-			"replace": ["\t\tconst launched = deps.launch({ backend: \"pi\", cwd: process.cwd(), runtimeArgs });"],
+			"find": ["\t\tconst launched = await deps.launch({ backend: \"pi\", cwd: identity.cwd, runtimeArgs });"],
+			"replace": ["\t\tconst launched = await deps.launch({ backend: \"pi\", cwd: process.cwd(), runtimeArgs });"],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-ARGV-FROM-RECORD]",
@@ -201,10 +201,10 @@
 			"title": "the backend is re-derived instead of taken from the typed error, which is the second read this rail refuses",
 			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
 			"find": [
-				"\t\t\t\t\t\t`${targetGardenId} is a ${err.backend} citizen; only pi and Claude Code citizens can be reopened ` +"
+				"\t\t\t\t\t\t`${targetGardenId} is a ${err.backend} citizen; only pi, pi-durable and Claude Code citizens can be reopened ` +"
 			],
 			"replace": [
-				"\t\t\t\t\t\t`${targetGardenId} is a citizen of another backend; only pi and Claude Code citizens can be reopened ` +"
+				"\t\t\t\t\t\t`${targetGardenId} is a citizen of another backend; only pi, pi-durable and Claude Code citizens can be reopened ` +"
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
@@ -338,10 +338,10 @@
 			"claim": "V2RESUME-PI-NEVER-READS-RECEIVER",
 			"title": "the pi path consults a Claude Code receiver marker, mixing the two backends' dormancy proofs",
 			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
-			"find": ["\t\tconst launched = deps.launch({ backend: \"pi\", cwd: identity.cwd, runtimeArgs });"],
+			"find": ["\t\tconst launched = await deps.launch({ backend: \"pi\", cwd: identity.cwd, runtimeArgs });"],
 			"replace": [
 				"\t\tdeps.inspectReceiver(targetGardenId);",
-				"\t\tconst launched = deps.launch({ backend: \"pi\", cwd: identity.cwd, runtimeArgs });"
+				"\t\tconst launched = await deps.launch({ backend: \"pi\", cwd: identity.cwd, runtimeArgs });"
 			],
 			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
 			"timeoutSeconds": 60,
@@ -491,6 +491,266 @@
 			"timeoutSeconds": 60,
 			"signature": "[QK:V2RESUME-CC-MARKER-BINDING-READ]",
 			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-REJECT-HINTS-FROM-ROOT",
+			"title": "one static rejection hint is re-authored as a code literal instead of the root ENTWURF.json text, so the reader stays exact while the rendered rejection no longer carries it",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\"target-locked\": ENTWURF_RESUME_REJECT_HINTS[\"target-locked\"],"],
+			"replace": ["\t\"target-locked\": \"another resume or dispatch holds this citizen's lock\","],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-REJECT-HINTS-FROM-ROOT]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-LAUNCH-AWAITED",
+			"title": "the pi launch stops being awaited, so a herdr launch that answers through a promise reads as a refusal with no reason while the tab it opened is on screen",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tconst launched = await deps.launch({ backend: \"pi\", cwd: identity.cwd, runtimeArgs });"],
+			"replace": [
+				"\t\tconst launched = deps.launch({ backend: \"pi\", cwd: identity.cwd, runtimeArgs }) as VisibleResumeLaunchOutcome;"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-LAUNCH-AWAITED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-HERDR-RENDER",
+			"title": "the herdr branch of the renderer is dropped, so a herdr launch is printed as a tmux window with undefined runtime, window and pane pid",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (h.rail === \"herdr\") return renderHerdrPiResume(result, h, actor);"],
+			"replace": [""],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-HERDR-RENDER]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-POST-CREATE-FAILURE-NAMED",
+			"title": "a launch failure after the tab create is folded into launch-refused, so the operator is told no window was opened over a tab that may be holding the citizen",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\treturn \"failure\" in launched"],
+			"replace": ["\treturn \"failureNever\" in launched"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-POST-CREATE-FAILURE-NAMED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-LAUNCH-FAILED-HEADER-HONEST",
+			"title": "the header of a tab create herdr declined by name claims the tab was created, sending the operator to look for a tab that never existed",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\t? \"entwurf_resume_call failed at the herdr tab create step\""],
+			"replace": ["\t\t\t? \"entwurf_resume_call failed after the herdr tab was created\""],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-LAUNCH-FAILED-HEADER-HONEST]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-JOIN-HANDLE-ONLY",
+			"title": "the guard that admits only a handle carrying the opened pane's direct child is disabled, so a herdr agent-start or pi-durable layout handle reaches the join with no pid and the wiring defect no longer fails by name",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (handle.rail !== \"tmux\" && handle.rail !== \"herdr-layout-claude\") {"],
+			"replace": ["\tif (handle.rail !== \"tmux\" && handle.rail !== \"herdr-layout-claude\" && false) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-JOIN-HANDLE-ONLY]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-PD-ADOPT-LAUNCH",
+			"title": "the adopt launch normalizes the reservation's raw profile, so the child's SDK reads another profile string than the one its reservation recorded and adopt row 5 refuses every resume",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\tPI_CODING_AGENT_DIR: reservation.profile,"],
+			"replace": ["\t\t\tPI_CODING_AGENT_DIR: path.resolve(reservation.profile),"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-PD-ADOPT-LAUNCH]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-PD-WITHDRAW-NONE-CREATED",
+			"title": "a launch failure whose recovery is none no longer withdraws, so a herdr decline that created nothing leaves the citizen reserved by a live bridge",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tconst noneCreated = !(\"failure\" in launched) || launched.failure.recovery.outcome === \"none\";"],
+			"replace": ["\t\tconst noneCreated = !(\"failure\" in launched);"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-PD-WITHDRAW-NONE-CREATED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-PD-KEEP-POSSIBLY-CREATED",
+			"title": "an unknown or orphaned launch outcome is read as none-created and the reservation is withdrawn while a child may still adopt it",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tconst noneCreated = !(\"failure\" in launched) || launched.failure.recovery.outcome === \"none\";"],
+			"replace": [
+				"\t\tconst noneCreated = !(\"failure\" in launched) || launched.failure.recovery.outcome !== \"closed\";"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-PD-KEEP-POSSIBLY-CREATED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-PD-THROW-KEEPS",
+			"title": "a launcher that threw withdraws the reservation, though a window may exist whose child can still adopt it",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": [
+				"\t\t\t`entwurf-v2-visible-resume: the pi-durable launch of ${targetGardenId} threw: ${messageOf(err)}${kept}`,"
+			],
+			"replace": [
+				"\t\t\t`entwurf-v2-visible-resume: the pi-durable launch of ${targetGardenId} threw: ${messageOf(err)}${await withdraw()}`,"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-PD-THROW-KEEPS]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-PD-WITHDRAW-FAILURE-REPORTED",
+			"title": "a failed withdrawal is silently retried, so the answer stops being the outcome of the one withdrawal this call made",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\tawait deps.withdrawPiDurable(reservation);"],
+			"replace": ["\t\t\tawait deps.withdrawPiDurable(reservation).catch(() => deps.withdrawPiDurable(reservation));"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-PD-WITHDRAW-FAILURE-REPORTED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-PD-RESERVE-LIVE-REFUSED",
+			"title": "a live holder's reserve refusal is no longer named target-live and surfaces as a raw fence error",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (err.reason === \"owner-live\") {"],
+			"replace": ["\tif (err.reason === \"withdraw-not-own\") {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-PD-RESERVE-LIVE-REFUSED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-PD-OBSERVE-BOUNDED-WAIT",
+			"title": "the adoption observation reads once and gives up, so a child that adopts a second later is reported not-yet-adopted",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": [
+				"\t\tif (deps.now() - started >= timeoutMs) return { kind: \"not-yet-adopted\", waitedMs: deps.now() - started };"
+			],
+			"replace": [
+				"\t\tif (deps.now() - started >= 0) return { kind: \"not-yet-adopted\", waitedMs: deps.now() - started };"
+			],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-PD-OBSERVE-BOUNDED-WAIT]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-PD-OBSERVE-CLASSES",
+			"title": "an unreadable D claim is reported as reservation-lost instead of unobserved with its cause",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": [
+				"\t\t\treturn { kind: \"unobserved\", reason: seen.reason, detail: seen.detail, waitedMs: deps.now() - started };"
+			],
+			"replace": ["\t\t\treturn { kind: \"reservation-lost\", waitedMs: deps.now() - started };"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-PD-OBSERVE-CLASSES]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-PD-RENDER",
+			"title": "the adopted receipt stops saying an adoption is not readiness, so it reads as the citizen being back",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["adoption of this reservation. That is not ` +"],
+			"replace": ["adoption of this reservation. That is ` +"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-PD-RENDER]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-PD-LAUNCH-FAILED-STEP",
+			"title": "a pi-durable layout.apply failure is rendered as the pi rail's tab create failure, sending the operator to a tab create step that never ran and to a control socket pi-durable does not have",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tconst layout = f.rail === \"herdr-layout\";"],
+			"replace": ["\tconst layout = false && f.rail === \"herdr-layout\";"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-PD-LAUNCH-FAILED-STEP]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-PD-RESERVED-HOLDER-NOT-ADDRESS",
+			"title": "a reservation's live parent is answered as a running holder, so the caller is pointed at a process entwurf_v2 cannot reach",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\tif (err.holderState === \"reserved\") {"],
+			"replace": ["\t\tif (err.holderState === \"closed\") {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-PD-RESERVED-HOLDER-NOT-ADDRESS]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-PD-RESERVE-WRITTEN-THEN-FAILED",
+			"title": "a reserve that wrote its reservation and then failed a lock release surfaces as a bare release error that names no reservation",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": [
+				"\t\t\tif (err.written !== undefined) throw new Error(piDurableReservedThenFailed(targetGardenId, err, err.written));"
+			],
+			"replace": ["\t\t\tvoid piDurableReservedThenFailed;"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-PD-RESERVE-WRITTEN-THEN-FAILED]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-PD-WITHDRAW-PARTIAL-STATE",
+			"title": "a withdrawal that wrote the donor's row and then left its transaction file is reported as if it had written nothing",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (err instanceof PiDurableOwnerFenceError && err.written !== undefined) {"],
+			"replace": ["\tif (err instanceof PiDurableOwnerFenceError && err.written === null) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-PD-WITHDRAW-PARTIAL-STATE]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-HERDR-JOIN",
+			"title": "the herdr Claude Code observation joins the marker owner to herdr's pane VIEW id instead of the pane's direct-child pid, so a real return is never seen",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": [
+				"\tconst panePid = handle.rail === \"tmux\" ? handle.panePid : (handle.paneChild as { pid: string }).pid;"
+			],
+			"replace": ["\tconst panePid = handle.rail === \"tmux\" ? handle.panePid : handle.herdrPaneId;"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-HERDR-JOIN]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-HERDR-PROCESS-UNREAD",
+			"title": "a herdr launch whose pane child herdr did not report goes on to wait for a marker joined to no pid, and ends as a quiet resume-unobserved instead of naming herdr's cause",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\tif (handle.rail === \"herdr-layout-claude\" && \"unread\" in handle.paneChild) {"],
+			"replace": ["\tif (handle.rail === \"herdr-layout-claude\" && \"unread\" in handle.paneChild && false) {"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-HERDR-PROCESS-UNREAD]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
+		},
+		{
+			"claim": "V2RESUME-CC-HERDR-RENDER",
+			"title": "the herdr Claude Code receipt drops the pane child pid it joined, so the operator cannot tell which process the observation was about",
+			"subject": "pi-extensions/lib/entwurf-v2-visible-resume.ts",
+			"find": ["\t\t\t`  child:    ${child}\\n` +"],
+			"replace": ["\t\t\t\"\" +"],
+			"gate": ["bash", "run.sh", "check-entwurf-v2-visible-resume"],
+			"timeoutSeconds": 60,
+			"signature": "[QK:V2RESUME-CC-HERDR-RENDER]",
+			"signatureSource": "pi-extensions/lib/entwurf-v2-visible-resume.test.ts"
 		}
 	]
 }

package/scripts/peer-facts.ts

@@ -84,7 +84,7 @@ const arg = process.argv[2];
 // A dash argv is a flag this command does not have, not a store directory — treating it as
 // a path would answer `--help` with "empty store, exit 0", a silent wrong fact.
 if (process.argv.length > 3 || (arg !== undefined && arg.startsWith("-"))) {
-	console.error("usage: entwurf peer-facts [meta-sessions-dir]");
+	console.error("peer-facts: see `entwurf help peer-facts` (from that checkout's root: `./run.sh help peer-facts`)");
 	process.exit(2);
 }