@junghanacs/entwurf 0.45.0 → 0.51.0

package/scripts/mutants/dev-gate-dispatch.json

@@ -0,0 +1,109 @@
+{
+	"schemaVersion": 1,
+	"lane": "dev-gate-dispatch",
+	"mutants": [
+		{
+			"claim": "BY-NAME-GATE-PREFIX",
+			"title": "the default arm drops its gate-prefix guard, so every function run.sh defines answers as a command by name — `entwurf usage` runs usage at rc 0, and the install writers are one spelling away",
+			"subject": "run.sh",
+			"find": ["    if [[ $cmd =~ ^(check|smoke)-[a-z0-9-]+$ ]] \\"],
+			"replace": ["    if true \\"],
+			"gate": ["bash", "run.sh", "check-install-surface"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BY-NAME-GATE-PREFIX]",
+			"signatureSource": "scripts/check-install-surface.ts"
+		},
+		{
+			"claim": "BY-NAME-GATE-DEFINED",
+			"title": "the default arm stops asking whether the gate function exists, so a misspelled gate dies as a bash command-not-found (rc 127) instead of the Unknown command it always was",
+			"subject": "run.sh",
+			"find": [
+				"      && gate_decl=$(shopt -s extdebug; declare -F \"$gate_fn\") \\\n      && [[ ${gate_decl#\"$gate_fn \"} =~ ^[1-9][0-9]*\\ (.*)$ ]] \\\n      && [ \"${BASH_REMATCH[1]}\" = \"${BASH_SOURCE[0]}\" ]; then"
+			],
+			"replace": ["      ; then"],
+			"gate": ["bash", "run.sh", "check-install-surface"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BY-NAME-GATE-DEFINED]",
+			"signatureSource": "scripts/check-install-surface.ts"
+		},
+		{
+			"claim": "BY-NAME-GATE-DEFINED-HERE",
+			"title": "the default arm admits any function bash can see, so an exported BASH_FUNC_check_* in the caller's environment becomes an entwurf command that run.sh never defined",
+			"subject": "run.sh",
+			"find": [
+				"      && [[ ${gate_decl#\"$gate_fn \"} =~ ^[1-9][0-9]*\\ (.*)$ ]] \\\n      && [ \"${BASH_REMATCH[1]}\" = \"${BASH_SOURCE[0]}\" ]; then"
+			],
+			"replace": ["      ; then"],
+			"gate": ["bash", "run.sh", "check-install-surface"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BY-NAME-GATE-DEFINED-HERE]",
+			"signatureSource": "scripts/check-install-surface.ts"
+		},
+		{
+			"claim": "BY-NAME-GATE-RUNS",
+			"title": "the admitted gate is never called: every by-name gate reports success with no output, and the whole dev floor goes green without running",
+			"subject": "run.sh",
+			"find": ["      \"$gate_fn\""],
+			"replace": ["      :"],
+			"gate": ["bash", "run.sh", "check-install-surface"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BY-NAME-GATE-RUNS]",
+			"signatureSource": "scripts/check-install-surface.ts"
+		},
+		{
+			"claim": "BY-NAME-GATE-NO-ARGV",
+			"title": "the by-name gate is handed run.sh's whole argv, its own name included, where the explicit arm it replaced called it with none",
+			"subject": "run.sh",
+			"find": ["      \"$gate_fn\""],
+			"replace": ["      \"$gate_fn\" \"$@\""],
+			"gate": ["bash", "run.sh", "check-install-surface"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BY-NAME-GATE-NO-ARGV]",
+			"signatureSource": "scripts/check-install-surface.ts"
+		},
+		{
+			"claim": "BY-NAME-GATE-STOPS",
+			"title": "the gate is called under `|| exit $?`, which reads like status propagation but switches errexit off inside it: a gate runs on past its first failure and returns the status of whatever ran last",
+			"subject": "run.sh",
+			"find": ["      \"$gate_fn\""],
+			"replace": ["      \"$gate_fn\" || exit $?"],
+			"gate": ["bash", "run.sh", "check-install-surface"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:BY-NAME-GATE-STOPS]",
+			"signatureSource": "scripts/check-install-surface.ts"
+		},
+		{
+			"claim": "DEV-GATE-BY-NAME-NOT-EMITTED",
+			"title": "a gate reached only by name is added to the bridge build include, and a case-label reader no longer sees it: the tarball ships a dev gate leaf while S4 stays green",
+			"subject": "mcp/entwurf-bridge/tsconfig.build.json",
+			"find": ["\t\t\"../../scripts/peer-facts.ts\","],
+			"replace": ["\t\t\"../../scripts/peer-facts.ts\",\n\t\t\"../../scripts/check-peer-facts.ts\","],
+			"gate": ["bash", "run.sh", "check-install-surface"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:DEV-GATE-BY-NAME-NOT-EMITTED]",
+			"signatureSource": "scripts/check-install-surface.ts"
+		},
+		{
+			"claim": "DEV-GATE-BY-NAME-READ",
+			"title": "the by-name reader narrows to check_ functions, so every smoke gate leaves S4's view and the bloat check passes on the rows it still sees",
+			"subject": "scripts/check-install-surface.ts",
+			"find": ["\tif (/^(?:check|smoke)_[a-z0-9_]+$/.test(fn) && !targets.has(cmd)) byNameGates.set(cmd, ts);"],
+			"replace": ["\tif (/^check_[a-z0-9_]+$/.test(fn) && !targets.has(cmd)) byNameGates.set(cmd, ts);"],
+			"gate": ["bash", "run.sh", "check-install-surface"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:DEV-GATE-BY-NAME-READ]",
+			"signatureSource": "scripts/check-install-surface.ts"
+		},
+		{
+			"claim": "DEV-GATE-BY-NAME-LEAVES",
+			"title": "the by-name reader keeps every gate name but drops the leaves they run, so the bloat check passes on empty rows and a gate leaf can ride into the tarball",
+			"subject": "scripts/check-install-surface.ts",
+			"find": ["\tif (/^(?:check|smoke)_[a-z0-9_]+$/.test(fn) && !targets.has(cmd)) byNameGates.set(cmd, ts);"],
+			"replace": ["\tif (/^(?:check|smoke)_[a-z0-9_]+$/.test(fn) && !targets.has(cmd)) byNameGates.set(cmd, []);"],
+			"gate": ["bash", "run.sh", "check-install-surface"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:DEV-GATE-BY-NAME-LEAVES]",
+			"signatureSource": "scripts/check-install-surface.ts"
+		}
+	]
+}

package/scripts/mutants/fresh-call-dispatch.json

@@ -67,8 +67,8 @@
 			"claim": "FCD-ONE-NONCE",
 			"title": "the rail mints its own second nonce, so the sibling calls back with a tag the caller never recorded",
 			"subject": "pi-extensions/lib/fresh-call-dispatch.ts",
-			"find": ["\t\treturn { rail: \"herdr\", result: await herdrFreshCall(request, run, env, nonce) };"],
-			"replace": ["\t\treturn { rail: \"herdr\", result: await herdrFreshCall(request, run, env, mintNonce()) };"],
+			"find": ["\t\treturn { rail: \"herdr\", result: await herdrFreshCall(herdrRequest, run, env, nonce) };"],
+			"replace": ["\t\treturn { rail: \"herdr\", result: await herdrFreshCall(herdrRequest, run, env, mintNonce()) };"],
 			"gate": ["bash", "run.sh", "check-fresh-call-dispatch"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:FCD-ONE-NONCE]",
@@ -186,6 +186,42 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:FCD-PROVIDER-OTHER-BACKENDS-UNJUDGED]",
 			"signatureSource": "pi-extensions/lib/fresh-call-dispatch.test.ts"
+		},
+		{
+			"claim": "FCD-RESUME-RAIL-SHARED",
+			"title": "the resume entry point reads the herdr marker loosely instead of through the shared exact predicate, so a process carrying HERDR_ENV=0 reopens its resume through a herdr launch",
+			"subject": "pi-extensions/lib/fresh-call-dispatch.ts",
+			"find": ["\tif (selectFreshCallRail(env) !== \"herdr\") return tmuxLaunch(input);"],
+			"replace": ["\tif (env.HERDR_ENV === undefined) return tmuxLaunch(input);"],
+			"gate": ["bash", "run.sh", "check-fresh-call-dispatch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FCD-RESUME-RAIL-SHARED]",
+			"signatureSource": "scripts/check-fresh-call-dispatch.ts"
+		},
+		{
+			"claim": "FCD-HERDR-PI-DURABLE-LAYOUT",
+			"title": "the root stops telling the herdr layout branch that the caller is a record-backed Codex citizen, so a Codex caller with no record cwd silently opens pi-durable in the bridge process's own directory",
+			"subject": "pi-extensions/lib/fresh-call-dispatch.ts",
+			"find": ["\t\t\tcallerIsCodex: request.callerNativeSessionId !== undefined,"],
+			"replace": ["\t\t\tcallerIsCodex: false,"],
+			"gate": ["bash", "run.sh", "check-fresh-call-dispatch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FCD-HERDR-PI-DURABLE-LAYOUT]",
+			"signatureSource": "scripts/check-fresh-call-dispatch.ts"
+		},
+		{
+			"claim": "FCD-HERDR-NO-THREAD-ID",
+			"title": "the herdr request carries the Codex thread id across the root again, so a tmux seat input reaches a rail that has no pane title to anchor it to and can start treating it as placement",
+			"subject": "pi-extensions/lib/fresh-call-dispatch.ts",
+			"find": ["\t\t\tcallerIsCodex: request.callerNativeSessionId !== undefined,"],
+			"replace": [
+				"\t\t\tcallerIsCodex: request.callerNativeSessionId !== undefined,",
+				"\t\t\tcallerNativeSessionId: request.callerNativeSessionId,"
+			],
+			"gate": ["bash", "run.sh", "check-fresh-call-dispatch"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:FCD-HERDR-NO-THREAD-ID]",
+			"signatureSource": "scripts/check-fresh-call-dispatch.ts"
 		}
 	]
 }

package/scripts/mutants/fresh-cut.json

@@ -38,6 +38,21 @@
 			"timeoutSeconds": 180,
 			"signature": "[QK:FRESHCUT-PREFLIGHT-CUT-DETECTED]",
 			"signatureSource": "scripts/check-fresh-cut-gate.sh"
+		},
+		{
+			"claim": "FRESHCUT-HELP-POINTER",
+			"title": "the leaf's --help and usage refusal point at another command's description, so an operator who followed them reads the wrong exit contract (#153)",
+			"subject": "scripts/meta-bridge-fresh-cut.ts",
+			"find": [
+				"\t\t\"meta-bridge-fresh-cut: see `entwurf help meta-bridge-fresh-cut` (from that checkout's root: `./run.sh help meta-bridge-fresh-cut`)\","
+			],
+			"replace": [
+				"\t\t\"meta-bridge-fresh-cut: see `entwurf help meta-bridge-prune` (from that checkout's root: `./run.sh help meta-bridge-prune`)\","
+			],
+			"gate": ["bash", "run.sh", "check-fresh-cut-gate"],
+			"timeoutSeconds": 180,
+			"signature": "[QK:FRESHCUT-HELP-POINTER]",
+			"signatureSource": "scripts/check-fresh-cut-gate.sh"
 		}
 	]
 }

package/scripts/mutants/herdr-activation.json

@@ -422,6 +422,134 @@
 			"timeoutSeconds": 300,
 			"signature": "[QK:DOCTOR-MODE-ADMISSION-CLAUSES]",
 			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "HAC-LEDGER-VERSION-ADMITTED",
+			"title": "a reader that admits only schema 2 refuses the floor ledger as uncertified, so the host's own current artifact can no longer read the ledger that keeps older artifacts out (#153)",
+			"subject": "scripts/herdr-activation.mjs",
+			"find": ["\tif (!ACTIVATION_SCHEMA_VERSIONS.includes(parsed.schemaVersion)) {"],
+			"replace": ["\tif (parsed.schemaVersion !== 2) {"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-LEDGER-VERSION-ADMITTED]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "HAC-LEDGER-WRITER-VERSION-CHECKED",
+			"title": "a writer that takes any version writes a ledger every reader refuses, turning a caller's typo into a host no verb can act on (#153)",
+			"subject": "scripts/herdr-activation.mjs",
+			"find": ["\tif (!ACTIVATION_SCHEMA_VERSIONS.includes(version)) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-LEDGER-WRITER-VERSION-CHECKED]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "HAC-LEDGER-WRITER-NO-EMBEDDED-VERSION",
+			"title": "an entry's own schemaVersion silently overrides the version the caller named, so a body copied from an old ledger lowers the floor without anyone asking (#153)",
+			"subject": "scripts/herdr-activation.mjs",
+			"find": ["\tif (Object.hasOwn(entry, \"schemaVersion\")) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-LEDGER-WRITER-NO-EMBEDDED-VERSION]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "HAC-LEDGER-VERSION-KEPT-BY-ACTIVATE",
+			"title": "activation rewrites every ledger at the fresh version, so one forward run over a floor host hands it back to the older readers the floor keeps out (#153)",
+			"subject": "scripts/herdr-plugin-activate.mjs",
+			"find": ["\tconst version = ledger?.schemaVersion ?? FRESH_ACTIVATION_SCHEMA_VERSION;"],
+			"replace": ["\tconst version = FRESH_ACTIVATION_SCHEMA_VERSION;"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-LEDGER-VERSION-KEPT-BY-ACTIVATE]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "HAC-LEDGER-VERSION-KEPT-BY-DEACTIVATE",
+			"title": "the teardown checkpoint lowers a floor ledger to 2, so a teardown stopped halfway can be resumed by an older reader that does not know the floor (#153)",
+			"subject": "scripts/herdr-plugin-deactivate.mjs",
+			"find": ["\t\t\tledger.schemaVersion,"],
+			"replace": ["\t\t\t2,"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-LEDGER-VERSION-KEPT-BY-DEACTIVATE]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "HAC-DEACTIVATE-LINK-FIRST",
+			"title": "the operator link is taken back after the components instead of before them, so a teardown stopped at a component leaves the link naming a runtime whose wiring is already half gone (#153)",
+			"subject": "scripts/herdr-plugin-deactivate.mjs",
+			"find": [
+				"\tif (operatorReceipt !== null) {",
+				"\t\tremoveOperatorLink(env, operatorReceipt);",
+				"\t\tdone.push(\"operator-link\");",
+				"\t}",
+				"\tfor (const step of steps) {",
+				"\t\tif (step === \"claude-code\" || step === \"pi\") {",
+				"\t\t\tconst verb = step === \"pi\" ? \"remove-user-scope\" : \"uninstall-meta-bridge\";",
+				"\t\t\tconst r = run(\"bash\", [path.join(PACKAGE_ROOT, \"run.sh\"), verb], env);",
+				"\t\t\tif (r.status !== 0) {",
+				"\t\t\t\tprocess.stderr.write(`${(r.stderr || r.stdout || \"\").trim()}\\n`);",
+				"\t\t\t\tfail(",
+				"\t\t\t\t\t\"deactivate-component-failed\",",
+				"\t\t\t\t\t`${step} inverse failed — runtime and ledger preserved as retry authority (${done.filter((s) => s === \"pi\" || s === \"claude-code\").length} component(s) already removed and recorded)`,",
+				"\t\t\t\t);",
+				"\t\t\t}",
+				"\t\t\tstates[step] = \"removed\";",
+				"\t\t\tcheckpoint();",
+				"\t\t\tdone.push(step);",
+				"\t\t} else if (step === \"runtime\") {"
+			],
+			"replace": [
+				"\tfor (const step of steps) {",
+				"\t\tif (step === \"claude-code\" || step === \"pi\") {",
+				"\t\t\tconst verb = step === \"pi\" ? \"remove-user-scope\" : \"uninstall-meta-bridge\";",
+				"\t\t\tconst r = run(\"bash\", [path.join(PACKAGE_ROOT, \"run.sh\"), verb], env);",
+				"\t\t\tif (r.status !== 0) {",
+				"\t\t\t\tprocess.stderr.write(`${(r.stderr || r.stdout || \"\").trim()}\\n`);",
+				"\t\t\t\tfail(",
+				"\t\t\t\t\t\"deactivate-component-failed\",",
+				"\t\t\t\t\t`${step} inverse failed — runtime and ledger preserved as retry authority (${done.filter((s) => s === \"pi\" || s === \"claude-code\").length} component(s) already removed and recorded)`,",
+				"\t\t\t\t);",
+				"\t\t\t}",
+				"\t\t\tstates[step] = \"removed\";",
+				"\t\t\tcheckpoint();",
+				"\t\t\tdone.push(step);",
+				"\t\t} else if (step === \"runtime\") {",
+				"\t\t\tif (operatorReceipt !== null) {",
+				"\t\t\t\tremoveOperatorLink(env, operatorReceipt);",
+				"\t\t\t\tdone.push(\"operator-link\");",
+				"\t\t\t}"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-DEACTIVATE-LINK-FIRST]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "HAC-DEACTIVATE-FOREIGN-LINK-REFUSES",
+			"title": "the deactivate preflight no longer judges the link, so a foreign link is found only by the removal after the ledger already moved to deactivating (#153)",
+			"subject": "scripts/herdr-operator-link.mjs",
+			"find": ["\tassessForRemoval(receipt);", "\treturn receipt;"],
+			"replace": ["\treturn receipt;"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-DEACTIVATE-FOREIGN-LINK-REFUSES]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "HAC-NO-LEDGER-OPERATOR-LEFTOVERS",
+			"title": "with no ledger an operator-link receipt is not named, so deactivate reports nothing to undo over a receipt and its link (#153)",
+			"subject": "scripts/herdr-plugin-deactivate.mjs",
+			"find": ["\t\tconst leftovers = [...leftoversAtPluginAddresses(runtime), ...operatorLinkLeftovers(env)];"],
+			"replace": ["\t\tconst leftovers = [...leftoversAtPluginAddresses(runtime)];"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-NO-LEDGER-OPERATOR-LEFTOVERS]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
 		}
 	]
 }

package/scripts/mutants/herdr-fresh-call.json

@@ -15,10 +15,10 @@
 		},
 		{
 			"claim": "HFC-PILOT-CLOSED",
-			"title": "a backend nobody measured on herdr is admitted to the pilot, so a caller gets a pane running something this rail never proved it can open (#116 A7: the tuple moved to the shared rails leaf, so the mutant follows its subject — widening the pilot set is still the mutation, it is simply written in one place now)",
+			"title": "a backend nobody measured on herdr is admitted to the agent-start set, so a caller gets a pane running something this rail never proved it can open (#116 A7: the tuple moved to the shared rails leaf; #157 A-L1 split it into the agent-start and layout sets, so the mutant follows the agent-start set that keys the herdr kind map — widening it is still the mutation)",
 			"subject": "scripts/herdr-rails.mjs",
-			"find": ["export const HERDR_FRESH_CALL_BACKENDS = Object.freeze([\"pi\", \"claude-code\"]);"],
-			"replace": ["export const HERDR_FRESH_CALL_BACKENDS = Object.freeze([\"pi\", \"claude-code\", \"codex\"]);"],
+			"find": ["export const HERDR_AGENT_START_BACKENDS = Object.freeze([\"pi\", \"claude-code\"]);"],
+			"replace": ["export const HERDR_AGENT_START_BACKENDS = Object.freeze([\"pi\", \"claude-code\", \"codex\"]);"],
 			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:HFC-PILOT-CLOSED]",
@@ -96,14 +96,25 @@
 			"signature": "[QK:HFC-FRAMING-CONTROL-REFUSED]",
 			"signatureSource": "scripts/check-herdr-fresh-call.ts"
 		},
+		{
+			"claim": "HFC-CODEX-CWD-NO-FALLBACK",
+			"title": "the shared cwd chooser lets a known Codex caller with no record cwd fall back to this process's directory, which is the app-server's, so an agent-start sibling opens somewhere the caller never was (#157 A-L1x)",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\t\t? { ok: false, reason: \"codex-caller-cwd-unavailable\" }"],
+			"replace": ["\t\t\t? { ok: true, cwd: input.callerProcessCwd(), source: \"caller-process\" }"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-CODEX-CWD-NO-FALLBACK]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
 		{
 			"claim": "HFC-PREMUTATION-ONLY",
 			"title": "a pre-mutation input refusal is dropped, so a call that should have refused instead splits a pane in the operator's workspace first",
 			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
 			"find": [
-				"\t\tconst badCwd = classifyHerdrCwd(cwd);\n\t\tif (badCwd !== null) return { ok: false, reason: badCwd };"
+				"\tconst badCwd = classifyHerdrCwd(chosenCwd.cwd);\n\tif (badCwd !== null) return { ok: false, reason: badCwd };"
 			],
-			"replace": ["\t\tvoid classifyHerdrCwd(cwd);"],
+			"replace": ["\tvoid classifyHerdrCwd(chosenCwd.cwd);"],
 			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
 			"timeoutSeconds": 120,
 			"signature": "[QK:HFC-PREMUTATION-ONLY]",
@@ -271,6 +282,19 @@
 			"signature": "[QK:HFC-CWD-EMPTY-IS-OMITTED]",
 			"signatureSource": "scripts/check-herdr-fresh-call.ts"
 		},
+		{
+			"claim": "HFC-CWD-CALLER-DEFAULT",
+			"title": "the agent-start tab create sends --cwd only for a requested directory again, so an omitted cwd opens the sibling in herdr's own default instead of where the caller is while the receipt still names the caller's directory (#157 A-L1x)",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\t\tworkspaceId: callerPane.workspaceId,\n\t\t\tcwd: chosenCwd.cwd,"],
+			"replace": [
+				"\t\t\tworkspaceId: callerPane.workspaceId,\n\t\t\t...(chosenCwd.source === \"requested\" ? { cwd: chosenCwd.cwd } : {}),"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HFC-CWD-CALLER-DEFAULT]",
+			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
 		{
 			"claim": "HFC-TAB-OCCUPIED",
 			"title": "a brand-new tab whose initial pane already holds an agent is started into anyway, landing beside somebody else's sibling",
@@ -454,6 +478,255 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:HFC-CALLBACK-ENV]",
 			"signatureSource": "scripts/check-herdr-fresh-call.ts"
+		},
+		{
+			"claim": "HLFC-SAME-ENDPOINT",
+			"title": "the caller-pane read is sent to a second endpoint instead of the one the layout write uses, so the workspace that names the new tab can come from a different herdr server answering with the same w1/p1 strings",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\tawait call(buildHerdrPaneGetPacket(readId, context.callerPaneId)),"],
+			"replace": [
+				"\t\tawait deps.socket(`${socketPath}.read`)(buildHerdrPaneGetPacket(readId, context.callerPaneId)),"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-SAME-ENDPOINT]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-READ-FAILURE-NO-WRITE",
+			"title": "a failed caller-pane read no longer stops the branch, so a layout write goes out with a workspace nobody read",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\tif (!read.ok) return { ok: false, reason: read.reason, reported: read.reported };"],
+			"replace": ["\tif (read.ok === undefined) return { ok: false, reason: read.reason, reported: read.reported };"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-READ-FAILURE-NO-WRITE]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-ENVELOPE-BEFORE-CERTAINTY",
+			"title": "a reply carrying BOTH a result and an error is read as its result arm, so a malformed envelope can be believed as a launch or a pre-create refusal",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\tif (hasResult === Object.hasOwn(parsed, \"error\")) return null;"],
+			"replace": ["\tif (!hasResult && !Object.hasOwn(parsed, \"error\")) return null;"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-ENVELOPE-BEFORE-CERTAINTY]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-NONE-CODES-ONLY",
+			"title": "layout_apply_failed joins the pre-create codes, so a request herdr may already have turned into a tab is reported as having created nothing",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\"invalid_env\","],
+			"replace": ["\t\"invalid_env\",", "\t\"layout_apply_failed\","],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-NONE-CODES-ONLY]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-POST-WRITE-UNKNOWN",
+			"title": "an I/O error after the connection existed is reported as none, so a layout request that may have reached herdr is said to have created nothing and its nonce is dropped",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": [
+				"\t\t\treturn layoutFailure(\"herdr-layout-transport-failed\", \"unknown\", {",
+				"\t\t\t\ttransport: boundHerdrDiagnostic(`io-failed: ${outcome.code}`),"
+			],
+			"replace": [
+				"\t\t\treturn layoutFailure(\"herdr-layout-transport-failed\", \"none\", {",
+				"\t\t\t\ttransport: boundHerdrDiagnostic(`io-failed: ${outcome.code}`),"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-POST-WRITE-UNKNOWN]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-SUCCESS-PROVES-LAUNCH",
+			"title": "the echoed argv is no longer compared, so a success reply describing some other command is accepted as this launch's receipt",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\t!sameArgv(root.command, expect.command)"],
+			"replace": ["\t\tfalse"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-SUCCESS-PROVES-LAUNCH]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-PAYLOAD-ROUNDTRIP",
+			"title": "the bootstrap payload is no longer escaped at its own layer, so a task carrying DEL or C1 cannot be launched faithfully and the call throws instead of opening the sibling",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\tconst payload = escapeRemainingControlChars(raw);"],
+			"replace": ["\tconst payload = raw;"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-PAYLOAD-ROUNDTRIP]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-CWD-NO-FALLBACK",
+			"title": "the layout branch drops the caller's Codex fact before choosing a start directory, so a pi-durable sibling for a Codex caller with no record cwd opens in this process's directory, which is the app-server's, and a Codex caller's record directory is passed over for it",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": [
+				"\tconst chosen = chooseHerdrLayoutCwd({\n\t\t...(requestedCwd === undefined ? {} : { requestedCwd }),\n\t\tcallerIsCodex: params.callerIsCodex === true,"
+			],
+			"replace": [
+				"\tconst chosen = chooseHerdrLayoutCwd({\n\t\t...(requestedCwd === undefined ? {} : { requestedCwd }),\n\t\tcallerIsCodex: false,"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-CWD-NO-FALLBACK]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-SOCKET-PATH-EXPLICIT",
+			"title": "a relative HERDR_SOCKET_PATH is accepted, so the endpoint becomes whatever that name resolves to in this process's directory",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\treturn typeof value === \"string\" && value.length > 0 && path.isAbsolute(value) ? value : null;"],
+			"replace": ["\treturn typeof value === \"string\" && value.length > 0 ? value : null;"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-SOCKET-PATH-EXPLICIT]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-PREFLIGHT-BEFORE-SOCKET",
+			"title": "the carrier/SDK verdict is no longer handed to the pi-durable preflight, so a drifted carrier or mismatched SDK set is launched into a herdr tab",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\truntime: packageLayout === null ? null : deps.runtimeVerdict(packageLayout),"],
+			"replace": ["\t\truntime: null,"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-PREFLIGHT-BEFORE-SOCKET]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-VERIFIED-LAUNCHER",
+			"title": "the package's run.sh is no longer checked as an executable regular file, so herdr is asked to exec a launcher that is missing, plain or a directory",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": [
+				"\tif (!isExecutableRegularFile(runtime)) return { ok: false, reason: \"pi-durable-launcher-missing\" };"
+			],
+			"replace": ["\tif (runtime === \"\") return { ok: false, reason: \"pi-durable-launcher-missing\" };"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-VERIFIED-LAUNCHER]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-SETS-AND-MAPS",
+			"title": "pi-durable is given a herdr agent kind, so a layout-launched backend could be started as herdr's pi program under its name",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["export const HERDR_AGENT_KIND: Record<HerdrAgentStartBackend, string> = {"],
+			"replace": ["export const HERDR_AGENT_KIND: Record<HerdrAgentStartBackend, string> = { \"pi-durable\": \"pi\","],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-SETS-AND-MAPS]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-RENDER-CERTAINTY",
+			"title": "every transport failure renders as the none text, so an operator is told nothing was created after a layout request that may have landed",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\tif (result.recovery.outcome === \"none\") {"],
+			"replace": [
+				"\tif (result.recovery.outcome === \"none\" || result.reason === \"herdr-layout-transport-failed\") {"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-RENDER-CERTAINTY]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-DIAGNOSTIC-BOUND",
+			"title": "the display cut is lifted, so a herdr-reported string of any length is copied whole into the operator's text",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["export const HERDR_DIAGNOSTIC_MAX_CHARS = 256;"],
+			"replace": ["export const HERDR_DIAGNOSTIC_MAX_CHARS = 4096;"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-DIAGNOSTIC-BOUND]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-TRANSPORT-FRAMING",
+			"title": "the reply decode leaf decodes chunk by chunk, so a multi-byte character split between reads is corrupted into replacement characters",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\treturn Buffer.concat(chunks).toString(\"utf8\");"],
+			"replace": ["\treturn chunks.map((chunk) => chunk.toString(\"utf8\")).join(\"\");"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-TRANSPORT-FRAMING]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-TRANSPORT-OVERSIZE",
+			"title": "the reply byte bound is effectively lifted, so an oversized reply is buffered until timeout instead of being refused at the bound",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\t\t\tif (lineBytes > bounds.maxReplyBytes) {"],
+			"replace": ["\t\t\t\tif (lineBytes > bounds.maxReplyBytes * 1000) {"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-TRANSPORT-OVERSIZE]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-TRANSPORT-EOF",
+			"title": "a close before the reply's newline is reported as a connect failure, so a request herdr received is said to have never been written",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\t\tsocket.on(\"close\", () => settle({ kind: \"eof-before-newline\" }));"],
+			"replace": ["\t\t\tsocket.on(\"close\", () => settle({ kind: \"connect-failed\", code: \"closed\" }));"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-TRANSPORT-EOF]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-TRANSPORT-CONNECT-FAIL",
+			"title": "a connection that never existed is reported as a post-connect I/O failure, so the one certain no-write outcome is lost",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\t\t\t\tsettle(connected ? { kind: \"io-failed\", code } : { kind: \"connect-failed\", code });"],
+			"replace": ["\t\t\t\tsettle({ kind: \"io-failed\", code });"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-TRANSPORT-CONNECT-FAIL]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-TRANSPORT-TIMEOUT",
+			"title": "a bound expiring after the connection exists is reported as a connect failure, so a request herdr may hold is said to have never been written",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": [
+				"\t\t\t\t() => settle(connected ? { kind: \"timeout\" } : { kind: \"connect-failed\", code: \"timeout-before-connect\" }),"
+			],
+			"replace": ["\t\t\t\t() => settle({ kind: \"connect-failed\", code: \"timeout-before-connect\" }),"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-TRANSPORT-TIMEOUT]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-PACKET-LITERAL",
+			"title": "the layout env drops the PI_SESSION_ID/PI_AGENT_ID scrub, so a pi-durable sibling started by herdr can inherit an identity carrier it does not own",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\tconst env: Record<string, string> = { PI_SESSION_ID: \"\", PI_AGENT_ID: \"\" };"],
+			"replace": ["\tconst env: Record<string, string> = {};"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-PACKET-LITERAL]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
+		},
+		{
+			"claim": "HLFC-READ-DIAGNOSTICS",
+			"title": "a failed caller-pane read drops herdr's reported cause, so the operator is refused without the transport outcome or herdr error that explains why",
+			"subject": "pi-extensions/lib/herdr-fresh-call.ts",
+			"find": ["\tif (!read.ok) return { ok: false, reason: read.reason, reported: read.reported };"],
+			"replace": ["\tif (!read.ok) return { ok: false, reason: read.reason, reported: {} };"],
+			"gate": ["bash", "run.sh", "check-herdr-fresh-call"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:HLFC-READ-DIAGNOSTICS]",
+			"signatureSource": "pi-extensions/lib/herdr-layout-fresh-call.test.ts"
 		}
 	]
 }