[systemfsoftware-maker]

Summary

A grader holding this repo to the cell-architecture pack now finds none of the four boundary escalations #321 and #322 left open on main, and stryker plan, the MCP rerun_mutant tool, the vitest runner and the e2e lane behave exactly as before. Plan: docs/plans/2026-10-13-1610-refactor-boundary-escalations-plan.md (supersedes 0941). The next unit, T2 (versioned runner/checker protocol), waits for this PR.

What changed

• plan-request.cell.ts:250-251 (pipeline-composition): planProject runs one module-level planStageCell (Cell.andThen + Cell.map pairing { prepared, done }) instead of two sequential Cell.provideContext(...).run calls.
• vitest-test-runner.ts:20 (refactor(repo): enforce cell-architecture layer placement and fix the six refused services #321 ledger): already fixed on main by refactor(repo): move driver-backed layers beside their services #322. At 117bff02 line 20 imported ./drivers/vitest-node.js; on b4db6d8e the import is ./vitest-node.js (:22) and git ls-tree -r origin/main -- packages | grep -c /src/drivers/ is 0. No vitest file changes here.
• Mcp/mcp-server.cell.ts:146 (service-and-layer-boundaries): runRestricted no longer builds or provides a layer. Mcp/rerun-stage.blueprint.ts acquires the run stage (RunEnvironment.layerStage + MachineConsole capture) inside runRestricted's Effect.scoped; Mcp/rerun-stage.handle.ts runs mutationTestCell against it. Effect.orDie stays outside the scope.
• MicroVM/TestTelemetry service modules (F8, F10): GuestJobsShape names no driver type (harness-owned GuestMount; one op requireCleanExit(step, cmd, mounts)); the job blueprint moves to the driver helper microsandbox-job.ts, used by microsandbox-guest-job.ts and warm-sandbox.handle.ts. harness-telemetry.service.ts (no Service) is now harness-telemetry.ts.

Evidence

Checks and review ran on ed3a6d2f (base b4db6d8e). The pushed head ef7e3b7b81 adds only a plain, conflict-free merge of main at efd19962 (#340, #328, #329, #316); none of those touch a file here, and the diff against main is line-for-line the reviewed diff (14 files, +442 -41).

• turbo run typecheck api:check lint lint:tsgo for stryker-js and stryker-e2e (package-filtered, not workspace-wide): 28/28 tasks. turbo run test --filter=@systemfsoftware/stryker-js: 21/21 tasks. dprint check clean.
• packages/stryker-js/etc/stryker-js.api.md unchanged. release.jsonc turbo.json gritlint.json flake.lock flake.nix .compound-engineering .github test/e2e-core unchanged vs main.
• Pinned gate (gritlint 0e2e07b3 built from the pin, cell-architecture enrolled in a scratch config outside the repo): main exit 0 (service-exports-no-layer: evaluated 45 file(s)); head exit 0 (evaluated 44 file(s); the rename removes one).
• AE greps on the head: no Layer.build/Cell.provideContext/Effect.provide( in runRestricted; no sequential stage runs in planProject; no microsandbox import in guest-job.service.ts; every test/e2e/src/Harness/*.service.ts declares a Service; no drivers/ import in vitest-test-runner.ts.
• Behaviour evidence: the existing public-surface suites carry the unchanged paths (plan.integration.test.ts byte-identical plan output, compile-error-reuse, plan-costs, plan-recorded-costs, plan-shard-reuse, plan-stream-location, plan-without-sandbox, mcp-server.integration.test.ts over the built stryker mcp). This refactor admits no failing-first test: nothing observable changes, and the one new property (stage scope exit) has no public surface reachable without a new in-process entry, which the Q1 ruling refused.
• KTD3 scope claim: a throwaway in-process probe registered an exit finalizer on the stage Scope and ran a passing and a failing cell through the old Effect.provide route and the new blueprint/handle; both closed the stage scope with success/failure respectively. Deleted (OP12).
• Stream D: its only open PR (feat(stryker-js-cli-contract): decode a whole machine stream with RunEventWireText #339) touches none of these files; plan 0900 moves only test/e2e-core files.

Review (ce-code-review, report-only, full path, base b4db6d8ed27e024646e8ee6f3a7dc863dd4ba8f6)

Lens	Served model (transcript)	Turns	Failed calls	Findings
correctness	openrouter/deepseek/deepseek-v4.1-flash	52	0	0
testing	openrouter/deepseek/deepseek-v4.1-flash	20	0	1
maintainability	openrouter/deepseek/deepseek-v4.1-flash	33	0	0
project-standards	openrouter/deepseek/deepseek-v4.1-flash	23	0	0
reliability	openrouter/deepseek/deepseek-v4.1-flash	18	0	0
api-contract	openrouter/deepseek/deepseek-v4.1-flash	21	0	0
adversarial	openrouter/deepseek/deepseek-v4.1-flash	45	0	0
agent-native	openrouter/deepseek/deepseek-v4.1-flash	34	0	0
learnings-cell	openrouter/deepseek/deepseek-v4.1-flash	24	0	0
learnings-testing	openrouter/deepseek/deepseek-v4.1-flash	69	0	0
learnings-topology	openrouter/deepseek/deepseek-v4.1-flash	19	0	0
adversarial-minimax	minimax-code/MiniMax-M3.1-Flash-Preview	7	0	1

Peer: omp -p --model minimax-code/MiniMax-M3.1-Flash-Preview --tools read,grep,glob (read-only), 8 tool calls. No Claude or Grok model served any pass.

#	Finding	Source	Disposition
1	P2 c75: MCP rerun scope change has no committed test for exit-sensitive cleanup	testing	Not accepted here. The suggested fix commits the in-process probe, which tests internal module wiring, not the public surface (OP12). Root's Q1 ruling: no new in-process entry; record the gap. The gap is listed below.
2	P2 c50 advisory: warm boot no longer reads GuestJobs, so a substituted GuestJobs stops covering warm boots	MiniMax peer	Intended (KTD5). Warm boot needs a live VM, not a job result, so it builds its blueprint through the driver helper in a driver module; no test substitutes GuestJobs.

Pack rule ledger (57 rules, 0 violate)

Rule	Verdict	Evidence
cell-architecture/callable-vs-resource-syntax	comply	packages/stryker-js/src/Mcp/rerun-stage.blueprint.ts:37 -- export const scoped = (spec: RerunStageSpec): Effect.Effect<RerunStageHandle, nev; packages/stryker-js/src/Mcp/rerun-stage.handle.ts:11 -- const RerunStageHandle = Handle.make<Record<never, never>, Context.Context<RunStageS
cell-architecture/handle-state-privacy	comply	packages/stryker-js/src/Mcp/rerun-stage.handle.ts:11 -- const RerunStageHandle = Handle.make<Record<never, never>, Context.Context<RunStageS; packages/stryker-js/src/Mcp/rerun-stage.handle.ts:38 -- Cell.provideContext(cell, RerunStageHandle.slot(handle)).run(input),
cell-architecture/pipeable-dual-parity	comply	packages/stryker-js/src/Mcp/rerun-stage.handle.ts:31 -- } = dual(; packages/stryker-js/src/Mcp/rerun-stage.handle.ts:38 -- Cell.provideContext(cell, RerunStageHandle.slot(handle)).run(input),
cell-architecture/pipeline-composition	comply	packages/stryker-js/src/plan-request.cell.ts:69 -- const planStageCell = Cell.andThen(; packages/stryker-js/src/plan-request.cell.ts:255 -- const { prepared, done } = yield* Cell.provideContext(planStageCell, context).run(stageI
cell-architecture/resource-vs-handle-duality	comply	packages/stryker-js/src/Mcp/rerun-stage.blueprint.ts:14 -- export const TypeId: unique symbol = Symbol.for('~systemfsoftware/stryker-js/Mcp/; packages/stryker-js/src/Mcp/rerun-stage.handle.ts:15 -- export const isRerunStageHandle = RerunStageHandle.is
cell-architecture/scoped-lifecycle-boundaries	comply	packages/stryker-js/src/Mcp/rerun-stage.blueprint.ts:23 -- const stage = yield* Layer.build(; packages/stryker-js/src/Mcp/mcp-server.cell.ts:142 -- return yield* Effect.scoped(
cell-architecture/service-and-layer-boundaries	comply	packages/stryker-js/src/Mcp/mcp-server.cell.ts:144 -- rerunStageScoped({ environment, events: queue }),; test/e2e/src/Harness/guest-job.service.ts:6 -- import type { ExitFailure, GuestJobFailure, GuestSignaledFailure } from './harness-failure.sc
cell-architecture/staged-lawful-builders	comply	packages/stryker-js/src/Mcp/rerun-stage.blueprint.ts:31 -- const RerunStages = Blueprint.make()(TypeId).steps({; packages/stryker-js/src/Mcp/rerun-stage.blueprint.ts:38 -- RerunStages.of(spec).scoped
boundary-testing/port-fakes-pass-the-port-contract	comply	test/e2e/src/Harness/guest-job.service.ts:13 -- export interface GuestJobsShape {; test/e2e/src/Harness/microsandbox-guest-job.ts:47 -- export const make: Effect.Effect = Effect.sync(() => ({ requireCleanExi
package-topology/import-time-inertness	comply	packages/stryker-js/src/plan-request.cell.ts:70 -- const planStageCell = Cell.andThen(; packages/stryker-js/src/Mcp/rerun-stage.blueprint.ts:32 -- const RerunStages = Blueprint.make()(TypeId).steps({
package-topology/surface-changes-are-versioned	comply	.changeset/quiet-stages-compose.md:2 -- "@systemfsoftware/stryker-js": none; packages/stryker-js/src/Mcp/mod.ts:1 -- export { mcpServerLayer, type McpServerOptions } from './mcp-server.cell.js'

Not applicable: learnings-cell: 7; learnings-testing: 19; learnings-topology: 20 — cell-architecture/decode-never-cast, cell-architecture/four-channel-contracts, cell-architecture/pure-decision-workflows, cell-architecture/sandwich-phase-order, cell-architecture/single-namespace-barrel, cell-architecture/store-serializable-unit-of-work, cell-architecture/store-unit-of-work-handle, boundary-testing/expected-values-never-come-from-the-subjects-output, boundary-testing/fake-and-real-store-laws, boundary-testing/no-mocks-on-internal-glue, boundary-testing/pin-dependency-semantics, boundary-testing/real-system-oracles, boundary-testing/staged-protocol-evidence, schema-laws/arbitrary-filter-floors, schema-laws/cross-field-invariants-as-struct-checks, schema-laws/data-only-schema-classes, schema-laws/invariants-as-refinements, schema-laws/law-failure-is-a-codec-defect, schema-laws/recursive-schema-suspend, schema-laws/refusals-beside-generated-laws, schema-laws/rich-type-over-foreign-encoded, schema-laws/tagged-unions-over-state-by-presence, schema-laws/tests-own-no-schemas, mutation-discipline/kill-survivors-with-contract-properties, mutation-discipline/suppress-by-shape-in-an-ignorer, mutation-discipline/unkillable-survivors-are-dead-code, package-topology/condition-branch-agreement, package-topology/declared-entry-points, package-topology/enumerated-entry-modules, package-topology/one-access-path, package-topology/public-signature-types, ci-wall-clock/failures-name-the-gate-and-location, ci-wall-clock/flake-outputs-build-once-on-main, ci-wall-clock/gates-share-one-job, ci-wall-clock/heavy-lanes-state-their-daily-minutes, ci-wall-clock/heavy-suites-judge-every-main-commit, ci-wall-clock/light-checks-run-the-pinned-tool, ci-wall-clock/local-gate-equals-pr-gate, ci-wall-clock/no-dev-shell-on-verdict-lanes, ci-wall-clock/no-lane-grades-the-repos-own-docs, ci-wall-clock/one-stuck-job-backstop, ci-wall-clock/pr-gate-runs-only-what-the-diff-affects, ci-wall-clock/red-main-reverts-its-culprit-same-day, ci-wall-clock/release-promotes-the-staging-proven-build, ci-wall-clock/setup-under-a-minute, turbo-task-graph/selection-and-caching-go-through-turbo.

Known gaps (recorded, not fixed)

• MCP exit-sensitive sandbox cleanup through the built stryker mcp: mcp-server.integration.test.ts:44 runs cleanTempDir: 'always'. Settled in process only (probe above).
• MCP stdout purity: the suite's reader skips non-JSON-RPC stdout lines (:215-220).
• F8/F10 run only on the postsubmit main e2e lane (typecheck and lint here).
• Out of scope per ruling, recorded as follow-ups: 16 other Service-less *.service.ts files; F7 (GuestJobFailure's MicroVM cause union); other F13 stage bindings (plan-request.cell.ts:253, Serve.cell.ts:166, run-request.cell.ts:159, audit-request.cell.ts:200); three unescalated binding sites (run/prepare.cell.ts:62, Serve/Serve.cell.ts:569, Reporter/reporter.service.ts:44,67).

Pre-push checks (OP13b)

Both failed for reasons outside the product: the stacked check needs gh stack init, which refuses because this branch's worktree is registered at a path the container cannot reach (repair was not authorized); the overlap check names other streams' PRs below. Neither reflects a defect in this change. The repository's own pre-push hook passed on the pushed head (tip contains main; single-plan: holds - 1 plan(s) added).

Overlap with other open PRs

#298 (Mcp/mcp-server.cell.ts), #296, #289, #287, #271 (plan-request.cell.ts; #271/#289 also fixture-cache.service.ts, warm-sandbox.handle.ts; #287 microsandbox-stryker-cli-runner.ts). Whichever lands second merges main.

CI

Running on ef7e3b7b81636434d1df75f2cbf963a2e1878779; this line is replaced with the run ids and conclusions when they finish.

[ryanleecode]

Root verdict on ef7e3b7: full path on ed3a6d2 with 11 lenses on DeepSeek V4.1 plus an adversarial peer on MiniMax M3.1, and no Claude or Grok. The 57-rule pack ledger has 0 violations. The pinned gritlint cell-architecture gate exits 0 on the head. Finding 1 was not accepted, per the root's no-in-process-entry ruling, and its gap is recorded. Finding 2 is intended (KTD5). The only commit after the review is the main merge ef7e3b7, which is conflict-free with an empty combined diff (git show --cc). It authors no line to review, and CI on that merged head is green. 0 threads, and no file overlaps the 4 main commits since then.