@junghanacs/entwurf 0.31.0 → 0.32.0

package/scripts/check-entwurf-bridge-pi-free.ts

@@ -1,10 +1,12 @@
 // check-entwurf-bridge-pi-free (0.12.1 A-gate, static half)
 //
-// INVARIANT: the entwurf-bridge MCP server must boot WITHOUT any pi package
-// (`@earendil-works/pi-*`). entwurf is a harness-neutral npm package; pi is one
-// optional adapter lane, not a boot dependency. A plain `npm install
-// @junghanacs/entwurf` (no pi peers) must still stand `entwurf-bridge` up and
-// answer MCP `tools/list`.
+// INVARIANT: the entwurf-bridge MCP server must boot WITHOUT importing any pi
+// package (`@earendil-works/pi-*`). entwurf is a harness-neutral npm package; pi is
+// one adapter lane, not a boot dependency. A plain `npm install @junghanacs/entwurf`
+// must still stand `entwurf-bridge` up and answer MCP `tools/list` without touching
+// pi. Since #130 that install carries the pi SDK as a production dependency (the
+// pi-durable carrier's), so the runtime half proves this under a deny hook in
+// check-pack-install rather than by the SDK's absence.
 //
 // This gate is the STATIC half of that contract: it walks the EAGER static
 // value-import closure of the bridge entry (`mcp/entwurf-bridge/src/index.ts`)

package/scripts/check-fresh-call-dispatch.ts

@@ -140,7 +140,7 @@ async function main(): Promise<void> {
 
 	// #129: pi-durable joined the tmux fresh set, NOT the herdr pilot set (GLG, 2026-10-06: no herdr
 	// pi-durable support in 0.31). Same axis as the codex cell: refused by the herdr reason, nothing
-	// spawned, no tmux fallback, and its operator-runtime preflight is never asked on this branch.
+	// spawned, no tmux fallback, and its installed-carrier preflight is never asked on this branch.
 	const durable = recordingSpawn();
 	const durableRefused = await dispatchFreshCall(
 		{ ...REQUEST, backend: "pi-durable", model: "loopback/scripted" },

package/scripts/check-gate-qualification.ts

@@ -66,9 +66,9 @@ import {
 	runGateBounded,
 	signatureAttributedToFailure,
 	signatureOnFailureLine,
-	sweepStaleSnapshots,
 	validateManifest,
 	validateManifestSet,
+	withOwnSnapshot,
 } from "./lib/mutation-qualify.ts";
 import { ACCEPTANCE_SCHEMA, checkAcceptanceRecord, RECORD_CONSISTENT } from "./lib/qualification-acceptance.ts";
 import {
@@ -637,6 +637,32 @@ function fixtureSpec(patch: Partial<MutantSpec>): MutantSpec {
 	};
 }
 
+/**
+ * A PRIOR run's snapshot root inside a self-test's private `tmpRoot`, in the exact shape the
+ * retired ambient sweep deleted (snapshot prefix, a `runner.json` naming a dead pid). It is
+ * that run's evidence: no qualification run may list it, let alone remove it. `state()`
+ * names every entry with its bytes, so a removal or a rewrite both read as a change.
+ */
+const PRIOR_RUN_ROOT = "entwurf-qualify-prior1";
+function seedPriorRunRoot(tmpRoot: string): { before: string; state: () => string } {
+	const dir = path.join(tmpRoot, PRIOR_RUN_ROOT);
+	fs.mkdirSync(dir);
+	fs.writeFileSync(path.join(dir, "runner.json"), JSON.stringify({ pid: 999_999_999, startedAt: 0 }));
+	fs.writeFileSync(path.join(dir, "evidence.log"), "a prior run's red evidence\n");
+	const state = (): string =>
+		fs.existsSync(dir)
+			? fs
+					.readdirSync(dir)
+					.sort()
+					.map((name) => `${name}\0${fs.readFileSync(path.join(dir, name), "utf8")}`)
+					.join("\n")
+			: "absent";
+	return { before: state(), state };
+}
+
+/** Each prior-root observation, asserted ONCE under its QK by Phase 1c-s (the token is exactly-once). */
+const priorRunKept: Record<string, boolean> = {};
+
 const quiet = (): void => {};
 
 {
@@ -897,21 +923,6 @@ const quiet = (): void => {};
 			ok(`pgroup: the GRANDCHILD (pid ${grandchild}) is dead after the group SIGKILL`, dead);
 			fs.rmSync(invocationDir, { recursive: true, force: true });
 		}
-
-		// Stale-snapshot sweep: dead-pid residue is reclaimed, a live runner's dir survives.
-		{
-			const tmpRoot = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualify-sweep-")));
-			const deadDir = path.join(tmpRoot, "entwurf-qualify-dead1");
-			fs.mkdirSync(deadDir);
-			fs.writeFileSync(path.join(deadDir, "runner.json"), JSON.stringify({ pid: 999_999_999, startedAt: 0 }));
-			const liveDir = path.join(tmpRoot, "entwurf-qualify-live1");
-			fs.mkdirSync(liveDir);
-			fs.writeFileSync(path.join(liveDir, "runner.json"), JSON.stringify({ pid: process.pid, startedAt: Date.now() }));
-			const swept = sweepStaleSnapshots(tmpRoot);
-			ok("sweep: a dead-pid snapshot dir is reclaimed", swept.includes(deadDir) && !fs.existsSync(deadDir));
-			ok("sweep: a live runner's snapshot dir survives", fs.existsSync(liveDir));
-			fs.rmSync(tmpRoot, { recursive: true, force: true });
-		}
 	} finally {
 		fs.rmSync(fixtureOrigin, { recursive: true, force: true });
 		fs.rmSync(path.dirname(externalTarget), { recursive: true, force: true });
@@ -1262,8 +1273,11 @@ function buildDeclaredOutputFixture(): string {
 				logError: quiet,
 				tmpRoot,
 			});
-		const snapshotsLeft = (): string[] => fs.readdirSync(tmpRoot).filter((f) => f.startsWith("entwurf-qualify-"));
+		// This run's own snapshots only: the seeded prior root is not this run's to reclaim.
+		const snapshotsLeft = (): string[] =>
+			fs.readdirSync(tmpRoot).filter((f) => f.startsWith("entwurf-qualify-") && f !== PRIOR_RUN_ROOT);
 		const readReceipt = (name: string) => JSON.parse(fs.readFileSync(out(name), "utf8"));
+		const prior = seedPriorRunRoot(tmpRoot);
 
 		const green = await runFx(["bash", "gates/kill.sh"], "green.json");
 		const gr = readReceipt("green.json");
@@ -1279,6 +1293,7 @@ function buildDeclaredOutputFixture(): string {
 				gr.receiptSha256 === green.receiptSha256,
 		);
 		ok("group run: the snapshot is reclaimed", snapshotsLeft().length === 0);
+		priorRunKept["group green"] = prior.state() === prior.before;
 
 		const red = await runFx(["bash", "gates/survive.sh"], "red.json");
 		const rr = readReceipt("red.json");
@@ -1286,6 +1301,7 @@ function buildDeclaredOutputFixture(): string {
 			"group run: a SURVIVED mutant is still written — red receipt, passed false",
 			red.passed === false && rr.result.passed === false && rr.result.mutants[0].verdict === "SURVIVED",
 		);
+		priorRunKept["group red"] = prior.state() === prior.before && snapshotsLeft().length === 0;
 
 		let refused = "";
 		try {
@@ -1405,6 +1421,7 @@ const refuseArgs = (argv: string[], naming: string): void =>
 		const receiptOf = (dir: string, file: string | null) =>
 			JSON.parse(fs.readFileSync(path.join(tmpRoot, dir, file ?? ""), "utf8"));
 
+		const prior = seedPriorRunRoot(tmpRoot);
 		const abc = await collect("abc", [sA, sB, sC]);
 		ok(
 			"[QK:COLLECT-RED-DOES-NOT-STOP] collect: green / red / green — the red middle does not stop the tail; collection COMPLETE and intact",
@@ -1430,8 +1447,9 @@ const refuseArgs = (argv: string[], naming: string): void =>
 			) &&
 				rB.result.control === "ok" &&
 				rB.result.mutants[0].verdict === "SURVIVED" &&
-				fs.readdirSync(tmpRoot).every((f) => !f.startsWith("entwurf-qualify-")),
+				fs.readdirSync(tmpRoot).every((f) => f === PRIOR_RUN_ROOT || !f.startsWith("entwurf-qualify-")),
 		);
+		priorRunKept["collect green/red/green"] = prior.state() === prior.before;
 		ok(
 			"collect: runId/runAttempt recorded exactly as the environment gave them; requested order kept",
 			abc.runId === "123" &&
@@ -1586,6 +1604,47 @@ const refuseArgs = (argv: string[], naming: string): void =>
 	}
 }
 
+// ═══ Phase 1c-s — every real run owns exactly its own snapshot (#130 r3) ═════
+//
+// The group (1c-g) and collection (1c-m) fixtures above seeded a prior run's root and
+// recorded whether it survived their green and red runs. That holds for real runs only while
+// every real run goes THROUGH the seam, so the production callers are read here too: the full
+// body and the group receipt each make their snapshot only via withOwnSnapshot, the collection
+// only via the group receipt, and the library exports no sweep and lists no tmp root. The
+// retired ambient sweep removed a protected prior snapshot during a release-gate run; the
+// fixtures cannot see a caller that bypasses the seam, this can. All four observations are
+// asserted once, under the claim's single token.
+
+{
+	const read = (rel: string): string => fs.readFileSync(path.join(REPO_DIR, rel), "utf8");
+	const qualifier = read("scripts/check-gate-qualification.ts");
+	// The LAST occurrence is the real header: this block's own needle sits above it.
+	const bodyAt = qualifier.lastIndexOf("// ═══ Phase 2m — several exact-argv groups");
+	const body = qualifier.slice(bodyAt);
+	const receipt = read("scripts/lib/qualification-receipt.ts");
+	const collection = read("scripts/lib/qualification-collection.ts");
+	const lib = read("scripts/lib/mutation-qualify.ts");
+	const libExports = Object.keys(await import("./lib/mutation-qualify.ts"));
+	priorRunKept.wiring =
+		bodyAt > qualifier.indexOf("// ═══ Phase 1c-s") &&
+		countOccurrences(body, "withOwnSnapshot(REPO_DIR, undefined,") === 1 &&
+		countOccurrences(body, "createRepoSnapshot(") === 0 &&
+		countOccurrences(receipt, "withOwnSnapshot(repoDir, opts.tmpRoot,") === 1 &&
+		countOccurrences(receipt, "createRepoSnapshot(") === 0 &&
+		countOccurrences(collection, "runGroupReceipt(") >= 1 &&
+		countOccurrences(collection, "createRepoSnapshot(") === 0 &&
+		countOccurrences(collection, "withOwnSnapshot(") === 0 &&
+		countOccurrences(lib, "createRepoSnapshot(") === 2 &&
+		countOccurrences(lib, "const snap = createRepoSnapshot(originDir, tmpRoot);") === 1 &&
+		countOccurrences(lib, "readdirSync(tmpRoot") === 0 &&
+		!libExports.some((name) => /sweep/i.test(name));
+	const failed = Object.keys(priorRunKept).filter((k) => !priorRunKept[k]);
+	ok(
+		`[QK:QUALIFY-PRIOR-RUN-EVIDENCE-KEPT] a prior run's dead-pid snapshot root keeps every name and byte through a green and a red group run and a green/red/green collection, each run's own snapshot is reclaimed, and the full body and group receipt snapshot only through withOwnSnapshot — failed: ${failed.join(", ") || "none"}`,
+		Object.keys(priorRunKept).length === 4 && failed.length === 0,
+	);
+}
+
 // ═══ Phase 1c-l — the composite ledger over REAL fixture receipts (#124 P2) ═
 //
 // A late failure, end to end: receipts are written by runGroupReceipt on a fixture
@@ -3342,16 +3401,16 @@ let manifestCount: number;
 		"copilot-birth": 19,
 		"copilot-launch": 14,
 		"pi-launch": 9,
-		"pi-floor": 1,
+		"pi-floor": 3,
 		"pi-bridge-sender": 4,
 		"pi-mcp-bridge": 2,
 		"pi-mcp-register": 3,
-		"pi-durable": 24,
+		"pi-durable": 47,
 		"copilot-receive": 20,
 		"entwurf-peers": 1,
 		"fresh-call-dispatch": 11,
 		"fresh-cut": 3,
-		"gate-qualification": 7,
+		"gate-qualification": 8,
 		"herdr-placement": 13,
 		"herdr-plugin": 25,
 		"herdr-plugin-profile": 14,
@@ -3503,7 +3562,6 @@ if (ARGS.mode === "compose") {
 if (ARGS.mode === "groups") {
 	const requested = ARGS.groups === "all" ? allGroupArgv(selected) : ARGS.groups;
 	checkRequestedGroups(requested, selected);
-	sweepStaleSnapshots(os.tmpdir());
 	const c = await collectGroups({
 		repoDir: REPO_DIR,
 		selected,
@@ -3532,7 +3590,6 @@ if (ARGS.mode === "groups") {
 // prints `[gate-qualification] ok` and never claims the full set.
 
 if (ARGS.mode === "group") {
-	sweepStaleSnapshots(os.tmpdir());
 	const { passed: groupPassed } = await runGroupReceipt({
 		repoDir: REPO_DIR,
 		selected,
@@ -3550,17 +3607,12 @@ if (ARGS.mode === "group") {
 	const headBefore = originHead(REPO_DIR);
 	const workSurfaceBefore = originWorkSurfaceSha(REPO_DIR);
 
-	sweepStaleSnapshots(os.tmpdir());
-	const snap = createRepoSnapshot(REPO_DIR);
-	console.log(
-		`[gate-qualification] snapshot: ${snap.repoDir} (${snap.fileCount} files, origin HEAD ${headBefore.slice(0, 12)})`,
-	);
-	let report: Awaited<ReturnType<typeof qualifyMutants>>;
-	try {
-		report = await qualifyMutants(snap, selected, (line) => console.log(line));
-	} finally {
-		fs.rmSync(snap.baseDir, { recursive: true, force: true });
-	}
+	const report = await withOwnSnapshot(REPO_DIR, undefined, (snap) => {
+		console.log(
+			`[gate-qualification] snapshot: ${snap.repoDir} (${snap.fileCount} files, origin HEAD ${headBefore.slice(0, 12)})`,
+		);
+		return qualifyMutants(snap, selected, (line) => console.log(line));
+	});
 
 	// Tripwire, not recovery: the runner never writes the origin, so any drift here is
 	// an outside writer racing the qualification — evidence cannot be attributed.

package/scripts/check-herdr-activation.ts

@@ -205,12 +205,13 @@ const {
 	COMPONENT_STATES,
 } = mod;
 
-/** The pi pin package.json declares — the SSOT `run.sh pi_supported_range` derives its range from. */
+/** The pi pin package.json declares (an exact production dependency since #130) — the SSOT
+ * `run.sh pi_supported_range` derives its range from. */
 const PI_PIN = (
 	JSON.parse(fs.readFileSync(path.join(REPO, "package.json"), "utf8")) as {
-		devDependencies: Record<string, string>;
+		dependencies: Record<string, string>;
 	}
-).devDependencies["@earendil-works/pi-coding-agent"];
+).dependencies["@earendil-works/pi-coding-agent"];
 
 /** A `pi` stand-in that reports `version` and nothing else — enough for a `--version` floor probe. */
 function fakePi(dir: string, name: string, version: string): string {
@@ -364,7 +365,7 @@ function ledgerWith(
 {
 	const env = world("pi-floor");
 	const bin = path.join(env.HOME as string, "bin");
-	// The supported range is DERIVED from the package.json devDep pin (run.sh
+	// The supported range is DERIVED from the package.json production dependency pin (run.sh
 	// `pi_supported_range`), so the fixtures are derived from it too — a hardcoded "0.85.1" here
 	// would silently stop being out-of-range the day the pin moves past it.
 	const [maj, min] = PI_PIN.split(".").map(Number);

package/scripts/check-pi-durable-contact.ts

@@ -3,7 +3,8 @@
  * CHECKOUT-ONLY dev gate: an installed package refuses it in `run_ts` before it reads an input.
  *
  * LABEL: adapter-direct, harness-bypassed. The durable app is opened through the production
- * bootstrap composition against a provisioned overlay checkout, the contact is born, and its
+ * bootstrap composition from THIS checkout's carrier (pi/pi-durable/carrier/, under its resolver,
+ * against the checkout's pinned pi SDK set — verified first), the contact is born, and its
  * registered tools are executed DIRECTLY in the host (scripts/pi-durable-contact-host.mjs). No
  * model turn, no ToolTask: this gate does NOT prove that the harness selects, validates or
  * replays these tools, that a model accepts their schema, or anything about send / delivery /
@@ -11,10 +12,9 @@
  * the contact's own `receiver()` state and the bridge's replyability verdict — never a doorbell, an
  * admission or a drain; those are check-pi-durable-receive's.
  *
- * Inputs, both required, neither provisioned here (missing → SKIP, never a pass):
- *   ENTWURF_PI_DURABLE_RUNTIME       an upstream checkout at pi/pi-durable/overlay's pin,
- *                                    with exactly the overlay patch applied, its deps installed
- *                                    and the pin's git-ignored model data in place
+ * Input, required, not provisioned here (missing → SKIP, never a pass). The durable app itself is
+ * no longer an input: it is this checkout's carrier, refused by name before anything spawns when it
+ * or the SDK set it resolves is not the pin (#130).
  *   ENTWURF_PI_DURABLE_BRIDGE_ENTRY  <bundle>/mcp/entwurf-bridge/src/index.js emitted from THIS
  *                                    checkout into a private bundle (a shared/installed bridge
  *                                    carries the old backend list and is refused as stale) — the
@@ -44,7 +44,7 @@
  * `malformed-report` makes the gate's host driver send a non-JSON report line, which arrives while
  * the gate is already waiting for it (the pending-line path of `Host.next`).
  */
-import { type ChildProcess, spawn, spawnSync } from "node:child_process";
+import { type ChildProcess, spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
@@ -52,16 +52,16 @@ import * as path from "node:path";
 import { createInterface } from "node:readline";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
-import {
-	inspectPiDurableRuntime,
-	PI_DURABLE_RESOLVER_RELATIVE,
-	readPiDurablePin,
-} from "../pi-extensions/lib/pi-durable-runtime.ts";
+import { checkPiDurableRuntime, piDurableLayoutAt } from "../pi-extensions/lib/pi-durable-runtime.ts";
 import { skipLive } from "./lib/live-skip.ts";
+import {
+	describeOperatorSnapshot,
+	operatorPiDurableSnapshot,
+	operatorSnapshotUnchanged,
+} from "./lib/pi-durable-operator-guard.ts";
 
 const LABEL = "check-pi-durable-contact";
 const REPO = path.resolve(import.meta.dirname, "..");
-const OVERLAY = path.join(REPO, "pi", "pi-durable", "overlay");
 const HOST_DRIVER = path.join(REPO, "scripts", "pi-durable-contact-host.mjs");
 const REPORT_TIMEOUT_MS = 90_000;
 const CLOSE_TIMEOUT_MS = 30_000;
@@ -74,17 +74,14 @@ if (FAULT !== undefined && FAULT !== "after-birth" && FAULT !== "malformed-repor
 	process.exit(2);
 }
 
-const runtimeInput = process.env.ENTWURF_PI_DURABLE_RUNTIME?.trim();
 const bridgeInput = process.env.ENTWURF_PI_DURABLE_BRIDGE_ENTRY?.trim();
-if (!runtimeInput || !bridgeInput) {
+if (!bridgeInput) {
 	skipLive(
 		LABEL,
-		"set ENTWURF_PI_DURABLE_RUNTIME=<overlay checkout at the pin, patch applied, deps and model data installed> and " +
-			"ENTWURF_PI_DURABLE_BRIDGE_ENTRY=<bridge index.js emitted from this checkout into a private bundle>; " +
-			"this gate provisions neither",
+		"set ENTWURF_PI_DURABLE_BRIDGE_ENTRY=<bridge index.js emitted from this checkout into a private bundle>; " +
+			"this gate does not provision it",
 	);
 }
-const runtime = path.resolve(runtimeInput);
 const bridgeEntry = path.resolve(bridgeInput);
 
 let passed = 0;
@@ -104,36 +101,18 @@ function fatal(message: string): never {
 	process.exit(1);
 }
 
-const sha256 = (data: string | Buffer): string => createHash("sha256").update(data).digest("hex");
-
 // ---------------------------------------------------------------------------
 // 0. Inputs. A provisioned-but-wrong input is broken, not absent: these FAIL, they do not skip.
 // ---------------------------------------------------------------------------
-// The pin and the runtime facts come from the ONE verifier the managed launch, setup and the fresh
-// preflight use (pi-extensions/lib/pi-durable-runtime.ts); this gate keeps its finer-grained QKs over
-// those facts and adds the reverse-apply check only it makes.
-const { pin, patchBytes } = readPiDurablePin(OVERLAY);
-const patchFile = path.join(OVERLAY, pin.patches[0] as string);
-const facts = inspectPiDurableRuntime(runtime, OVERLAY);
-const reverse = spawnSync("git", ["-C", runtime, "apply", "-R", "--check", patchFile]);
-console.log("0. inputs: tracked overlay, ignored model data, bridge bundle registry");
-ok(
-	`[QK:PDC-PIN] runtime HEAD is the overlay pin ${pin.commit} (got ${facts.head || "no answer"})`,
-	facts.gitAnswered && facts.head === pin.commit,
-);
-ok(
-	`[QK:PDC-TRACKED-OVERLAY-EXACT] the TRACKED tree is exactly pin + overlay patch and no non-ignored file is untracked (index ${facts.indexMatchesHead ? "==" : "!="} HEAD, diff ${facts.diffEqualsPatch ? "==" : "!="} patch ${sha256(patchBytes).slice(0, 12)}, untracked ${facts.untracked || "none"}) — git-ignored runtime inputs are outside this assertion`,
-	facts.gitAnswered && facts.indexMatchesHead && facts.diffEqualsPatch && facts.untracked === "",
-);
-ok("[QK:PDC-OVERLAY-REVERSE] the patch reverse-applies cleanly", reverse.status === 0);
+// The carrier and its SDK set are verified by the ONE verifier the managed launch, setup and the
+// fresh preflight use (pi-extensions/lib/pi-durable-runtime.ts), from this checkout's layout.
+const carrier = checkPiDurableRuntime(piDurableLayoutAt(REPO));
+console.log("0. inputs: the checkout carrier and its pi SDK set, bridge bundle registry");
 ok(
-	`[QK:PDC-MODEL-DATA-DIGEST] the git-ignored model data is the pin's recorded bytes (${facts.modelDataFiles} files, aggregate ${facts.modelDataAggregate.slice(0, 12)}, manifest ${facts.manifestSha256.slice(0, 12)})`,
-	facts.modelDataFiles === pin.modelData.files &&
-		facts.modelDataAggregate === pin.modelData.aggregateSha256 &&
-		facts.manifestSha256 === pin.modelData.manifestSha256,
+	`[QK:PDC-CARRIER-VERIFIED] this checkout's pi-durable carrier and the pi SDK set it resolves are the pin (${carrier.ok ? "verified" : `${carrier.reason}: ${carrier.detail}`})`,
+	carrier.ok,
 );
-const resolver = path.join(runtime, PI_DURABLE_RESOLVER_RELATIVE);
-ok("[QK:PDC-RESOLVER] the checkout carries the experimental source resolver", facts.resolverPresent);
+const resolver = carrier.ok ? carrier.resolver : "";
 const bundleRoot = path.resolve(bridgeEntry, "..", "..", "..", "..");
 const bundleRegistry = path.join(bundleRoot, "pi-extensions", "entwurf-capabilities.json");
 const repoRegistry = path.join(REPO, "pi", "entwurf-capabilities.json");
@@ -154,52 +133,14 @@ ok(
 	`[QK:PDC-BUNDLE-OWNER-JOIN] the bridge bundle's compiled owner join admits pi-durable-host (${joinLine || "not found"})`,
 	joinLine.includes('"pi-durable-host"'),
 );
-if (failed > 0)
-	fatal("inputs are not the pinned overlay, its model data, this checkout's registry and owner join — refusing to run");
+if (failed > 0) fatal("inputs are not the verified carrier, this checkout's registry and owner join — refusing to run");
 
 // ---------------------------------------------------------------------------
 // Operator guard — COARSE and pi-durable-specific: the operator's own roots gain no pi-durable
 // record, sender dir or durable session tree. Not a proof about any other operator byte.
 // ---------------------------------------------------------------------------
 const operatorAgent = path.join(os.homedir(), ".pi", "agent");
-function operatorPiDurableFacts(): string {
-	const sessions = path.join(operatorAgent, "meta-sessions");
-	const durableRecords = fs.existsSync(sessions)
-		? fs
-				.readdirSync(sessions)
-				.filter((n) => n.endsWith(".meta.json"))
-				.filter((n) => {
-					try {
-						return (
-							(JSON.parse(fs.readFileSync(path.join(sessions, n), "utf8")) as { backend?: unknown }).backend ===
-							"pi-durable"
-						);
-					} catch {
-						return false;
-					}
-				})
-		: [];
-	const senders = fs.existsSync(path.join(operatorAgent, "meta-senders", "pi-durable"));
-	const durableSessions = fs.existsSync(path.join(operatorAgent, "experimental", "durable-sessions"));
-	const receiversDir = path.join(operatorAgent, "meta-receivers");
-	const durableReceivers = fs.existsSync(receiversDir)
-		? fs
-				.readdirSync(receiversDir)
-				.filter((n) => n.endsWith(".json"))
-				.filter((n) => {
-					try {
-						return (
-							(JSON.parse(fs.readFileSync(path.join(receiversDir, n), "utf8")) as { backend?: unknown }).backend ===
-							"pi-durable"
-						);
-					} catch {
-						return false;
-					}
-				})
-		: [];
-	return JSON.stringify({ durableRecords, senders, durableSessions, durableReceivers });
-}
-const operatorBefore = operatorPiDurableFacts();
+const operatorBefore = operatorPiDurableSnapshot(operatorAgent);
 
 // ---------------------------------------------------------------------------
 // Sandbox: private root, env built from nothing, children at umask 022.
@@ -810,17 +751,9 @@ ok(
 	`[QK:PDC-OWNED-REAPED] every host this gate spawned and every bridge observed under it is gone (${ownedSummary || "none spawned"}; alive ${stillAlive.join(",") || "none"})`,
 	stillAlive.length === 0 && cleanupProblems.length === 0,
 );
-const before = JSON.parse(operatorBefore) as {
-	durableRecords: string[];
-	senders: boolean;
-	durableReceivers: string[];
-};
 ok(
-	`[QK:PDC-OPERATOR-UNTOUCHED] coarse pi-durable guard: the operator's own roots are unchanged by this run and hold no pi-durable record, sender dir or receiver marker (${operatorBefore})`,
-	operatorPiDurableFacts() === operatorBefore &&
-		before.durableRecords.length === 0 &&
-		!before.senders &&
-		before.durableReceivers.length === 0,
+	`[QK:PDC-OPERATOR-UNTOUCHED] coarse pi-durable registration guard: this run left the operator's pi-durable registrations exactly as it found them (${describeOperatorSnapshot(operatorBefore)} — same names, same bytes; existing state is not a red; no auth or session content read)`,
+	operatorSnapshotUnchanged(operatorBefore, operatorPiDurableSnapshot(operatorAgent)),
 );
 if (stillAlive.length > 0) console.log(`sandbox kept because owned processes are still alive: ${root}`);
 else if (process.env.ENTWURF_PI_DURABLE_KEEP === "1") console.log(`sandbox kept: ${root}`);

package/scripts/check-pi-durable-receive.ts

@@ -40,7 +40,8 @@
  * Intended single idle cell: controller input 0, doorbell admission 1, S requests 2, V 0.
  *
  * Inputs as check-pi-durable-contact (missing → SKIP 97, never a pass):
- *   ENTWURF_PI_DURABLE_RUNTIME, ENTWURF_PI_DURABLE_BRIDGE_ENTRY (a bundle carrying the owner join)
+ *   ENTWURF_PI_DURABLE_BRIDGE_ENTRY (a bundle carrying the owner join; the durable app is this
+ *   checkout's verified carrier, #130)
  * Optional:
  *   ENTWURF_PI_DURABLE_RECEIPTS  a NEW absolute directory (refused if it exists) for the cell's raw bytes.
  *
@@ -58,12 +59,13 @@ import { createInterface } from "node:readline";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { metaReceiverMarkerPath, upsertMetaSession, writeMetaSenderMarker } from "../pi-extensions/lib/meta-session.ts";
-import {
-	inspectPiDurableRuntime,
-	PI_DURABLE_RESOLVER_RELATIVE,
-	readPiDurablePin,
-} from "../pi-extensions/lib/pi-durable-runtime.ts";
+import { checkPiDurableRuntime, piDurableLayoutAt } from "../pi-extensions/lib/pi-durable-runtime.ts";
 import { skipLive } from "./lib/live-skip.ts";
+import {
+	describeOperatorSnapshot,
+	operatorPiDurableSnapshot,
+	operatorSnapshotUnchanged,
+} from "./lib/pi-durable-operator-guard.ts";
 import { ownedReapVerdict } from "./lib/pi-durable-reap.ts";
 import {
 	encodedRequestIdColumn,
@@ -75,7 +77,6 @@ import {
 const LABEL = "check-pi-durable-receive";
 const QK = "PRX";
 const REPO = path.resolve(import.meta.dirname, "..");
-const OVERLAY = path.join(REPO, "pi", "pi-durable", "overlay");
 const HOST_DRIVER = path.join(REPO, "scripts", "pi-durable-receive-host.mjs");
 const REPORT_TIMEOUT_MS = 120_000;
 /** Validity cutoff for request #1 after the ENQUEUE — a gap bound, never a success inference. */
@@ -85,17 +86,14 @@ const REAP_TIMEOUT_MS = 5_000;
 const CALL_ID = "call_prx_1";
 const FINAL_TEXT = "read.";
 
-const runtimeInput = process.env.ENTWURF_PI_DURABLE_RUNTIME?.trim();
 const bridgeInput = process.env.ENTWURF_PI_DURABLE_BRIDGE_ENTRY?.trim();
-if (!runtimeInput || !bridgeInput) {
+if (!bridgeInput) {
 	skipLive(
 		LABEL,
-		"set ENTWURF_PI_DURABLE_RUNTIME=<overlay checkout at the pin, patch applied, deps and model data installed> and " +
-			"ENTWURF_PI_DURABLE_BRIDGE_ENTRY=<bridge index.js emitted from this checkout into a private bundle>; " +
-			"this gate provisions neither",
+		"set ENTWURF_PI_DURABLE_BRIDGE_ENTRY=<bridge index.js emitted from this checkout into a private bundle>; " +
+			"this gate does not provision it",
 	);
 }
-const runtime = path.resolve(runtimeInput);
 const bridgeEntry = path.resolve(bridgeInput);
 const receiptsInput = process.env.ENTWURF_PI_DURABLE_RECEIPTS?.trim() || undefined;
 if (receiptsInput !== undefined) {
@@ -158,28 +156,19 @@ function messageText(content: unknown): string {
 }
 
 // ---------------------------------------------------------------------------
-// 0. Inputs — the pinned overlay, its model data, the bundle registry, and the bundle's owner join.
+// 0. Inputs — the verified checkout carrier, the bundle registry, and the bundle's owner join.
 // ---------------------------------------------------------------------------
-// The pin and the runtime facts come from the ONE verifier the managed launch, setup and the fresh
-// preflight use (pi-extensions/lib/pi-durable-runtime.ts).
-const { pin } = readPiDurablePin(OVERLAY);
-const facts = inspectPiDurableRuntime(runtime, OVERLAY);
-const resolver = path.join(runtime, PI_DURABLE_RESOLVER_RELATIVE);
+// The carrier and its SDK set are verified by the ONE verifier the managed launch, setup and the fresh
+// preflight use (pi-extensions/lib/pi-durable-runtime.ts), from this checkout's layout.
+const carrier = checkPiDurableRuntime(piDurableLayoutAt(REPO));
+const resolver = carrier.ok ? carrier.resolver : "";
 const bundleRoot = path.resolve(bridgeEntry, "..", "..", "..", "..");
 const bundleRegistry = path.join(bundleRoot, "pi-extensions", "entwurf-capabilities.json");
 const bundleDeliverability = path.join(bundleRoot, "pi-extensions", "lib", "entwurf-deliverability.js");
 console.log("0. inputs");
 ok(
-	`[QK:${QK}-INPUTS] runtime is the pin with exactly the tracked overlay (index == HEAD, nothing staged), the pin's ignored model data, the resolver, and a bridge bundle whose registry matches this checkout`,
-	facts.gitAnswered &&
-		facts.head === pin.commit &&
-		facts.indexMatchesHead &&
-		facts.diffEqualsPatch &&
-		facts.untracked === "" &&
-		facts.modelDataFiles === pin.modelData.files &&
-		facts.modelDataAggregate === pin.modelData.aggregateSha256 &&
-		facts.manifestSha256 === pin.modelData.manifestSha256 &&
-		facts.resolverPresent &&
+	`[QK:${QK}-INPUTS] this checkout's pi-durable carrier and the pi SDK set it resolves are the pin (${carrier.ok ? "verified" : `${carrier.reason}: ${carrier.detail}`}), and the bridge bundle's registry matches this checkout`,
+	carrier.ok &&
 		fs.existsSync(bridgeEntry) &&
 		fs.existsSync(bundleRegistry) &&
 		fs.readFileSync(bundleRegistry).equals(fs.readFileSync(path.join(REPO, "pi", "entwurf-capabilities.json"))),
@@ -192,33 +181,11 @@ ok(
 	`[QK:${QK}-BUNDLE-OWNER-JOIN] the bridge bundle's compiled owner join admits pi-durable-host (${joinLine || "not found"})`,
 	joinLine.includes('"pi-durable-host"'),
 );
-if (failed > 0) fatal("inputs are not the pinned overlay, its model data, this checkout's registry and owner join");
+if (failed > 0) fatal("inputs are not the verified carrier, this checkout's registry and owner join");
 
 // Coarse pi-durable-specific operator guard (as G-contact): no operator-byte claim beyond it.
 const operatorAgent = path.join(os.homedir(), ".pi", "agent");
-function operatorPiDurableFacts(): string {
-	const backendOf = (file: string): unknown => {
-		try {
-			return (JSON.parse(fs.readFileSync(file, "utf8")) as { backend?: unknown }).backend;
-		} catch {
-			return undefined;
-		}
-	};
-	const list = (dir: string, suffix: string) =>
-		fs.existsSync(dir)
-			? fs
-					.readdirSync(dir)
-					.filter((n) => n.endsWith(suffix))
-					.filter((n) => backendOf(path.join(dir, n)) === "pi-durable")
-			: [];
-	return JSON.stringify({
-		durableRecords: list(path.join(operatorAgent, "meta-sessions"), ".meta.json"),
-		senders: fs.existsSync(path.join(operatorAgent, "meta-senders", "pi-durable")),
-		durableReceivers: list(path.join(operatorAgent, "meta-receivers"), ".json"),
-		durableSessions: fs.existsSync(path.join(operatorAgent, "experimental", "durable-sessions")),
-	});
-}
-const operatorBefore = operatorPiDurableFacts();
+const operatorBefore = operatorPiDurableSnapshot(operatorAgent);
 
 // ---------------------------------------------------------------------------
 // Sandbox: one private world — HOME/XDG/agent, the four garden roots and ENTWURF_DIR.
@@ -1096,13 +1063,9 @@ if (receiptsInput !== undefined) {
 		ok(`[QK:${QK}-RECEIPTS-EXPORTED] receipt export failed: ${(error as Error).message}`, false);
 	}
 }
-const before = JSON.parse(operatorBefore) as { durableRecords: string[]; senders: boolean; durableReceivers: string[] };
 ok(
-	`[QK:${QK}-OPERATOR-UNTOUCHED] coarse pi-durable guard: the operator's own roots are unchanged by this run and hold no pi-durable record, sender dir or receiver marker (${operatorBefore})`,
-	operatorPiDurableFacts() === operatorBefore &&
-		before.durableRecords.length === 0 &&
-		!before.senders &&
-		before.durableReceivers.length === 0,
+	`[QK:${QK}-OPERATOR-UNTOUCHED] coarse pi-durable registration guard: this run left the operator's pi-durable registrations exactly as it found them (${describeOperatorSnapshot(operatorBefore)} — same names, same bytes; existing state is not a red; no auth or session content read)`,
+	operatorSnapshotUnchanged(operatorBefore, operatorPiDurableSnapshot(operatorAgent)),
 );
 if (alive.length > 0) console.log(`sandbox kept because owned processes are still alive: ${root}`);
 else if (process.env.ENTWURF_PI_DURABLE_KEEP === "1") console.log(`sandbox kept: ${root}`);