@junghanacs/entwurf 0.33.0 → 0.34.0

package/pi/pi-durable/overlay/runtime-contacts.patch

@@ -1,5 +1,5 @@
 diff --git a/packages/coding-agent/src/experimental/durable/runtime.ts b/packages/coding-agent/src/experimental/durable/runtime.ts
-index fcd6e523..929dbc79 100644
+index fcd6e523..7f00e27f 100644
 --- a/packages/coding-agent/src/experimental/durable/runtime.ts
 +++ b/packages/coding-agent/src/experimental/durable/runtime.ts
 @@ -8,7 +8,9 @@ import {
@@ -12,7 +12,19 @@ index fcd6e523..929dbc79 100644
  	type ModelRef,
  	ROOT_CONVERSATION_ID,
  	type Submission,
-@@ -81,6 +83,10 @@ export interface DurableController {
+@@ -56,8 +58,10 @@ export interface DurableView {
+ 	readonly conversations: readonly ConversationSummary[];
+ 	readonly models: readonly ModelSummary[];
+ 	readonly notices: readonly Notice[];
+-	/** The live task graph while the task panel is open. */
++	/** The live task graph, observed for the session's lifetime whether or not its panel is shown. */
+ 	readonly tasks?: TaskGraph;
++	/** Whether the task panel is shown; /tasks toggles only this. */
++	readonly tasksPanel: boolean;
+ }
+ 
+ export interface DurableViewSource {
+@@ -81,6 +85,10 @@ export interface DurableController {
  export interface OpenDurableOptions {
  	readonly cwd?: string;
  	readonly continueSession?: boolean;
@@ -23,7 +35,7 @@ index fcd6e523..929dbc79 100644
  }
  
  export interface OpenDurableResult {
-@@ -88,6 +94,8 @@ export interface OpenDurableResult {
+@@ -88,6 +96,8 @@ export interface OpenDurableResult {
  	readonly controller: DurableController;
  	/** pi's settings, for the TUI's theme and terminal capabilities. */
  	readonly settings: SettingsManager;
@@ -32,7 +44,7 @@ index fcd6e523..929dbc79 100644
  	close(): Promise<void>;
  }
  
-@@ -122,6 +130,9 @@ function titleOf(entry: EntryRecord | undefined): { title?: string } {
+@@ -122,6 +132,9 @@ function titleOf(entry: EntryRecord | undefined): { title?: string } {
  }
  
  export async function openDurable(options: OpenDurableOptions = {}): Promise<OpenDurableResult> {
@@ -42,7 +54,7 @@ index fcd6e523..929dbc79 100644
  	const location = await selectSession(options.cwd ?? process.cwd(), options.continueSession ?? false);
  	const envs = new ExecutionEnvs(location.cwd);
  	let harness: Harness | undefined;
-@@ -132,6 +143,7 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
+@@ -132,6 +145,7 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
  		const settings = createHarnessSettings(settingsManager);
  		const registry = createCodingRegistry(settingsManager, location.cwd);
  		registry.install(Subagent);
@@ -50,7 +62,7 @@ index fcd6e523..929dbc79 100644
  
  		const pendingReports: unknown[] = [];
  		let report: (error: unknown) => void = (error) => pendingReports.push(error);
-@@ -146,7 +158,29 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
+@@ -146,7 +160,29 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
  			},
  			context,
  		);
@@ -81,7 +93,49 @@ index fcd6e523..929dbc79 100644
  		const root = await harness.root(context, {
  			agent: {
  				cwd: location.cwd,
-@@ -342,6 +376,7 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
+@@ -179,6 +215,7 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
+ 			conversations: summaries,
+ 			models: models(),
+ 			notices: [],
++			tasksPanel: true,
+ 		};
+ 		const listeners = new Set<() => void>();
+ 		let notifying = false;
+@@ -296,17 +333,8 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
+ 					const thinking: ModelThinkingLevel = agentOf(state.conversation).thinkingLevel ?? "off";
+ 					await current.configure({ model: ref, thinkingLevel: clampThinkingLevel(model, thinking) }, context);
+ 				}),
+-			toggleTasks: () =>
+-				command(async () => {
+-					if (tasks !== undefined) {
+-						closeTasks();
+-						update({ tasks: undefined });
+-						return;
+-					}
+-					const graph = await opened.taskGraph(context);
+-					tasks = graph;
+-					unsubscribeTasks = graph.subscribe((value) => update({ tasks: value }));
+-				}),
++			// Only the panel: the graph stays observed, so live background work is never out of view.
++			toggleTasks: () => command(async () => update({ tasksPanel: !state.tasksPanel })),
+ 			switchConversation: (id) =>
+ 				command(async () => {
+ 					const next = await opened.conversation(id, context);
+@@ -326,8 +354,11 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
+ 			notice("warning", `Saved model is unavailable: ${saved.provider}/${saved.modelId}`);
+ 		}
+ 		if (initial?.fallbackMessage !== undefined) notice("info", initial.fallbackMessage);
+-		// The task panel starts open; /tasks hides it.
+-		await controller.toggleTasks();
++		// The task graph is observed until close; its panel starts open and /tasks hides it.
++		const graph = await opened.taskGraph(context);
++		tasks = graph;
++		update({ tasks: graph.value });
++		unsubscribeTasks = graph.subscribe((value) => update({ tasks: value }));
+ 		// Recovered work from an interrupted turn continues now.
+ 		harness.resume();
+ 
+@@ -342,6 +373,7 @@ export async function openDurable(options: OpenDurableOptions = {}): Promise<Ope
  			},
  			controller,
  			settings: settingsManager,
@@ -89,3 +143,141 @@ index fcd6e523..929dbc79 100644
  			close() {
  				closing ??= (async () => {
  					unsubscribe();
+diff --git a/packages/coding-agent/src/experimental/durable/tui.ts b/packages/coding-agent/src/experimental/durable/tui.ts
+index 397b276c..6a8fce8f 100644
+--- a/packages/coding-agent/src/experimental/durable/tui.ts
++++ b/packages/coding-agent/src/experimental/durable/tui.ts
+@@ -23,12 +23,14 @@ import {
+ 	SelectList,
+ 	type SelectListTheme,
+ 	Spacer,
++	type StackEntry,
+ 	setCapabilityOverrides,
+ 	setKeybindings,
+ 	Text,
+ 	TruncatedText,
+ 	TuiAltScreen,
+ 	VStack,
++	visibleWidth,
+ } from "@earendil-works/pi-tui";
+ import { getAgentDir } from "../../config.ts";
+ import { KeybindingsManager } from "../../core/keybindings.ts";
+@@ -150,10 +152,75 @@ interface Handlers {
+ 	cycleThinking(): void;
+ }
+ 
++/**
++ * The live background-task badge: the dock's first row, never shrunk, so live background work stays on
++ * screen however small the terminal gets. It counts the graph's background tasks whatever their kind and
++ * names the ones that are not running; with none it renders nothing and the dock is upstream's.
++ */
++export class TaskBadge implements Component {
++	#count = 0;
++	#detail = "";
++
++	get count(): number {
++		return this.#count;
++	}
++
++	set(graph: TaskGraph | undefined): void {
++		const nodes = Object.values(graph?.tasks ?? {}).filter((node) => node.background);
++		const tally = (state: string, match: (node: TaskGraphNode) => boolean): string[] => {
++			const n = nodes.filter(match).length;
++			return n === 0 ? [] : [`${n} ${state}`];
++		};
++		this.#count = nodes.length;
++		this.#detail = [
++			...tally("aborting", (node) => node.abortRequested),
++			...tally("completing", (node) => !node.abortRequested && node.state.status === "completing"),
++			...tally("waiting", (node) => !node.abortRequested && node.state.status === "waiting"),
++			...tally("pending", (node) => !node.abortRequested && node.state.status === "pending"),
++		].join(", ");
++	}
++
++	/** The widest form that fits, padded when there is room; narrower terminals drop detail, then words. */
++	render(width: number): string[] {
++		const n = this.#count;
++		if (n === 0) return [];
++		const tasks = `⏳ ${n} ${n === 1 ? "task" : "tasks"}`;
++		const detailed = this.#detail ? [`${tasks} (${this.#detail})`] : [];
++		const forms = [...detailed, tasks, `⏳ ${n}`, `⏳${n}`, `*${n}`, "*+", "*"];
++		for (const form of forms) {
++			if (visibleWidth(form) < width) return [theme.fg("accent", ` ${form}`)];
++			if (visibleWidth(form) === width) return [theme.fg("accent", form)];
++		}
++		return [theme.fg("accent", "*")];
++	}
++
++	invalidate(): void {}
++}
++
++/**
++ * The screen: the transcript above the dock. The badge is the dock's first row and never shrinks, so the
++ * renderer, which clips from the bottom, drops the editor and the footer before it; a one-row terminal
++ * with live background work shows the badge instead of the transcript.
++ */
++export function durableLayout(transcript: Component, badge: TaskBadge, dock: readonly StackEntry[]): VStack {
++	return new VStack([
++		{
++			component: transcript,
++			basis: 0,
++			grow: 1,
++			shrink: 1,
++			minSize: 1,
++			visible: (viewport) => badge.count === 0 || viewport.height > 1,
++		},
++		{ component: new VStack([{ component: badge, shrink: 0 }, ...dock]), basis: "auto", grow: 0, shrink: 1, minSize: 1 },
++	]);
++}
++
+ class DurableTui {
+ 	static readonly #renderers: Record<string, ToolRenderers> = createAllToolRenderers();
+ 	readonly #ui: TuiAltScreen;
+ 	readonly #chat = new Container();
++	readonly #taskBadge = new TaskBadge();
+ 	readonly #tasks = new Container();
+ 	readonly #queue = new Container();
+ 	readonly #notices = new Container();
+@@ -216,15 +283,9 @@ class DurableTui {
+ 		content.addChild(new Spacer(1));
+ 		const transcript = new ScrollView(content, { follow: "end", primary: true, overscroll: "chain" });
+ 		this.#transcript = transcript;
+-		const dock = new VStack([
+-			{ component: this.#tasks, shrink: 1, minSize: 0 },
+-			{ component: this.#queue, shrink: 1, minSize: 0 },
+-			{ component: this.#notices, shrink: 1, minSize: 0 },
+-			{ component: this.#editorContainer, shrink: 1, minSize: 3 },
+-			{ component: this.#footer, shrink: 1, minSize: 0 },
+-		]);
+ 		for (const component of [
+ 			this.#chat,
++			this.#taskBadge,
+ 			this.#tasks,
+ 			this.#queue,
+ 			this.#notices,
+@@ -234,9 +295,12 @@ class DurableTui {
+ 			this.#ui.addChild(component);
+ 		}
+ 		this.#ui.setLayoutRoot(
+-			new VStack([
+-				{ component: transcript, basis: 0, grow: 1, shrink: 1, minSize: 1 },
+-				{ component: dock, basis: "auto", grow: 0, shrink: 1, minSize: 1 },
++			durableLayout(transcript, this.#taskBadge, [
++				{ component: this.#tasks, shrink: 1, minSize: 0 },
++				{ component: this.#queue, shrink: 1, minSize: 0 },
++				{ component: this.#notices, shrink: 1, minSize: 0 },
++				{ component: this.#editorContainer, shrink: 1, minSize: 3 },
++				{ component: this.#footer, shrink: 1, minSize: 0 },
+ 			]),
+ 		);
+ 		this.#ui.setFocus(this.#editor);
+@@ -299,7 +363,8 @@ class DurableTui {
+ 				);
+ 			}
+ 		}
+-		this.#syncTasks(view.tasks);
++		this.#taskBadge.set(view.tasks);
++		this.#syncTasks(view.tasksPanel ? view.tasks : undefined);
+ 		this.#syncQueue((view.conversation.docs["pi.inbox"] ?? { items: [] }) as InboxState);
+ 		this.#syncNotices(view);
+ 		this.#editor.borderColor = theme.getThinkingBorderColor(agentOf(view.conversation).thinkingLevel ?? "off");

package/pi/pi-durable/overlay/upstream-pin.json

@@ -23,14 +23,14 @@
 				"source": "packages/coding-agent/src/experimental/durable/runtime.ts",
 				"patched": true,
 				"blob": "fcd6e5239e999ebf17dea0335fb3dc9cd7f7ce45",
-				"sha256": "ca0ee10dc904a57d46bb33b37fcc4efe48dfa08b2f0d10e79e7bc22136871f0a"
+				"sha256": "bfd88844fae61e8bd32d57b5b986f48056c64eebb5466d9826318a0783ac9005"
 			},
 			{
 				"name": "tui.js",
 				"source": "packages/coding-agent/src/experimental/durable/tui.ts",
-				"patched": false,
+				"patched": true,
 				"blob": "397b276cbeb1c90e1fbc96c3cc59e6a25f92dad7",
-				"sha256": "bef1ea4bd6e8ab150273752a9b94552d8ce672b518ba3d1ed1a209b8405be1b3"
+				"sha256": "f61cc68e5d32552a8196785093ae9e2f4a946088fe71582bb05690517db8c5b4"
 			},
 			{
 				"name": "harness-setup.js",

package/run.sh

@@ -134,7 +134,7 @@ Usage:
   ./run.sh check-omp-birth-hook       # #87 gate: drives the real OMP assembler into a temp dir, imports the ASSEMBLED index.ts into a MOCK omp host and fires session_start/session_switch. tui mints one backend:"omp" record + a sender marker keyed to the host's OWN pid (the one-process join) + the garden id on the status line; print/rpc/json mint NOTHING (hasUI is true on the rpc rows, as in the vendor); switch attaches on the same native id and mints the replacement on a new one; the CERTIFIED receiver reader still finds no marker. Also the four-root joint binding: extension and omp-labeled bridge child resolve the same sessions/mailbox/senders/receivers bundle against test-built literals (never the production resolver as its own oracle), under a poisoned PI_CODING_AGENT_DIR and under four distinct ENTWURF_META_* overrides; the override grammar is absolute-or-~ and both halves plus the doctor refuse anything else by name; and a drifted provenance label selects no root policy at all. Hermetic; no omp, no model turn
   ./run.sh check-pi-durable-contact   # #129 L-identity gate, CHECKOUT-ONLY (an installed package refuses it in run_ts). Opens the REAL durable app from THIS checkout's verified carrier (pi/pi-durable/carrier/ under its resolver, against the checkout's pinned pi SDK set — refused by name first) with the pi-durable contact, births the citizen and runs its tools adapter-direct through a privately emitted branch bridge (ENTWURF_PI_DURABLE_BRIDGE_ENTRY; its registry must match this checkout). Matrix roots {default, explicit} x {fresh, --continue}: one record keyed by the durable session dir, sender marker on the spawned host pid, exactly one bridge child whose /proc PPID is that host, poisoned identity carriers kept from it, its four root carriers bound to the roots written, the receiver ARMED (raw marker owned by the host pid + start key as pi-durable-host, joined to the sender marker; removed on close), self = the record and replyable, peers from an outside bridge, same garden id on reopen; the bundle's compiled owner join must admit pi-durable-host. Reaps only the host/bridges it owns on any failure. Harness-bypassed: no model turn, no ToolTask. Missing inputs → SKIP (97), never a pass
   ./run.sh check-pi-durable-send      # #129 L-send FIRST CELL, CHECKOUT-ONLY. Same input as check-pi-durable-contact. One native durable turn: the app's own controller input → GenerationTask → ToolTask → the contact's entwurf_v2 → the private bridge → a seeded self-fetch target (C2 recipe, owned by a separate idle child). S = a 127.0.0.1 scripted OpenAI-compatible endpoint configured through the app's documented models.json (dummy key, PI_OFFLINE); H = the native ToolTask path; V (a vendor turn) is NOT run. Oracles: the wire (tools offered, v2 schema = the bridge's tools/list, exactly two requests, the tool result + receipt in the second), the raw mailbox (.msg 1, signal, sender = the host record), the native view (one call, its settled result, root current). Not exactly-once, not recovery, not a recipient turn. Missing inputs → SKIP (97)
-  ./run.sh check-pi-durable-beside    # #129 mutant execution coordinate (VERIFY rule 3): run_vitest over the five pi-durable beside tests (adapter, carrier/SDK-set verifier, preflight, owner join, carrier relocation/resolver/emitter) — the pi-durable qualification lane's gate argv. Same files check-tests-beside-behavior already runs.
+  ./run.sh check-pi-durable-beside    # #129 mutant execution coordinate (VERIFY rule 3): run_vitest over the six pi-durable beside tests (adapter, carrier/SDK-set verifier, preflight, owner join, carrier relocation/resolver/emitter/task footer, native-module file and directory ingress) — the pi-durable qualification lane's gate argv. Same files check-tests-beside-behavior already runs.
   ./run.sh check-pi-durable-receive   # #129 L-receive FIRST CELL, CHECKOUT-ONLY. Same input (the bundle must carry the pi-durable-host owner join). The host driver gives the app NO input; a seeded claude-code sender (marker owned by a separate idle child, handed to a gate-owned sending bridge through ENTWURF_META_SENDER_MARKER) enqueues one message, the host's doorbell admits its notice to the ROOT conversation, and the scripted model drains it with entwurf_inbox_read. S withholds response #1 until the ENQUEUE receipt, the .delivered bytes, the signal, the host-owned receiver marker and the notice are captured. Oracles: receiver() admission, native view, raw archive (.delivered.read + lastReadAt), wire (exactly two requests, drain result = view), and after a green reap a forensic read-only SQLite copy (submission row by request id = reported id, root, input, done, placed entry = the notice). V NOT run. Missing inputs → SKIP (97)
   ./run.sh check-copilot-receive-arm  # #82 RAIL 5 gate: the REAL receiver installer + the REAL extension.mjs forked with a stubbed SDK. Arms only after birth, marker owned by the WATCHER pid, self-fetch dispatch answer, doorbell carries the garden id and NOT the body, id-drift/foreign-parent refusals. Hermetic; no Copilot, no model turn
   ./run.sh check-copilot-launch       # #82 RAIL 7 gate: the MANAGED launch `entwurf copilot`, driven through its public address against a FAKE VENDOR on a sandbox PATH. Receiver precondition refusals, EXTENSIONS token + operator token preservation, injected defaults before the `--` terminator, byte-identical argv, the 11 explicit permission/surface policy overrides that suppress `--yolo`, exec (not fork) pid identity, exit passthrough, recursion refusal. Hermetic; no Copilot, no model turn
@@ -208,7 +208,7 @@ Usage:
   ./run.sh smoke-entwurf-chain-live    # LIVE cross-harness delivery chain: native Claude Code -> pi GPT -> pi ACP Sonnet -> mailbox terminus, proving sender identity/replyable at every hop and a real read receipt at the end. Prerequisites (claude on PATH, pi credentials per backend) report protocol SKIP, never a pass
   ./run.sh check-release-gate-outcomes  # release-gate STEP OUTCOME protocol (P1): one skip exit code shared by the shell + TS halves, classifier never rounds a skip up to a pass, `--cut` refuses a MUST SKIP while a bare diagnostic stays exit 0, no LIVE smoke keeps the old exit-0 skip shape, and both real skip surfaces are INVOKED and observed to propagate the code
   ./run.sh check-gate-manifests         # the HEAD of that qualification, on its own: runner self-test + the committed manifests validated against the origin index + the declared lane inventory. Executes ZERO committed mutants (only the self-test's synthetic fixture mutants, in tmp fixture repos) and never snapshots this repo (~20s), which is why it lives in check:hermetic while the body stays on CI/release-gate — three of the five reds qualification ever produced in CI died right here, before a mutant gate ran (#99 B-3)
-  ./run.sh check-gate-qualification    # kill-proof qualification (the gate-of-gates): runner self-test (classifier truth table + synthetic negatives incl. wrong-reason/hang/control-red/impurity) + committed mutant manifests (scripts/mutants/*.json) run in an isolated snapshot repo under control→mutant→restore→control; the real checkout is never written. Evidence = claim IDs + killed mutant IDs, never assertion counts
+  ./run.sh check-gate-qualification    # kill-proof qualification (the gate-of-gates): runner self-test (classifier truth table + synthetic negatives incl. wrong-reason/hang/control-red/impurity) + committed mutant manifests (scripts/mutants/*.json) run in an isolated snapshot repo under control→mutant→restore→control; the real checkout is never written. Evidence = claim IDs + killed mutant IDs, never assertion counts. Bare = the whole body (the prepared SHA's CI call); `--group '<argv JSON>' --receipt <abs path outside the repo>` = one affected exact-argv group, a PARTIAL receipt (development's run, #133)
   ./run.sh check-probe-ordering        # §11-7 ordering-probe deterministic gate: raw-client SAMENESS pinned to backend.ts (sequence/args/timeouts/permission policy — the probe may never measure a lookalike), phase attribution incl. set-model, probe-mode fixture wire markers (delay honored, probeRunId REQUIRED, smoke-acp-mcp-live legacy compat), event-log door integrity (reserved keys refused at write; unknown marker name, broken sort axis, or a payload the classifier cannot judge on is MALFORMED, never a quiet event), and the §11-7 paired-verdict truth table (P0/I0 outside the space, phase-qualified D, B promotion ladder, C, A two-delay rule). Offline/deterministic; one product claim (no production prompt cutoff) is replant-qualified via scripts/mutants/probe-ordering.json, while the other assertions are direct [CHECK:*] contracts
   ./run.sh check-probe-cli-shim        # §11-7-c B-name-snapshot PRODUCER gate: the CLI shim driven as a REAL process against fake CLIs (no API, no cost). Proves what a defect would buy — FABRICATED evidence (a malformed init is never reported as an empty name set; the boot report carries the true target path+sha256 the classifier verifies against the roster), a DESTROYED turn (byte transparency across mid-UTF8/CRLF/oversized/unterminated framing, exit-code fidelity, signal re-raise, inbound signal forwarding, stderr passthrough, stdout backpressure), and LEAKED operator state (exact-allowlist env scrub, no argv/env/prompt body in the log). Offline/deterministic; 20 direct [CHECK:*] contracts, deliberately no longer replant-qualified after #70 subtraction
   ./run.sh smoke-agy-statusline-state # agy ambient garden-id statusLine install/doctor/inverse regression. Offline/deterministic
@@ -1520,8 +1520,8 @@ check_pi_durable_beside() {
   # from re-running every beside test. The six files are one contact: the adapter and its packaged
   # bootstrap, the installed carrier/SDK-set verifier (which also reads the three checkout gates as
   # SOURCE), the fresh preflight, the owner join that admits the durable host, the carrier's
-  # relocation grammar, resolver and maintainer emitter (#130), and the bootstrap's explicit
-  # --native-module ingress (#130 P2).
+  # relocation grammar, resolver and maintainer emitter (#130) with the carrier's task footer (#134),
+  # and the bootstrap's explicit --native-module ingress (#130 P2) and its --native-module-dir (#134).
   run_vitest pi-extensions/meta-bridge-pi-durable.test.ts pi-extensions/lib/pi-durable-runtime.test.ts pi-extensions/lib/pi-durable-fresh-preflight.test.ts pi-extensions/lib/entwurf-deliverability.owner-join.test.ts pi-extensions/lib/pi-durable-carrier.test.ts pi-extensions/lib/pi-durable-native-module.test.ts
 }
 
@@ -4025,8 +4025,8 @@ ORACLE
   # copied from this checkout into the sandbox — it never ships (test/ is outside the package files).
   # Its initialization appends `init` to the receipt this cell names; the same public launch must then
   # reach the same carrier model refusal, so the installed bootstrap loaded the module before the
-  # runtime and the native registry installed its extension (carrier/runtime.js 146) before that
-  # refusal (runtime.js 162). A module claiming an extension name the app installs itself is refused by
+  # runtime and the native registry installed its extension (carrier/runtime.js 148) before that
+  # refusal (runtime.js 164). A module claiming an extension name the app installs itself is refused by
   # name before anything opens: no durable session directory, no citizen, in a fresh sandbox home.
   # Native SDK file opens here are ordinary (the module runs in the native process); none is judged.
   local mod_dir="$box/pd-module" mod_home="$box/pd-module-home" mod_env=()
@@ -4048,6 +4048,32 @@ ORACLE
   fi
   echo "[check-pack-install] pi-durable native module: the installed bootstrap initialized one explicit module before the carrier's runtime (then the same model refusal), and refused a reserved extension name before anything opened"
 
+  # (c3) #134: the paired --native-module-dir on the INSTALLED package. One named directory holding the
+  # same synthetic module under a matching name beside a helper and a dotfile that would throw if
+  # opened: the installed bootstrap must read only the top-level *.extension.mjs, initialize it once
+  # (one `init` receipt) and reach the same carrier model refusal. A directory without a matching
+  # module is refused by name before anything opens: no durable session directory, no citizen.
+  local dir_mods="$box/pd-module-dir" dir_empty="$box/pd-module-dir-empty" dir_home="$box/pd-module-dir-home" dir_env=()
+  mkdir -p "$dir_mods" "$dir_empty" "$dir_home/.pi/agent"
+  cp "$REPO_DIR/test/fixtures/pi-durable-native-module/mock.mjs" "$dir_mods/10-mock.extension.mjs"
+  printf 'throw new Error("pack-install: helper opened");\n' > "$dir_mods/helper.mjs"
+  printf 'throw new Error("pack-install: dotfile opened");\n' > "$dir_mods/.hidden.extension.mjs"
+  cp "$dir_mods/helper.mjs" "$dir_empty/index.mjs"
+  rc=0; out=$(cd "$launch_cwd" && env "${launch_env[@]}" PI_OFFLINE=1 MOCK_NATIVE_RECEIPT="$dir_mods/receipt.log" "$l1s/node_modules/.bin/entwurf" pi-durable --provider entwurf-pack-probe --model no-such-model --width task-wide --native-module-dir "$dir_mods" 2>&1 </dev/null) || rc=$?
+  if [ "$rc" -eq 0 ] || [ "$(cat "$dir_mods/receipt.log" 2>/dev/null)" != "init" ] || ! grep -q 'Could not resolve model: Unknown provider "entwurf-pack-probe"' <<<"$out" || ! grep -q "at openDurable (file://.*/pi/pi-durable/carrier/runtime.js" <<<"$out" || grep -q -e "native-module-" -e "pack-install: .* opened" <<<"$out"; then
+    fail "[QK:PACK-INSTALL-DURABLE-NATIVE-MODULE-DIR] [check-pack-install] the installed 'entwurf pi-durable --native-module-dir' did not initialize exactly its one top-level *.extension.mjs and then reach the carrier openDurable's own model refusal (rc=$rc, receipt $(cat "$dir_mods/receipt.log" 2>/dev/null | tr '\n' ' ')):"
+    echo "$out" | tail -15 | sed 's/^/    /' >&2
+    return 1
+  fi
+  mapfile -t dir_env < <(pack_install_consumer_env "$dir_home")
+  rc=0; out=$(cd "$launch_cwd" && env "${dir_env[@]}" PI_OFFLINE=1 "$l1s/node_modules/.bin/entwurf" pi-durable --provider entwurf-pack-probe --model no-such-model --width task-wide --native-module-dir "$dir_empty" 2>&1 </dev/null) || rc=$?
+  if [ "$rc" -eq 0 ] || ! grep -q "native-module-dir-empty: " <<<"$out" || grep -q -e "Unknown provider" -e "pack-install: .* opened" <<<"$out" || [ -e "$dir_home/.pi/agent/experimental" ] || [ -e "$dir_home/.pi/agent/meta-sessions" ]; then
+    fail "[QK:PACK-INSTALL-DURABLE-NATIVE-MODULE-DIR] [check-pack-install] the installed launch did not refuse a directory without a module by name before anything opened (rc=$rc):"
+    echo "$out" | tail -15 | sed 's/^/    /' >&2
+    return 1
+  fi
+  echo "[check-pack-install] pi-durable module directory: the installed bootstrap initialized only the named directory's one top-level *.extension.mjs before the carrier's runtime (then the same model refusal), and refused a directory without a module before anything opened"
+
   # (d) Host vs native are two subjects. The installed package's native SDK set is the pin (above);
   # the ordinary Pi HOST on PATH is judged by its OWN real `pi --version` against the derived range.
   # Real host binaries, no forged version: a sandbox install of the previous pi generation must make the
@@ -7483,7 +7509,13 @@ case "$cmd" in
     # (HEAD + work-surface content hash asserted identical before/after). The runner is negative-controlled
     # first: zero-match/multi-match/survived/wrong-reason/hang(+pgroup grandchild kill)/
     # control-red/impurity all must classify red before any real manifest counts.
-    run_ts scripts/check-gate-qualification.ts
+    # Arguments reach the runner's own parser unchanged (#133): `--group '<argv JSON>'
+    # --receipt <abs path>` is the affected PARTIAL a development lane runs, and a malformed,
+    # missing or repeated flag is refused there before any body or snapshot. Dropping them
+    # turned a requested PARTIAL into the whole body. Bare, it stays the whole body — the
+    # prepared SHA's CI call. Never retry bare after a refusal.
+    shift || true
+    run_ts scripts/check-gate-qualification.ts "$@"
     ;;
   check-probe-ordering)
     # §11-7 ordering-probe gate (docs/acp-backend-rail.md §11-7): the raw-client seam is

package/scripts/check-gate-qualification.ts

@@ -49,7 +49,7 @@ import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import {
 	classifyMutantRun,
 	countOccurrences,
@@ -1178,6 +1178,63 @@ function buildDeclaredOutputFixture(): string {
 			parsedCompose.expectPath === "/e.txt",
 	);
 
+	// The operator's door to this parser is `run.sh check-gate-qualification` (#133): it
+	// once dropped every argument, so a requested PARTIAL started the whole body. The
+	// cells run a byte copy of this checkout's run.sh whose runner is a fixture: the REAL
+	// parser, then a print where the body would start — so neither a refusal nor a mutated
+	// wrapper can launch a body or a snapshot from here. Mutation acceptance stays the
+	// runner's own; this proves only the door's control flow.
+	const door = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualification-door-")));
+	fs.mkdirSync(path.join(door, "scripts"));
+	fs.copyFileSync(path.join(REPO_DIR, "run.sh"), path.join(door, "run.sh"));
+	const parserUrl = pathToFileURL(path.join(REPO_DIR, "scripts", "lib", "qualification-receipt.ts")).href;
+	fs.writeFileSync(
+		path.join(door, "scripts", "check-gate-qualification.ts"),
+		[
+			`import { parseQualificationArgs } from ${JSON.stringify(parserUrl)};`,
+			"const argv = process.argv.slice(2);",
+			"let parsed;",
+			"try { parsed = parseQualificationArgs(argv); }",
+			'catch (err) { process.stderr.write("refused: " + (err instanceof Error ? err.message : String(err)) + "\\n"); process.exit(2); }',
+			'process.stdout.write(JSON.stringify({ argv, parsed }) + "\\n");',
+			"",
+		].join("\n"),
+	);
+	const viaDoor = (argv: string[]) => {
+		const r = spawnSync("bash", [path.join(door, "run.sh"), "check-gate-qualification", ...argv], {
+			cwd: door,
+			encoding: "utf8",
+			env: { PATH: process.env.PATH ?? "", HOME: door },
+			timeout: 30_000,
+		});
+		const started = r.stdout.trim() === "" ? undefined : JSON.parse(r.stdout);
+		return { status: r.status, stderr: r.stderr, started };
+	};
+	const requested = ["--group", '["bash","run.sh","check pi *"]', "--receipt", "/x/r.json"];
+	const partial = viaDoor(requested);
+	const bare = viaDoor([]);
+	ok(
+		"[QK:QUALIFY-DOOR-FORWARDS-ARGV] run.sh check-gate-qualification hands --group/--receipt to the parser unchanged (a space and a glob inside the argv JSON included) and the parser reads one PARTIAL group; called bare it still reads the whole body — the prepared SHA's CI call",
+		partial.status === 0 &&
+			JSON.stringify(partial.started?.argv) === JSON.stringify(requested) &&
+			partial.started?.parsed.mode === "group" &&
+			partial.started.parsed.receiptPath === "/x/r.json" &&
+			bare.status === 0 &&
+			JSON.stringify(bare.started?.argv) === "[]" &&
+			bare.started?.parsed.mode === "full",
+	);
+	const doorRefusals: Array<[string[], string]> = [
+		[["--group", '["bash","run.sh","check-x"]'], "--group needs --receipt"],
+		[["--group", '["a"]', "--group", '["a"]', "--receipt", "/x/r.json"], "repeated flag"],
+		[["--grop", '["a"]', "--receipt", "/x/r.json"], "unknown argument"],
+		[["--group", "check-x", "--receipt", "/x/r.json"], "JSON array"],
+	];
+	const refused = doorRefusals.map(([argv, naming]) => ({ naming, run: viaDoor(argv) }));
+	ok(
+		"[QK:QUALIFY-DOOR-REFUSES-BEFORE-BODY] through run.sh, a missing --receipt, a repeated flag, a misspelled flag and a non-array --group are each refused by name and nothing starts — never a whole body in place of the PARTIAL that was asked for",
+		refused.every(({ naming, run }) => run.status === 2 && run.stderr.includes(naming) && run.started === undefined),
+	);
+
 	const tmpRoot = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-receipt-selftest-")));
 	const { dir: origin, externalTarget } = buildFixtureOrigin();
 	try {
@@ -3405,12 +3462,12 @@ let manifestCount: number;
 		"pi-bridge-sender": 4,
 		"pi-mcp-bridge": 2,
 		"pi-mcp-register": 3,
-		"pi-durable": 47,
+		"pi-durable": 58,
 		"copilot-receive": 20,
 		"entwurf-peers": 1,
 		"fresh-call-dispatch": 11,
 		"fresh-cut": 3,
-		"gate-qualification": 8,
+		"gate-qualification": 10,
 		"herdr-placement": 13,
 		"herdr-plugin": 25,
 		"herdr-plugin-profile": 14,

package/scripts/check-release-gate-outcomes.ts

@@ -1098,7 +1098,7 @@ console.log(
 		"a run.sh wrapper declining its own prerequisite (including the measured LIVE=1 no-cortex-connection cell); and every " +
 		"LIVE smoke is either wired into release_gate or excluded by a sentence the docs still carry; and the moved " +
 		"check-gate-qualification stays reachable on its owners (absent from the default chain, exactly once in CI, " +
-		"exactly once as a release-gate MUST step) and the CI step qualifies the FULL floor, which runs before it, " +
+		"absent from release_gate: the one body is the prepared SHA's CI step) and the CI step qualifies the FULL floor, which runs before it, " +
 		"while the exact-SHA release oracle requires that BODY step to have concluded success at the release SHA, " +
 		"and the CI filter that decides when that body runs covers every mutant subject and still runs it for all " +
 		"five historical reds; and " +

package/scripts/emit-pi-durable-carrier.ts

@@ -10,9 +10,10 @@
  * Inputs, and nothing else: the pinned commit's OBJECTS (each declared file and the license, read as
  * `<commit>:<path>` — never a worktree, so the repository's checkout state cannot enter), the packaged
  * overlay patch, and this Node's `stripTypeScriptTypes` in strip mode (upstream runs these exact
- * sources under Node's strip-only TypeScript). The patch is applied by git's own engine to a private
- * scratch copy; the base blob and the patched result must carry the blob ids the patch's `index` line
- * names. Each stripped file is then relocated by pi/pi-durable/carrier-relocation.mjs, and the targets
+ * sources under Node's strip-only TypeScript). The one patch carries exactly one section per file the
+ * pin declares `patched`, and no other section (#134). Each section is applied by git's own engine to a
+ * private scratch copy of its file; the base blob and the patched result must carry the blob ids that
+ * section's `index` line names. Each stripped file is then relocated by pi/pi-durable/carrier-relocation.mjs, and the targets
  * the six files import must equal the pin's declared `distTargets` exactly.
  *
  * `--write` emits pi/pi-durable/carrier/{<files>,LICENSE} and fills the pin's generated fields
@@ -118,22 +119,60 @@ function readPin(): CarrierPin {
 			`the emitter is ${EMITTER_TOOL} in ${EMITTER_MODE} mode, not ${JSON.stringify(pin.carrier.emitter)}`,
 		);
 	}
-	if (pin.carrier.files.filter((f) => f.patched).length !== 1) {
-		throw refuse("carrier-pin-malformed", "exactly one carrier file carries the overlay patch");
+	if (!pin.carrier.files.some((f) => f.patched)) {
+		throw refuse("carrier-pin-malformed", "at least one carrier file carries the overlay patch");
 	}
 	return pin;
 }
 
-/** The overlay patch's one file and the two blob ids its `index` line names. */
-function readPatch(pin: CarrierPin): { bytes: Buffer; file: string; base: string; result: string } {
-	const bytes = fs.readFileSync(path.join(DURABLE, "overlay", pin.patches[0]));
-	const text = bytes.toString("utf8");
-	const files = [...text.matchAll(/^diff --git a\/(\S+) b\/(\S+)$/gm)];
-	const index = [...text.matchAll(/^index ([0-9a-f]+)\.\.([0-9a-f]+) 100644$/gm)];
-	if (files.length !== 1 || files[0][1] !== files[0][2] || index.length !== 1) {
-		throw refuse("carrier-patch-shape", `${pin.patches[0]} must change exactly one existing file`);
+/** One file's section of the overlay patch: its own bytes and the two blob ids its `index` line names. */
+export interface PatchSection {
+	bytes: Buffer;
+	base: string;
+	result: string;
+}
+
+/**
+ * The overlay patch split into its per-file sections, keyed by the existing file each one changes, and
+ * matched against the source paths the pin declares `patched`: exactly one section per declared file and
+ * no section for any other file. Anything else is the patch's shape, refused by name.
+ */
+export function patchSections(
+	text: string,
+	patched: readonly string[],
+	name = "the overlay patch",
+): Map<string, PatchSection> {
+	const starts = [...text.matchAll(/^diff --git /gm)].map((m) => m.index);
+	if (starts.length === 0 || starts[0] !== 0) {
+		throw refuse("carrier-patch-shape", `${name} must start with its first file section`);
+	}
+	const sections = new Map<string, PatchSection>();
+	for (const [at, start] of starts.entries()) {
+		const chunk = text.slice(start, starts[at + 1] ?? text.length);
+		const files = [...chunk.matchAll(/^diff --git a\/(\S+) b\/(\S+)$/gm)];
+		const index = [...chunk.matchAll(/^index ([0-9a-f]+)\.\.([0-9a-f]+) 100644$/gm)];
+		if (files.length !== 1 || files[0][1] !== files[0][2] || index.length !== 1) {
+			throw refuse("carrier-patch-shape", `every section of ${name} changes exactly one existing file`);
+		}
+		const file = files[0][1];
+		if (sections.has(file)) throw refuse("carrier-patch-shape", `${name} changes ${file} in two sections`);
+		sections.set(file, { bytes: Buffer.from(chunk, "utf8"), base: index[0][1], result: index[0][2] });
 	}
-	return { bytes, file: files[0][1], base: index[0][1], result: index[0][2] };
+	const undeclared = [...sections.keys()].filter((file) => !patched.includes(file));
+	const missing = patched.filter((file) => !sections.has(file));
+	if (undeclared.length > 0 || missing.length > 0) {
+		throw refuse(
+			"carrier-patch-shape",
+			`${name} must change exactly the files the pin declares patched (undeclared: ${undeclared.join(", ") || "none"}; missing: ${missing.join(", ") || "none"})`,
+		);
+	}
+	return sections;
+}
+
+function readPatch(pin: CarrierPin): Map<string, PatchSection> {
+	const text = fs.readFileSync(path.join(DURABLE, "overlay", pin.patches[0]), "utf8");
+	const patched = pin.carrier.files.filter((f) => f.patched).map((f) => f.source);
+	return patchSections(text, patched, pin.patches[0]);
 }
 
 /** `base` with the patch applied by git, in a private scratch tree outside any repository. */
@@ -172,7 +211,7 @@ function emit(source: string, pin: CarrierPin): Emission {
 	if (git(source, ["cat-file", "-t", pin.commit]).toString().trim() !== "commit") {
 		throw refuse("carrier-source-unreadable", `${pin.commit} is not a commit in ${source}`);
 	}
-	const patch = readPatch(pin);
+	const sections = readPatch(pin);
 	const names = pin.carrier.files.map((f) => f.name);
 	const targets = pin.carrier.distTargets;
 	if (new Set(targets).size !== targets.length) throw refuse("carrier-pin-malformed", "distTargets repeats a path");
@@ -183,18 +222,19 @@ function emit(source: string, pin: CarrierPin): Emission {
 		const original = readSourceObject(source, `${pin.commit}:${declared.source}`);
 		const blob = blobId(original);
 		let text = original;
-		if (declared.patched) {
-			if (declared.source !== patch.file || !blob.startsWith(patch.base)) {
+		const section = declared.patched ? sections.get(declared.source) : undefined;
+		if (section !== undefined) {
+			if (!blob.startsWith(section.base)) {
 				throw refuse(
 					"carrier-patch-base",
-					`the patch changes ${patch.file} from ${patch.base}; ${declared.source} is ${blob}`,
+					`the patch changes ${declared.source} from ${section.base}; the pinned object is ${blob}`,
 				);
 			}
-			text = applyPatch(declared.source, original, patch.bytes);
-			if (!blobId(text).startsWith(patch.result)) {
+			text = applyPatch(declared.source, original, section.bytes);
+			if (!blobId(text).startsWith(section.result)) {
 				throw refuse(
 					"carrier-patch-result",
-					`patched ${declared.source} is ${blobId(text)}, the patch names ${patch.result}`,
+					`patched ${declared.source} is ${blobId(text)}, the patch names ${section.result}`,
 				);
 			}
 		}

package/scripts/mutants/gate-qualification.json

@@ -95,6 +95,30 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:QUALIFY-PRIOR-RUN-EVIDENCE-KEPT]",
 			"signatureSource": "scripts/check-gate-qualification.ts"
+		},
+		{
+			"claim": "QUALIFY-DOOR-FORWARDS-ARGV",
+			"title": "run.sh check-gate-qualification drops its arguments again — a requested --group/--receipt PARTIAL reaches the runner as a bare call and starts the whole ~900-mutant body nobody asked for (#133: the wrapper defect that made every development PARTIAL a whole run)",
+			"subject": "run.sh",
+			"find": ["    run_ts scripts/check-gate-qualification.ts \"$@\""],
+			"replace": ["    run_ts scripts/check-gate-qualification.ts"],
+			"gate": ["bash", "run.sh", "check-gate-manifests"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:QUALIFY-DOOR-FORWARDS-ARGV]",
+			"signatureSource": "scripts/check-gate-qualification.ts"
+		},
+		{
+			"claim": "QUALIFY-DOOR-REFUSES-BEFORE-BODY",
+			"title": "run.sh check-gate-qualification retries bare when the runner refuses — a malformed, missing or repeated flag is named, then the whole body starts anyway in place of the PARTIAL that was asked for (#133)",
+			"subject": "run.sh",
+			"find": ["    run_ts scripts/check-gate-qualification.ts \"$@\""],
+			"replace": [
+				"    run_ts scripts/check-gate-qualification.ts \"$@\" || run_ts scripts/check-gate-qualification.ts"
+			],
+			"gate": ["bash", "run.sh", "check-gate-manifests"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:QUALIFY-DOOR-REFUSES-BEFORE-BODY]",
+			"signatureSource": "scripts/check-gate-qualification.ts"
 		}
 	]
 }