@junghanacs/entwurf 0.33.0 → 0.34.1

package/run.sh

@@ -134,7 +134,7 @@ Usage:
   ./run.sh check-omp-birth-hook       # #87 gate: drives the real OMP assembler into a temp dir, imports the ASSEMBLED index.ts into a MOCK omp host and fires session_start/session_switch. tui mints one backend:"omp" record + a sender marker keyed to the host's OWN pid (the one-process join) + the garden id on the status line; print/rpc/json mint NOTHING (hasUI is true on the rpc rows, as in the vendor); switch attaches on the same native id and mints the replacement on a new one; the CERTIFIED receiver reader still finds no marker. Also the four-root joint binding: extension and omp-labeled bridge child resolve the same sessions/mailbox/senders/receivers bundle against test-built literals (never the production resolver as its own oracle), under a poisoned PI_CODING_AGENT_DIR and under four distinct ENTWURF_META_* overrides; the override grammar is absolute-or-~ and both halves plus the doctor refuse anything else by name; and a drifted provenance label selects no root policy at all. Hermetic; no omp, no model turn
   ./run.sh check-pi-durable-contact   # #129 L-identity gate, CHECKOUT-ONLY (an installed package refuses it in run_ts). Opens the REAL durable app from THIS checkout's verified carrier (pi/pi-durable/carrier/ under its resolver, against the checkout's pinned pi SDK set — refused by name first) with the pi-durable contact, births the citizen and runs its tools adapter-direct through a privately emitted branch bridge (ENTWURF_PI_DURABLE_BRIDGE_ENTRY; its registry must match this checkout). Matrix roots {default, explicit} x {fresh, --continue}: one record keyed by the durable session dir, sender marker on the spawned host pid, exactly one bridge child whose /proc PPID is that host, poisoned identity carriers kept from it, its four root carriers bound to the roots written, the receiver ARMED (raw marker owned by the host pid + start key as pi-durable-host, joined to the sender marker; removed on close), self = the record and replyable, peers from an outside bridge, same garden id on reopen; the bundle's compiled owner join must admit pi-durable-host. Reaps only the host/bridges it owns on any failure. Harness-bypassed: no model turn, no ToolTask. Missing inputs → SKIP (97), never a pass
   ./run.sh check-pi-durable-send      # #129 L-send FIRST CELL, CHECKOUT-ONLY. Same input as check-pi-durable-contact. One native durable turn: the app's own controller input → GenerationTask → ToolTask → the contact's entwurf_v2 → the private bridge → a seeded self-fetch target (C2 recipe, owned by a separate idle child). S = a 127.0.0.1 scripted OpenAI-compatible endpoint configured through the app's documented models.json (dummy key, PI_OFFLINE); H = the native ToolTask path; V (a vendor turn) is NOT run. Oracles: the wire (tools offered, v2 schema = the bridge's tools/list, exactly two requests, the tool result + receipt in the second), the raw mailbox (.msg 1, signal, sender = the host record), the native view (one call, its settled result, root current). Not exactly-once, not recovery, not a recipient turn. Missing inputs → SKIP (97)
-  ./run.sh check-pi-durable-beside    # #129 mutant execution coordinate (VERIFY rule 3): run_vitest over the five pi-durable beside tests (adapter, carrier/SDK-set verifier, preflight, owner join, carrier relocation/resolver/emitter) — the pi-durable qualification lane's gate argv. Same files check-tests-beside-behavior already runs.
+  ./run.sh check-pi-durable-beside    # #129 mutant execution coordinate (VERIFY rule 3): run_vitest over the six pi-durable beside tests (adapter, carrier/SDK-set verifier, preflight, owner join, carrier relocation/resolver/emitter/task footer, native-module file and directory ingress) — the pi-durable qualification lane's gate argv. Same files check-tests-beside-behavior already runs.
   ./run.sh check-pi-durable-receive   # #129 L-receive FIRST CELL, CHECKOUT-ONLY. Same input (the bundle must carry the pi-durable-host owner join). The host driver gives the app NO input; a seeded claude-code sender (marker owned by a separate idle child, handed to a gate-owned sending bridge through ENTWURF_META_SENDER_MARKER) enqueues one message, the host's doorbell admits its notice to the ROOT conversation, and the scripted model drains it with entwurf_inbox_read. S withholds response #1 until the ENQUEUE receipt, the .delivered bytes, the signal, the host-owned receiver marker and the notice are captured. Oracles: receiver() admission, native view, raw archive (.delivered.read + lastReadAt), wire (exactly two requests, drain result = view), and after a green reap a forensic read-only SQLite copy (submission row by request id = reported id, root, input, done, placed entry = the notice). V NOT run. Missing inputs → SKIP (97)
   ./run.sh check-copilot-receive-arm  # #82 RAIL 5 gate: the REAL receiver installer + the REAL extension.mjs forked with a stubbed SDK. Arms only after birth, marker owned by the WATCHER pid, self-fetch dispatch answer, doorbell carries the garden id and NOT the body, id-drift/foreign-parent refusals. Hermetic; no Copilot, no model turn
   ./run.sh check-copilot-launch       # #82 RAIL 7 gate: the MANAGED launch `entwurf copilot`, driven through its public address against a FAKE VENDOR on a sandbox PATH. Receiver precondition refusals, EXTENSIONS token + operator token preservation, injected defaults before the `--` terminator, byte-identical argv, the 11 explicit permission/surface policy overrides that suppress `--yolo`, exec (not fork) pid identity, exit passthrough, recursion refusal. Hermetic; no Copilot, no model turn
@@ -208,7 +208,7 @@ Usage:
   ./run.sh smoke-entwurf-chain-live    # LIVE cross-harness delivery chain: native Claude Code -> pi GPT -> pi ACP Sonnet -> mailbox terminus, proving sender identity/replyable at every hop and a real read receipt at the end. Prerequisites (claude on PATH, pi credentials per backend) report protocol SKIP, never a pass
   ./run.sh check-release-gate-outcomes  # release-gate STEP OUTCOME protocol (P1): one skip exit code shared by the shell + TS halves, classifier never rounds a skip up to a pass, `--cut` refuses a MUST SKIP while a bare diagnostic stays exit 0, no LIVE smoke keeps the old exit-0 skip shape, and both real skip surfaces are INVOKED and observed to propagate the code
   ./run.sh check-gate-manifests         # the HEAD of that qualification, on its own: runner self-test + the committed manifests validated against the origin index + the declared lane inventory. Executes ZERO committed mutants (only the self-test's synthetic fixture mutants, in tmp fixture repos) and never snapshots this repo (~20s), which is why it lives in check:hermetic while the body stays on CI/release-gate — three of the five reds qualification ever produced in CI died right here, before a mutant gate ran (#99 B-3)
-  ./run.sh check-gate-qualification    # kill-proof qualification (the gate-of-gates): runner self-test (classifier truth table + synthetic negatives incl. wrong-reason/hang/control-red/impurity) + committed mutant manifests (scripts/mutants/*.json) run in an isolated snapshot repo under control→mutant→restore→control; the real checkout is never written. Evidence = claim IDs + killed mutant IDs, never assertion counts
+  ./run.sh check-gate-qualification    # kill-proof qualification (the gate-of-gates): runner self-test (classifier truth table + synthetic negatives incl. wrong-reason/hang/control-red/impurity) + committed mutant manifests (scripts/mutants/*.json) run in an isolated snapshot repo under control→mutant→restore→control; the real checkout is never written. Evidence = claim IDs + killed mutant IDs, never assertion counts. Bare = the whole body (the prepared SHA's CI call); `--group '<argv JSON>' --receipt <abs path outside the repo>` = one affected exact-argv group, a PARTIAL receipt (development's run, #133)
   ./run.sh check-probe-ordering        # §11-7 ordering-probe deterministic gate: raw-client SAMENESS pinned to backend.ts (sequence/args/timeouts/permission policy — the probe may never measure a lookalike), phase attribution incl. set-model, probe-mode fixture wire markers (delay honored, probeRunId REQUIRED, smoke-acp-mcp-live legacy compat), event-log door integrity (reserved keys refused at write; unknown marker name, broken sort axis, or a payload the classifier cannot judge on is MALFORMED, never a quiet event), and the §11-7 paired-verdict truth table (P0/I0 outside the space, phase-qualified D, B promotion ladder, C, A two-delay rule). Offline/deterministic; one product claim (no production prompt cutoff) is replant-qualified via scripts/mutants/probe-ordering.json, while the other assertions are direct [CHECK:*] contracts
   ./run.sh check-probe-cli-shim        # §11-7-c B-name-snapshot PRODUCER gate: the CLI shim driven as a REAL process against fake CLIs (no API, no cost). Proves what a defect would buy — FABRICATED evidence (a malformed init is never reported as an empty name set; the boot report carries the true target path+sha256 the classifier verifies against the roster), a DESTROYED turn (byte transparency across mid-UTF8/CRLF/oversized/unterminated framing, exit-code fidelity, signal re-raise, inbound signal forwarding, stderr passthrough, stdout backpressure), and LEAKED operator state (exact-allowlist env scrub, no argv/env/prompt body in the log). Offline/deterministic; 20 direct [CHECK:*] contracts, deliberately no longer replant-qualified after #70 subtraction
   ./run.sh smoke-agy-statusline-state # agy ambient garden-id statusLine install/doctor/inverse regression. Offline/deterministic
@@ -294,7 +294,7 @@ Usage:
   ./run.sh remove [project-dir]       # remove entwurf entries from project .pi/settings.json (project scope only; global user-scope citizen left intact)
   ./run.sh install-user-scope [--plugin-runtime <root>]  # #116 M3-b2 PLUGIN-ONLY forward seam: compose ONLY the global pi citizen (user-scope packages[] + provider), never a project `.pi/settings.json` — a Herdr plugin activation has no project and must not invent one. With --plugin-runtime the provider's managed command becomes the absolute bridge under that certified stable runtime (a clean host has nothing entwurf on PATH); without it every byte is the historical bare-bin install. Inverse: remove-user-scope
   ./run.sh herdr-plugin-activate <backend...>  # #116 M3-b2 public forward activation. Takes a subset of {pi, claude-code} and NOTHING else — the stable runtime root is DERIVED from XDG here and handed down, and both harness writers accept a named root only when it IS that derived one. Certifies the runtime-ready journal AND the installed tree, certifies the existing ledger and its recorded harness roots, plans ADD-ONLY (a backend absent from this request is retained, never removed), preflights every selected component before the first byte, then writes each component `pending` BEFORE mutating and checkpoints `active` the moment its writer returns — so a run that dies halfway leaves a record of how far it got. Which backends is M3-b3's question: this verb is handed the answer, it does not read Herdr's integration status
-  ./run.sh herdr-plugin-deactivate   # #116 M3-b2 public teardown of a Herdr-plugin activation. Herdr's `plugin uninstall` deletes its checkout and calls NO cleanup hook, so the harness wiring and the stable runtime are retained, not cleaned — this is the shipped verb that takes them back. Certifies the activation ledger, the resolved Pi/Claude roots and BOTH component inverses read-only first; mutates only when every preflight is green; then Claude -> Pi user scope -> runtime -> ledger LAST. A component failure stops with the runtime and ledger intact as retry authority. Static imports only: the process deletes the runtime it is running from, and a lazy import after that fails
+  ./run.sh herdr-plugin-deactivate   # #116 M3-b2 public teardown of a Herdr-plugin activation. Herdr's `plugin uninstall` deletes its checkout and calls NO cleanup hook, so the harness wiring and the stable runtime are retained, not cleaned — this is the shipped verb that takes them back. Certifies the activation ledger, the resolved Pi/Claude roots and BOTH component inverses read-only first; mutates only when every preflight is green; then Claude -> Pi user scope -> runtime -> ledger LAST. A component failure stops with the runtime and ledger intact as retry authority. With NO ledger it removes nothing: a clean host exits 0, and anything found at the plugin's journal/runtime/cache addresses is named with a non-zero exit (#135). Static imports only: the process deletes the runtime it is running from, and a lazy import after that fails
   ./run.sh remove-user-scope          # explicit GLOBAL inverse of install's user-scope citizen: drop entwurf from ~/.pi/agent/settings.json packages[] (affects ALL cwds — shared entry, not per-project). #86 C2: same-owner-only — a LIVE foreign owner refuses; a MISSING owner is removed only when package entry + package state + provider installerRoot all align (reported orphan cleanup)
   ./run.sh takeover-user-scope        # #86 C2: operator-EXPLICIT ownership move of the shared user-scope registration to THIS root (old→new reported, packages[] entry + provider installerRoot together). The only writer over another owner — normal install/setup/remove refuse instead. No --force exists
   ./run.sh doctor-pi-package          # #86 C2: package-side user-scope ownership verdict — unregistered / owned / owned-by-other(live) / legacy-no-state / mismatch / missing-owner (nonzero on defect verdicts). Provider runtime verdicts stay with doctor-pi-provider
@@ -1520,8 +1520,8 @@ check_pi_durable_beside() {
   # from re-running every beside test. The six files are one contact: the adapter and its packaged
   # bootstrap, the installed carrier/SDK-set verifier (which also reads the three checkout gates as
   # SOURCE), the fresh preflight, the owner join that admits the durable host, the carrier's
-  # relocation grammar, resolver and maintainer emitter (#130), and the bootstrap's explicit
-  # --native-module ingress (#130 P2).
+  # relocation grammar, resolver and maintainer emitter (#130) with the carrier's task footer (#134),
+  # and the bootstrap's explicit --native-module ingress (#130 P2) and its --native-module-dir (#134).
   run_vitest pi-extensions/meta-bridge-pi-durable.test.ts pi-extensions/lib/pi-durable-runtime.test.ts pi-extensions/lib/pi-durable-fresh-preflight.test.ts pi-extensions/lib/entwurf-deliverability.owner-join.test.ts pi-extensions/lib/pi-durable-carrier.test.ts pi-extensions/lib/pi-durable-native-module.test.ts
 }
 
@@ -4025,8 +4025,8 @@ ORACLE
   # copied from this checkout into the sandbox — it never ships (test/ is outside the package files).
   # Its initialization appends `init` to the receipt this cell names; the same public launch must then
   # reach the same carrier model refusal, so the installed bootstrap loaded the module before the
-  # runtime and the native registry installed its extension (carrier/runtime.js 146) before that
-  # refusal (runtime.js 162). A module claiming an extension name the app installs itself is refused by
+  # runtime and the native registry installed its extension (carrier/runtime.js 148) before that
+  # refusal (runtime.js 164). A module claiming an extension name the app installs itself is refused by
   # name before anything opens: no durable session directory, no citizen, in a fresh sandbox home.
   # Native SDK file opens here are ordinary (the module runs in the native process); none is judged.
   local mod_dir="$box/pd-module" mod_home="$box/pd-module-home" mod_env=()
@@ -4048,6 +4048,32 @@ ORACLE
   fi
   echo "[check-pack-install] pi-durable native module: the installed bootstrap initialized one explicit module before the carrier's runtime (then the same model refusal), and refused a reserved extension name before anything opened"
 
+  # (c3) #134: the paired --native-module-dir on the INSTALLED package. One named directory holding the
+  # same synthetic module under a matching name beside a helper and a dotfile that would throw if
+  # opened: the installed bootstrap must read only the top-level *.extension.mjs, initialize it once
+  # (one `init` receipt) and reach the same carrier model refusal. A directory without a matching
+  # module is refused by name before anything opens: no durable session directory, no citizen.
+  local dir_mods="$box/pd-module-dir" dir_empty="$box/pd-module-dir-empty" dir_home="$box/pd-module-dir-home" dir_env=()
+  mkdir -p "$dir_mods" "$dir_empty" "$dir_home/.pi/agent"
+  cp "$REPO_DIR/test/fixtures/pi-durable-native-module/mock.mjs" "$dir_mods/10-mock.extension.mjs"
+  printf 'throw new Error("pack-install: helper opened");\n' > "$dir_mods/helper.mjs"
+  printf 'throw new Error("pack-install: dotfile opened");\n' > "$dir_mods/.hidden.extension.mjs"
+  cp "$dir_mods/helper.mjs" "$dir_empty/index.mjs"
+  rc=0; out=$(cd "$launch_cwd" && env "${launch_env[@]}" PI_OFFLINE=1 MOCK_NATIVE_RECEIPT="$dir_mods/receipt.log" "$l1s/node_modules/.bin/entwurf" pi-durable --provider entwurf-pack-probe --model no-such-model --width task-wide --native-module-dir "$dir_mods" 2>&1 </dev/null) || rc=$?
+  if [ "$rc" -eq 0 ] || [ "$(cat "$dir_mods/receipt.log" 2>/dev/null)" != "init" ] || ! grep -q 'Could not resolve model: Unknown provider "entwurf-pack-probe"' <<<"$out" || ! grep -q "at openDurable (file://.*/pi/pi-durable/carrier/runtime.js" <<<"$out" || grep -q -e "native-module-" -e "pack-install: .* opened" <<<"$out"; then
+    fail "[QK:PACK-INSTALL-DURABLE-NATIVE-MODULE-DIR] [check-pack-install] the installed 'entwurf pi-durable --native-module-dir' did not initialize exactly its one top-level *.extension.mjs and then reach the carrier openDurable's own model refusal (rc=$rc, receipt $(cat "$dir_mods/receipt.log" 2>/dev/null | tr '\n' ' ')):"
+    echo "$out" | tail -15 | sed 's/^/    /' >&2
+    return 1
+  fi
+  mapfile -t dir_env < <(pack_install_consumer_env "$dir_home")
+  rc=0; out=$(cd "$launch_cwd" && env "${dir_env[@]}" PI_OFFLINE=1 "$l1s/node_modules/.bin/entwurf" pi-durable --provider entwurf-pack-probe --model no-such-model --width task-wide --native-module-dir "$dir_empty" 2>&1 </dev/null) || rc=$?
+  if [ "$rc" -eq 0 ] || ! grep -q "native-module-dir-empty: " <<<"$out" || grep -q -e "Unknown provider" -e "pack-install: .* opened" <<<"$out" || [ -e "$dir_home/.pi/agent/experimental" ] || [ -e "$dir_home/.pi/agent/meta-sessions" ]; then
+    fail "[QK:PACK-INSTALL-DURABLE-NATIVE-MODULE-DIR] [check-pack-install] the installed launch did not refuse a directory without a module by name before anything opened (rc=$rc):"
+    echo "$out" | tail -15 | sed 's/^/    /' >&2
+    return 1
+  fi
+  echo "[check-pack-install] pi-durable module directory: the installed bootstrap initialized only the named directory's one top-level *.extension.mjs before the carrier's runtime (then the same model refusal), and refused a directory without a module before anything opened"
+
   # (d) Host vs native are two subjects. The installed package's native SDK set is the pin (above);
   # the ordinary Pi HOST on PATH is judged by its OWN real `pi --version` against the derived range.
   # Real host binaries, no forged version: a sandbox install of the previous pi generation must make the
@@ -4367,8 +4393,8 @@ _check_pack_install_impl() {
 
   # Fresh-temp install smoke. Uses pnpm because that is what this
   # repo packages with; --ignore-workspace stops it from re-attaching
-  # to our pnpm-workspace.yaml; --ignore-scripts blocks the husky
-  # prepare hook (and any future install scripts) from running inside
+  # to our pnpm-workspace.yaml; --ignore-scripts blocks
+  # prepare (and any future install scripts) from running inside
   # the consumer project. The pi SDK is pinned to the CURRENT pi release
   # baseline (the package.json exact production dependency — the pins below
   # are what check-dep-versions binds to it) so the smoke matches the same
@@ -7483,7 +7509,13 @@ case "$cmd" in
     # (HEAD + work-surface content hash asserted identical before/after). The runner is negative-controlled
     # first: zero-match/multi-match/survived/wrong-reason/hang(+pgroup grandchild kill)/
     # control-red/impurity all must classify red before any real manifest counts.
-    run_ts scripts/check-gate-qualification.ts
+    # Arguments reach the runner's own parser unchanged (#133): `--group '<argv JSON>'
+    # --receipt <abs path>` is the affected PARTIAL a development lane runs, and a malformed,
+    # missing or repeated flag is refused there before any body or snapshot. Dropping them
+    # turned a requested PARTIAL into the whole body. Bare, it stays the whole body — the
+    # prepared SHA's CI call. Never retry bare after a refusal.
+    shift || true
+    run_ts scripts/check-gate-qualification.ts "$@"
     ;;
   check-probe-ordering)
     # §11-7 ordering-probe gate (docs/acp-backend-rail.md §11-7): the raw-client seam is

package/scripts/check-gate-qualification.ts

@@ -49,7 +49,7 @@ import { createHash } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 import {
 	classifyMutantRun,
 	countOccurrences,
@@ -1178,6 +1178,63 @@ function buildDeclaredOutputFixture(): string {
 			parsedCompose.expectPath === "/e.txt",
 	);
 
+	// The operator's door to this parser is `run.sh check-gate-qualification` (#133): it
+	// once dropped every argument, so a requested PARTIAL started the whole body. The
+	// cells run a byte copy of this checkout's run.sh whose runner is a fixture: the REAL
+	// parser, then a print where the body would start — so neither a refusal nor a mutated
+	// wrapper can launch a body or a snapshot from here. Mutation acceptance stays the
+	// runner's own; this proves only the door's control flow.
+	const door = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-qualification-door-")));
+	fs.mkdirSync(path.join(door, "scripts"));
+	fs.copyFileSync(path.join(REPO_DIR, "run.sh"), path.join(door, "run.sh"));
+	const parserUrl = pathToFileURL(path.join(REPO_DIR, "scripts", "lib", "qualification-receipt.ts")).href;
+	fs.writeFileSync(
+		path.join(door, "scripts", "check-gate-qualification.ts"),
+		[
+			`import { parseQualificationArgs } from ${JSON.stringify(parserUrl)};`,
+			"const argv = process.argv.slice(2);",
+			"let parsed;",
+			"try { parsed = parseQualificationArgs(argv); }",
+			'catch (err) { process.stderr.write("refused: " + (err instanceof Error ? err.message : String(err)) + "\\n"); process.exit(2); }',
+			'process.stdout.write(JSON.stringify({ argv, parsed }) + "\\n");',
+			"",
+		].join("\n"),
+	);
+	const viaDoor = (argv: string[]) => {
+		const r = spawnSync("bash", [path.join(door, "run.sh"), "check-gate-qualification", ...argv], {
+			cwd: door,
+			encoding: "utf8",
+			env: { PATH: process.env.PATH ?? "", HOME: door },
+			timeout: 30_000,
+		});
+		const started = r.stdout.trim() === "" ? undefined : JSON.parse(r.stdout);
+		return { status: r.status, stderr: r.stderr, started };
+	};
+	const requested = ["--group", '["bash","run.sh","check pi *"]', "--receipt", "/x/r.json"];
+	const partial = viaDoor(requested);
+	const bare = viaDoor([]);
+	ok(
+		"[QK:QUALIFY-DOOR-FORWARDS-ARGV] run.sh check-gate-qualification hands --group/--receipt to the parser unchanged (a space and a glob inside the argv JSON included) and the parser reads one PARTIAL group; called bare it still reads the whole body — the prepared SHA's CI call",
+		partial.status === 0 &&
+			JSON.stringify(partial.started?.argv) === JSON.stringify(requested) &&
+			partial.started?.parsed.mode === "group" &&
+			partial.started.parsed.receiptPath === "/x/r.json" &&
+			bare.status === 0 &&
+			JSON.stringify(bare.started?.argv) === "[]" &&
+			bare.started?.parsed.mode === "full",
+	);
+	const doorRefusals: Array<[string[], string]> = [
+		[["--group", '["bash","run.sh","check-x"]'], "--group needs --receipt"],
+		[["--group", '["a"]', "--group", '["a"]', "--receipt", "/x/r.json"], "repeated flag"],
+		[["--grop", '["a"]', "--receipt", "/x/r.json"], "unknown argument"],
+		[["--group", "check-x", "--receipt", "/x/r.json"], "JSON array"],
+	];
+	const refused = doorRefusals.map(([argv, naming]) => ({ naming, run: viaDoor(argv) }));
+	ok(
+		"[QK:QUALIFY-DOOR-REFUSES-BEFORE-BODY] through run.sh, a missing --receipt, a repeated flag, a misspelled flag and a non-array --group are each refused by name and nothing starts — never a whole body in place of the PARTIAL that was asked for",
+		refused.every(({ naming, run }) => run.status === 2 && run.stderr.includes(naming) && run.started === undefined),
+	);
+
 	const tmpRoot = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-receipt-selftest-")));
 	const { dir: origin, externalTarget } = buildFixtureOrigin();
 	try {
@@ -3405,17 +3462,17 @@ let manifestCount: number;
 		"pi-bridge-sender": 4,
 		"pi-mcp-bridge": 2,
 		"pi-mcp-register": 3,
-		"pi-durable": 47,
+		"pi-durable": 58,
 		"copilot-receive": 20,
 		"entwurf-peers": 1,
 		"fresh-call-dispatch": 11,
 		"fresh-cut": 3,
-		"gate-qualification": 8,
+		"gate-qualification": 10,
 		"herdr-placement": 13,
 		"herdr-plugin": 25,
 		"herdr-plugin-profile": 14,
-		"herdr-activation": 25,
-		"herdr-plugin-build": 14,
+		"herdr-activation": 28,
+		"herdr-plugin-build": 20,
 		"herdr-runtime-bootstrap": 31,
 		"herdr-fresh-call": 38,
 		"herdr-supply": 11,

package/scripts/check-herdr-activation.ts

@@ -27,6 +27,7 @@ import os from "node:os";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
+import { treeDigest } from "./lib/tree-digest.ts";
 
 let passed = 0;
 function ok(label: string, cond: boolean): void {
@@ -737,21 +738,12 @@ function ledgerWith(
 	const dataRoot = resolveEntwurfDataRoot(bare);
 	const states = piStatePaths(bare);
 	const piExpected = path.join(home, ".local", "share", "entwurf");
-	// The python writers derive the SAME stable root from the SAME environment.
-	const pyRoot = spawnSync(
-		"python3",
-		[
-			"-c",
-			"import sys; sys.path.insert(0, 'scripts'); from importlib import import_module; m = import_module('register-pi-provider'.replace('-', '_')) if False else None",
-		],
-		{ encoding: "utf8", env: bare },
-	);
 	ok(
 		"[QK:HAC-XDG-RESOLUTION-SHARED] every root comes from one resolution — `XDG_DATA_HOME`, else " +
 			"`$HOME/.local/share` — so a host with XDG unset is the same host to the teardown as it is to the writers. " +
 			'The first cut built its Pi state paths from `env.XDG_DATA_HOME || ""`, which on such a host pointed at ' +
 			"`/entwurf/...`: a preflight that looked at a file nobody writes and passed for the wrong reason " +
-			`(dataRoot=${dataRoot === piExpected} packageState=${path.relative(home, states.packageState)} py=${pyRoot.status === 0})`,
+			`(dataRoot=${dataRoot === piExpected} packageState=${path.relative(home, states.packageState)})`,
 		dataRoot === piExpected &&
 			states.packageState === path.join(piExpected, "pi-package", "install-state.json") &&
 			states.providerState === path.join(piExpected, "pi-provider", "install-state.json"),
@@ -1364,4 +1356,132 @@ function ledgerWith(
 	);
 }
 
+// ── 26. both Pi owner records are asked where their writers keep them (#135 D1) ─
+{
+	const env = world("pi-state-paths");
+	const defaultData = path.join(env.HOME as string, ".local", "share");
+	// An EMPTY XDG_DATA_HOME: run.sh and the runtime owner both fall back to $HOME/.local/share.
+	const runEnv = { ...env, XDG_DATA_HOME: "" };
+	seedRuntime({ ...env, XDG_DATA_HOME: defaultData });
+	const agentSettings = path.join(env.PI_CODING_AGENT_DIR as string, "settings.json");
+	fs.writeFileSync(agentSettings, '{"theme":"dark"}\n');
+	const foreign = path.join(env.HOME as string, "dev", "entwurf");
+	fs.mkdirSync(foreign, { recursive: true });
+	const seeded = py(env, "register-pi-provider.py", [
+		"install",
+		agentSettings,
+		foreign,
+		"--scope",
+		"user",
+		"--state",
+		path.join(defaultData, "entwurf", "pi-provider", "install-state.json"),
+	]);
+	assert.equal(seeded.status, 0, `fixture: seeding the provider owner failed: ${seeded.stderr}`);
+	const layout = resolveActivationLayout(runEnv);
+	const run = spawnSync("node", [ACTIVATE, "pi"], { encoding: "utf8", env: runEnv, cwd: env.HOME as string });
+	ok(
+		"[QK:HAC-PI-STATE-PATHS-SHARED] both Pi ownership preflights read the record where its writer keeps it: with " +
+			"XDG_DATA_HOME set but EMPTY, run.sh writes to $HOME/.local/share, so the provider preflight must look there " +
+			"too — the first cut built a RELATIVE path for the provider half alone, saw no owner, and let the ledger land " +
+			`on a host the provider writer then refused (exit=${run.status} ledger=${fs.existsSync(layout.ledgerPath)} refusal=${JSON.stringify((run.stderr || "").trim().split("\n").pop())})`,
+		run.status !== 0 &&
+			(run.stderr || "").includes("activation-preflight-refused") &&
+			(run.stderr || "").includes("pi-provider") &&
+			!fs.existsSync(layout.ledgerPath),
+	);
+}
+
+// ── 27. no ledger is not "nothing here" (#135) ─────────────────────────────────
+{
+	const plugin = (env: NodeJS.ProcessEnv) => path.join(env.XDG_DATA_HOME as string, "entwurf", "herdr-plugin");
+	const rows: [string, (env: NodeJS.ProcessEnv) => void][] = [
+		[
+			"installing-journal",
+			(env) => {
+				fs.mkdirSync(path.join(plugin(env), "runtime"), { recursive: true });
+				fs.writeFileSync(
+					path.join(plugin(env), "journal.json"),
+					`${JSON.stringify({
+						schemaVersion: 2,
+						phase: "installing",
+						runtimeRoot: runtimeRootOf(env),
+						artifactIdentity: { kind: "npm", name: PACKAGE, version: "0.21.0", expectedIntegrity: "sha512-fixture" },
+						previousRuntime: null,
+					})}\n`,
+				);
+			},
+		],
+		["ready-runtime", (env) => void seedRuntime(env)],
+		[
+			"cache-only",
+			(env) =>
+				fs.mkdirSync(path.join(env.XDG_CACHE_HOME as string, "entwurf", "herdr-plugin", "npm"), { recursive: true }),
+		],
+		["journal-less-runtime", (env) => fs.mkdirSync(path.join(plugin(env), "runtime", "active"), { recursive: true })],
+	];
+	const results = rows.map(([tag, make]) => {
+		const env = world(`no-ledger-${tag}`);
+		make(env);
+		const before = treeDigest(env.HOME as string);
+		const run = spawnSync("node", [DEACTIVATE], { encoding: "utf8", env });
+		return {
+			tag,
+			status: run.status,
+			named: (run.stderr || "").includes("deactivate-unattributed-leftovers"),
+			unchanged: before === treeDigest(env.HOME as string),
+		};
+	});
+	const clean = world("no-ledger-clean");
+	const cleanRun = spawnSync("node", [DEACTIVATE], { encoding: "utf8", env: clean });
+	ok(
+		"[QK:HAC-NO-LEDGER-LEFTOVERS-REPORTED] without a ledger the teardown no longer says 'nothing to undo' over what " +
+			"an aborted install left: an installing journal, a ready runtime, our npm cache, or a runtime with no journal " +
+			"are each NAMED and the verb exits non-zero with every byte untouched — nothing proves what they belong to, so " +
+			"nothing is removed. A truly clean host still exits 0 with the old line " +
+			`(rows=${JSON.stringify(results)} clean=${cleanRun.status}/${JSON.stringify((cleanRun.stdout || "").trim())})`,
+		results.every((r) => r.status !== 0 && r.named && r.unchanged) &&
+			cleanRun.status === 0 &&
+			(cleanRun.stdout || "").includes("no certified activation ledger — nothing to undo"),
+	);
+}
+
+// ── 28. only a regular file — or nothing — may stand at the ledger address (#135) ─
+{
+	const env = world("ledger-kinds");
+	seedRuntime(env);
+	const layout = resolveActivationLayout(env);
+	fs.mkdirSync(layout.stateRoot, { recursive: true });
+	// a DANGLING symlink: readFileSync used to answer ENOENT, i.e. "no ledger".
+	fs.symlinkSync(path.join(env.HOME as string, "nowhere.json"), layout.ledgerPath);
+	const dangling = refusal(() => readCertifiedLedger(layout));
+	const danglingRun = spawnSync("node", [DEACTIVATE], { encoding: "utf8", env });
+	fs.unlinkSync(layout.ledgerPath);
+	// a symlink to a perfectly valid ledger is still not OUR ledger file.
+	const elsewhere = path.join(env.HOME as string, "ledger-elsewhere.json");
+	fs.writeFileSync(elsewhere, `${JSON.stringify({ schemaVersion: 2, ...ledgerFor(env, ["pi"]) }, null, 2)}\n`);
+	fs.symlinkSync(elsewhere, layout.ledgerPath);
+	const linked = refusal(() => readCertifiedLedger(layout));
+	fs.unlinkSync(layout.ledgerPath);
+	fs.mkdirSync(layout.ledgerPath);
+	const directory = refusal(() => readCertifiedLedger(layout));
+	// a state root that is a FILE: lstat answers ENOTDIR, which must stay a named refusal, not a raw errno.
+	const fileRoot = path.join(env.HOME as string, "state-root-is-a-file");
+	fs.writeFileSync(fileRoot, "not a directory\n");
+	const notDir = refusal(() =>
+		readCertifiedLedger({ stateRoot: fileRoot, ledgerPath: path.join(fileRoot, "activation.json") }),
+	);
+	ok(
+		"[QK:HAC-LEDGER-PATH-KIND] the ledger address is read by lstat first: a dangling symlink, a symlink to a valid " +
+			"ledger elsewhere, a directory, and a state root that is a file are each refused by name — none of them is " +
+			"'no ledger', which is what a dangling link used to read as, letting every verb act as if nothing had been " +
+			`activated (dangling=${dangling}/teardown-exit=${danglingRun.status} linked=${linked} directory=${directory} not-dir=${notDir})`,
+		dangling === "activation-ledger-uncertified" &&
+			danglingRun.status !== 0 &&
+			(danglingRun.stderr || "").includes("activation-ledger-uncertified") &&
+			linked === "activation-ledger-uncertified" &&
+			directory === "activation-ledger-uncertified" &&
+			notDir === "activation-ledger-uncertified",
+	);
+}
+
 console.log(`\ncheck-herdr-activation: ${passed} assertions passed`);