@junghanacs/entwurf 0.33.0 → 0.34.1

package/scripts/check-herdr-plugin-build.ts

@@ -187,12 +187,18 @@ function tree(root: string): string[] {
  * installed package's activation verb is — absent, incapable (exits 0 on an empty request), or a
  * faithful recorder that refuses an empty request by name and logs the argv it was given.
  */
-function fixtureAcquire(opts: { activate: "absent" | "incapable" | "recorder"; log?: string; fail?: boolean }) {
+function fixtureAcquire(opts: {
+	activate: "absent" | "incapable" | "recorder";
+	log?: string;
+	fail?: boolean;
+	name?: string;
+}) {
+	const name = opts.name ?? PACKAGE;
 	return ({ identity, prefix }: AcquireArgs) => {
 		const version = identity.version ?? FIXTURE_VERSION;
-		const root = path.join(prefix, "node_modules", PACKAGE);
+		const root = path.join(prefix, "node_modules", name);
 		fs.mkdirSync(path.join(root, path.dirname(COMPILED_ENTRY)), { recursive: true });
-		fs.writeFileSync(path.join(root, "package.json"), `${JSON.stringify({ name: PACKAGE, version })}\n`);
+		fs.writeFileSync(path.join(root, "package.json"), `${JSON.stringify({ name, version })}\n`);
 		fs.writeFileSync(path.join(root, COMPILED_ENTRY), "// compiled entry fixture\n");
 		const bin = path.join(prefix, "node_modules", ".bin");
 		fs.mkdirSync(bin, { recursive: true });
@@ -222,7 +228,7 @@ function fixtureAcquire(opts: { activate: "absent" | "incapable" | "recorder"; l
 			observedDigest: `sha256-${createHash("sha256")
 				.update(identity.commit ?? "x")
 				.digest("hex")}`,
-			packageName: PACKAGE,
+			packageName: name,
 			packageVersion: version,
 		};
 	};
@@ -238,7 +244,7 @@ function drive(
 	env: NodeJS.ProcessEnv,
 	text: string | { error: string } | { status: number; stderr: string },
 	deps: Record<string, unknown> = {},
-): { code: number | null; refusal: string | null; out: string; progress: string[] } {
+): { code: number | null; refusal: string | null; detail: string; out: string; progress: string[] } {
 	let out = "";
 	// The operator's terminal is a SEAM here, never the real `/dev/tty`: a gate that narrated into
 	// whatever terminal happened to be running it would be writing outside its own sandbox.
@@ -269,11 +275,12 @@ function drive(
 			readRuntimeLock: () => FIXTURE_NPM_LOCK,
 			...deps,
 		});
-		return { code, refusal: null, out, progress: progressLines };
+		return { code, refusal: null, detail: "", out, progress: progressLines };
 	} catch (err) {
 		return {
 			code: null,
 			refusal: (err as { code?: string }).code ?? `not-a-HerdrBuildError:${String(err)}`,
+			detail: (err as { detail?: string }).detail ?? String(err),
 			out,
 			progress: progressLines,
 		};
@@ -727,6 +734,228 @@ function drive(
 	);
 }
 
+// ── 6c. the selected components' owners are asked before the first byte (#135) ─
+/** Run one of the shipped Pi ownership writers against a sandbox, exactly as run.sh does. */
+function piOwner(env: NodeJS.ProcessEnv, script: string, args: string[]): SpawnResult {
+	return spawnSync("python3", [path.join(REPO, "scripts", script), ...args], {
+		encoding: "utf8",
+		env,
+	}) as unknown as SpawnResult;
+}
+function piSettingsOf(env: NodeJS.ProcessEnv): string {
+	return path.join(env.HOME as string, ".pi", "agent", "settings.json");
+}
+function piStateOf(env: NodeJS.ProcessEnv, half: "package" | "provider"): string {
+	return path.join(env.XDG_DATA_HOME as string, "entwurf", `pi-${half}`, "install-state.json");
+}
+/** A LIVE foreign owner: a real directory standing for a developer checkout, registered for real. */
+function foreignPiOwner(env: NodeJS.ProcessEnv, halves: ("package" | "provider")[]): string {
+	const checkout = path.join(env.HOME as string, "dev", "entwurf");
+	fs.mkdirSync(checkout, { recursive: true });
+	fs.mkdirSync(path.dirname(piSettingsOf(env)), { recursive: true });
+	fs.writeFileSync(piSettingsOf(env), '{"theme":"dark"}\n');
+	if (halves.includes("package")) {
+		const r = piOwner(env, "register-pi-package.py", [
+			piSettingsOf(env),
+			checkout,
+			"--scope",
+			"user",
+			"--state",
+			piStateOf(env, "package"),
+		]);
+		assert.equal(r.status, 0, `fixture: seeding the foreign package owner failed: ${r.stderr}`);
+	}
+	if (halves.includes("provider")) {
+		const r = piOwner(env, "register-pi-provider.py", [
+			"install",
+			piSettingsOf(env),
+			checkout,
+			"--scope",
+			"user",
+			"--state",
+			piStateOf(env, "provider"),
+		]);
+		assert.equal(r.status, 0, `fixture: seeding the foreign provider owner failed: ${r.stderr}`);
+	}
+	return checkout;
+}
+/** An acquisition that must never be reached: it counts, and it throws a sentinel instead of fetching. */
+function countingSentinel(): { acquire: () => never; calls: () => number } {
+	let calls = 0;
+	return {
+		acquire: () => {
+			calls++;
+			throw new Error("HPB_OWNERSHIP_SENTINEL_NO_NETWORK");
+		},
+		calls: () => calls,
+	};
+}
+{
+	const env = world("owner-package");
+	foreignPiOwner(env, ["package"]);
+	const before = treeDigest(env.HOME as string);
+	const sentinel = countingSentinel();
+	const r = drive(env, listing({ pi: "current (v8) (/home/u/.pi)" }), {
+		acquire: sentinel.acquire,
+		resolveCommit: () => COMMIT_A,
+	});
+	const after = treeDigest(env.HOME as string);
+	ok(
+		"[QK:HPB-OWNERSHIP-BEFORE-ACQUISITION] a Pi user-scope registration owned by another LIVE root refuses the " +
+			"plugin install BEFORE anything is fetched or written: the SAME shipped package-owner preflight the installed " +
+			"activation runs is asked against the prospective plugin root, so the refusal names the component and the " +
+			"acquisition is never called — no installing journal, runtime, cache or ledger appears and every byte under " +
+			"the sandbox HOME is unchanged. The first cut asked only after bootstrap, so a known refusal still fetched and " +
+			`installed a runtime first (refusal=${r.refusal} acquired=${sentinel.calls()} home-unchanged=${before === after} ` +
+			`journal=${fs.existsSync(journalPathOf(env))} detail=${JSON.stringify(r.detail.slice(0, 160))})`,
+		r.refusal === "herdr-build-component-ownership-refused" &&
+			r.detail.includes("pi-package") &&
+			sentinel.calls() === 0 &&
+			before === after &&
+			!fs.existsSync(journalPathOf(env)),
+	);
+}
+{
+	// The provider key carries its OWN ownership record; a host whose package entry is free but whose
+	// provider key another root owns must refuse just as early.
+	const env = world("owner-provider");
+	foreignPiOwner(env, ["provider"]);
+	const before = treeDigest(env.HOME as string);
+	const sentinel = countingSentinel();
+	const r = drive(env, listing({ pi: "current (v8) (/home/u/.pi)" }), {
+		acquire: sentinel.acquire,
+		resolveCommit: () => COMMIT_A,
+	});
+	ok(
+		"[QK:HPB-OWNERSHIP-PROVIDER-HALF] the provider half is asked on its own: a free package entry with a provider " +
+			"key another LIVE root owns still refuses before acquisition, names `pi-provider`, and leaves the sandbox " +
+			`HOME byte-identical (refusal=${r.refusal} acquired=${sentinel.calls()} home-unchanged=${before === treeDigest(env.HOME as string)} detail=${JSON.stringify(r.detail.slice(0, 120))})`,
+		r.refusal === "herdr-build-component-ownership-refused" &&
+			r.detail.includes("pi-provider") &&
+			!r.detail.includes("pi-package:") &&
+			sentinel.calls() === 0 &&
+			before === treeDigest(env.HOME as string),
+	);
+}
+{
+	// Claude's preflight is its PLAN check (documents and managed-key shapes), run against the
+	// prospective root in plugin mode. It is not a claim about which root owns Claude.
+	const env = world("owner-claude-plan");
+	fs.mkdirSync(path.join(env.HOME as string, ".claude"), { recursive: true });
+	fs.writeFileSync(path.join(env.HOME as string, ".claude", "settings.json"), "[]\n");
+	const before = treeDigest(env.HOME as string);
+	const sentinel = countingSentinel();
+	const r = drive(env, listing({ claude: "current (v2) (/home/u/.claude)" }), {
+		acquire: sentinel.acquire,
+		resolveCommit: () => COMMIT_A,
+	});
+	ok(
+		"[QK:HPB-OWNERSHIP-CLAUDE-PLAN] a selected Claude whose install plan its own state owner refuses (a settings " +
+			"file that is not a JSON object) refuses before acquisition, names `claude-code`, and writes nothing " +
+			`(refusal=${r.refusal} acquired=${sentinel.calls()} home-unchanged=${before === treeDigest(env.HOME as string)} detail=${JSON.stringify(r.detail.slice(0, 120))})`,
+		r.refusal === "herdr-build-component-ownership-refused" &&
+			r.detail.includes("claude-code") &&
+			sentinel.calls() === 0 &&
+			before === treeDigest(env.HOME as string),
+	);
+}
+{
+	// Only the SELECTED components are asked: a backend Herdr has not integrated cannot veto another's install.
+	const piOnly = world("owner-unselected-claude");
+	fs.mkdirSync(path.join(piOnly.HOME as string, ".claude"), { recursive: true });
+	fs.writeFileSync(path.join(piOnly.HOME as string, ".claude", "settings.json"), "[]\n");
+	const piLog = path.join(piOnly.HOME as string, "argv.log");
+	const piRun = drive(piOnly, listing({ pi: "current (v8) (/home/u/.pi)" }), {
+		acquire: fixtureAcquire({ activate: "recorder", log: piLog }),
+		resolveCommit: () => COMMIT_A,
+	});
+	const claudeOnly = world("owner-unselected-pi");
+	foreignPiOwner(claudeOnly, ["package", "provider"]);
+	const claudeLog = path.join(claudeOnly.HOME as string, "argv.log");
+	const claudeRun = drive(claudeOnly, listing({ claude: "current (v2) (/home/u/.claude)" }), {
+		acquire: fixtureAcquire({ activate: "recorder", log: claudeLog }),
+		resolveCommit: () => COMMIT_A,
+	});
+	const logged = (f: string) => (fs.existsSync(f) ? fs.readFileSync(f, "utf8").trim() : "");
+	ok(
+		"[QK:HPB-OWNERSHIP-SELECTED-ONLY] only the backends in `A` are asked: Pi alone installs over a Claude settings " +
+			"file its owner would refuse, and Claude alone installs over a Pi registration another root owns — an " +
+			"unselected backend's owner never vetoes the selected one " +
+			`(pi-only=${piRun.code}/${piRun.refusal}/${JSON.stringify(logged(piLog))} claude-only=${claudeRun.code}/${claudeRun.refusal}/${JSON.stringify(logged(claudeLog))})`,
+		piRun.code === 0 && logged(piLog) === "pi" && claudeRun.code === 0 && logged(claudeLog) === "claude-code",
+	);
+}
+{
+	// A SAME-owner reinstall under a symlinked XDG_DATA_HOME. The installed verb sees its own root in
+	// PHYSICAL form (Node realpaths the ESM entry) and the provider owner records that root without
+	// resolving it, so the early ask must use the physical form too, while the stable command stays the
+	// lexical runtime address.
+	const home = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-hpb-owner-symlinked-")));
+	const realData = path.join(home, "real-data");
+	fs.mkdirSync(realData, { recursive: true });
+	fs.symlinkSync(realData, path.join(home, "data"));
+	const env: NodeJS.ProcessEnv = {
+		HOME: home,
+		XDG_DATA_HOME: path.join(home, "data"),
+		XDG_CACHE_HOME: path.join(home, "cache"),
+		XDG_STATE_HOME: path.join(home, "state"),
+		PATH: process.env.PATH,
+	};
+	const physicalRoot = path.join(realData, "entwurf", "herdr-plugin", "runtime", "active", "node_modules", PACKAGE);
+	fs.mkdirSync(path.dirname(piSettingsOf(env)), { recursive: true });
+	fs.writeFileSync(piSettingsOf(env), '{"theme":"dark"}\n');
+	const pkg = piOwner(env, "register-pi-package.py", [
+		piSettingsOf(env),
+		physicalRoot,
+		"--scope",
+		"user",
+		"--state",
+		piStateOf(env, "package"),
+	]);
+	const prov = piOwner(env, "register-pi-provider.py", [
+		"install",
+		piSettingsOf(env),
+		physicalRoot,
+		"--scope",
+		"user",
+		"--state",
+		piStateOf(env, "provider"),
+		"--plugin-runtime",
+		activeDirOf(env),
+	]);
+	assert.equal(pkg.status, 0, `fixture: same-owner package seed failed: ${pkg.stderr}`);
+	assert.equal(prov.status, 0, `fixture: same-owner provider seed failed: ${prov.stderr}`);
+	const log = path.join(home, "argv.log");
+	const r = drive(env, listing({ pi: "current (v8) (/home/u/.pi)" }), {
+		acquire: fixtureAcquire({ activate: "recorder", log }),
+		resolveCommit: () => COMMIT_A,
+	});
+	ok(
+		"[QK:HPB-OWNERSHIP-PHYSICAL-ROOT] a same-owner reinstall under a symlinked XDG_DATA_HOME is admitted, not " +
+			"mistaken for a foreign root: the early owner preflight asks with the PHYSICAL prospective package root " +
+			"(the form the installed verb records as its own) and passes the LEXICAL stable runtime as the plugin-mode " +
+			"runtime flag (the only form the provider owner accepts), so the build reaches activation " +
+			`(code=${r.code} refusal=${r.refusal} detail=${JSON.stringify(r.detail.slice(0, 160))})`,
+		r.code === 0 && fs.existsSync(log) && fs.readFileSync(log, "utf8").trim() === "pi",
+	);
+}
+{
+	// The owners were asked about one root; the installed verb must run from that same root.
+	const env = world("owner-root-tie");
+	const log = path.join(env.HOME as string, "argv.log");
+	const r = drive(env, listing({ pi: "current (v8) (/home/u/.pi)" }), {
+		acquire: fixtureAcquire({ activate: "recorder", log, name: "@elsewhere/entwurf" }),
+		readRuntimeLock: () => FIXTURE_CHECKOUT_LOCK,
+		resolveCommit: () => COMMIT_A,
+	});
+	ok(
+		"[QK:HPB-PLANNED-ROOT-TIE] the root the component owners were asked about is the root the installed verb runs " +
+			"from: an artifact that lands under another package name is refused by name before activation, so the early " +
+			`answer can never have been about a different root (refusal=${r.refusal} activated=${fs.existsSync(log)} detail=${JSON.stringify(r.detail.slice(0, 160))})`,
+		r.refusal === "herdr-build-artifact-drifted" && !fs.existsSync(log),
+	);
+}
+
 // ── 7. the runner claims nothing about Herdr's own commit ──────────────────────
 {
 	const env = world("post-build-gap");

package/scripts/check-release-gate-outcomes.ts

@@ -1098,7 +1098,7 @@ console.log(
 		"a run.sh wrapper declining its own prerequisite (including the measured LIVE=1 no-cortex-connection cell); and every " +
 		"LIVE smoke is either wired into release_gate or excluded by a sentence the docs still carry; and the moved " +
 		"check-gate-qualification stays reachable on its owners (absent from the default chain, exactly once in CI, " +
-		"exactly once as a release-gate MUST step) and the CI step qualifies the FULL floor, which runs before it, " +
+		"absent from release_gate: the one body is the prepared SHA's CI step) and the CI step qualifies the FULL floor, which runs before it, " +
 		"while the exact-SHA release oracle requires that BODY step to have concluded success at the release SHA, " +
 		"and the CI filter that decides when that body runs covers every mutant subject and still runs it for all " +
 		"five historical reds; and " +

package/scripts/emit-pi-durable-carrier.ts

@@ -10,9 +10,10 @@
  * Inputs, and nothing else: the pinned commit's OBJECTS (each declared file and the license, read as
  * `<commit>:<path>` — never a worktree, so the repository's checkout state cannot enter), the packaged
  * overlay patch, and this Node's `stripTypeScriptTypes` in strip mode (upstream runs these exact
- * sources under Node's strip-only TypeScript). The patch is applied by git's own engine to a private
- * scratch copy; the base blob and the patched result must carry the blob ids the patch's `index` line
- * names. Each stripped file is then relocated by pi/pi-durable/carrier-relocation.mjs, and the targets
+ * sources under Node's strip-only TypeScript). The one patch carries exactly one section per file the
+ * pin declares `patched`, and no other section (#134). Each section is applied by git's own engine to a
+ * private scratch copy of its file; the base blob and the patched result must carry the blob ids that
+ * section's `index` line names. Each stripped file is then relocated by pi/pi-durable/carrier-relocation.mjs, and the targets
  * the six files import must equal the pin's declared `distTargets` exactly.
  *
  * `--write` emits pi/pi-durable/carrier/{<files>,LICENSE} and fills the pin's generated fields
@@ -118,22 +119,60 @@ function readPin(): CarrierPin {
 			`the emitter is ${EMITTER_TOOL} in ${EMITTER_MODE} mode, not ${JSON.stringify(pin.carrier.emitter)}`,
 		);
 	}
-	if (pin.carrier.files.filter((f) => f.patched).length !== 1) {
-		throw refuse("carrier-pin-malformed", "exactly one carrier file carries the overlay patch");
+	if (!pin.carrier.files.some((f) => f.patched)) {
+		throw refuse("carrier-pin-malformed", "at least one carrier file carries the overlay patch");
 	}
 	return pin;
 }
 
-/** The overlay patch's one file and the two blob ids its `index` line names. */
-function readPatch(pin: CarrierPin): { bytes: Buffer; file: string; base: string; result: string } {
-	const bytes = fs.readFileSync(path.join(DURABLE, "overlay", pin.patches[0]));
-	const text = bytes.toString("utf8");
-	const files = [...text.matchAll(/^diff --git a\/(\S+) b\/(\S+)$/gm)];
-	const index = [...text.matchAll(/^index ([0-9a-f]+)\.\.([0-9a-f]+) 100644$/gm)];
-	if (files.length !== 1 || files[0][1] !== files[0][2] || index.length !== 1) {
-		throw refuse("carrier-patch-shape", `${pin.patches[0]} must change exactly one existing file`);
+/** One file's section of the overlay patch: its own bytes and the two blob ids its `index` line names. */
+export interface PatchSection {
+	bytes: Buffer;
+	base: string;
+	result: string;
+}
+
+/**
+ * The overlay patch split into its per-file sections, keyed by the existing file each one changes, and
+ * matched against the source paths the pin declares `patched`: exactly one section per declared file and
+ * no section for any other file. Anything else is the patch's shape, refused by name.
+ */
+export function patchSections(
+	text: string,
+	patched: readonly string[],
+	name = "the overlay patch",
+): Map<string, PatchSection> {
+	const starts = [...text.matchAll(/^diff --git /gm)].map((m) => m.index);
+	if (starts.length === 0 || starts[0] !== 0) {
+		throw refuse("carrier-patch-shape", `${name} must start with its first file section`);
+	}
+	const sections = new Map<string, PatchSection>();
+	for (const [at, start] of starts.entries()) {
+		const chunk = text.slice(start, starts[at + 1] ?? text.length);
+		const files = [...chunk.matchAll(/^diff --git a\/(\S+) b\/(\S+)$/gm)];
+		const index = [...chunk.matchAll(/^index ([0-9a-f]+)\.\.([0-9a-f]+) 100644$/gm)];
+		if (files.length !== 1 || files[0][1] !== files[0][2] || index.length !== 1) {
+			throw refuse("carrier-patch-shape", `every section of ${name} changes exactly one existing file`);
+		}
+		const file = files[0][1];
+		if (sections.has(file)) throw refuse("carrier-patch-shape", `${name} changes ${file} in two sections`);
+		sections.set(file, { bytes: Buffer.from(chunk, "utf8"), base: index[0][1], result: index[0][2] });
 	}
-	return { bytes, file: files[0][1], base: index[0][1], result: index[0][2] };
+	const undeclared = [...sections.keys()].filter((file) => !patched.includes(file));
+	const missing = patched.filter((file) => !sections.has(file));
+	if (undeclared.length > 0 || missing.length > 0) {
+		throw refuse(
+			"carrier-patch-shape",
+			`${name} must change exactly the files the pin declares patched (undeclared: ${undeclared.join(", ") || "none"}; missing: ${missing.join(", ") || "none"})`,
+		);
+	}
+	return sections;
+}
+
+function readPatch(pin: CarrierPin): Map<string, PatchSection> {
+	const text = fs.readFileSync(path.join(DURABLE, "overlay", pin.patches[0]), "utf8");
+	const patched = pin.carrier.files.filter((f) => f.patched).map((f) => f.source);
+	return patchSections(text, patched, pin.patches[0]);
 }
 
 /** `base` with the patch applied by git, in a private scratch tree outside any repository. */
@@ -172,7 +211,7 @@ function emit(source: string, pin: CarrierPin): Emission {
 	if (git(source, ["cat-file", "-t", pin.commit]).toString().trim() !== "commit") {
 		throw refuse("carrier-source-unreadable", `${pin.commit} is not a commit in ${source}`);
 	}
-	const patch = readPatch(pin);
+	const sections = readPatch(pin);
 	const names = pin.carrier.files.map((f) => f.name);
 	const targets = pin.carrier.distTargets;
 	if (new Set(targets).size !== targets.length) throw refuse("carrier-pin-malformed", "distTargets repeats a path");
@@ -183,18 +222,19 @@ function emit(source: string, pin: CarrierPin): Emission {
 		const original = readSourceObject(source, `${pin.commit}:${declared.source}`);
 		const blob = blobId(original);
 		let text = original;
-		if (declared.patched) {
-			if (declared.source !== patch.file || !blob.startsWith(patch.base)) {
+		const section = declared.patched ? sections.get(declared.source) : undefined;
+		if (section !== undefined) {
+			if (!blob.startsWith(section.base)) {
 				throw refuse(
 					"carrier-patch-base",
-					`the patch changes ${patch.file} from ${patch.base}; ${declared.source} is ${blob}`,
+					`the patch changes ${declared.source} from ${section.base}; the pinned object is ${blob}`,
 				);
 			}
-			text = applyPatch(declared.source, original, patch.bytes);
-			if (!blobId(text).startsWith(patch.result)) {
+			text = applyPatch(declared.source, original, section.bytes);
+			if (!blobId(text).startsWith(section.result)) {
 				throw refuse(
 					"carrier-patch-result",
-					`patched ${declared.source} is ${blobId(text)}, the patch names ${patch.result}`,
+					`patched ${declared.source} is ${blobId(text)}, the patch names ${section.result}`,
 				);
 			}
 		}

package/scripts/herdr-activation.mjs

@@ -155,6 +155,22 @@ export function writeLedger(layout, entry) {
  * host it was never describing.
  */
 export function readCertifiedLedger(layout) {
+	// lstat FIRST (#135). `readFileSync` follows links, so a dangling symlink at the ledger address
+	// read as ENOENT — "no ledger" — and every verb then acted as if nothing had ever been activated.
+	// Only a regular file, or nothing at all, may stand there.
+	let kind;
+	try {
+		kind = fs.lstatSync(layout.ledgerPath, { throwIfNoEntry: false });
+	} catch (err) {
+		throw new ActivationError("activation-ledger-uncertified", `${layout.ledgerPath}: ${err.message}`);
+	}
+	if (kind === undefined) return null;
+	if (!kind.isFile()) {
+		throw new ActivationError(
+			"activation-ledger-uncertified",
+			`${layout.ledgerPath} is ${kind.isSymbolicLink() ? "a symlink" : kind.isDirectory() ? "a directory" : "not a regular file"}; only a regular file or nothing may stand at the ledger address`,
+		);
+	}
 	let raw;
 	try {
 		raw = fs.readFileSync(layout.ledgerPath, "utf8");

package/scripts/herdr-plugin-activate.mjs

@@ -33,11 +33,11 @@ import {
 	certifyRootsAgainstLedger,
 	componentStates,
 	ledgerBody,
+	piStatePaths,
 	planActivation,
 	readCertifiedLedger,
 	resolveActivationLayout,
 	resolveComponentRoots,
-	resolveEntwurfDataRoot,
 	writeLedger,
 } from "./herdr-activation.mjs";
 import {
@@ -49,8 +49,109 @@ import {
 
 const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
-function run(command, args, env) {
-	return spawnSync(command, args, { encoding: "utf8", env, stdio: ["ignore", "pipe", "pipe"] });
+function run(command, args, env, spawn = spawnSync) {
+	return spawn(command, args, { encoding: "utf8", env, stdio: ["ignore", "pipe", "pipe"] });
+}
+
+/**
+ * Ask every selected component's OWN ownership authority, read-only, whether a write for
+ * `packageRoot` would be admitted. Returns the refused `[name, result]` pairs; writes nothing.
+ *
+ * TWO CALL POSITIONS, ONE LIST (#135). The installed verb below asks it about itself, after the
+ * runtime exists. The Herdr build asks it BEFORE any byte of runtime work, with the checkout's copy
+ * of the same owners and the PROSPECTIVE installed root — so an owner the late check would refuse
+ * is refused while nothing has been fetched. `scriptRoot` is whose owner scripts run; `packageRoot`
+ * is the root they judge. The prospective root must be in the form this verb will later see as its
+ * own PACKAGE_ROOT (physical: Node realpaths the ESM entry), because the provider owner records the
+ * root without resolving it; `runtimeRoot` stays the lexical stable address the commands are
+ * derived from.
+ *
+ * Claude's preflight is its document/plan-shape check. It does not judge which root owns Claude.
+ */
+export function preflightSelectedComponents(
+	env,
+	{ scriptRoot, packageRoot, runtimeRoot, selected, spawn = spawnSync },
+) {
+	const preflights = [];
+	if (selected.includes("claude-code")) {
+		preflights.push([
+			"claude-code",
+			// The mode rides the ARGV, because that is what the state owner reads. The env var is the
+			// installer script's channel; passing only that preflights the DEFAULT mode and then
+			// installs the plugin one — a green check of work nobody is going to do.
+			run(
+				"python3",
+				[
+					path.join(scriptRoot, "scripts", "meta-bridge-state.py"),
+					"preflight-install",
+					"--repo",
+					packageRoot,
+					"--plugin-runtime",
+					runtimeRoot,
+				],
+				{ ...env, ENTWURF_PLUGIN_RUNTIME: runtimeRoot },
+				spawn,
+			),
+		]);
+	}
+	if (selected.includes("pi")) {
+		const agentSettings = path.join(resolveComponentRoots(env).piAgentDir.path, "settings.json");
+		// ONE resolution for both owner records, the one their writers use (`run.sh` `${XDG_DATA_HOME:-…}`).
+		const piState = piStatePaths(env);
+		// BOTH halves. The user-scope citizen is a package registration and a provider key with
+		// SEPARATE ownership records, and a foreign or corrupt package state refuses independently —
+		// preflighting only the provider would let the first ledger write land on a host the package
+		// writer was always going to refuse.
+		preflights.push([
+			"pi-package",
+			run(
+				"python3",
+				[
+					path.join(scriptRoot, "scripts", "register-pi-package.py"),
+					agentSettings,
+					packageRoot,
+					"--scope",
+					"user",
+					"--state",
+					piState.packageState,
+					"--preflight",
+				],
+				env,
+				spawn,
+			),
+		]);
+		preflights.push([
+			"pi-provider",
+			run(
+				"python3",
+				[
+					path.join(scriptRoot, "scripts", "register-pi-provider.py"),
+					"install",
+					agentSettings,
+					packageRoot,
+					"--scope",
+					"user",
+					"--state",
+					piState.providerState,
+					"--plugin-runtime",
+					runtimeRoot,
+					"--preflight",
+				],
+				env,
+				spawn,
+			),
+		]);
+	}
+	return preflights.filter(([, r]) => r.status !== 0);
+}
+
+/** The owner's own last line for each refused component, for the operator to act on. */
+export function describeRefusedComponents(refused) {
+	return refused
+		.map(
+			([name, r]) => `${name}: ${(r.stderr || r.stdout || (r.error ? r.error.message : "")).trim().split("\n").pop()}`,
+		)
+		.join("; ");
 }
 
 /** The only input: a subset of P, parsed from argv and refused if it is anything else. */
@@ -113,79 +214,14 @@ export function activate(env, requested) {
 	const plan = planActivation({ ledger, requested });
 	const selected = [...plan.reconcile, ...plan.add];
 
-	// 3. preflight EVERY selected component before the first byte.
-	const preflights = [];
-	if (selected.includes("claude-code")) {
-		preflights.push([
-			"claude-code",
-			// The mode rides the ARGV, because that is what the state owner reads. The env var is the
-			// installer script's channel; passing only that preflights the DEFAULT mode and then
-			// installs the plugin one — a green check of work nobody is going to do.
-			run(
-				"python3",
-				[
-					path.join(PACKAGE_ROOT, "scripts", "meta-bridge-state.py"),
-					"preflight-install",
-					"--repo",
-					PACKAGE_ROOT,
-					"--plugin-runtime",
-					runtime.activeDir,
-				],
-				{ ...env, ENTWURF_PLUGIN_RUNTIME: runtime.activeDir },
-			),
-		]);
-	}
-	if (selected.includes("pi")) {
-		const agentSettings = path.join(roots.piAgentDir.path, "settings.json");
-		const dataRoot = resolveEntwurfDataRoot(env);
-		// BOTH halves. The user-scope citizen is a package registration and a provider key with
-		// SEPARATE ownership records, and a foreign or corrupt package state refuses independently —
-		// preflighting only the provider would let the first ledger write land on a host the package
-		// writer was always going to refuse.
-		preflights.push([
-			"pi-package",
-			run(
-				"python3",
-				[
-					path.join(PACKAGE_ROOT, "scripts", "register-pi-package.py"),
-					agentSettings,
-					PACKAGE_ROOT,
-					"--scope",
-					"user",
-					"--state",
-					path.join(dataRoot, "pi-package", "install-state.json"),
-					"--preflight",
-				],
-				env,
-			),
-		]);
-		preflights.push([
-			"pi-provider",
-			run(
-				"python3",
-				[
-					path.join(PACKAGE_ROOT, "scripts", "register-pi-provider.py"),
-					"install",
-					agentSettings,
-					PACKAGE_ROOT,
-					"--scope",
-					"user",
-					"--state",
-					path.join(
-						env.XDG_DATA_HOME ?? path.join(env.HOME, ".local", "share"),
-						"entwurf",
-						"pi-provider",
-						"install-state.json",
-					),
-					"--plugin-runtime",
-					runtime.activeDir,
-					"--preflight",
-				],
-				env,
-			),
-		]);
-	}
-	const refused = preflights.filter(([, r]) => r.status !== 0);
+	// 3. preflight EVERY selected component before the first byte — the same list the Herdr build
+	// already asked about the prospective root; this is the installed recheck.
+	const refused = preflightSelectedComponents(env, {
+		scriptRoot: PACKAGE_ROOT,
+		packageRoot: PACKAGE_ROOT,
+		runtimeRoot: runtime.activeDir,
+		selected,
+	});
 	if (refused.length > 0) {
 		for (const [name, r] of refused) {
 			process.stderr.write(`  ${name}: ${(r.stderr || r.stdout || "").trim().split("\n").pop()}\n`);