@junghanacs/entwurf 0.33.0 → 0.34.1

package/scripts/herdr-plugin-deactivate.mjs

@@ -25,6 +25,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import {
+	ActivationError,
 	certifyPhaseForInverse,
 	certifyRootsAgainstLedger,
 	componentStates,
@@ -49,6 +50,31 @@ function fail(code, detail) {
 	process.exit(1);
 }
 
+/**
+ * What stands at this host's fixed plugin addresses — journal, runtime root, our npm cache — by
+ * lstat, without reading or following anything. Only consulted when there is no ledger.
+ */
+function leftoversAtPluginAddresses(runtime) {
+	const found = [];
+	for (const [label, target] of [
+		["journal", runtime.journalPath],
+		["runtime", runtime.runtimeRoot],
+		["cache", runtime.cacheDir],
+	]) {
+		const stat = fs.lstatSync(target, { throwIfNoEntry: false });
+		if (stat === undefined) continue;
+		const kind = stat.isSymbolicLink()
+			? "symlink"
+			: stat.isDirectory()
+				? "directory"
+				: stat.isFile()
+					? "file"
+					: "other";
+		found.push(`${label}=${kind} (${target})`);
+	}
+	return found;
+}
+
 export function deactivate(env) {
 	const activation = resolveActivationLayout(env);
 	const runtime = resolveRuntimeLayout(env);
@@ -56,8 +82,21 @@ export function deactivate(env) {
 
 	const ledger = readCertifiedLedger(activation);
 	if (ledger === null) {
-		process.stdout.write("[herdr-plugin-deactivate] no certified activation ledger — nothing to undo\n");
-		return 0;
+		// NO LEDGER IS NOT "NOTHING HERE" (#135). An install that stopped before its activation was
+		// recorded leaves a journal, a runtime or a cache behind, and saying "nothing to undo" over them
+		// was a false success. Without a ledger nothing proves what they belong to or that no harness
+		// wiring names them, so this verb removes nothing: it names what it found and exits non-zero.
+		const leftovers = leftoversAtPluginAddresses(runtime);
+		if (leftovers.length === 0) {
+			process.stdout.write("[herdr-plugin-deactivate] no certified activation ledger — nothing to undo\n");
+			return 0;
+		}
+		throw new ActivationError(
+			"deactivate-unattributed-leftovers",
+			`no certified activation ledger, yet ${leftovers.join(", ")} — NOTHING was removed. Without an activation ` +
+				"ledger nothing proves what these belong to or that no harness wiring still names them; inspect them and " +
+				"remove them by hand only if they are yours",
+		);
 	}
 	certifyRootsAgainstLedger(ledger, roots, runtime.activeDir);
 	certifyPhaseForInverse(ledger);

package/scripts/mutants/gate-qualification.json

@@ -95,6 +95,30 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:QUALIFY-PRIOR-RUN-EVIDENCE-KEPT]",
 			"signatureSource": "scripts/check-gate-qualification.ts"
+		},
+		{
+			"claim": "QUALIFY-DOOR-FORWARDS-ARGV",
+			"title": "run.sh check-gate-qualification drops its arguments again — a requested --group/--receipt PARTIAL reaches the runner as a bare call and starts the whole ~900-mutant body nobody asked for (#133: the wrapper defect that made every development PARTIAL a whole run)",
+			"subject": "run.sh",
+			"find": ["    run_ts scripts/check-gate-qualification.ts \"$@\""],
+			"replace": ["    run_ts scripts/check-gate-qualification.ts"],
+			"gate": ["bash", "run.sh", "check-gate-manifests"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:QUALIFY-DOOR-FORWARDS-ARGV]",
+			"signatureSource": "scripts/check-gate-qualification.ts"
+		},
+		{
+			"claim": "QUALIFY-DOOR-REFUSES-BEFORE-BODY",
+			"title": "run.sh check-gate-qualification retries bare when the runner refuses — a malformed, missing or repeated flag is named, then the whole body starts anyway in place of the PARTIAL that was asked for (#133)",
+			"subject": "run.sh",
+			"find": ["    run_ts scripts/check-gate-qualification.ts \"$@\""],
+			"replace": [
+				"    run_ts scripts/check-gate-qualification.ts \"$@\" || run_ts scripts/check-gate-qualification.ts"
+			],
+			"gate": ["bash", "run.sh", "check-gate-manifests"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:QUALIFY-DOOR-REFUSES-BEFORE-BODY]",
+			"signatureSource": "scripts/check-gate-qualification.ts"
 		}
 	]
 }

package/scripts/mutants/herdr-activation.json

@@ -316,6 +316,41 @@
 			"timeoutSeconds": 420,
 			"signature": "[QK:HAC-REBIND-ATOMIC-CHECKPOINT]",
 			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "HAC-PI-STATE-PATHS-SHARED",
+			"title": "resolving the provider owner record with `??` turns an empty XDG_DATA_HOME into a relative path no writer uses, so the preflight sees no owner and the ledger lands on a host the provider writer then refuses",
+			"subject": "scripts/herdr-plugin-activate.mjs",
+			"find": ["\t\tconst piState = piStatePaths(env);"],
+			"replace": [
+				"\t\tconst piState = { packageState: piStatePaths(env).packageState, providerState: path.join(env.XDG_DATA_HOME ?? path.join(env.HOME, \".local\", \"share\"), \"entwurf\", \"pi-provider\", \"install-state.json\") };"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-PI-STATE-PATHS-SHARED]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "HAC-NO-LEDGER-LEFTOVERS-REPORTED",
+			"title": "answering 'nothing to undo' whenever the ledger is absent is a false success over the journal, runtime or cache an aborted install left behind",
+			"subject": "scripts/herdr-plugin-deactivate.mjs",
+			"find": ["\t\tif (leftovers.length === 0) {"],
+			"replace": ["\t\tif (true) {"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-NO-LEDGER-LEFTOVERS-REPORTED]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "HAC-LEDGER-PATH-KIND",
+			"title": "reading the ledger without lstat lets a dangling symlink answer ENOENT, i.e. 'no ledger', and every verb then acts as if nothing had ever been activated",
+			"subject": "scripts/herdr-activation.mjs",
+			"find": ["\tif (!kind.isFile()) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-LEDGER-PATH-KIND]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
 		}
 	]
 }

package/scripts/mutants/herdr-plugin-build.json

@@ -162,6 +162,72 @@
 			"timeoutSeconds": 300,
 			"signature": "[QK:HPB-INSTALL-USAGE-NOTE]",
 			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-OWNERSHIP-BEFORE-ACQUISITION",
+			"title": "not asking the selected components' owners before bootstrap fetches and installs a runtime for a registration another root owns — the refusal only arrives after the bytes are on disk, which is the #135 ordering defect",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\tcertifyComponentOwners(env, {"],
+			"replace": ["\t((_env, _args) => {})(env, {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-OWNERSHIP-BEFORE-ACQUISITION]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-OWNERSHIP-PROVIDER-HALF",
+			"title": "dropping the provider half lets a host whose provider key another root owns pass the early check, so the runtime is fetched for an install its own provider writer was always going to refuse",
+			"subject": "scripts/herdr-plugin-activate.mjs",
+			"find": ["\t\tpreflights.push([", "\t\t\t\"pi-provider\","],
+			"replace": ["\t\tif (false) preflights.push([", "\t\t\t\"pi-provider\","],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-OWNERSHIP-PROVIDER-HALF]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-OWNERSHIP-CLAUDE-PLAN",
+			"title": "skipping Claude's plan preflight lets a selected Claude whose settings its own state owner cannot plan reach acquisition, and the refusal lands only after the runtime is installed",
+			"subject": "scripts/herdr-plugin-activate.mjs",
+			"find": ["\tif (selected.includes(\"claude-code\")) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-OWNERSHIP-CLAUDE-PLAN]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-OWNERSHIP-SELECTED-ONLY",
+			"title": "asking every backend instead of the selected ones lets a harness Herdr has not integrated veto the install of one it has",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\t\tselected: profile.activate,", "\t\tspawn,"],
+			"replace": ["\t\tselected: [\"pi\", \"claude-code\"],", "\t\tspawn,"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-OWNERSHIP-SELECTED-ONLY]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-OWNERSHIP-PHYSICAL-ROOT",
+			"title": "asking the owners with the lexical prospective root makes a same-owner reinstall under a symlinked XDG_DATA_HOME look like a foreign root, because the installed verb records its own root in physical form",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\t\t\treturn path.join(fs.realpathSync(probe), ...rest);"],
+			"replace": ["\t\t\treturn path.join(probe, ...rest);"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-OWNERSHIP-PHYSICAL-ROOT]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-PLANNED-ROOT-TIE",
+			"title": "without the tie the owners can have been asked about one root while the installed verb runs from another, so the early answer is about bytes nobody installed",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\tif (completeness.name !== plannedName || landedRoot !== plannedRoot) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-PLANNED-ROOT-TIE]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
 		}
 	]
 }

package/scripts/mutants/herdr-runtime-bootstrap.json

@@ -398,10 +398,10 @@
 		},
 		{
 			"claim": "HRB-PREPARE-STDOUT-CLEAN",
-			"title": "silencing stderr instead of stdout is the exact byte that broke the first clean-host install: husky writes `.git can't be found` to STDOUT when npm packs our GitHub git spec (no `.git` in a codeload tarball), npm merges that line into `npm pack --json`, and a perfectly good artifact is refused as `runtime-checkout-source-unavailable` — invisible to both the fake-npm cells here and to the LIVE gate, whose `insteadOf` mirror is cloned and therefore HAS a `.git`",
+			"title": "silencing stderr instead of routing stdout to it lets the `prepare` bridge build's stdout into the `npm pack --json` stream this rail parses — the class of byte that broke the first clean-host install, when husky (then part of `prepare`) wrote `.git can't be found` to STDOUT while npm packed our GitHub git spec (no `.git` in a codeload tarball) and a perfectly good artifact was refused as `runtime-checkout-source-unavailable`, invisible to both the fake-npm cells here and to the LIVE gate, whose `insteadOf` mirror is cloned and therefore HAS a `.git`",
 			"subject": "package.json",
-			"find": ["\t\t\"prepare\": \"husky 1>&2 || true; npm run --silent build-bridge 1>&2\","],
-			"replace": ["\t\t\"prepare\": \"husky 2>/dev/null || true; npm run --silent build-bridge\","],
+			"find": ["\t\t\"prepare\": \"npm run --silent build-bridge 1>&2\","],
+			"replace": ["\t\t\"prepare\": \"npm run --silent build-bridge 2>/dev/null\","],
 			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:HRB-PREPARE-STDOUT-CLEAN]",

package/scripts/mutants/pi-durable.json

@@ -53,12 +53,8 @@
 			"claim": "PI-DURABLE-BOOTSTRAP-ARGV-NO-BRIDGE-ENTRY",
 			"title": "the launch argv accepts --bridge-entry, so a caller can point the contact at a bridge outside this package",
 			"subject": "pi/pi-durable/bootstrap.mjs",
-			"find": [
-				"const VALUE_FLAGS = [\"--provider\", \"--model\", \"--width\", \"--entwurf-bootstrap\", \"--native-module\"];"
-			],
-			"replace": [
-				"const VALUE_FLAGS = [\"--bridge-entry\", \"--provider\", \"--model\", \"--width\", \"--entwurf-bootstrap\", \"--native-module\"];"
-			],
+			"find": ["const VALUE_FLAGS = ["],
+			"replace": ["const VALUE_FLAGS = [\n\t\"--bridge-entry\","],
 			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:PI-DURABLE-BOOTSTRAP-ARGV-NO-BRIDGE-ENTRY]",
@@ -345,7 +341,7 @@
 			"claim": "PI-DURABLE-CARRIER-PIN-MATCHES",
 			"title": "the pin records a digest the committed carrier file does not carry, so a carrier edited after emission would still be the declared one",
 			"subject": "pi/pi-durable/overlay/upstream-pin.json",
-			"find": ["\"sha256\": \"ca0ee10dc904a57d46bb33b37fcc4efe48dfa08b2f0d10e79e7bc22136871f0a\""],
+			"find": ["\"sha256\": \"bfd88844fae61e8bd32d57b5b986f48056c64eebb5466d9826318a0783ac9005\""],
 			"replace": ["\"sha256\": \"0000000000000000000000000000000000000000000000000000000000000000\""],
 			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
 			"timeoutSeconds": 300,
@@ -588,8 +584,8 @@
 			"claim": "PI-DURABLE-MODULE-ABSENT-UNCHANGED",
 			"title": "the module phase runs without a --native-module, so a launch that names no module still tries to import one",
 			"subject": "pi/pi-durable/bootstrap.mjs",
-			"find": ["\tconst extensions = nativeModule === undefined ? [] : [await loadNativeModule(nativeModule)];"],
-			"replace": ["\tconst extensions = false ? [] : [await loadNativeModule(nativeModule)];"],
+			"find": ["\tconst { nativeModules = [], ...args } = parseArgs(argv);"],
+			"replace": ["\tconst { nativeModules = [undefined], ...args } = parseArgs(argv);"],
 			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:PI-DURABLE-MODULE-ABSENT-UNCHANGED]",
@@ -619,7 +615,7 @@
 			"title": "the module initializes after the TUI is imported, so its environment arrives after the SDK modules have evaluated",
 			"subject": "pi/pi-durable/bootstrap.mjs",
 			"find": [
-				"\tconst extensions = nativeModule === undefined ? [] : [await loadNativeModule(nativeModule)];",
+				"\tconst extensions = await loadNativeModules(nativeModules);",
 				"\t// Loaded before anything opens, as upstream main.ts imports it statically: a TUI that cannot",
 				"\t// load opens no session, mints no citizen and leaves nothing to clean up.",
 				"\tconst { runDurableTui } = await loadTui();"
@@ -628,7 +624,7 @@
 				"\t// Loaded before anything opens, as upstream main.ts imports it statically: a TUI that cannot",
 				"\t// load opens no session, mints no citizen and leaves nothing to clean up.",
 				"\tconst { runDurableTui } = await loadTui();",
-				"\tconst extensions = nativeModule === undefined ? [] : [await loadNativeModule(nativeModule)];"
+				"\tconst extensions = await loadNativeModules(nativeModules);"
 			],
 			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
 			"timeoutSeconds": 300,
@@ -718,6 +714,177 @@
 				"argv": ["bash", "scripts/build-bridge.sh"],
 				"output": "mcp/entwurf-bridge/dist"
 			}
+		},
+		{
+			"claim": "PI-DURABLE-CARRIER-PATCH-SECTIONS",
+			"title": "a declared patched file with no section of its own passes the patch-shape check, so the emitter would ship that file unpatched",
+			"subject": "scripts/emit-pi-durable-carrier.ts",
+			"find": ["\tif (undeclared.length > 0 || missing.length > 0) {"],
+			"replace": ["\tif (undeclared.length > 0) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-CARRIER-PATCH-SECTIONS]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-FOOTER-GRAPH-LIFETIME",
+			"title": "/tasks closes the task-graph observation again, so hiding the panel also hides live background work from the badge",
+			"subject": "pi/pi-durable/carrier/runtime.js",
+			"find": ["\t\t\ttoggleTasks: () => command(async () => update({ tasksPanel: !state.tasksPanel })),"],
+			"replace": [
+				"\t\t\ttoggleTasks: () => command(async () => update({ tasksPanel: !state.tasksPanel, tasks: state.tasksPanel ? undefined : state.tasks })),"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-FOOTER-GRAPH-LIFETIME]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-FOOTER-BADGE-COUNT",
+			"title": "the badge counts every live task, foreground generation and tool tasks included, so an idle-but-turning session shows phantom background work",
+			"subject": "pi/pi-durable/carrier/tui.js",
+			"find": ["\t\tconst nodes = Object.values(graph?.tasks ?? {}).filter((node) => node.background);"],
+			"replace": ["\t\tconst nodes = Object.values(graph?.tasks ?? {});"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-FOOTER-BADGE-COUNT]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-FOOTER-BADGE-WIDTH",
+			"title": "the badge has no one- or two-cell form, so a very narrow terminal shows a bare marker with no count",
+			"subject": "pi/pi-durable/carrier/tui.js",
+			"find": ["\t\tconst forms = [...detailed, tasks, `⏳ ${n}`, `⏳${n}`, `*${n}`, \"*+\", \"*\"];"],
+			"replace": ["\t\tconst forms = [...detailed, tasks, `⏳ ${n}`, `⏳${n}`, \"*\"];"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-FOOTER-BADGE-WIDTH]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-FOOTER-BADGE-PROTECTED",
+			"title": "the badge sits last in the dock, so the renderer's bottom clip drops it first on a short terminal",
+			"subject": "pi/pi-durable/carrier/tui.js",
+			"find": [
+				"\t\t{ component: new VStack([{ component: badge, shrink: 0 }, ...dock]), basis: \"auto\", grow: 0, shrink: 1, minSize: 1 },"
+			],
+			"replace": [
+				"\t\t{ component: new VStack([...dock, { component: badge, shrink: 0 }]), basis: \"auto\", grow: 0, shrink: 1, minSize: 1 },"
+			],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-FOOTER-BADGE-PROTECTED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-FOOTER-ZERO-UPSTREAM",
+			"title": "a one-row terminal hides the transcript even with no background work, so the idle screen is no longer upstream's",
+			"subject": "pi/pi-durable/carrier/tui.js",
+			"find": ["\t\t\tvisible: (viewport) => badge.count === 0 || viewport.height > 1,"],
+			"replace": ["\t\t\tvisible: (viewport) => viewport.height > 1,"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-FOOTER-ZERO-UPSTREAM]",
+			"signatureSource": "pi-extensions/lib/pi-durable-carrier.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-DIR-TOPLEVEL-FILTER",
+			"title": "a dotfile ending in .extension.mjs counts as a module, so a hidden file in the named directory is evaluated as operator code",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["const MODULE_ENTRY = /^[^.].*\\.extension\\.mjs$/;"],
+			"replace": ["const MODULE_ENTRY = /\\.extension\\.mjs$/;"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-DIR-TOPLEVEL-FILTER]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-DIR-ORDER-BYTEWISE",
+			"title": "modules are ordered by the locale's collation, so the initialization order depends on the host's language settings",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\t\t.sort((a, b) => Buffer.compare(Buffer.from(a), Buffer.from(b)));"],
+			"replace": ["\t\t.sort((a, b) => a.localeCompare(b));"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-DIR-ORDER-BYTEWISE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-DIR-REFUSED",
+			"title": "a named directory without a module launches with none, so a wrong path or an unrenamed plain index.mjs goes unnoticed",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\tif (names.length === 0) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-DIR-REFUSED]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-DIR-EXCLUSIVE",
+			"title": "naming both the file and the directory silently keeps only the file",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\tif (moduleArg !== undefined && dirArg !== undefined) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-DIR-EXCLUSIVE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
+		},
+		{
+			"claim": "PI-DURABLE-MODULE-DIR-NAME-DUPLICATE",
+			"title": "a second module's same-named extension or tool is accepted, so the native registry replaces the first extension or keeps both tools without a word",
+			"subject": "pi/pi-durable/bootstrap.mjs",
+			"find": ["\t\t\tif (owners.has(name)) {"],
+			"replace": ["\t\t\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-pi-durable-beside"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:PI-DURABLE-MODULE-DIR-NAME-DUPLICATE]",
+			"signatureSource": "pi-extensions/lib/pi-durable-native-module.test.ts",
+			"build": {
+				"argv": ["bash", "scripts/build-bridge.sh"],
+				"output": "mcp/entwurf-bridge/dist"
+			}
 		}
 	]
 }