@junghanacs/entwurf 0.34.0 → 0.34.1

package/CHANGELOG.md

@@ -4,6 +4,111 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.34.1 - 2026-10-09
+
+### Release coordination
+
+- **A patch cut for #135.** Coordinated by the pi-durable citizen `20261008T113104-801621` and
+  implemented by Claude Code Opus as sole writer, under the maintainer's grant through prepare and
+  make; npm publication is not part of that grant. This section is written at prepare time, before
+  the release gates run: the `check:full`, package-consumer and `release-gate --cut` results are
+  recorded in the operator handoff and the GitHub release, not claimed here. Their raw logs stay
+  under the ignored `.tmp-verify/135-install-ownership/writer/release-0341/{p4,p6,p5}/`.
+- **The published 0.34.0 does not carry these fixes.** Its registry bytes stay as accepted.
+
+### Herdr plugin
+
+- **Component owners are asked before anything is fetched (#135).** The plugin build now runs the
+  selected components' read-only owner preflights — Pi package, Pi provider, and the Claude
+  meta-bridge plan — before runtime acquisition, on the same Pi state paths the activation reads. A
+  foreign Pi owner refuses with no runtime, journal, cache or ledger written, and the refusal says
+  to release the registration from the root that owns it (its own `remove-user-scope`): a takeover
+  from the plugin's root is not a route. The check is planned against the physical prospective
+  runtime root; a landed package whose name or root differs from that plan refuses as
+  `herdr-build-artifact-drifted`. The installed activation keeps its own preflight recheck.
+- **`herdr-plugin-deactivate` without a ledger no longer reports success over leftovers.** With no
+  certified activation ledger it exits 0 only when nothing stands at the plugin's journal, runtime
+  and cache addresses; otherwise it names what it found and exits non-zero
+  (`deactivate-unattributed-leftovers`), removing nothing.
+- **Only a regular file or nothing may stand at the activation ledger address.** A symlink,
+  dangling or not, or a directory at `activation.json` refuses as `activation-ledger-uncertified`.
+- **Limits that stay.** The Claude install state records the last installer and is not root-bound.
+  Roots changed between runs, or a host changing between the early owner check and the installed
+  recheck, can still refuse after the download. The no-ledger deactivate reports leftovers and
+  neither reclaims nor reuses them. No wider Claude-root or ownership guarantee is added.
+  `docs/setup-clean-host.md` §1.1 names the four installation paths and these limits.
+- **The runtime lock rides the `herdr-checkout` verification carrier for this window.**
+  `plugins/herdr/runtime-lock.json` returns from npm 0.34.0 to the closed `herdr-checkout` source,
+  so the lock stays coherent with the 0.34.1 package version without inventing a registry
+  integrity. The plugin manifest stays 0.34.0, and this is not a plugin pair: the npm re-pin to
+  0.34.1 follows publication with its measured sha512 and its own source proof. Moving a host
+  between the published npm 0.34.0 plugin and this carrier, in either direction, needs
+  `herdr-plugin-deactivate` first.
+
+### Repository hooks
+
+- **`prepare` no longer runs husky.** It only builds the bridge. The local
+  `core.hooksPath=.husky/_` override that shadowed the configured global guard was removed on this
+  checkout, and `.husky/pre-commit` (whitespace, lint, typecheck) is reached through a global guard
+  that chains to repository-local hooks. Another existing clone may keep its local value until it
+  is unset there (unmeasured). On this checkout a real `npm pack` inside `check-pack-install` left
+  `.git/config` and `.husky/_` unchanged. The `husky` devDependency is unchanged.
+
+## v2026.10.9-herdr.0.34.0 — Herdr Entwurf plugin 0.34.0
+
+A Herdr plugin snapshot, not a core release: no package version, npm artifact or core tag moves.
+
+### Herdr plugin
+
+- **Runtime re-pinned to the published 0.34.0 (#132 B).** `plugins/herdr/runtime-lock.json`
+  returns from the `herdr-checkout` verification carrier the 0.30.1 preparation rode to the npm
+  production source: `@junghanacs/entwurf@0.34.0` with the registry's measured sha512
+  (`sha512-rUpQ…/uJ/fw==`), which is the artifact accepted and published as 0.34.0. 0.31–0.33
+  were never pinned here. The manifest version moves 0.30.1 → 0.34.0; `min_herdr_version` stays
+  0.9.0 and the measured Herdr supply stays 0.9.3.
+- **Upgrading from a 0.30.1 plugin install needs an explicit deactivate.** That install recorded a
+  `herdr-checkout` runtime and ledger, and npm is a different acquisition source, which is refused
+  rather than inherited (`activation-artifact-source-drifted`). Run `entwurf
+  herdr-plugin-deactivate`, then `herdr plugin install` again. A host with no plugin installation
+  starts fresh.
+- **The release skill's core baseline ignores Herdr snapshot tags.** `prepare` P1 took the newest
+  tag by version sort, and a `vYYYY.M.D-herdr.*` tag sorts above every `v0.x`, so it would have
+  become the next core audit baseline. P1 now excludes exactly that shape; a core `v20.1.0` is
+  still picked.
+- **Plugin docs corrected before the tag (GLG's final review).**
+  - The direct route opens six fresh-call backends, `pi-durable` among them as the managed launcher.
+    The plugin's Herdr pair stays `{pi, claude-code}`, and the manifest now says it does not widen
+    with the core list.
+  - `smoke-herdr-plugin-build-live` is described as the checkout-carrier journey it is, not as
+    registry evidence.
+  - `herdr-plugin-deactivate` is given by its absolute runtime path, because the plugin puts nothing
+    on `PATH`.
+  - The plugin tag namespace is explained.
+  - A v1 record is now described as refused by the current inverse as well. The launch-rail doc
+    separates the `0.9.0` admission floor from the single Herdr version the gates certify (the
+    supply pin, 0.9.3).
+
+### Verification
+
+- **Real-npm swap and torn-swap recovery, measured before commit.** This is the row the 0.30.0
+  pin left open. A one-shot driver ran the registry-shipped `scripts/herdr-runtime.mjs`, whose
+  sha256 equals this checkout's, against the real registry:
+  - A 0.33.0 → 0.34.0 swap.
+  - The same upgrade torn between its two renames (`torn-swap-with-candidate`), then resumed.
+    The last-good 0.33.0 tree was restored before 0.34.0 was acquired again.
+  - Both ended `runtime-ready` with observed digest
+    `sha256-e9d995ff3858ffca40fa12b4fce2a6db3802da3ee27c7b233142fc4c71f23450`, the accepted
+    artifact. Neither left a staging or backup directory behind.
+  - Each 0.34.0 runtime passed the installed-runtime check: three executable bins, the compiled
+    entry, and `check-bridge` with its exact eight verbs. The owned inverse removed cache,
+    runtime and journal.
+  - Two earlier runs stopped on defects in the driver's own verb parser, not on product behaviour.
+- The focused Herdr gates (`check-herdr-plugin`, `-plugin-profile`, `-plugin-build`,
+  `-runtime-bootstrap`, `-activation`) and `check-gate-manifests` are green on this tree. No gate,
+  mutant or matrix changed, so no qualification PARTIAL is owed.
+- The public-ref first-user path (`smoke-herdr-raw-install-live`) and the exact-SHA CI run on the
+  pushed commit. Their receipts are recorded in the GitHub release and #132, not claimed here.
+
 ## 0.34.0 - 2026-10-09
 
 ### Release coordination

package/CONTRIBUTING.md

@@ -30,7 +30,7 @@ pnpm check              # everyday core (prints wall time; <=60s on the referenc
 pnpm run check:full     # full deterministic floor — the required PR gate
 ```
 
-The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory; zero COMMITTED mutants executed — the self-test runs only its synthetic fixture mutants in tmp fixture repos — ~20s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on a branch push whose diff touched the qualification surface (and unconditionally on dispatch or the weekly schedule) and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling").
+The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory; zero COMMITTED mutants executed — the self-test runs only its synthetic fixture mutants in tmp fixture repos — ~20s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on a branch push whose diff touched the qualification surface (and unconditionally on dispatch or the weekly schedule) and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling"). No install or build lifecycle script installs git hooks: a global `core.hooksPath` guard that chains to repository-local hooks runs its own checks, then delegates — to `.husky/pre-commit` here, unless an executable `.git/hooks/pre-commit` takes precedence.
 
 For changes that touch backend launch, session lifecycle, or `_meta` shape, also run
 the live ACP smokes that cover the touched rail — at minimum:

package/VERIFY.md

@@ -96,7 +96,7 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 
 > **The herdr rail is an on-demand axis until it has run.** `smoke-herdr-fresh-call-live` opens a real caller inside a real herdr pane, has it invoke the PUBLIC `entwurf_fresh_call`, and reads the child's nonce callback — the one axis no deterministic gate reaches, since the rail is selected from the caller's own process environment. **The release aggregate does not yet require the herdr rail**: herdr is optional (a cut on a host without it must not block), and first evidence precedes promotion — a rail whose first acceptance run is days old has not earned a place in the gate that blocks every cut. Run it directly with `LIVE=1 ./run.sh smoke-herdr-fresh-call-live` whenever a cut changes herdr rail code, and promote it to a MUST only after the axis has a run history to point at. Without `LIVE=1`, or without herdr/pi/claude on PATH, it reports protocol SKIP — never a pass.
 
-> **The plugin's FIRST USER PATH is its own on-demand axis, and an npm acquisition receipt holds only for the ref it ran on (#118 홉 1).** Every other herdr gate proves the plugin against a source this repository controls: `check-herdr-plugin-build` drives a stub, and `smoke-herdr-plugin-build-live` redirects the product remote to a local bare clone with git `insteadOf` and asserts `identity.kind === "herdr-checkout"`. npm has been the production authority class since `dd84ac0`; the 0.30.0 follow-up re-pinned `@junghanacs/entwurf@0.30.0` with its published sha512 after the candidate windows rode `herdr-checkout` (`8b92e09`). The **unpublished 0.30.1 preparation** now uses that closed verification carrier again, without inventing a registry integrity. The source re-proof has separate dated npm rows: 2026-09-23 public `main=113ca53`, plugin 0.5.0, runtime 0.25.0 (CHANGELOG 0.25.1), and the 0.30.0 re-pin accepted at public `506c46f` in the [#126 thread](https://github.com/junghan0611/entwurf/issues/126). Neither certifies a future 0.30.1 registry acquisition. After publication and a measured re-pin, that source owes its own public-ref run; checkout candidate evidence does not transfer. `LIVE=1 ./run.sh smoke-herdr-raw-install-live [--ref <REF>]` fills that row in a clean `node:24` container with no socket, config, cache or repo mounted, no `insteadOf`, the public remote spelled as a user would type it, and pi / herdr / Claude Code installed in the IMAGE BUILD as scaffolding (Hard Rule 17 — the product face begins at `herdr integration install pi`). herdr itself comes from `scripts/install-herdr-ci.sh` against `scripts/fixtures/herdr-supply.json`, so no version or digest lives here. `--ref` defaults to `main` rather than a pinned SHA because receipt (a) is defined as what a user gets today; the resolved commit is printed, so the receipt stays exact. It takes a REMOTE REF and not an arbitrary commit — measured on herdr 0.9.1, `--ref <sha>` fails as `couldn't find remote ref`, because the checkout fetches by name — so a candidate is addressed by its branch and pinned by the resolved commit the gate prints. **Its first question is a measurement, not an assumption:** herdr registers a plugin through a running server and falls back to `persist_plugin_offline` only on a connection error (`src/cli/plugin.rs:914-981,1016-1021` @ `c77af189`, 0.9.0 source), and a container has no server. The 2026-09-23 PASS installed with no server on the 0.9.1 binary `113ca53`'s `herdr-supply.json` pins, so that install path worked on 0.9.1 — inferred from the PASS, not a direct observation of the fallback branch; a later "no" on another herdr is #118 investigation output rather than a completion. `--yes` is always passed so a non-interactive exit 2 (`:189`) can never be misread as a missing server. **At a ref whose lock names `herdr-checkout` the acquisition axis reports a NAMED SKIP rather than a red, and the rest of the journey still runs.** That lock is the candidate carrier a cut legitimately sits on — 0.23.0 was tagged that way and `dd84ac0` pinned npm afterwards — so a red there would report a broken install when what is true is that the ref does not lock npm. What is asserted at BOTH lock kinds is that the runtime came from the source the ref locks, and the package name is read from the checkout manifest rather than the lock, because a `herdr-checkout` lock carries no `name` (`herdr-runtime.mjs:317-328`) and joining `undefined` throws instead of failing an assertion. **Cells [6]–[9] carry it past the install into the USE path (#118 H1-4/H1-5).** An install is not a use, so the same container then runs what those bytes became: the compiled bridge entry, the three `REQUIRED_BINS` as executables, and a real `entwurf check-bridge` printing its exact eight-verb set — the installed-runtime row below, measured rather than inferred from the bootstrap's refusal to install without them. Then the pi that this plugin WIRED is started with no `-e` and no `--no-extensions`, because the subject is the wiring and not this checkout: one `get_state` in `--mode rpc` costs zero tokens and needs no provider argument (a bogus `--provider` exits 1 before session_start; omitting the pair lets pi resolve the default the extension itself registers), and while that session is alive the cell reads its V3 record, its gardenId-keyed control socket, and the installed `entwurf peer-facts` reporting it `alive`. The plugin's own status fan is then driven with NEITHER side stubbed, in both states a user can be in: with no herdr server it must name `herdr-agent-list-failed` and go red rather than draw an empty table, and under a headless `herdr server` — scaffolding for that second read only, stopped again before the teardown — it exits 0 and COUNTS the citizen as `unobserved` instead of dropping it. Last, the shipped `entwurf herdr-plugin-deactivate` runs from the installed bin, deletes the runtime it is executing from, and the plugin reinstalls onto the host it fully left — the deactivation row, on the npm source. **What these cells still do not close:** swap / torn-swap recovery on the npm source, the package-consumer proof, and the fan drawing a citizen as a ROW — that needs `placement.kind === "herdr-pane"`, so the pi session must live in a herdr pane a session reference joins, and a headless container has no panes. **This smoke carries no test beside behavior and no mutant**, and that is a property of its class rather than an omission: it is a real-live container journey whose oracle is the container's own end state, so there is no pure seam to assert against and nothing a source mutation could kill deterministically. Like the other two herdr LIVE lanes it is **on-demand and not an aggregate MUST** — herdr is optional, a cut on a host without it must not block, and first evidence precedes promotion. Without `LIVE=1`, or without a usable Docker daemon, it reports a named SKIP; `ENTWURF_REQUIRE_DOCKER=1` turns the Docker absence red. Neither skip is a pass.
+> **The plugin's FIRST USER PATH is its own on-demand axis, and an npm acquisition receipt holds only for the ref it ran on (#118 홉 1).** Every other herdr gate proves the plugin against a source this repository controls: `check-herdr-plugin-build` drives a stub, and `smoke-herdr-plugin-build-live` redirects the product remote to a local bare clone with git `insteadOf` and asserts `identity.kind === "herdr-checkout"`. npm has been the production authority class since `dd84ac0`; the 0.30.0 follow-up re-pinned `@junghanacs/entwurf@0.30.0` with its published sha512 after the candidate windows rode `herdr-checkout` (`8b92e09`), and the 0.30.1 preparation rode that closed verification carrier again without inventing a registry integrity. The last published plugin snapshot `v2026.10.9-herdr.0.34.0` pins the published `@junghanacs/entwurf@0.34.0` with its measured sha512 (#132); 0.31–0.33 were never pinned. This checkout's unpublished 0.34.1 preparation rides the closed `herdr-checkout` verification carrier again, without inventing a registry integrity: it has no published npm SRI and is not a plugin pair. The source re-proof has separate dated npm rows: 2026-09-23 public `main=113ca53`, plugin 0.5.0, runtime 0.25.0 (CHANGELOG 0.25.1), and the 0.30.0 re-pin accepted at public `506c46f` in the [#126 thread](https://github.com/junghan0611/entwurf/issues/126). Neither certifies the 0.34.0 registry acquisition. That pin's real-npm swap / torn-swap recovery was measured locally on 2026-10-09 by driving the registry-shipped `scripts/herdr-runtime.mjs` (byte-equal to this checkout's) with its own npm acquisition: a 0.33.0 → 0.34.0 swap, and the same upgrade torn between its two renames then resumed, where the last-good 0.33.0 tree was restored before 0.34.0 was acquired again. Both ended `runtime-ready` at observed digest `sha256-e9d995ff…`, the accepted 0.34.0 artifact. That local receipt is recorded in the [#132 thread](https://github.com/junghan0611/entwurf/issues/132); it covers runtime recovery, not this smoke's cells. The public-ref acceptance of this smoke is PENDING the prepared push, and its actual result will be recorded there; checkout candidate evidence does not transfer. `LIVE=1 ./run.sh smoke-herdr-raw-install-live [--ref <REF>]` fills that row in a clean `node:24` container with no socket, config, cache or repo mounted, no `insteadOf`, the public remote spelled as a user would type it, and pi / herdr / Claude Code installed in the IMAGE BUILD as scaffolding (Hard Rule 17 — the product face begins at `herdr integration install pi`). herdr itself comes from `scripts/install-herdr-ci.sh` against `scripts/fixtures/herdr-supply.json`, so no version or digest lives here. `--ref` defaults to `main` rather than a pinned SHA because receipt (a) is defined as what a user gets today; the resolved commit is printed, so the receipt stays exact. It takes a REMOTE REF and not an arbitrary commit — measured on herdr 0.9.1, `--ref <sha>` fails as `couldn't find remote ref`, because the checkout fetches by name — so a candidate is addressed by its branch and pinned by the resolved commit the gate prints. **Its first question is a measurement, not an assumption:** herdr registers a plugin through a running server and falls back to `persist_plugin_offline` only on a connection error (`src/cli/plugin.rs:914-981,1016-1021` @ `c77af189`, 0.9.0 source), and a container has no server. The 2026-09-23 PASS installed with no server on the 0.9.1 binary `113ca53`'s `herdr-supply.json` pins, so that install path worked on 0.9.1 — inferred from the PASS, not a direct observation of the fallback branch; a later "no" on another herdr is #118 investigation output rather than a completion. `--yes` is always passed so a non-interactive exit 2 (`:189`) can never be misread as a missing server. **At a ref whose lock names `herdr-checkout` the acquisition axis reports a NAMED SKIP rather than a red, and the rest of the journey still runs.** That lock is the candidate carrier a cut legitimately sits on — 0.23.0 was tagged that way and `dd84ac0` pinned npm afterwards — so a red there would report a broken install when what is true is that the ref does not lock npm. What is asserted at BOTH lock kinds is that the runtime came from the source the ref locks, and the package name is read from the checkout manifest rather than the lock, because a `herdr-checkout` lock carries no `name` (`herdr-runtime.mjs:317-328`) and joining `undefined` throws instead of failing an assertion. **Cells [6]–[9] carry it past the install into the USE path (#118 H1-4/H1-5).** An install is not a use, so the same container then runs what those bytes became: the compiled bridge entry, the three `REQUIRED_BINS` as executables, and a real `entwurf check-bridge` printing its exact eight-verb set — the installed-runtime row below, measured rather than inferred from the bootstrap's refusal to install without them. Then the pi that this plugin WIRED is started with no `-e` and no `--no-extensions`, because the subject is the wiring and not this checkout: one `get_state` in `--mode rpc` costs zero tokens and needs no provider argument (a bogus `--provider` exits 1 before session_start; omitting the pair lets pi resolve the default the extension itself registers), and while that session is alive the cell reads its V3 record, its gardenId-keyed control socket, and the installed `entwurf peer-facts` reporting it `alive`. The plugin's own status fan is then driven with NEITHER side stubbed, in both states a user can be in: with no herdr server it must name `herdr-agent-list-failed` and go red rather than draw an empty table, and under a headless `herdr server` — scaffolding for that second read only, stopped again before the teardown — it exits 0 and COUNTS the citizen as `unobserved` instead of dropping it. Last, the shipped `entwurf herdr-plugin-deactivate` runs from the installed bin, deletes the runtime it is executing from, and the plugin reinstalls onto the host it fully left — the deactivation row, on the npm source. **What these cells still do not close:** swap / torn-swap recovery on the npm source, the package-consumer proof, and the fan drawing a citizen as a ROW — that needs `placement.kind === "herdr-pane"`, so the pi session must live in a herdr pane a session reference joins, and a headless container has no panes. **This smoke carries no test beside behavior and no mutant**, and that is a property of its class rather than an omission: it is a real-live container journey whose oracle is the container's own end state, so there is no pure seam to assert against and nothing a source mutation could kill deterministically. Like the other two herdr LIVE lanes it is **on-demand and not an aggregate MUST** — herdr is optional, a cut on a host without it must not block, and first evidence precedes promotion. Without `LIVE=1`, or without a usable Docker daemon, it reports a named SKIP; `ENTWURF_REQUIRE_DOCKER=1` turns the Docker absence red. Neither skip is a pass.
 
 > **The Herdr plugin's install-time build has two axes, and one of them needs the network (#116 M3-b3).** `check-herdr-plugin-build` is deterministic and rides `check:hermetic`: the listing reaches the runner through its own spawn seam (there is no fake `herdr` binary in this repo), and the one cell that drives the REAL binary reports a named SKIP on a host without it — `ENTWURF_REQUIRE_HERDR=1` makes that absence red. What it cannot have is the real acquisition: `npm pack git+https://github.com/junghan0611/entwurf.git#<full sha>` builds the bridge through `prepare`, which installs devDependencies from the registry. So `LIVE=1 ./run.sh smoke-herdr-plugin-build-live` owns that axis, and its cells are **two kinds of evidence, labelled as such**: three are the real Herdr journey — a real `herdr plugin install` driving the real `[[build]]`, with the UNCHANGED product remote redirected to a local bare clone by git `insteadOf` (the one substitution, which is what makes an unpushed candidate testable) — covering remote-commit available, the `{pi}` → `{pi, claude-code}` reinstall with OpenCode as a zero-write negative control and exactly ONE counted vendor MCP owner entry, and the post-build Herdr-commit gap (where the ledger has already rebound to the gap commit, so the honest assertion is that transition and not unchanged bytes). The fourth cell — remote-commit **unavailable** — calls the shipped runtime leaf directly with the fixed product argv and is therefore **acquisition-leaf evidence, not a journey**; routing it through Herdr would add a second explanation for one red. Its oracle is the honest one too: active runtime, ledger and harness bytes preserved, while the journal is left as the certified `installing` retry authority the transaction deliberately writes before acquiring, and a normal install afterwards is green. Its Claude cell is where the vendor question the deterministic gates refuse to claim gets answered — whether Claude Code accepts an ABSOLUTE executable as an MCP command — and it reports a named skip on a host without `claude`, never a pass. Like the herdr fresh-call rail, this smoke is **on-demand and not an aggregate MUST**. The release aggregate does not require the plugin build smoke: herdr is optional, a cut on a host without it must not block, and first evidence precedes promotion.
 

package/docs/setup-clean-host.md

@@ -179,6 +179,24 @@ packageRoot↔installerRoot coupling mismatch and a package/provider managed-pat
 | source checkout | the checkout dir | `dev-bin` symlinks (`setup`) | `<project>/.pi/settings.json` | shared entry + owner state | `takeover-user-scope` from the new checkout | `remove` (project) / `remove-user-scope` (global, same-owner-only) | `doctor-pi-package` → `missing-owner`; normal install still refuses |
 | global npm (`npm i -g`) | the global `node_modules/@junghanacs/entwurf` | npm bin linking | same | same shared entry | same explicit action | same; a LIVE foreign owner always refuses | same |
 | project-local npm | that project's `node_modules/@junghanacs/entwurf` | `node_modules/.bin` | same | same shared entry | same explicit action | same | same; a deleted root becomes the aligned `remove-user-scope` orphan cleanup (entry + package state + provider installerRoot must all name that missing root) |
+| Herdr plugin | `$XDG_DATA_HOME/entwurf/herdr-plugin/runtime/active/node_modules/@junghanacs/entwurf` | none on PATH — Pi provider and Claude MCP/statusLine record ABSOLUTE commands under that runtime | none | same shared entry, plus the plugin's activation ledger (`$XDG_STATE_HOME/entwurf/herdr-plugin/activation.json`) | none — the plugin never takes a registration over; release it from its owner first | the runtime's own absolute `…/node_modules/.bin/entwurf herdr-plugin-deactivate` | — |
+
+The four installation paths keep separate records: Herdr's plugin registry (changed only by `herdr
+plugin install` / `unlink` / `uninstall`), the plugin's runtime journal and activation ledger, the shared Pi
+package/provider ownership above, and the Claude meta-bridge install state
+(`${CLAUDE_CONFIG_DIR:-~/.claude}/entwurf.install-state.json`). Moving between them is explicit: release the
+shared registration from its owner (`remove-user-scope`, plus `uninstall-meta-bridge` for Claude) before
+`herdr plugin install` — a foreign Pi owner refuses the plugin build before anything is fetched (#135) — and
+run the plugin's `herdr-plugin-deactivate` before going back to `setup`. Do not `takeover-user-scope` a
+registration the plugin owns, even though a refused `setup` suggests it: it splits ownership (the plugin's
+provider key becomes an unowned override while its ledger still records pi) and the plugin's deactivate
+then refuses. Limits that stay as they are: the Claude install state records the LAST installer and is not
+root-bound — an install from another root rewrites it rather than refusing; nothing covers roots (XDG,
+`PI_CODING_AGENT_DIR`, Claude config) changed between runs or a host that changes between the plugin's
+early owner check and its installed recheck, which can still refuse after the download; and the plugin's
+deactivate, finding no activation ledger, reports what is left at its addresses and neither reclaims nor
+reuses it. The no-ledger diagnostic is not in the published 0.34.0 runtime; a plugin host receives it only
+from a later published runtime the plugin pins.
 
 ## 2. Optional pi adapter / ACP plugin
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.34.0",
+	"version": "0.34.1",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, Antigravity, and Codex CLI; Claude and Snowflake Cortex Code ACP backends.",
 	"license": "MIT",
 	"author": {
@@ -119,7 +119,7 @@
 		"vitest": "4.1.9"
 	},
 	"scripts": {
-		"prepare": "husky 1>&2 || true; npm run --silent build-bridge 1>&2",
+		"prepare": "npm run --silent build-bridge 1>&2",
 		"postinstall": "node scripts/postinstall-chmod.cjs",
 		"build-bridge": "bash scripts/with-dist-lock.sh bash scripts/build-bridge.sh",
 		"prepack": "pnpm run build-bridge 1>&2",

package/run.sh

@@ -294,7 +294,7 @@ Usage:
   ./run.sh remove [project-dir]       # remove entwurf entries from project .pi/settings.json (project scope only; global user-scope citizen left intact)
   ./run.sh install-user-scope [--plugin-runtime <root>]  # #116 M3-b2 PLUGIN-ONLY forward seam: compose ONLY the global pi citizen (user-scope packages[] + provider), never a project `.pi/settings.json` — a Herdr plugin activation has no project and must not invent one. With --plugin-runtime the provider's managed command becomes the absolute bridge under that certified stable runtime (a clean host has nothing entwurf on PATH); without it every byte is the historical bare-bin install. Inverse: remove-user-scope
   ./run.sh herdr-plugin-activate <backend...>  # #116 M3-b2 public forward activation. Takes a subset of {pi, claude-code} and NOTHING else — the stable runtime root is DERIVED from XDG here and handed down, and both harness writers accept a named root only when it IS that derived one. Certifies the runtime-ready journal AND the installed tree, certifies the existing ledger and its recorded harness roots, plans ADD-ONLY (a backend absent from this request is retained, never removed), preflights every selected component before the first byte, then writes each component `pending` BEFORE mutating and checkpoints `active` the moment its writer returns — so a run that dies halfway leaves a record of how far it got. Which backends is M3-b3's question: this verb is handed the answer, it does not read Herdr's integration status
-  ./run.sh herdr-plugin-deactivate   # #116 M3-b2 public teardown of a Herdr-plugin activation. Herdr's `plugin uninstall` deletes its checkout and calls NO cleanup hook, so the harness wiring and the stable runtime are retained, not cleaned — this is the shipped verb that takes them back. Certifies the activation ledger, the resolved Pi/Claude roots and BOTH component inverses read-only first; mutates only when every preflight is green; then Claude -> Pi user scope -> runtime -> ledger LAST. A component failure stops with the runtime and ledger intact as retry authority. Static imports only: the process deletes the runtime it is running from, and a lazy import after that fails
+  ./run.sh herdr-plugin-deactivate   # #116 M3-b2 public teardown of a Herdr-plugin activation. Herdr's `plugin uninstall` deletes its checkout and calls NO cleanup hook, so the harness wiring and the stable runtime are retained, not cleaned — this is the shipped verb that takes them back. Certifies the activation ledger, the resolved Pi/Claude roots and BOTH component inverses read-only first; mutates only when every preflight is green; then Claude -> Pi user scope -> runtime -> ledger LAST. A component failure stops with the runtime and ledger intact as retry authority. With NO ledger it removes nothing: a clean host exits 0, and anything found at the plugin's journal/runtime/cache addresses is named with a non-zero exit (#135). Static imports only: the process deletes the runtime it is running from, and a lazy import after that fails
   ./run.sh remove-user-scope          # explicit GLOBAL inverse of install's user-scope citizen: drop entwurf from ~/.pi/agent/settings.json packages[] (affects ALL cwds — shared entry, not per-project). #86 C2: same-owner-only — a LIVE foreign owner refuses; a MISSING owner is removed only when package entry + package state + provider installerRoot all align (reported orphan cleanup)
   ./run.sh takeover-user-scope        # #86 C2: operator-EXPLICIT ownership move of the shared user-scope registration to THIS root (old→new reported, packages[] entry + provider installerRoot together). The only writer over another owner — normal install/setup/remove refuse instead. No --force exists
   ./run.sh doctor-pi-package          # #86 C2: package-side user-scope ownership verdict — unregistered / owned / owned-by-other(live) / legacy-no-state / mismatch / missing-owner (nonzero on defect verdicts). Provider runtime verdicts stay with doctor-pi-provider
@@ -4393,8 +4393,8 @@ _check_pack_install_impl() {
 
   # Fresh-temp install smoke. Uses pnpm because that is what this
   # repo packages with; --ignore-workspace stops it from re-attaching
-  # to our pnpm-workspace.yaml; --ignore-scripts blocks the husky
-  # prepare hook (and any future install scripts) from running inside
+  # to our pnpm-workspace.yaml; --ignore-scripts blocks
+  # prepare (and any future install scripts) from running inside
   # the consumer project. The pi SDK is pinned to the CURRENT pi release
   # baseline (the package.json exact production dependency — the pins below
   # are what check-dep-versions binds to it) so the smoke matches the same

package/scripts/check-gate-qualification.ts

@@ -3471,8 +3471,8 @@ let manifestCount: number;
 		"herdr-placement": 13,
 		"herdr-plugin": 25,
 		"herdr-plugin-profile": 14,
-		"herdr-activation": 25,
-		"herdr-plugin-build": 14,
+		"herdr-activation": 28,
+		"herdr-plugin-build": 20,
 		"herdr-runtime-bootstrap": 31,
 		"herdr-fresh-call": 38,
 		"herdr-supply": 11,

package/scripts/check-herdr-activation.ts

@@ -27,6 +27,7 @@ import os from "node:os";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
+import { treeDigest } from "./lib/tree-digest.ts";
 
 let passed = 0;
 function ok(label: string, cond: boolean): void {
@@ -737,21 +738,12 @@ function ledgerWith(
 	const dataRoot = resolveEntwurfDataRoot(bare);
 	const states = piStatePaths(bare);
 	const piExpected = path.join(home, ".local", "share", "entwurf");
-	// The python writers derive the SAME stable root from the SAME environment.
-	const pyRoot = spawnSync(
-		"python3",
-		[
-			"-c",
-			"import sys; sys.path.insert(0, 'scripts'); from importlib import import_module; m = import_module('register-pi-provider'.replace('-', '_')) if False else None",
-		],
-		{ encoding: "utf8", env: bare },
-	);
 	ok(
 		"[QK:HAC-XDG-RESOLUTION-SHARED] every root comes from one resolution — `XDG_DATA_HOME`, else " +
 			"`$HOME/.local/share` — so a host with XDG unset is the same host to the teardown as it is to the writers. " +
 			'The first cut built its Pi state paths from `env.XDG_DATA_HOME || ""`, which on such a host pointed at ' +
 			"`/entwurf/...`: a preflight that looked at a file nobody writes and passed for the wrong reason " +
-			`(dataRoot=${dataRoot === piExpected} packageState=${path.relative(home, states.packageState)} py=${pyRoot.status === 0})`,
+			`(dataRoot=${dataRoot === piExpected} packageState=${path.relative(home, states.packageState)})`,
 		dataRoot === piExpected &&
 			states.packageState === path.join(piExpected, "pi-package", "install-state.json") &&
 			states.providerState === path.join(piExpected, "pi-provider", "install-state.json"),
@@ -1364,4 +1356,132 @@ function ledgerWith(
 	);
 }
 
+// ── 26. both Pi owner records are asked where their writers keep them (#135 D1) ─
+{
+	const env = world("pi-state-paths");
+	const defaultData = path.join(env.HOME as string, ".local", "share");
+	// An EMPTY XDG_DATA_HOME: run.sh and the runtime owner both fall back to $HOME/.local/share.
+	const runEnv = { ...env, XDG_DATA_HOME: "" };
+	seedRuntime({ ...env, XDG_DATA_HOME: defaultData });
+	const agentSettings = path.join(env.PI_CODING_AGENT_DIR as string, "settings.json");
+	fs.writeFileSync(agentSettings, '{"theme":"dark"}\n');
+	const foreign = path.join(env.HOME as string, "dev", "entwurf");
+	fs.mkdirSync(foreign, { recursive: true });
+	const seeded = py(env, "register-pi-provider.py", [
+		"install",
+		agentSettings,
+		foreign,
+		"--scope",
+		"user",
+		"--state",
+		path.join(defaultData, "entwurf", "pi-provider", "install-state.json"),
+	]);
+	assert.equal(seeded.status, 0, `fixture: seeding the provider owner failed: ${seeded.stderr}`);
+	const layout = resolveActivationLayout(runEnv);
+	const run = spawnSync("node", [ACTIVATE, "pi"], { encoding: "utf8", env: runEnv, cwd: env.HOME as string });
+	ok(
+		"[QK:HAC-PI-STATE-PATHS-SHARED] both Pi ownership preflights read the record where its writer keeps it: with " +
+			"XDG_DATA_HOME set but EMPTY, run.sh writes to $HOME/.local/share, so the provider preflight must look there " +
+			"too — the first cut built a RELATIVE path for the provider half alone, saw no owner, and let the ledger land " +
+			`on a host the provider writer then refused (exit=${run.status} ledger=${fs.existsSync(layout.ledgerPath)} refusal=${JSON.stringify((run.stderr || "").trim().split("\n").pop())})`,
+		run.status !== 0 &&
+			(run.stderr || "").includes("activation-preflight-refused") &&
+			(run.stderr || "").includes("pi-provider") &&
+			!fs.existsSync(layout.ledgerPath),
+	);
+}
+
+// ── 27. no ledger is not "nothing here" (#135) ─────────────────────────────────
+{
+	const plugin = (env: NodeJS.ProcessEnv) => path.join(env.XDG_DATA_HOME as string, "entwurf", "herdr-plugin");
+	const rows: [string, (env: NodeJS.ProcessEnv) => void][] = [
+		[
+			"installing-journal",
+			(env) => {
+				fs.mkdirSync(path.join(plugin(env), "runtime"), { recursive: true });
+				fs.writeFileSync(
+					path.join(plugin(env), "journal.json"),
+					`${JSON.stringify({
+						schemaVersion: 2,
+						phase: "installing",
+						runtimeRoot: runtimeRootOf(env),
+						artifactIdentity: { kind: "npm", name: PACKAGE, version: "0.21.0", expectedIntegrity: "sha512-fixture" },
+						previousRuntime: null,
+					})}\n`,
+				);
+			},
+		],
+		["ready-runtime", (env) => void seedRuntime(env)],
+		[
+			"cache-only",
+			(env) =>
+				fs.mkdirSync(path.join(env.XDG_CACHE_HOME as string, "entwurf", "herdr-plugin", "npm"), { recursive: true }),
+		],
+		["journal-less-runtime", (env) => fs.mkdirSync(path.join(plugin(env), "runtime", "active"), { recursive: true })],
+	];
+	const results = rows.map(([tag, make]) => {
+		const env = world(`no-ledger-${tag}`);
+		make(env);
+		const before = treeDigest(env.HOME as string);
+		const run = spawnSync("node", [DEACTIVATE], { encoding: "utf8", env });
+		return {
+			tag,
+			status: run.status,
+			named: (run.stderr || "").includes("deactivate-unattributed-leftovers"),
+			unchanged: before === treeDigest(env.HOME as string),
+		};
+	});
+	const clean = world("no-ledger-clean");
+	const cleanRun = spawnSync("node", [DEACTIVATE], { encoding: "utf8", env: clean });
+	ok(
+		"[QK:HAC-NO-LEDGER-LEFTOVERS-REPORTED] without a ledger the teardown no longer says 'nothing to undo' over what " +
+			"an aborted install left: an installing journal, a ready runtime, our npm cache, or a runtime with no journal " +
+			"are each NAMED and the verb exits non-zero with every byte untouched — nothing proves what they belong to, so " +
+			"nothing is removed. A truly clean host still exits 0 with the old line " +
+			`(rows=${JSON.stringify(results)} clean=${cleanRun.status}/${JSON.stringify((cleanRun.stdout || "").trim())})`,
+		results.every((r) => r.status !== 0 && r.named && r.unchanged) &&
+			cleanRun.status === 0 &&
+			(cleanRun.stdout || "").includes("no certified activation ledger — nothing to undo"),
+	);
+}
+
+// ── 28. only a regular file — or nothing — may stand at the ledger address (#135) ─
+{
+	const env = world("ledger-kinds");
+	seedRuntime(env);
+	const layout = resolveActivationLayout(env);
+	fs.mkdirSync(layout.stateRoot, { recursive: true });
+	// a DANGLING symlink: readFileSync used to answer ENOENT, i.e. "no ledger".
+	fs.symlinkSync(path.join(env.HOME as string, "nowhere.json"), layout.ledgerPath);
+	const dangling = refusal(() => readCertifiedLedger(layout));
+	const danglingRun = spawnSync("node", [DEACTIVATE], { encoding: "utf8", env });
+	fs.unlinkSync(layout.ledgerPath);
+	// a symlink to a perfectly valid ledger is still not OUR ledger file.
+	const elsewhere = path.join(env.HOME as string, "ledger-elsewhere.json");
+	fs.writeFileSync(elsewhere, `${JSON.stringify({ schemaVersion: 2, ...ledgerFor(env, ["pi"]) }, null, 2)}\n`);
+	fs.symlinkSync(elsewhere, layout.ledgerPath);
+	const linked = refusal(() => readCertifiedLedger(layout));
+	fs.unlinkSync(layout.ledgerPath);
+	fs.mkdirSync(layout.ledgerPath);
+	const directory = refusal(() => readCertifiedLedger(layout));
+	// a state root that is a FILE: lstat answers ENOTDIR, which must stay a named refusal, not a raw errno.
+	const fileRoot = path.join(env.HOME as string, "state-root-is-a-file");
+	fs.writeFileSync(fileRoot, "not a directory\n");
+	const notDir = refusal(() =>
+		readCertifiedLedger({ stateRoot: fileRoot, ledgerPath: path.join(fileRoot, "activation.json") }),
+	);
+	ok(
+		"[QK:HAC-LEDGER-PATH-KIND] the ledger address is read by lstat first: a dangling symlink, a symlink to a valid " +
+			"ledger elsewhere, a directory, and a state root that is a file are each refused by name — none of them is " +
+			"'no ledger', which is what a dangling link used to read as, letting every verb act as if nothing had been " +
+			`activated (dangling=${dangling}/teardown-exit=${danglingRun.status} linked=${linked} directory=${directory} not-dir=${notDir})`,
+		dangling === "activation-ledger-uncertified" &&
+			danglingRun.status !== 0 &&
+			(danglingRun.stderr || "").includes("activation-ledger-uncertified") &&
+			linked === "activation-ledger-uncertified" &&
+			directory === "activation-ledger-uncertified" &&
+			notDir === "activation-ledger-uncertified",
+	);
+}
+
 console.log(`\ncheck-herdr-activation: ${passed} assertions passed`);

package/scripts/check-herdr-plugin-build.ts

@@ -187,12 +187,18 @@ function tree(root: string): string[] {
  * installed package's activation verb is — absent, incapable (exits 0 on an empty request), or a
  * faithful recorder that refuses an empty request by name and logs the argv it was given.
  */
-function fixtureAcquire(opts: { activate: "absent" | "incapable" | "recorder"; log?: string; fail?: boolean }) {
+function fixtureAcquire(opts: {
+	activate: "absent" | "incapable" | "recorder";
+	log?: string;
+	fail?: boolean;
+	name?: string;
+}) {
+	const name = opts.name ?? PACKAGE;
 	return ({ identity, prefix }: AcquireArgs) => {
 		const version = identity.version ?? FIXTURE_VERSION;
-		const root = path.join(prefix, "node_modules", PACKAGE);
+		const root = path.join(prefix, "node_modules", name);
 		fs.mkdirSync(path.join(root, path.dirname(COMPILED_ENTRY)), { recursive: true });
-		fs.writeFileSync(path.join(root, "package.json"), `${JSON.stringify({ name: PACKAGE, version })}\n`);
+		fs.writeFileSync(path.join(root, "package.json"), `${JSON.stringify({ name, version })}\n`);
 		fs.writeFileSync(path.join(root, COMPILED_ENTRY), "// compiled entry fixture\n");
 		const bin = path.join(prefix, "node_modules", ".bin");
 		fs.mkdirSync(bin, { recursive: true });
@@ -222,7 +228,7 @@ function fixtureAcquire(opts: { activate: "absent" | "incapable" | "recorder"; l
 			observedDigest: `sha256-${createHash("sha256")
 				.update(identity.commit ?? "x")
 				.digest("hex")}`,
-			packageName: PACKAGE,
+			packageName: name,
 			packageVersion: version,
 		};
 	};
@@ -238,7 +244,7 @@ function drive(
 	env: NodeJS.ProcessEnv,
 	text: string | { error: string } | { status: number; stderr: string },
 	deps: Record<string, unknown> = {},
-): { code: number | null; refusal: string | null; out: string; progress: string[] } {
+): { code: number | null; refusal: string | null; detail: string; out: string; progress: string[] } {
 	let out = "";
 	// The operator's terminal is a SEAM here, never the real `/dev/tty`: a gate that narrated into
 	// whatever terminal happened to be running it would be writing outside its own sandbox.
@@ -269,11 +275,12 @@ function drive(
 			readRuntimeLock: () => FIXTURE_NPM_LOCK,
 			...deps,
 		});
-		return { code, refusal: null, out, progress: progressLines };
+		return { code, refusal: null, detail: "", out, progress: progressLines };
 	} catch (err) {
 		return {
 			code: null,
 			refusal: (err as { code?: string }).code ?? `not-a-HerdrBuildError:${String(err)}`,
+			detail: (err as { detail?: string }).detail ?? String(err),
 			out,
 			progress: progressLines,
 		};
@@ -727,6 +734,228 @@ function drive(
 	);
 }
 
+// ── 6c. the selected components' owners are asked before the first byte (#135) ─
+/** Run one of the shipped Pi ownership writers against a sandbox, exactly as run.sh does. */
+function piOwner(env: NodeJS.ProcessEnv, script: string, args: string[]): SpawnResult {
+	return spawnSync("python3", [path.join(REPO, "scripts", script), ...args], {
+		encoding: "utf8",
+		env,
+	}) as unknown as SpawnResult;
+}
+function piSettingsOf(env: NodeJS.ProcessEnv): string {
+	return path.join(env.HOME as string, ".pi", "agent", "settings.json");
+}
+function piStateOf(env: NodeJS.ProcessEnv, half: "package" | "provider"): string {
+	return path.join(env.XDG_DATA_HOME as string, "entwurf", `pi-${half}`, "install-state.json");
+}
+/** A LIVE foreign owner: a real directory standing for a developer checkout, registered for real. */
+function foreignPiOwner(env: NodeJS.ProcessEnv, halves: ("package" | "provider")[]): string {
+	const checkout = path.join(env.HOME as string, "dev", "entwurf");
+	fs.mkdirSync(checkout, { recursive: true });
+	fs.mkdirSync(path.dirname(piSettingsOf(env)), { recursive: true });
+	fs.writeFileSync(piSettingsOf(env), '{"theme":"dark"}\n');
+	if (halves.includes("package")) {
+		const r = piOwner(env, "register-pi-package.py", [
+			piSettingsOf(env),
+			checkout,
+			"--scope",
+			"user",
+			"--state",
+			piStateOf(env, "package"),
+		]);
+		assert.equal(r.status, 0, `fixture: seeding the foreign package owner failed: ${r.stderr}`);
+	}
+	if (halves.includes("provider")) {
+		const r = piOwner(env, "register-pi-provider.py", [
+			"install",
+			piSettingsOf(env),
+			checkout,
+			"--scope",
+			"user",
+			"--state",
+			piStateOf(env, "provider"),
+		]);
+		assert.equal(r.status, 0, `fixture: seeding the foreign provider owner failed: ${r.stderr}`);
+	}
+	return checkout;
+}
+/** An acquisition that must never be reached: it counts, and it throws a sentinel instead of fetching. */
+function countingSentinel(): { acquire: () => never; calls: () => number } {
+	let calls = 0;
+	return {
+		acquire: () => {
+			calls++;
+			throw new Error("HPB_OWNERSHIP_SENTINEL_NO_NETWORK");
+		},
+		calls: () => calls,
+	};
+}
+{
+	const env = world("owner-package");
+	foreignPiOwner(env, ["package"]);
+	const before = treeDigest(env.HOME as string);
+	const sentinel = countingSentinel();
+	const r = drive(env, listing({ pi: "current (v8) (/home/u/.pi)" }), {
+		acquire: sentinel.acquire,
+		resolveCommit: () => COMMIT_A,
+	});
+	const after = treeDigest(env.HOME as string);
+	ok(
+		"[QK:HPB-OWNERSHIP-BEFORE-ACQUISITION] a Pi user-scope registration owned by another LIVE root refuses the " +
+			"plugin install BEFORE anything is fetched or written: the SAME shipped package-owner preflight the installed " +
+			"activation runs is asked against the prospective plugin root, so the refusal names the component and the " +
+			"acquisition is never called — no installing journal, runtime, cache or ledger appears and every byte under " +
+			"the sandbox HOME is unchanged. The first cut asked only after bootstrap, so a known refusal still fetched and " +
+			`installed a runtime first (refusal=${r.refusal} acquired=${sentinel.calls()} home-unchanged=${before === after} ` +
+			`journal=${fs.existsSync(journalPathOf(env))} detail=${JSON.stringify(r.detail.slice(0, 160))})`,
+		r.refusal === "herdr-build-component-ownership-refused" &&
+			r.detail.includes("pi-package") &&
+			sentinel.calls() === 0 &&
+			before === after &&
+			!fs.existsSync(journalPathOf(env)),
+	);
+}
+{
+	// The provider key carries its OWN ownership record; a host whose package entry is free but whose
+	// provider key another root owns must refuse just as early.
+	const env = world("owner-provider");
+	foreignPiOwner(env, ["provider"]);
+	const before = treeDigest(env.HOME as string);
+	const sentinel = countingSentinel();
+	const r = drive(env, listing({ pi: "current (v8) (/home/u/.pi)" }), {
+		acquire: sentinel.acquire,
+		resolveCommit: () => COMMIT_A,
+	});
+	ok(
+		"[QK:HPB-OWNERSHIP-PROVIDER-HALF] the provider half is asked on its own: a free package entry with a provider " +
+			"key another LIVE root owns still refuses before acquisition, names `pi-provider`, and leaves the sandbox " +
+			`HOME byte-identical (refusal=${r.refusal} acquired=${sentinel.calls()} home-unchanged=${before === treeDigest(env.HOME as string)} detail=${JSON.stringify(r.detail.slice(0, 120))})`,
+		r.refusal === "herdr-build-component-ownership-refused" &&
+			r.detail.includes("pi-provider") &&
+			!r.detail.includes("pi-package:") &&
+			sentinel.calls() === 0 &&
+			before === treeDigest(env.HOME as string),
+	);
+}
+{
+	// Claude's preflight is its PLAN check (documents and managed-key shapes), run against the
+	// prospective root in plugin mode. It is not a claim about which root owns Claude.
+	const env = world("owner-claude-plan");
+	fs.mkdirSync(path.join(env.HOME as string, ".claude"), { recursive: true });
+	fs.writeFileSync(path.join(env.HOME as string, ".claude", "settings.json"), "[]\n");
+	const before = treeDigest(env.HOME as string);
+	const sentinel = countingSentinel();
+	const r = drive(env, listing({ claude: "current (v2) (/home/u/.claude)" }), {
+		acquire: sentinel.acquire,
+		resolveCommit: () => COMMIT_A,
+	});
+	ok(
+		"[QK:HPB-OWNERSHIP-CLAUDE-PLAN] a selected Claude whose install plan its own state owner refuses (a settings " +
+			"file that is not a JSON object) refuses before acquisition, names `claude-code`, and writes nothing " +
+			`(refusal=${r.refusal} acquired=${sentinel.calls()} home-unchanged=${before === treeDigest(env.HOME as string)} detail=${JSON.stringify(r.detail.slice(0, 120))})`,
+		r.refusal === "herdr-build-component-ownership-refused" &&
+			r.detail.includes("claude-code") &&
+			sentinel.calls() === 0 &&
+			before === treeDigest(env.HOME as string),
+	);
+}
+{
+	// Only the SELECTED components are asked: a backend Herdr has not integrated cannot veto another's install.
+	const piOnly = world("owner-unselected-claude");
+	fs.mkdirSync(path.join(piOnly.HOME as string, ".claude"), { recursive: true });
+	fs.writeFileSync(path.join(piOnly.HOME as string, ".claude", "settings.json"), "[]\n");
+	const piLog = path.join(piOnly.HOME as string, "argv.log");
+	const piRun = drive(piOnly, listing({ pi: "current (v8) (/home/u/.pi)" }), {
+		acquire: fixtureAcquire({ activate: "recorder", log: piLog }),
+		resolveCommit: () => COMMIT_A,
+	});
+	const claudeOnly = world("owner-unselected-pi");
+	foreignPiOwner(claudeOnly, ["package", "provider"]);
+	const claudeLog = path.join(claudeOnly.HOME as string, "argv.log");
+	const claudeRun = drive(claudeOnly, listing({ claude: "current (v2) (/home/u/.claude)" }), {
+		acquire: fixtureAcquire({ activate: "recorder", log: claudeLog }),
+		resolveCommit: () => COMMIT_A,
+	});
+	const logged = (f: string) => (fs.existsSync(f) ? fs.readFileSync(f, "utf8").trim() : "");
+	ok(
+		"[QK:HPB-OWNERSHIP-SELECTED-ONLY] only the backends in `A` are asked: Pi alone installs over a Claude settings " +
+			"file its owner would refuse, and Claude alone installs over a Pi registration another root owns — an " +
+			"unselected backend's owner never vetoes the selected one " +
+			`(pi-only=${piRun.code}/${piRun.refusal}/${JSON.stringify(logged(piLog))} claude-only=${claudeRun.code}/${claudeRun.refusal}/${JSON.stringify(logged(claudeLog))})`,
+		piRun.code === 0 && logged(piLog) === "pi" && claudeRun.code === 0 && logged(claudeLog) === "claude-code",
+	);
+}
+{
+	// A SAME-owner reinstall under a symlinked XDG_DATA_HOME. The installed verb sees its own root in
+	// PHYSICAL form (Node realpaths the ESM entry) and the provider owner records that root without
+	// resolving it, so the early ask must use the physical form too, while the stable command stays the
+	// lexical runtime address.
+	const home = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-hpb-owner-symlinked-")));
+	const realData = path.join(home, "real-data");
+	fs.mkdirSync(realData, { recursive: true });
+	fs.symlinkSync(realData, path.join(home, "data"));
+	const env: NodeJS.ProcessEnv = {
+		HOME: home,
+		XDG_DATA_HOME: path.join(home, "data"),
+		XDG_CACHE_HOME: path.join(home, "cache"),
+		XDG_STATE_HOME: path.join(home, "state"),
+		PATH: process.env.PATH,
+	};
+	const physicalRoot = path.join(realData, "entwurf", "herdr-plugin", "runtime", "active", "node_modules", PACKAGE);
+	fs.mkdirSync(path.dirname(piSettingsOf(env)), { recursive: true });
+	fs.writeFileSync(piSettingsOf(env), '{"theme":"dark"}\n');
+	const pkg = piOwner(env, "register-pi-package.py", [
+		piSettingsOf(env),
+		physicalRoot,
+		"--scope",
+		"user",
+		"--state",
+		piStateOf(env, "package"),
+	]);
+	const prov = piOwner(env, "register-pi-provider.py", [
+		"install",
+		piSettingsOf(env),
+		physicalRoot,
+		"--scope",
+		"user",
+		"--state",
+		piStateOf(env, "provider"),
+		"--plugin-runtime",
+		activeDirOf(env),
+	]);
+	assert.equal(pkg.status, 0, `fixture: same-owner package seed failed: ${pkg.stderr}`);
+	assert.equal(prov.status, 0, `fixture: same-owner provider seed failed: ${prov.stderr}`);
+	const log = path.join(home, "argv.log");
+	const r = drive(env, listing({ pi: "current (v8) (/home/u/.pi)" }), {
+		acquire: fixtureAcquire({ activate: "recorder", log }),
+		resolveCommit: () => COMMIT_A,
+	});
+	ok(
+		"[QK:HPB-OWNERSHIP-PHYSICAL-ROOT] a same-owner reinstall under a symlinked XDG_DATA_HOME is admitted, not " +
+			"mistaken for a foreign root: the early owner preflight asks with the PHYSICAL prospective package root " +
+			"(the form the installed verb records as its own) and passes the LEXICAL stable runtime as the plugin-mode " +
+			"runtime flag (the only form the provider owner accepts), so the build reaches activation " +
+			`(code=${r.code} refusal=${r.refusal} detail=${JSON.stringify(r.detail.slice(0, 160))})`,
+		r.code === 0 && fs.existsSync(log) && fs.readFileSync(log, "utf8").trim() === "pi",
+	);
+}
+{
+	// The owners were asked about one root; the installed verb must run from that same root.
+	const env = world("owner-root-tie");
+	const log = path.join(env.HOME as string, "argv.log");
+	const r = drive(env, listing({ pi: "current (v8) (/home/u/.pi)" }), {
+		acquire: fixtureAcquire({ activate: "recorder", log, name: "@elsewhere/entwurf" }),
+		readRuntimeLock: () => FIXTURE_CHECKOUT_LOCK,
+		resolveCommit: () => COMMIT_A,
+	});
+	ok(
+		"[QK:HPB-PLANNED-ROOT-TIE] the root the component owners were asked about is the root the installed verb runs " +
+			"from: an artifact that lands under another package name is refused by name before activation, so the early " +
+			`answer can never have been about a different root (refusal=${r.refusal} activated=${fs.existsSync(log)} detail=${JSON.stringify(r.detail.slice(0, 160))})`,
+		r.refusal === "herdr-build-artifact-drifted" && !fs.existsSync(log),
+	);
+}
+
 // ── 7. the runner claims nothing about Herdr's own commit ──────────────────────
 {
 	const env = world("post-build-gap");

package/scripts/herdr-activation.mjs

@@ -155,6 +155,22 @@ export function writeLedger(layout, entry) {
  * host it was never describing.
  */
 export function readCertifiedLedger(layout) {
+	// lstat FIRST (#135). `readFileSync` follows links, so a dangling symlink at the ledger address
+	// read as ENOENT — "no ledger" — and every verb then acted as if nothing had ever been activated.
+	// Only a regular file, or nothing at all, may stand there.
+	let kind;
+	try {
+		kind = fs.lstatSync(layout.ledgerPath, { throwIfNoEntry: false });
+	} catch (err) {
+		throw new ActivationError("activation-ledger-uncertified", `${layout.ledgerPath}: ${err.message}`);
+	}
+	if (kind === undefined) return null;
+	if (!kind.isFile()) {
+		throw new ActivationError(
+			"activation-ledger-uncertified",
+			`${layout.ledgerPath} is ${kind.isSymbolicLink() ? "a symlink" : kind.isDirectory() ? "a directory" : "not a regular file"}; only a regular file or nothing may stand at the ledger address`,
+		);
+	}
 	let raw;
 	try {
 		raw = fs.readFileSync(layout.ledgerPath, "utf8");

package/scripts/herdr-plugin-activate.mjs

@@ -33,11 +33,11 @@ import {
 	certifyRootsAgainstLedger,
 	componentStates,
 	ledgerBody,
+	piStatePaths,
 	planActivation,
 	readCertifiedLedger,
 	resolveActivationLayout,
 	resolveComponentRoots,
-	resolveEntwurfDataRoot,
 	writeLedger,
 } from "./herdr-activation.mjs";
 import {
@@ -49,8 +49,109 @@ import {
 
 const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
-function run(command, args, env) {
-	return spawnSync(command, args, { encoding: "utf8", env, stdio: ["ignore", "pipe", "pipe"] });
+function run(command, args, env, spawn = spawnSync) {
+	return spawn(command, args, { encoding: "utf8", env, stdio: ["ignore", "pipe", "pipe"] });
+}
+
+/**
+ * Ask every selected component's OWN ownership authority, read-only, whether a write for
+ * `packageRoot` would be admitted. Returns the refused `[name, result]` pairs; writes nothing.
+ *
+ * TWO CALL POSITIONS, ONE LIST (#135). The installed verb below asks it about itself, after the
+ * runtime exists. The Herdr build asks it BEFORE any byte of runtime work, with the checkout's copy
+ * of the same owners and the PROSPECTIVE installed root — so an owner the late check would refuse
+ * is refused while nothing has been fetched. `scriptRoot` is whose owner scripts run; `packageRoot`
+ * is the root they judge. The prospective root must be in the form this verb will later see as its
+ * own PACKAGE_ROOT (physical: Node realpaths the ESM entry), because the provider owner records the
+ * root without resolving it; `runtimeRoot` stays the lexical stable address the commands are
+ * derived from.
+ *
+ * Claude's preflight is its document/plan-shape check. It does not judge which root owns Claude.
+ */
+export function preflightSelectedComponents(
+	env,
+	{ scriptRoot, packageRoot, runtimeRoot, selected, spawn = spawnSync },
+) {
+	const preflights = [];
+	if (selected.includes("claude-code")) {
+		preflights.push([
+			"claude-code",
+			// The mode rides the ARGV, because that is what the state owner reads. The env var is the
+			// installer script's channel; passing only that preflights the DEFAULT mode and then
+			// installs the plugin one — a green check of work nobody is going to do.
+			run(
+				"python3",
+				[
+					path.join(scriptRoot, "scripts", "meta-bridge-state.py"),
+					"preflight-install",
+					"--repo",
+					packageRoot,
+					"--plugin-runtime",
+					runtimeRoot,
+				],
+				{ ...env, ENTWURF_PLUGIN_RUNTIME: runtimeRoot },
+				spawn,
+			),
+		]);
+	}
+	if (selected.includes("pi")) {
+		const agentSettings = path.join(resolveComponentRoots(env).piAgentDir.path, "settings.json");
+		// ONE resolution for both owner records, the one their writers use (`run.sh` `${XDG_DATA_HOME:-…}`).
+		const piState = piStatePaths(env);
+		// BOTH halves. The user-scope citizen is a package registration and a provider key with
+		// SEPARATE ownership records, and a foreign or corrupt package state refuses independently —
+		// preflighting only the provider would let the first ledger write land on a host the package
+		// writer was always going to refuse.
+		preflights.push([
+			"pi-package",
+			run(
+				"python3",
+				[
+					path.join(scriptRoot, "scripts", "register-pi-package.py"),
+					agentSettings,
+					packageRoot,
+					"--scope",
+					"user",
+					"--state",
+					piState.packageState,
+					"--preflight",
+				],
+				env,
+				spawn,
+			),
+		]);
+		preflights.push([
+			"pi-provider",
+			run(
+				"python3",
+				[
+					path.join(scriptRoot, "scripts", "register-pi-provider.py"),
+					"install",
+					agentSettings,
+					packageRoot,
+					"--scope",
+					"user",
+					"--state",
+					piState.providerState,
+					"--plugin-runtime",
+					runtimeRoot,
+					"--preflight",
+				],
+				env,
+				spawn,
+			),
+		]);
+	}
+	return preflights.filter(([, r]) => r.status !== 0);
+}
+
+/** The owner's own last line for each refused component, for the operator to act on. */
+export function describeRefusedComponents(refused) {
+	return refused
+		.map(
+			([name, r]) => `${name}: ${(r.stderr || r.stdout || (r.error ? r.error.message : "")).trim().split("\n").pop()}`,
+		)
+		.join("; ");
 }
 
 /** The only input: a subset of P, parsed from argv and refused if it is anything else. */
@@ -113,79 +214,14 @@ export function activate(env, requested) {
 	const plan = planActivation({ ledger, requested });
 	const selected = [...plan.reconcile, ...plan.add];
 
-	// 3. preflight EVERY selected component before the first byte.
-	const preflights = [];
-	if (selected.includes("claude-code")) {
-		preflights.push([
-			"claude-code",
-			// The mode rides the ARGV, because that is what the state owner reads. The env var is the
-			// installer script's channel; passing only that preflights the DEFAULT mode and then
-			// installs the plugin one — a green check of work nobody is going to do.
-			run(
-				"python3",
-				[
-					path.join(PACKAGE_ROOT, "scripts", "meta-bridge-state.py"),
-					"preflight-install",
-					"--repo",
-					PACKAGE_ROOT,
-					"--plugin-runtime",
-					runtime.activeDir,
-				],
-				{ ...env, ENTWURF_PLUGIN_RUNTIME: runtime.activeDir },
-			),
-		]);
-	}
-	if (selected.includes("pi")) {
-		const agentSettings = path.join(roots.piAgentDir.path, "settings.json");
-		const dataRoot = resolveEntwurfDataRoot(env);
-		// BOTH halves. The user-scope citizen is a package registration and a provider key with
-		// SEPARATE ownership records, and a foreign or corrupt package state refuses independently —
-		// preflighting only the provider would let the first ledger write land on a host the package
-		// writer was always going to refuse.
-		preflights.push([
-			"pi-package",
-			run(
-				"python3",
-				[
-					path.join(PACKAGE_ROOT, "scripts", "register-pi-package.py"),
-					agentSettings,
-					PACKAGE_ROOT,
-					"--scope",
-					"user",
-					"--state",
-					path.join(dataRoot, "pi-package", "install-state.json"),
-					"--preflight",
-				],
-				env,
-			),
-		]);
-		preflights.push([
-			"pi-provider",
-			run(
-				"python3",
-				[
-					path.join(PACKAGE_ROOT, "scripts", "register-pi-provider.py"),
-					"install",
-					agentSettings,
-					PACKAGE_ROOT,
-					"--scope",
-					"user",
-					"--state",
-					path.join(
-						env.XDG_DATA_HOME ?? path.join(env.HOME, ".local", "share"),
-						"entwurf",
-						"pi-provider",
-						"install-state.json",
-					),
-					"--plugin-runtime",
-					runtime.activeDir,
-					"--preflight",
-				],
-				env,
-			),
-		]);
-	}
-	const refused = preflights.filter(([, r]) => r.status !== 0);
+	// 3. preflight EVERY selected component before the first byte — the same list the Herdr build
+	// already asked about the prospective root; this is the installed recheck.
+	const refused = preflightSelectedComponents(env, {
+		scriptRoot: PACKAGE_ROOT,
+		packageRoot: PACKAGE_ROOT,
+		runtimeRoot: runtime.activeDir,
+		selected,
+	});
 	if (refused.length > 0) {
 		for (const [name, r] of refused) {
 			process.stderr.write(`  ${name}: ${(r.stderr || r.stdout || "").trim().split("\n").pop()}\n`);

package/scripts/herdr-plugin-deactivate.mjs

@@ -25,6 +25,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import {
+	ActivationError,
 	certifyPhaseForInverse,
 	certifyRootsAgainstLedger,
 	componentStates,
@@ -49,6 +50,31 @@ function fail(code, detail) {
 	process.exit(1);
 }
 
+/**
+ * What stands at this host's fixed plugin addresses — journal, runtime root, our npm cache — by
+ * lstat, without reading or following anything. Only consulted when there is no ledger.
+ */
+function leftoversAtPluginAddresses(runtime) {
+	const found = [];
+	for (const [label, target] of [
+		["journal", runtime.journalPath],
+		["runtime", runtime.runtimeRoot],
+		["cache", runtime.cacheDir],
+	]) {
+		const stat = fs.lstatSync(target, { throwIfNoEntry: false });
+		if (stat === undefined) continue;
+		const kind = stat.isSymbolicLink()
+			? "symlink"
+			: stat.isDirectory()
+				? "directory"
+				: stat.isFile()
+					? "file"
+					: "other";
+		found.push(`${label}=${kind} (${target})`);
+	}
+	return found;
+}
+
 export function deactivate(env) {
 	const activation = resolveActivationLayout(env);
 	const runtime = resolveRuntimeLayout(env);
@@ -56,8 +82,21 @@ export function deactivate(env) {
 
 	const ledger = readCertifiedLedger(activation);
 	if (ledger === null) {
-		process.stdout.write("[herdr-plugin-deactivate] no certified activation ledger — nothing to undo\n");
-		return 0;
+		// NO LEDGER IS NOT "NOTHING HERE" (#135). An install that stopped before its activation was
+		// recorded leaves a journal, a runtime or a cache behind, and saying "nothing to undo" over them
+		// was a false success. Without a ledger nothing proves what they belong to or that no harness
+		// wiring names them, so this verb removes nothing: it names what it found and exits non-zero.
+		const leftovers = leftoversAtPluginAddresses(runtime);
+		if (leftovers.length === 0) {
+			process.stdout.write("[herdr-plugin-deactivate] no certified activation ledger — nothing to undo\n");
+			return 0;
+		}
+		throw new ActivationError(
+			"deactivate-unattributed-leftovers",
+			`no certified activation ledger, yet ${leftovers.join(", ")} — NOTHING was removed. Without an activation ` +
+				"ledger nothing proves what these belong to or that no harness wiring still names them; inspect them and " +
+				"remove them by hand only if they are yours",
+		);
 	}
 	certifyRootsAgainstLedger(ledger, roots, runtime.activeDir);
 	certifyPhaseForInverse(ledger);

package/scripts/mutants/herdr-activation.json

@@ -316,6 +316,41 @@
 			"timeoutSeconds": 420,
 			"signature": "[QK:HAC-REBIND-ATOMIC-CHECKPOINT]",
 			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "HAC-PI-STATE-PATHS-SHARED",
+			"title": "resolving the provider owner record with `??` turns an empty XDG_DATA_HOME into a relative path no writer uses, so the preflight sees no owner and the ledger lands on a host the provider writer then refuses",
+			"subject": "scripts/herdr-plugin-activate.mjs",
+			"find": ["\t\tconst piState = piStatePaths(env);"],
+			"replace": [
+				"\t\tconst piState = { packageState: piStatePaths(env).packageState, providerState: path.join(env.XDG_DATA_HOME ?? path.join(env.HOME, \".local\", \"share\"), \"entwurf\", \"pi-provider\", \"install-state.json\") };"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-PI-STATE-PATHS-SHARED]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "HAC-NO-LEDGER-LEFTOVERS-REPORTED",
+			"title": "answering 'nothing to undo' whenever the ledger is absent is a false success over the journal, runtime or cache an aborted install left behind",
+			"subject": "scripts/herdr-plugin-deactivate.mjs",
+			"find": ["\t\tif (leftovers.length === 0) {"],
+			"replace": ["\t\tif (true) {"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-NO-LEDGER-LEFTOVERS-REPORTED]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "HAC-LEDGER-PATH-KIND",
+			"title": "reading the ledger without lstat lets a dangling symlink answer ENOENT, i.e. 'no ledger', and every verb then acts as if nothing had ever been activated",
+			"subject": "scripts/herdr-activation.mjs",
+			"find": ["\tif (!kind.isFile()) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-LEDGER-PATH-KIND]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
 		}
 	]
 }

package/scripts/mutants/herdr-plugin-build.json

@@ -162,6 +162,72 @@
 			"timeoutSeconds": 300,
 			"signature": "[QK:HPB-INSTALL-USAGE-NOTE]",
 			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-OWNERSHIP-BEFORE-ACQUISITION",
+			"title": "not asking the selected components' owners before bootstrap fetches and installs a runtime for a registration another root owns — the refusal only arrives after the bytes are on disk, which is the #135 ordering defect",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\tcertifyComponentOwners(env, {"],
+			"replace": ["\t((_env, _args) => {})(env, {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-OWNERSHIP-BEFORE-ACQUISITION]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-OWNERSHIP-PROVIDER-HALF",
+			"title": "dropping the provider half lets a host whose provider key another root owns pass the early check, so the runtime is fetched for an install its own provider writer was always going to refuse",
+			"subject": "scripts/herdr-plugin-activate.mjs",
+			"find": ["\t\tpreflights.push([", "\t\t\t\"pi-provider\","],
+			"replace": ["\t\tif (false) preflights.push([", "\t\t\t\"pi-provider\","],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-OWNERSHIP-PROVIDER-HALF]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-OWNERSHIP-CLAUDE-PLAN",
+			"title": "skipping Claude's plan preflight lets a selected Claude whose settings its own state owner cannot plan reach acquisition, and the refusal lands only after the runtime is installed",
+			"subject": "scripts/herdr-plugin-activate.mjs",
+			"find": ["\tif (selected.includes(\"claude-code\")) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-OWNERSHIP-CLAUDE-PLAN]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-OWNERSHIP-SELECTED-ONLY",
+			"title": "asking every backend instead of the selected ones lets a harness Herdr has not integrated veto the install of one it has",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\t\tselected: profile.activate,", "\t\tspawn,"],
+			"replace": ["\t\tselected: [\"pi\", \"claude-code\"],", "\t\tspawn,"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-OWNERSHIP-SELECTED-ONLY]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-OWNERSHIP-PHYSICAL-ROOT",
+			"title": "asking the owners with the lexical prospective root makes a same-owner reinstall under a symlinked XDG_DATA_HOME look like a foreign root, because the installed verb records its own root in physical form",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\t\t\treturn path.join(fs.realpathSync(probe), ...rest);"],
+			"replace": ["\t\t\treturn path.join(probe, ...rest);"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-OWNERSHIP-PHYSICAL-ROOT]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
+		},
+		{
+			"claim": "HPB-PLANNED-ROOT-TIE",
+			"title": "without the tie the owners can have been asked about one root while the installed verb runs from another, so the early answer is about bytes nobody installed",
+			"subject": "plugins/herdr/lib/build.mjs",
+			"find": ["\tif (completeness.name !== plannedName || landedRoot !== plannedRoot) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-plugin-build"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HPB-PLANNED-ROOT-TIE]",
+			"signatureSource": "scripts/check-herdr-plugin-build.ts"
 		}
 	]
 }

package/scripts/mutants/herdr-runtime-bootstrap.json

@@ -398,10 +398,10 @@
 		},
 		{
 			"claim": "HRB-PREPARE-STDOUT-CLEAN",
-			"title": "silencing stderr instead of stdout is the exact byte that broke the first clean-host install: husky writes `.git can't be found` to STDOUT when npm packs our GitHub git spec (no `.git` in a codeload tarball), npm merges that line into `npm pack --json`, and a perfectly good artifact is refused as `runtime-checkout-source-unavailable` — invisible to both the fake-npm cells here and to the LIVE gate, whose `insteadOf` mirror is cloned and therefore HAS a `.git`",
+			"title": "silencing stderr instead of routing stdout to it lets the `prepare` bridge build's stdout into the `npm pack --json` stream this rail parses — the class of byte that broke the first clean-host install, when husky (then part of `prepare`) wrote `.git can't be found` to STDOUT while npm packed our GitHub git spec (no `.git` in a codeload tarball) and a perfectly good artifact was refused as `runtime-checkout-source-unavailable`, invisible to both the fake-npm cells here and to the LIVE gate, whose `insteadOf` mirror is cloned and therefore HAS a `.git`",
 			"subject": "package.json",
-			"find": ["\t\t\"prepare\": \"husky 1>&2 || true; npm run --silent build-bridge 1>&2\","],
-			"replace": ["\t\t\"prepare\": \"husky 2>/dev/null || true; npm run --silent build-bridge\","],
+			"find": ["\t\t\"prepare\": \"npm run --silent build-bridge 1>&2\","],
+			"replace": ["\t\t\"prepare\": \"npm run --silent build-bridge 2>/dev/null\","],
 			"gate": ["bash", "run.sh", "check-herdr-runtime-bootstrap"],
 			"timeoutSeconds": 300,
 			"signature": "[QK:HRB-PREPARE-STDOUT-CLEAN]",