@junghanacs/entwurf 0.34.0 → 0.34.2

package/scripts/check-herdr-activation.ts

@@ -27,6 +27,7 @@ import os from "node:os";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { reclaimOnExit } from "./lib/reclaim-on-exit.ts";
+import { treeDigest } from "./lib/tree-digest.ts";
 
 let passed = 0;
 function ok(label: string, cond: boolean): void {
@@ -182,6 +183,7 @@ interface Mod {
 	resolveEntwurfDataRoot: (env: NodeJS.ProcessEnv) => string;
 	LEDGER_PHASES: string[];
 	COMPONENT_STATES: string[];
+	resolveDoctorPluginRuntime: (env: NodeJS.ProcessEnv, opts: { repo: string; override?: string }) => string | null;
 }
 
 const mod = (await import(pathToFileURL(ACTIVATION).href)) as Mod;
@@ -203,6 +205,7 @@ const {
 	resolveEntwurfDataRoot,
 	LEDGER_PHASES,
 	COMPONENT_STATES,
+	resolveDoctorPluginRuntime,
 } = mod;
 
 /** The pi pin package.json declares (an exact production dependency since #130) — the SSOT
@@ -737,21 +740,12 @@ function ledgerWith(
 	const dataRoot = resolveEntwurfDataRoot(bare);
 	const states = piStatePaths(bare);
 	const piExpected = path.join(home, ".local", "share", "entwurf");
-	// The python writers derive the SAME stable root from the SAME environment.
-	const pyRoot = spawnSync(
-		"python3",
-		[
-			"-c",
-			"import sys; sys.path.insert(0, 'scripts'); from importlib import import_module; m = import_module('register-pi-provider'.replace('-', '_')) if False else None",
-		],
-		{ encoding: "utf8", env: bare },
-	);
 	ok(
 		"[QK:HAC-XDG-RESOLUTION-SHARED] every root comes from one resolution — `XDG_DATA_HOME`, else " +
 			"`$HOME/.local/share` — so a host with XDG unset is the same host to the teardown as it is to the writers. " +
 			'The first cut built its Pi state paths from `env.XDG_DATA_HOME || ""`, which on such a host pointed at ' +
 			"`/entwurf/...`: a preflight that looked at a file nobody writes and passed for the wrong reason " +
-			`(dataRoot=${dataRoot === piExpected} packageState=${path.relative(home, states.packageState)} py=${pyRoot.status === 0})`,
+			`(dataRoot=${dataRoot === piExpected} packageState=${path.relative(home, states.packageState)})`,
 		dataRoot === piExpected &&
 			states.packageState === path.join(piExpected, "pi-package", "install-state.json") &&
 			states.providerState === path.join(piExpected, "pi-provider", "install-state.json"),
@@ -1364,4 +1358,210 @@ function ledgerWith(
 	);
 }
 
+// ── 26. both Pi owner records are asked where their writers keep them (#135 D1) ─
+{
+	const env = world("pi-state-paths");
+	const defaultData = path.join(env.HOME as string, ".local", "share");
+	// An EMPTY XDG_DATA_HOME: run.sh and the runtime owner both fall back to $HOME/.local/share.
+	const runEnv = { ...env, XDG_DATA_HOME: "" };
+	seedRuntime({ ...env, XDG_DATA_HOME: defaultData });
+	const agentSettings = path.join(env.PI_CODING_AGENT_DIR as string, "settings.json");
+	fs.writeFileSync(agentSettings, '{"theme":"dark"}\n');
+	const foreign = path.join(env.HOME as string, "dev", "entwurf");
+	fs.mkdirSync(foreign, { recursive: true });
+	const seeded = py(env, "register-pi-provider.py", [
+		"install",
+		agentSettings,
+		foreign,
+		"--scope",
+		"user",
+		"--state",
+		path.join(defaultData, "entwurf", "pi-provider", "install-state.json"),
+	]);
+	assert.equal(seeded.status, 0, `fixture: seeding the provider owner failed: ${seeded.stderr}`);
+	const layout = resolveActivationLayout(runEnv);
+	const run = spawnSync("node", [ACTIVATE, "pi"], { encoding: "utf8", env: runEnv, cwd: env.HOME as string });
+	ok(
+		"[QK:HAC-PI-STATE-PATHS-SHARED] both Pi ownership preflights read the record where its writer keeps it: with " +
+			"XDG_DATA_HOME set but EMPTY, run.sh writes to $HOME/.local/share, so the provider preflight must look there " +
+			"too — the first cut built a RELATIVE path for the provider half alone, saw no owner, and let the ledger land " +
+			`on a host the provider writer then refused (exit=${run.status} ledger=${fs.existsSync(layout.ledgerPath)} refusal=${JSON.stringify((run.stderr || "").trim().split("\n").pop())})`,
+		run.status !== 0 &&
+			(run.stderr || "").includes("activation-preflight-refused") &&
+			(run.stderr || "").includes("pi-provider") &&
+			!fs.existsSync(layout.ledgerPath),
+	);
+}
+
+// ── 27. no ledger is not "nothing here" (#135) ─────────────────────────────────
+{
+	const plugin = (env: NodeJS.ProcessEnv) => path.join(env.XDG_DATA_HOME as string, "entwurf", "herdr-plugin");
+	const rows: [string, (env: NodeJS.ProcessEnv) => void][] = [
+		[
+			"installing-journal",
+			(env) => {
+				fs.mkdirSync(path.join(plugin(env), "runtime"), { recursive: true });
+				fs.writeFileSync(
+					path.join(plugin(env), "journal.json"),
+					`${JSON.stringify({
+						schemaVersion: 2,
+						phase: "installing",
+						runtimeRoot: runtimeRootOf(env),
+						artifactIdentity: { kind: "npm", name: PACKAGE, version: "0.21.0", expectedIntegrity: "sha512-fixture" },
+						previousRuntime: null,
+					})}\n`,
+				);
+			},
+		],
+		["ready-runtime", (env) => void seedRuntime(env)],
+		[
+			"cache-only",
+			(env) =>
+				fs.mkdirSync(path.join(env.XDG_CACHE_HOME as string, "entwurf", "herdr-plugin", "npm"), { recursive: true }),
+		],
+		["journal-less-runtime", (env) => fs.mkdirSync(path.join(plugin(env), "runtime", "active"), { recursive: true })],
+	];
+	const results = rows.map(([tag, make]) => {
+		const env = world(`no-ledger-${tag}`);
+		make(env);
+		const before = treeDigest(env.HOME as string);
+		const run = spawnSync("node", [DEACTIVATE], { encoding: "utf8", env });
+		return {
+			tag,
+			status: run.status,
+			named: (run.stderr || "").includes("deactivate-unattributed-leftovers"),
+			unchanged: before === treeDigest(env.HOME as string),
+		};
+	});
+	const clean = world("no-ledger-clean");
+	const cleanRun = spawnSync("node", [DEACTIVATE], { encoding: "utf8", env: clean });
+	ok(
+		"[QK:HAC-NO-LEDGER-LEFTOVERS-REPORTED] without a ledger the teardown no longer says 'nothing to undo' over what " +
+			"an aborted install left: an installing journal, a ready runtime, our npm cache, or a runtime with no journal " +
+			"are each NAMED and the verb exits non-zero with every byte untouched — nothing proves what they belong to, so " +
+			"nothing is removed. A truly clean host still exits 0 with the old line " +
+			`(rows=${JSON.stringify(results)} clean=${cleanRun.status}/${JSON.stringify((cleanRun.stdout || "").trim())})`,
+		results.every((r) => r.status !== 0 && r.named && r.unchanged) &&
+			cleanRun.status === 0 &&
+			(cleanRun.stdout || "").includes("no certified activation ledger — nothing to undo"),
+	);
+}
+
+// ── 28. only a regular file — or nothing — may stand at the ledger address (#135) ─
+{
+	const env = world("ledger-kinds");
+	seedRuntime(env);
+	const layout = resolveActivationLayout(env);
+	fs.mkdirSync(layout.stateRoot, { recursive: true });
+	// a DANGLING symlink: readFileSync used to answer ENOENT, i.e. "no ledger".
+	fs.symlinkSync(path.join(env.HOME as string, "nowhere.json"), layout.ledgerPath);
+	const dangling = refusal(() => readCertifiedLedger(layout));
+	const danglingRun = spawnSync("node", [DEACTIVATE], { encoding: "utf8", env });
+	fs.unlinkSync(layout.ledgerPath);
+	// a symlink to a perfectly valid ledger is still not OUR ledger file.
+	const elsewhere = path.join(env.HOME as string, "ledger-elsewhere.json");
+	fs.writeFileSync(elsewhere, `${JSON.stringify({ schemaVersion: 2, ...ledgerFor(env, ["pi"]) }, null, 2)}\n`);
+	fs.symlinkSync(elsewhere, layout.ledgerPath);
+	const linked = refusal(() => readCertifiedLedger(layout));
+	fs.unlinkSync(layout.ledgerPath);
+	fs.mkdirSync(layout.ledgerPath);
+	const directory = refusal(() => readCertifiedLedger(layout));
+	// a state root that is a FILE: lstat answers ENOTDIR, which must stay a named refusal, not a raw errno.
+	const fileRoot = path.join(env.HOME as string, "state-root-is-a-file");
+	fs.writeFileSync(fileRoot, "not a directory\n");
+	const notDir = refusal(() =>
+		readCertifiedLedger({ stateRoot: fileRoot, ledgerPath: path.join(fileRoot, "activation.json") }),
+	);
+	ok(
+		"[QK:HAC-LEDGER-PATH-KIND] the ledger address is read by lstat first: a dangling symlink, a symlink to a valid " +
+			"ledger elsewhere, a directory, and a state root that is a file are each refused by name — none of them is " +
+			"'no ledger', which is what a dangling link used to read as, letting every verb act as if nothing had been " +
+			`activated (dangling=${dangling}/teardown-exit=${danglingRun.status} linked=${linked} directory=${directory} not-dir=${notDir})`,
+		dangling === "activation-ledger-uncertified" &&
+			danglingRun.status !== 0 &&
+			(danglingRun.stderr || "").includes("activation-ledger-uncertified") &&
+			linked === "activation-ledger-uncertified" &&
+			directory === "activation-ledger-uncertified" &&
+			notDir === "activation-ledger-uncertified",
+	);
+}
+
+// ── 29. the doctor's expectation mode comes from the activation ledger (#136) ────
+// `doctor-meta-bridge` must compute the plugin activation's ABSOLUTE expectations exactly when the
+// ledger authorised that wiring, and never adopt it from a checkout. The oracle for the returned
+// root is `runtimeRootOf`, computed here independently of the resolver.
+{
+	const env = world("doctor-mode");
+	seedRuntime(env);
+	const active = runtimeRootOf(env);
+	const runtimeRepo = path.join(active, "node_modules", "@junghanacs", "entwurf");
+	const layout = resolveActivationLayout(env);
+	const mode = (opts: { repo: string; override?: string }): string | null => {
+		try {
+			return resolveDoctorPluginRuntime(env, opts);
+		} catch (err) {
+			return `refused:${(err as { code?: string }).code ?? String(err)}`;
+		}
+	};
+	// D2 — no ledger: a doctor running from the runtime package is simply not in plugin mode.
+	const absent = mode({ repo: runtimeRepo });
+	writeLedger(layout, ledgerFor(env, ["pi", "claude-code"]));
+	// D1 — runtime package + an active ledger that activated claude-code at THIS stable root.
+	const derived = mode({ repo: runtimeRepo });
+	ok(
+		"[QK:DOCTOR-MODE-DERIVED] a doctor running from the plugin runtime's package derives plugin-runtime mode from " +
+			`an active ledger that activated claude-code at this host's stable root, and from nothing else (no-ledger=${absent} derived=${derived})`,
+		absent === null && derived === active,
+	);
+	// D3 — the checkout never derives, and never even opens the ledger: an uncertified body is
+	// planted first, so reading it would throw instead of returning null.
+	fs.writeFileSync(layout.ledgerPath, "not json\n");
+	const checkout = mode({ repo: REPO });
+	ok(
+		"[QK:DOCTOR-MODE-CHECKOUT-NEVER-DERIVES] a doctor whose repo is not the runtime package returns no plugin mode " +
+			`without opening the ledger, so a checkout never adopts plugin wiring (checkout=${checkout})`,
+		checkout === null,
+	);
+	// D5 — on a reading path an uncertified ledger dies with the reader's own refusal, never null.
+	fs.unlinkSync(layout.ledgerPath);
+	fs.symlinkSync(path.join(env.HOME as string, "nowhere.json"), layout.ledgerPath);
+	const viaRuntime = mode({ repo: runtimeRepo });
+	const viaOverride = mode({ repo: REPO, override: active });
+	fs.unlinkSync(layout.ledgerPath);
+	ok(
+		"[QK:DOCTOR-MODE-UNCERTIFIED-DIES] an uncertified ledger on either reading path (runtime-repo derivation, explicit " +
+			`override) refuses with the reader's own code, never 'not plugin mode' (runtime=${viaRuntime} override=${viaOverride})`,
+		viaRuntime === "refused:activation-ledger-uncertified" && viaOverride === "refused:activation-ledger-uncertified",
+	);
+	// D4 — the admission clauses on a reading path, each on a CERTIFIED ledger so only the clause can
+	// refuse: a phase other than active, a ledger that never activated claude-code, and a runtimeRoot
+	// that is not this host's stable root. Each is refused by name, never read as 'not plugin mode'.
+	writeLedger(layout, ledgerWith(env, "activating", { pi: "active", "claude-code": "pending" }));
+	const notActive = mode({ repo: runtimeRepo });
+	writeLedger(layout, ledgerFor(env, ["pi"]));
+	const piOnly = mode({ repo: runtimeRepo });
+	writeLedger(layout, {
+		...ledgerFor(env, ["pi", "claude-code"]),
+		runtimeRoot: path.join(env.HOME as string, "another-runtime", "active"),
+	});
+	const foreignRoot = mode({ repo: runtimeRepo });
+	ok(
+		"[QK:DOCTOR-MODE-ADMISSION-CLAUSES] on the runtime repo a certified ledger still admits plugin mode only when " +
+			"phase is active, claude-code was activated and its runtimeRoot is this host's stable root — each other case " +
+			`is refused by name (activating=${notActive} pi-only=${piOnly} foreign-root=${foreignRoot})`,
+		notActive === "refused:doctor-plugin-runtime-unadmitted" &&
+			piOnly === "refused:doctor-plugin-runtime-unadmitted" &&
+			foreignRoot === "refused:doctor-plugin-runtime-unadmitted",
+	);
+	// D6 — the override must agree with the ledger's root; agreeing, it is admitted from a checkout.
+	writeLedger(layout, ledgerFor(env, ["pi", "claude-code"]));
+	const elsewhere = mode({ repo: REPO, override: path.join(env.HOME as string, "elsewhere") });
+	const agreeing = mode({ repo: REPO, override: active });
+	ok(
+		"[QK:DOCTOR-MODE-OVERRIDE-AGREES] an explicit --plugin-runtime is admitted only when it names the ledger's own " +
+			`stable root (elsewhere=${elsewhere} agreeing=${agreeing})`,
+		elsewhere === "refused:doctor-plugin-runtime-unadmitted" && agreeing === active,
+	);
+}
+
 console.log(`\ncheck-herdr-activation: ${passed} assertions passed`);

package/scripts/check-herdr-plugin-build.ts

@@ -187,12 +187,18 @@ function tree(root: string): string[] {
  * installed package's activation verb is — absent, incapable (exits 0 on an empty request), or a
  * faithful recorder that refuses an empty request by name and logs the argv it was given.
  */
-function fixtureAcquire(opts: { activate: "absent" | "incapable" | "recorder"; log?: string; fail?: boolean }) {
+function fixtureAcquire(opts: {
+	activate: "absent" | "incapable" | "recorder";
+	log?: string;
+	fail?: boolean;
+	name?: string;
+}) {
+	const name = opts.name ?? PACKAGE;
 	return ({ identity, prefix }: AcquireArgs) => {
 		const version = identity.version ?? FIXTURE_VERSION;
-		const root = path.join(prefix, "node_modules", PACKAGE);
+		const root = path.join(prefix, "node_modules", name);
 		fs.mkdirSync(path.join(root, path.dirname(COMPILED_ENTRY)), { recursive: true });
-		fs.writeFileSync(path.join(root, "package.json"), `${JSON.stringify({ name: PACKAGE, version })}\n`);
+		fs.writeFileSync(path.join(root, "package.json"), `${JSON.stringify({ name, version })}\n`);
 		fs.writeFileSync(path.join(root, COMPILED_ENTRY), "// compiled entry fixture\n");
 		const bin = path.join(prefix, "node_modules", ".bin");
 		fs.mkdirSync(bin, { recursive: true });
@@ -222,7 +228,7 @@ function fixtureAcquire(opts: { activate: "absent" | "incapable" | "recorder"; l
 			observedDigest: `sha256-${createHash("sha256")
 				.update(identity.commit ?? "x")
 				.digest("hex")}`,
-			packageName: PACKAGE,
+			packageName: name,
 			packageVersion: version,
 		};
 	};
@@ -238,7 +244,7 @@ function drive(
 	env: NodeJS.ProcessEnv,
 	text: string | { error: string } | { status: number; stderr: string },
 	deps: Record<string, unknown> = {},
-): { code: number | null; refusal: string | null; out: string; progress: string[] } {
+): { code: number | null; refusal: string | null; detail: string; out: string; progress: string[] } {
 	let out = "";
 	// The operator's terminal is a SEAM here, never the real `/dev/tty`: a gate that narrated into
 	// whatever terminal happened to be running it would be writing outside its own sandbox.
@@ -269,11 +275,12 @@ function drive(
 			readRuntimeLock: () => FIXTURE_NPM_LOCK,
 			...deps,
 		});
-		return { code, refusal: null, out, progress: progressLines };
+		return { code, refusal: null, detail: "", out, progress: progressLines };
 	} catch (err) {
 		return {
 			code: null,
 			refusal: (err as { code?: string }).code ?? `not-a-HerdrBuildError:${String(err)}`,
+			detail: (err as { detail?: string }).detail ?? String(err),
 			out,
 			progress: progressLines,
 		};
@@ -727,6 +734,228 @@ function drive(
 	);
 }
 
+// ── 6c. the selected components' owners are asked before the first byte (#135) ─
+/** Run one of the shipped Pi ownership writers against a sandbox, exactly as run.sh does. */
+function piOwner(env: NodeJS.ProcessEnv, script: string, args: string[]): SpawnResult {
+	return spawnSync("python3", [path.join(REPO, "scripts", script), ...args], {
+		encoding: "utf8",
+		env,
+	}) as unknown as SpawnResult;
+}
+function piSettingsOf(env: NodeJS.ProcessEnv): string {
+	return path.join(env.HOME as string, ".pi", "agent", "settings.json");
+}
+function piStateOf(env: NodeJS.ProcessEnv, half: "package" | "provider"): string {
+	return path.join(env.XDG_DATA_HOME as string, "entwurf", `pi-${half}`, "install-state.json");
+}
+/** A LIVE foreign owner: a real directory standing for a developer checkout, registered for real. */
+function foreignPiOwner(env: NodeJS.ProcessEnv, halves: ("package" | "provider")[]): string {
+	const checkout = path.join(env.HOME as string, "dev", "entwurf");
+	fs.mkdirSync(checkout, { recursive: true });
+	fs.mkdirSync(path.dirname(piSettingsOf(env)), { recursive: true });
+	fs.writeFileSync(piSettingsOf(env), '{"theme":"dark"}\n');
+	if (halves.includes("package")) {
+		const r = piOwner(env, "register-pi-package.py", [
+			piSettingsOf(env),
+			checkout,
+			"--scope",
+			"user",
+			"--state",
+			piStateOf(env, "package"),
+		]);
+		assert.equal(r.status, 0, `fixture: seeding the foreign package owner failed: ${r.stderr}`);
+	}
+	if (halves.includes("provider")) {
+		const r = piOwner(env, "register-pi-provider.py", [
+			"install",
+			piSettingsOf(env),
+			checkout,
+			"--scope",
+			"user",
+			"--state",
+			piStateOf(env, "provider"),
+		]);
+		assert.equal(r.status, 0, `fixture: seeding the foreign provider owner failed: ${r.stderr}`);
+	}
+	return checkout;
+}
+/** An acquisition that must never be reached: it counts, and it throws a sentinel instead of fetching. */
+function countingSentinel(): { acquire: () => never; calls: () => number } {
+	let calls = 0;
+	return {
+		acquire: () => {
+			calls++;
+			throw new Error("HPB_OWNERSHIP_SENTINEL_NO_NETWORK");
+		},
+		calls: () => calls,
+	};
+}
+{
+	const env = world("owner-package");
+	foreignPiOwner(env, ["package"]);
+	const before = treeDigest(env.HOME as string);
+	const sentinel = countingSentinel();
+	const r = drive(env, listing({ pi: "current (v8) (/home/u/.pi)" }), {
+		acquire: sentinel.acquire,
+		resolveCommit: () => COMMIT_A,
+	});
+	const after = treeDigest(env.HOME as string);
+	ok(
+		"[QK:HPB-OWNERSHIP-BEFORE-ACQUISITION] a Pi user-scope registration owned by another LIVE root refuses the " +
+			"plugin install BEFORE anything is fetched or written: the SAME shipped package-owner preflight the installed " +
+			"activation runs is asked against the prospective plugin root, so the refusal names the component and the " +
+			"acquisition is never called — no installing journal, runtime, cache or ledger appears and every byte under " +
+			"the sandbox HOME is unchanged. The first cut asked only after bootstrap, so a known refusal still fetched and " +
+			`installed a runtime first (refusal=${r.refusal} acquired=${sentinel.calls()} home-unchanged=${before === after} ` +
+			`journal=${fs.existsSync(journalPathOf(env))} detail=${JSON.stringify(r.detail.slice(0, 160))})`,
+		r.refusal === "herdr-build-component-ownership-refused" &&
+			r.detail.includes("pi-package") &&
+			sentinel.calls() === 0 &&
+			before === after &&
+			!fs.existsSync(journalPathOf(env)),
+	);
+}
+{
+	// The provider key carries its OWN ownership record; a host whose package entry is free but whose
+	// provider key another root owns must refuse just as early.
+	const env = world("owner-provider");
+	foreignPiOwner(env, ["provider"]);
+	const before = treeDigest(env.HOME as string);
+	const sentinel = countingSentinel();
+	const r = drive(env, listing({ pi: "current (v8) (/home/u/.pi)" }), {
+		acquire: sentinel.acquire,
+		resolveCommit: () => COMMIT_A,
+	});
+	ok(
+		"[QK:HPB-OWNERSHIP-PROVIDER-HALF] the provider half is asked on its own: a free package entry with a provider " +
+			"key another LIVE root owns still refuses before acquisition, names `pi-provider`, and leaves the sandbox " +
+			`HOME byte-identical (refusal=${r.refusal} acquired=${sentinel.calls()} home-unchanged=${before === treeDigest(env.HOME as string)} detail=${JSON.stringify(r.detail.slice(0, 120))})`,
+		r.refusal === "herdr-build-component-ownership-refused" &&
+			r.detail.includes("pi-provider") &&
+			!r.detail.includes("pi-package:") &&
+			sentinel.calls() === 0 &&
+			before === treeDigest(env.HOME as string),
+	);
+}
+{
+	// Claude's preflight is its PLAN check (documents and managed-key shapes), run against the
+	// prospective root in plugin mode. It is not a claim about which root owns Claude.
+	const env = world("owner-claude-plan");
+	fs.mkdirSync(path.join(env.HOME as string, ".claude"), { recursive: true });
+	fs.writeFileSync(path.join(env.HOME as string, ".claude", "settings.json"), "[]\n");
+	const before = treeDigest(env.HOME as string);
+	const sentinel = countingSentinel();
+	const r = drive(env, listing({ claude: "current (v2) (/home/u/.claude)" }), {
+		acquire: sentinel.acquire,
+		resolveCommit: () => COMMIT_A,
+	});
+	ok(
+		"[QK:HPB-OWNERSHIP-CLAUDE-PLAN] a selected Claude whose install plan its own state owner refuses (a settings " +
+			"file that is not a JSON object) refuses before acquisition, names `claude-code`, and writes nothing " +
+			`(refusal=${r.refusal} acquired=${sentinel.calls()} home-unchanged=${before === treeDigest(env.HOME as string)} detail=${JSON.stringify(r.detail.slice(0, 120))})`,
+		r.refusal === "herdr-build-component-ownership-refused" &&
+			r.detail.includes("claude-code") &&
+			sentinel.calls() === 0 &&
+			before === treeDigest(env.HOME as string),
+	);
+}
+{
+	// Only the SELECTED components are asked: a backend Herdr has not integrated cannot veto another's install.
+	const piOnly = world("owner-unselected-claude");
+	fs.mkdirSync(path.join(piOnly.HOME as string, ".claude"), { recursive: true });
+	fs.writeFileSync(path.join(piOnly.HOME as string, ".claude", "settings.json"), "[]\n");
+	const piLog = path.join(piOnly.HOME as string, "argv.log");
+	const piRun = drive(piOnly, listing({ pi: "current (v8) (/home/u/.pi)" }), {
+		acquire: fixtureAcquire({ activate: "recorder", log: piLog }),
+		resolveCommit: () => COMMIT_A,
+	});
+	const claudeOnly = world("owner-unselected-pi");
+	foreignPiOwner(claudeOnly, ["package", "provider"]);
+	const claudeLog = path.join(claudeOnly.HOME as string, "argv.log");
+	const claudeRun = drive(claudeOnly, listing({ claude: "current (v2) (/home/u/.claude)" }), {
+		acquire: fixtureAcquire({ activate: "recorder", log: claudeLog }),
+		resolveCommit: () => COMMIT_A,
+	});
+	const logged = (f: string) => (fs.existsSync(f) ? fs.readFileSync(f, "utf8").trim() : "");
+	ok(
+		"[QK:HPB-OWNERSHIP-SELECTED-ONLY] only the backends in `A` are asked: Pi alone installs over a Claude settings " +
+			"file its owner would refuse, and Claude alone installs over a Pi registration another root owns — an " +
+			"unselected backend's owner never vetoes the selected one " +
+			`(pi-only=${piRun.code}/${piRun.refusal}/${JSON.stringify(logged(piLog))} claude-only=${claudeRun.code}/${claudeRun.refusal}/${JSON.stringify(logged(claudeLog))})`,
+		piRun.code === 0 && logged(piLog) === "pi" && claudeRun.code === 0 && logged(claudeLog) === "claude-code",
+	);
+}
+{
+	// A SAME-owner reinstall under a symlinked XDG_DATA_HOME. The installed verb sees its own root in
+	// PHYSICAL form (Node realpaths the ESM entry) and the provider owner records that root without
+	// resolving it, so the early ask must use the physical form too, while the stable command stays the
+	// lexical runtime address.
+	const home = reclaimOnExit(fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-hpb-owner-symlinked-")));
+	const realData = path.join(home, "real-data");
+	fs.mkdirSync(realData, { recursive: true });
+	fs.symlinkSync(realData, path.join(home, "data"));
+	const env: NodeJS.ProcessEnv = {
+		HOME: home,
+		XDG_DATA_HOME: path.join(home, "data"),
+		XDG_CACHE_HOME: path.join(home, "cache"),
+		XDG_STATE_HOME: path.join(home, "state"),
+		PATH: process.env.PATH,
+	};
+	const physicalRoot = path.join(realData, "entwurf", "herdr-plugin", "runtime", "active", "node_modules", PACKAGE);
+	fs.mkdirSync(path.dirname(piSettingsOf(env)), { recursive: true });
+	fs.writeFileSync(piSettingsOf(env), '{"theme":"dark"}\n');
+	const pkg = piOwner(env, "register-pi-package.py", [
+		piSettingsOf(env),
+		physicalRoot,
+		"--scope",
+		"user",
+		"--state",
+		piStateOf(env, "package"),
+	]);
+	const prov = piOwner(env, "register-pi-provider.py", [
+		"install",
+		piSettingsOf(env),
+		physicalRoot,
+		"--scope",
+		"user",
+		"--state",
+		piStateOf(env, "provider"),
+		"--plugin-runtime",
+		activeDirOf(env),
+	]);
+	assert.equal(pkg.status, 0, `fixture: same-owner package seed failed: ${pkg.stderr}`);
+	assert.equal(prov.status, 0, `fixture: same-owner provider seed failed: ${prov.stderr}`);
+	const log = path.join(home, "argv.log");
+	const r = drive(env, listing({ pi: "current (v8) (/home/u/.pi)" }), {
+		acquire: fixtureAcquire({ activate: "recorder", log }),
+		resolveCommit: () => COMMIT_A,
+	});
+	ok(
+		"[QK:HPB-OWNERSHIP-PHYSICAL-ROOT] a same-owner reinstall under a symlinked XDG_DATA_HOME is admitted, not " +
+			"mistaken for a foreign root: the early owner preflight asks with the PHYSICAL prospective package root " +
+			"(the form the installed verb records as its own) and passes the LEXICAL stable runtime as the plugin-mode " +
+			"runtime flag (the only form the provider owner accepts), so the build reaches activation " +
+			`(code=${r.code} refusal=${r.refusal} detail=${JSON.stringify(r.detail.slice(0, 160))})`,
+		r.code === 0 && fs.existsSync(log) && fs.readFileSync(log, "utf8").trim() === "pi",
+	);
+}
+{
+	// The owners were asked about one root; the installed verb must run from that same root.
+	const env = world("owner-root-tie");
+	const log = path.join(env.HOME as string, "argv.log");
+	const r = drive(env, listing({ pi: "current (v8) (/home/u/.pi)" }), {
+		acquire: fixtureAcquire({ activate: "recorder", log, name: "@elsewhere/entwurf" }),
+		readRuntimeLock: () => FIXTURE_CHECKOUT_LOCK,
+		resolveCommit: () => COMMIT_A,
+	});
+	ok(
+		"[QK:HPB-PLANNED-ROOT-TIE] the root the component owners were asked about is the root the installed verb runs " +
+			"from: an artifact that lands under another package name is refused by name before activation, so the early " +
+			`answer can never have been about a different root (refusal=${r.refusal} activated=${fs.existsSync(log)} detail=${JSON.stringify(r.detail.slice(0, 160))})`,
+		r.refusal === "herdr-build-artifact-drifted" && !fs.existsSync(log),
+	);
+}
+
 // ── 7. the runner claims nothing about Herdr's own commit ──────────────────────
 {
 	const env = world("post-build-gap");

package/scripts/check-meta-doctor-oracle.sh

@@ -227,6 +227,8 @@ ok "fake live entwurf MCP bridge running as a child of the stand-in Claude pid (
 # --- doctor driver -----------------------------------------------------------
 DOC_OUT=""
 DOC_RC=0
+# #136: arguments for the plugin-runtime block at the end; empty for every clone cell.
+DOC_ARGS=()
 run_doctor() {
   set +e
   # Deliberate cross-harness poison. Before the doctor scrubbed these carriers, the
@@ -237,7 +239,7 @@ run_doctor() {
   DOC_OUT="$(PI_SESSION_ID=ambient-pi-session-must-not-win \
     PI_AGENT_ID=ambient-pi-agent/must-not-win \
     ENTWURF_META_SENDER_MARKER="$TMP/ambient-sender-marker-must-not-win.json" \
-    bash "$REPO/scripts/meta-bridge-doctor.sh" 2>&1)"
+    bash "$REPO/scripts/meta-bridge-doctor.sh" ${DOC_ARGS[@]+"${DOC_ARGS[@]}"} 2>&1)"
   DOC_RC=$?
   set -e
 }
@@ -713,5 +715,88 @@ else
   bad "doctor stayed red after reverting every mutation (a restore is incomplete):"$'\n'"$(printf '%s\n' "$DOC_OUT" | grep -E '^  FAIL' | sed 's/^/        /')"
 fi
 
+# --- 6. #136: a Herdr plugin activation's ABSOLUTE wiring ---------------------
+# The plugin activation runs the same installer with ENTWURF_PLUGIN_RUNTIME, so Claude's MCP and
+# statusLine name absolute bins under the stable runtime. The doctor must learn that mode from the
+# activation ledger and certify the wiring, not call it drift. FIXTURE HONESTY: the two runtime
+# bins are wrappers onto this checkout's own launcher and statusline, and the ledger is written by
+# the shipped writer with a fixture artifact identity; no npm runtime is installed here.
+echo "[plugin-runtime] the installer's absolute wiring, certified through the activation ledger"
+ACTIVE="$XDG_DATA_HOME/entwurf/herdr-plugin/runtime/active"
+mkdir -p "$ACTIVE/node_modules/.bin" "$ACTIVE/node_modules/@junghanacs/entwurf"
+printf '#!/usr/bin/env bash\nexec bash "%s/mcp/entwurf-bridge/start.sh" "$@"\n' "$REPO" > "$ACTIVE/node_modules/.bin/entwurf-bridge"
+printf '#!/usr/bin/env bash\nexec "%s/scripts/meta-bridge-statusline.sh" "$@"\n' "$REPO" > "$ACTIVE/node_modules/.bin/entwurf-statusline"
+chmod +x "$ACTIVE/node_modules/.bin/entwurf-bridge" "$ACTIVE/node_modules/.bin/entwurf-statusline"
+if ENTWURF_PLUGIN_RUNTIME="$ACTIVE" bash "$REPO/scripts/meta-bridge-install.sh" >"$TMP/install-plugin.log" 2>&1; then
+  ok "real meta-bridge-install.sh wires the plugin-runtime mode (absolute bins under the sandbox stable root)"
+else
+  bad "plugin-runtime install-meta-bridge failed in the sandbox:"$'\n'"$(sed 's/^/        install| /' "$TMP/install-plugin.log")"
+fi
+rm -rf "$PLANTED"
+mkdir -p "$PLANTED"
+cp -r "$ASM/$PLUGIN/." "$PLANTED/"
+write_ledger() {
+  node --input-type=module - "$REPO/scripts/herdr-activation.mjs" "$ACTIVE" "$1" <<'JS'
+import { pathToFileURL } from "node:url";
+const [modPath, active, backends] = process.argv.slice(2);
+const m = await import(pathToFileURL(modPath).href);
+const states = Object.fromEntries(backends.split(",").map((b) => [b, "active"]));
+m.writeLedger(m.resolveActivationLayout(process.env), m.ledgerBody({
+	phase: "active",
+	runtimeRoot: active,
+	artifactIdentity: { kind: "npm", name: "@junghanacs/entwurf", version: "0.34.1", expectedIntegrity: "sha512-fixture", observedDigest: `sha256-${"c".repeat(64)}` },
+	roots: m.resolveComponentRoots(process.env),
+	states,
+}));
+JS
+}
+write_ledger "pi,claude-code"
+DOC_ARGS=(--plugin-runtime "$ACTIVE")
+
+# P1 — the plugin wiring the installer wrote is certified: PASS, and the doctor names its mode.
+# The [QK:] token lives on the `bad` line only (see M9b).
+run_doctor
+if [ "$DOC_RC" -eq 0 ] && printf '%s\n' "$DOC_OUT" | grep -q 'meta-bridge doctor: PASS' \
+   && printf '%s\n' "$DOC_OUT" | grep -qF "mode: plugin-runtime $ACTIVE (activation ledger)" \
+   && printf '%s\n' "$DOC_OUT" | grep -qF 'live mcpServers.entwurf-bridge equals desired_mcp()'; then
+  ok "plugin-runtime wiring reaches doctor PASS through the activation ledger, and the doctor names that mode"
+else
+  bad "[QK:DOCTOR-PLUGIN-MODE-GREEN] the plugin activation's absolute wiring did NOT reach PASS (exit $DOC_RC):"$'\n'"$(printf '%s\n' "$DOC_OUT" | grep -E '^  (FAIL|WARN)|mode:' | sed 's/^/        /')"
+fi
+
+# P2 — genuine drift stays red in plugin mode: an absolute statusLine under the same root, but not ours.
+cp "$CLAUDE_CONFIG_DIR/settings.json" "$TMP/settings-p2.bak"
+python3 - "$CLAUDE_CONFIG_DIR/settings.json" "$ACTIVE/node_modules/.bin/evil" <<'PY'
+import json, sys
+p = sys.argv[1]
+d = json.load(open(p, encoding="utf-8"))
+d["statusLine"]["command"] = sys.argv[2]
+json.dump(d, open(p, "w", encoding="utf-8"), indent=2)
+PY
+expect_red "plugin-mode statusLine repointed under the same runtime root" "statusLine.command drifted"
+cp "$TMP/settings-p2.bak" "$CLAUDE_CONFIG_DIR/settings.json"
+
+# P3 — a ledger that did not activate claude-code admits no plugin mode. The refusal is named,
+# and it is NOT an early exit: the store and live-owner sections still run (Hard Rule 13).
+write_ledger "pi"
+expect_red "override against a ledger that never activated claude-code" "doctor-plugin-runtime-unadmitted"
+# Each of the three expectation sites says UNKNOWN for that reason (never a bare-bin fallback),
+# and the runtime axes still run: the live command still DELIVERS, the store and owner join report.
+for claim in \
+  'managed settings/MCP keyset is UNKNOWN: the expectation mode was not established' \
+  'statusLine expectation is UNKNOWN: the expectation mode was not established' \
+  'live-vs-desired MCP ownership is UNKNOWN: the expectation mode was not established' \
+  'live bridge command DELIVERS' \
+  '[meta-record store]' \
+  '[live Claude MCP owner join]'
+do
+  if printf '%s\n' "$DOC_OUT" | sed -n '/expectation mode refused: doctor-plugin-runtime-unadmitted/,$p' | grep -qF "$claim"; then
+    ok "after the mode refusal the doctor still reports: $claim"
+  else
+    bad "after the mode refusal the doctor never reported: $claim"
+  fi
+done
+write_ledger "pi,claude-code"
+
 echo
 if [ "$fail" -eq 0 ]; then echo "check-meta-doctor-oracle: PASS"; else echo "check-meta-doctor-oracle: FAIL (see above)"; exit 1; fi