@junghanacs/entwurf 0.34.0 → 0.34.2

package/scripts/herdr-activation.mjs

@@ -28,7 +28,7 @@
 
 import fs from "node:fs";
 import path from "node:path";
-import { artifactStage, certifyArtifactIdentity, sameArtifactRequest } from "./herdr-runtime.mjs";
+import { artifactStage, certifyArtifactIdentity, resolveRuntimeLayout, sameArtifactRequest } from "./herdr-runtime.mjs";
 
 /** Ledger format. Bump only with a reader that understands both. */
 export const ACTIVATION_SCHEMA_VERSION = 2;
@@ -155,6 +155,22 @@ export function writeLedger(layout, entry) {
  * host it was never describing.
  */
 export function readCertifiedLedger(layout) {
+	// lstat FIRST (#135). `readFileSync` follows links, so a dangling symlink at the ledger address
+	// read as ENOENT — "no ledger" — and every verb then acted as if nothing had ever been activated.
+	// Only a regular file, or nothing at all, may stand there.
+	let kind;
+	try {
+		kind = fs.lstatSync(layout.ledgerPath, { throwIfNoEntry: false });
+	} catch (err) {
+		throw new ActivationError("activation-ledger-uncertified", `${layout.ledgerPath}: ${err.message}`);
+	}
+	if (kind === undefined) return null;
+	if (!kind.isFile()) {
+		throw new ActivationError(
+			"activation-ledger-uncertified",
+			`${layout.ledgerPath} is ${kind.isSymbolicLink() ? "a symlink" : kind.isDirectory() ? "a directory" : "not a regular file"}; only a regular file or nothing may stand at the ledger address`,
+		);
+	}
 	let raw;
 	try {
 		raw = fs.readFileSync(layout.ledgerPath, "utf8");
@@ -486,6 +502,55 @@ export function piStatePaths(env) {
 	});
 }
 
+/**
+ * Which expectations `doctor-meta-bridge` must compute (#136): the stable active root when this
+ * host's Claude wiring was written by a plugin activation, otherwise null (clone / installed).
+ *
+ * The plugin activation writes Claude's MCP and statusLine as ABSOLUTE commands under the stable
+ * runtime. A doctor that does not know that expects bare bins and calls correct wiring drifted. The
+ * mode is read from the record that authorised the wiring, the certified activation ledger, never
+ * from settings, environment or a path guess:
+ *   - phase `active`, `claude-code` activated, and the ledger's runtimeRoot is THIS host's stable root;
+ *   - without an override, only a doctor running FROM that runtime's package derives the mode. A
+ *     checkout's doctor returns null without opening the ledger, so it never adopts plugin wiring;
+ *   - an explicit override must agree with the ledger, or it is refused.
+ * An absent ledger is "not plugin mode"; an uncertified one throws the reader's own refusal.
+ */
+export function resolveDoctorPluginRuntime(env, { repo, override } = {}) {
+	const activeDir = resolveRuntimeLayout(env).activeDir;
+	if (override === undefined) {
+		const runtimePackage = path.join(activeDir, "node_modules", "@junghanacs", "entwurf");
+		let same = false;
+		try {
+			same = fs.realpathSync(repo) === fs.realpathSync(runtimePackage);
+		} catch {
+			// Bounded probe: no runtime package at the stable address means this repo is not it.
+			same = false;
+		}
+		if (!same) return null;
+	}
+	const ledger = readCertifiedLedger(resolveActivationLayout(env));
+	if (ledger === null) {
+		if (override === undefined) return null;
+		throw new ActivationError(
+			"doctor-plugin-runtime-unadmitted",
+			"--plugin-runtime was given but no activation ledger exists",
+		);
+	}
+	const refuse = (clause) => {
+		throw new ActivationError("doctor-plugin-runtime-unadmitted", clause);
+	};
+	if (ledger.phase !== "active") refuse(`activation ledger phase is ${ledger.phase}, not active`);
+	if (!ledger.activatedBackends.includes("claude-code")) refuse("the activation ledger did not activate claude-code");
+	if (ledger.runtimeRoot !== activeDir) {
+		refuse(`the ledger's runtimeRoot ${ledger.runtimeRoot} is not this host's stable runtime root ${activeDir}`);
+	}
+	if (override !== undefined && override !== activeDir) {
+		refuse(`--plugin-runtime ${override} does not name the ledger's runtime root ${activeDir}`);
+	}
+	return activeDir;
+}
+
 /** A component row, in the one shape the certifier accepts. */
 export function componentRow(backend, state) {
 	return Object.freeze({ backend, state });

package/scripts/herdr-doctor-mode.mjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+/**
+ * herdr-doctor-mode — the one call `meta-bridge-doctor.sh` makes to learn its expectation mode (#136).
+ *
+ *   node herdr-doctor-mode.mjs <repo> [<plugin-runtime override>]
+ *
+ * Prints the stable active root (plugin-runtime mode) or nothing (clone / installed), exit 0.
+ * A refusal prints `code: detail` to stderr and exits 3. Any other exit is a crash the doctor
+ * reports as UNKNOWN. All judgement lives in `resolveDoctorPluginRuntime`; nothing is decided here.
+ */
+import { resolveDoctorPluginRuntime } from "./herdr-activation.mjs";
+
+const [repo, override] = process.argv.slice(2);
+if (!repo) {
+	process.stderr.write("usage: herdr-doctor-mode.mjs <repo> [<plugin-runtime>]\n");
+	process.exit(2);
+}
+let root;
+try {
+	root = resolveDoctorPluginRuntime(process.env, { repo, override });
+} catch (err) {
+	if (err?.name !== "ActivationError") throw err;
+	process.stderr.write(`${err.message}\n`);
+	process.exit(3);
+}
+if (root !== null) process.stdout.write(`${root}\n`);

package/scripts/herdr-plugin-activate.mjs

@@ -33,11 +33,11 @@ import {
 	certifyRootsAgainstLedger,
 	componentStates,
 	ledgerBody,
+	piStatePaths,
 	planActivation,
 	readCertifiedLedger,
 	resolveActivationLayout,
 	resolveComponentRoots,
-	resolveEntwurfDataRoot,
 	writeLedger,
 } from "./herdr-activation.mjs";
 import {
@@ -49,8 +49,109 @@ import {
 
 const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
-function run(command, args, env) {
-	return spawnSync(command, args, { encoding: "utf8", env, stdio: ["ignore", "pipe", "pipe"] });
+function run(command, args, env, spawn = spawnSync) {
+	return spawn(command, args, { encoding: "utf8", env, stdio: ["ignore", "pipe", "pipe"] });
+}
+
+/**
+ * Ask every selected component's OWN ownership authority, read-only, whether a write for
+ * `packageRoot` would be admitted. Returns the refused `[name, result]` pairs; writes nothing.
+ *
+ * TWO CALL POSITIONS, ONE LIST (#135). The installed verb below asks it about itself, after the
+ * runtime exists. The Herdr build asks it BEFORE any byte of runtime work, with the checkout's copy
+ * of the same owners and the PROSPECTIVE installed root — so an owner the late check would refuse
+ * is refused while nothing has been fetched. `scriptRoot` is whose owner scripts run; `packageRoot`
+ * is the root they judge. The prospective root must be in the form this verb will later see as its
+ * own PACKAGE_ROOT (physical: Node realpaths the ESM entry), because the provider owner records the
+ * root without resolving it; `runtimeRoot` stays the lexical stable address the commands are
+ * derived from.
+ *
+ * Claude's preflight is its document/plan-shape check. It does not judge which root owns Claude.
+ */
+export function preflightSelectedComponents(
+	env,
+	{ scriptRoot, packageRoot, runtimeRoot, selected, spawn = spawnSync },
+) {
+	const preflights = [];
+	if (selected.includes("claude-code")) {
+		preflights.push([
+			"claude-code",
+			// The mode rides the ARGV, because that is what the state owner reads. The env var is the
+			// installer script's channel; passing only that preflights the DEFAULT mode and then
+			// installs the plugin one — a green check of work nobody is going to do.
+			run(
+				"python3",
+				[
+					path.join(scriptRoot, "scripts", "meta-bridge-state.py"),
+					"preflight-install",
+					"--repo",
+					packageRoot,
+					"--plugin-runtime",
+					runtimeRoot,
+				],
+				{ ...env, ENTWURF_PLUGIN_RUNTIME: runtimeRoot },
+				spawn,
+			),
+		]);
+	}
+	if (selected.includes("pi")) {
+		const agentSettings = path.join(resolveComponentRoots(env).piAgentDir.path, "settings.json");
+		// ONE resolution for both owner records, the one their writers use (`run.sh` `${XDG_DATA_HOME:-…}`).
+		const piState = piStatePaths(env);
+		// BOTH halves. The user-scope citizen is a package registration and a provider key with
+		// SEPARATE ownership records, and a foreign or corrupt package state refuses independently —
+		// preflighting only the provider would let the first ledger write land on a host the package
+		// writer was always going to refuse.
+		preflights.push([
+			"pi-package",
+			run(
+				"python3",
+				[
+					path.join(scriptRoot, "scripts", "register-pi-package.py"),
+					agentSettings,
+					packageRoot,
+					"--scope",
+					"user",
+					"--state",
+					piState.packageState,
+					"--preflight",
+				],
+				env,
+				spawn,
+			),
+		]);
+		preflights.push([
+			"pi-provider",
+			run(
+				"python3",
+				[
+					path.join(scriptRoot, "scripts", "register-pi-provider.py"),
+					"install",
+					agentSettings,
+					packageRoot,
+					"--scope",
+					"user",
+					"--state",
+					piState.providerState,
+					"--plugin-runtime",
+					runtimeRoot,
+					"--preflight",
+				],
+				env,
+				spawn,
+			),
+		]);
+	}
+	return preflights.filter(([, r]) => r.status !== 0);
+}
+
+/** The owner's own last line for each refused component, for the operator to act on. */
+export function describeRefusedComponents(refused) {
+	return refused
+		.map(
+			([name, r]) => `${name}: ${(r.stderr || r.stdout || (r.error ? r.error.message : "")).trim().split("\n").pop()}`,
+		)
+		.join("; ");
 }
 
 /** The only input: a subset of P, parsed from argv and refused if it is anything else. */
@@ -113,79 +214,14 @@ export function activate(env, requested) {
 	const plan = planActivation({ ledger, requested });
 	const selected = [...plan.reconcile, ...plan.add];
 
-	// 3. preflight EVERY selected component before the first byte.
-	const preflights = [];
-	if (selected.includes("claude-code")) {
-		preflights.push([
-			"claude-code",
-			// The mode rides the ARGV, because that is what the state owner reads. The env var is the
-			// installer script's channel; passing only that preflights the DEFAULT mode and then
-			// installs the plugin one — a green check of work nobody is going to do.
-			run(
-				"python3",
-				[
-					path.join(PACKAGE_ROOT, "scripts", "meta-bridge-state.py"),
-					"preflight-install",
-					"--repo",
-					PACKAGE_ROOT,
-					"--plugin-runtime",
-					runtime.activeDir,
-				],
-				{ ...env, ENTWURF_PLUGIN_RUNTIME: runtime.activeDir },
-			),
-		]);
-	}
-	if (selected.includes("pi")) {
-		const agentSettings = path.join(roots.piAgentDir.path, "settings.json");
-		const dataRoot = resolveEntwurfDataRoot(env);
-		// BOTH halves. The user-scope citizen is a package registration and a provider key with
-		// SEPARATE ownership records, and a foreign or corrupt package state refuses independently —
-		// preflighting only the provider would let the first ledger write land on a host the package
-		// writer was always going to refuse.
-		preflights.push([
-			"pi-package",
-			run(
-				"python3",
-				[
-					path.join(PACKAGE_ROOT, "scripts", "register-pi-package.py"),
-					agentSettings,
-					PACKAGE_ROOT,
-					"--scope",
-					"user",
-					"--state",
-					path.join(dataRoot, "pi-package", "install-state.json"),
-					"--preflight",
-				],
-				env,
-			),
-		]);
-		preflights.push([
-			"pi-provider",
-			run(
-				"python3",
-				[
-					path.join(PACKAGE_ROOT, "scripts", "register-pi-provider.py"),
-					"install",
-					agentSettings,
-					PACKAGE_ROOT,
-					"--scope",
-					"user",
-					"--state",
-					path.join(
-						env.XDG_DATA_HOME ?? path.join(env.HOME, ".local", "share"),
-						"entwurf",
-						"pi-provider",
-						"install-state.json",
-					),
-					"--plugin-runtime",
-					runtime.activeDir,
-					"--preflight",
-				],
-				env,
-			),
-		]);
-	}
-	const refused = preflights.filter(([, r]) => r.status !== 0);
+	// 3. preflight EVERY selected component before the first byte — the same list the Herdr build
+	// already asked about the prospective root; this is the installed recheck.
+	const refused = preflightSelectedComponents(env, {
+		scriptRoot: PACKAGE_ROOT,
+		packageRoot: PACKAGE_ROOT,
+		runtimeRoot: runtime.activeDir,
+		selected,
+	});
 	if (refused.length > 0) {
 		for (const [name, r] of refused) {
 			process.stderr.write(`  ${name}: ${(r.stderr || r.stdout || "").trim().split("\n").pop()}\n`);

package/scripts/herdr-plugin-deactivate.mjs

@@ -25,6 +25,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
 import {
+	ActivationError,
 	certifyPhaseForInverse,
 	certifyRootsAgainstLedger,
 	componentStates,
@@ -49,6 +50,31 @@ function fail(code, detail) {
 	process.exit(1);
 }
 
+/**
+ * What stands at this host's fixed plugin addresses — journal, runtime root, our npm cache — by
+ * lstat, without reading or following anything. Only consulted when there is no ledger.
+ */
+function leftoversAtPluginAddresses(runtime) {
+	const found = [];
+	for (const [label, target] of [
+		["journal", runtime.journalPath],
+		["runtime", runtime.runtimeRoot],
+		["cache", runtime.cacheDir],
+	]) {
+		const stat = fs.lstatSync(target, { throwIfNoEntry: false });
+		if (stat === undefined) continue;
+		const kind = stat.isSymbolicLink()
+			? "symlink"
+			: stat.isDirectory()
+				? "directory"
+				: stat.isFile()
+					? "file"
+					: "other";
+		found.push(`${label}=${kind} (${target})`);
+	}
+	return found;
+}
+
 export function deactivate(env) {
 	const activation = resolveActivationLayout(env);
 	const runtime = resolveRuntimeLayout(env);
@@ -56,8 +82,21 @@ export function deactivate(env) {
 
 	const ledger = readCertifiedLedger(activation);
 	if (ledger === null) {
-		process.stdout.write("[herdr-plugin-deactivate] no certified activation ledger — nothing to undo\n");
-		return 0;
+		// NO LEDGER IS NOT "NOTHING HERE" (#135). An install that stopped before its activation was
+		// recorded leaves a journal, a runtime or a cache behind, and saying "nothing to undo" over them
+		// was a false success. Without a ledger nothing proves what they belong to or that no harness
+		// wiring names them, so this verb removes nothing: it names what it found and exits non-zero.
+		const leftovers = leftoversAtPluginAddresses(runtime);
+		if (leftovers.length === 0) {
+			process.stdout.write("[herdr-plugin-deactivate] no certified activation ledger — nothing to undo\n");
+			return 0;
+		}
+		throw new ActivationError(
+			"deactivate-unattributed-leftovers",
+			`no certified activation ledger, yet ${leftovers.join(", ")} — NOTHING was removed. Without an activation ` +
+				"ledger nothing proves what these belong to or that no harness wiring still names them; inspect them and " +
+				"remove them by hand only if they are yours",
+		);
 	}
 	certifyRootsAgainstLedger(ledger, roots, runtime.activeDir);
 	certifyPhaseForInverse(ledger);

package/scripts/meta-bridge-doctor.sh

@@ -17,6 +17,18 @@ MKT_NAME="meta-bridge-local"
 PLUGIN="entwurf-meta-receive"
 CLAUDE_CFG="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
 REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# #136: the one argument. A Herdr plugin activation wires Claude with ABSOLUTE commands under the
+# stable runtime; the mode is normally derived from the activation ledger (see [expectation mode]),
+# and this override exists so a checkout's doctor can name that root. It must agree with the ledger.
+PLUGIN_RUNTIME_OVERRIDE=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --plugin-runtime)
+      [ -n "${2:-}" ] || { echo "meta-bridge-doctor: --plugin-runtime requires a value" >&2; exit 2; }
+      PLUGIN_RUNTIME_OVERRIDE="$2"; shift 2 ;;
+    *) echo "usage: meta-bridge-doctor.sh [--plugin-runtime <stable active runtime root>]" >&2; exit 2 ;;
+  esac
+done
 # The live artifact lives under the XDG data dir (dev clone and installed package
 # alike — never the checkout). Prefer the path RECORDED in install-state so a doctor
 # run under a different XDG_DATA_HOME than install still hashes the REAL assembled
@@ -110,6 +122,44 @@ if command -v node >/dev/null; then
   if [ "${MJ:-0}" -ge 24 ]; then ok "node $NV (>= 24, supported axis)"; else bad "node $NV too old (need >= 24; there is no Node 22 lane)"; fi
 else bad "node not on PATH"; fi
 
+echo "[expectation mode]"
+# #136: which expectations the three desired-state calls below compute. The judgement is the
+# activation owner's (`resolveDoctorPluginRuntime`, herdr-activation.mjs) reached through one narrow
+# call, so no second reader of the ledger exists. A refusal is NOT a fallback to bare expectations:
+# each call site then reports UNKNOWN, and every other section still runs (Hard Rule 13).
+PLUGIN_ARGS=()
+MODE_ERR=""
+if ! command -v node >/dev/null; then
+  MODE_ERR="node not on PATH, so the activation ledger could not be read"
+  bad "expectation mode is UNKNOWN: $MODE_ERR"
+else
+  MODE_STDERR="$(mktemp -t entwurf-doctor-mode.XXXXXX)"
+  set +e
+  if [ -n "$PLUGIN_RUNTIME_OVERRIDE" ]; then
+    MODE_ROOT="$(node "$REPO/scripts/herdr-doctor-mode.mjs" "$REPO" "$PLUGIN_RUNTIME_OVERRIDE" 2>"$MODE_STDERR")"
+  else
+    MODE_ROOT="$(node "$REPO/scripts/herdr-doctor-mode.mjs" "$REPO" 2>"$MODE_STDERR")"
+  fi
+  MODE_RC=$?
+  set -e
+  MODE_DETAIL="$(tr '\n' ' ' < "$MODE_STDERR" | cut -c1-400)"
+  rm -f "$MODE_STDERR"
+  if [ "$MODE_RC" -eq 3 ]; then
+    MODE_ERR="$MODE_DETAIL"
+    bad "expectation mode refused: $MODE_ERR"
+  elif [ "$MODE_RC" -ne 0 ]; then
+    MODE_ERR="herdr-doctor-mode.mjs exited $MODE_RC: $MODE_DETAIL"
+    bad "expectation mode is UNKNOWN: $MODE_ERR"
+  elif [ -n "$MODE_ROOT" ]; then
+    PLUGIN_ARGS=(--plugin-runtime "$MODE_ROOT")
+    ok "mode: plugin-runtime $MODE_ROOT (activation ledger)"
+  elif [ "$LIB_EXT" = "js" ]; then
+    ok "mode: installed (no activation ledger, or this package is not the plugin runtime)"
+  else
+    ok "mode: clone (this checkout is not the plugin runtime)"
+  fi
+fi
+
 echo "[managed config state]"
 if command -v python3 >/dev/null; then
   # state.py check is the effect-based keyset-survival guard: it asserts every
@@ -123,7 +173,9 @@ if command -v python3 >/dev/null; then
   # which key drifted — silent instead of fail-loud. As an `if` condition the
   # substitution's nonzero status is consumed (set -e suspended), so we always
   # reach the detail. stderr (drift detail) is captured via `2>&1 >/dev/null`.
-  if CHECK_ERR="$(python3 "$REPO/scripts/meta-bridge-state.py" check --repo "$REPO" --asm "$ASM" 2>&1 >/dev/null)"; then
+  if [ -n "$MODE_ERR" ]; then
+    bad "managed settings/MCP keyset is UNKNOWN: the expectation mode was not established ($MODE_ERR)"
+  elif CHECK_ERR="$(python3 "$REPO/scripts/meta-bridge-state.py" check --repo "$REPO" --asm "$ASM" ${PLUGIN_ARGS[@]+"${PLUGIN_ARGS[@]}"} 2>&1 >/dev/null)"; then
     ok "state file present and managed settings/MCP keyset survives intact"
   else
     bad "managed settings/MCP keyset missing or overwritten — another consumer may have clobbered a pi-owned key. Re-run ./run.sh install-meta-bridge. Drift detail:"
@@ -565,25 +617,29 @@ except Exception:
     print('')
 PY
 )"
-  EXPECTED_STATUSLINE="$(python3 "$REPO/scripts/meta-bridge-state.py" desired-statusline --repo "$REPO" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("command", ""))')"
-  if [ "$STATUSLINE_CMD" = "$EXPECTED_STATUSLINE" ]; then ok "statusLine.command matches expected (dev: checkout path; installed: entwurf-statusline bin shim): $STATUSLINE_CMD"; else bad "statusLine.command drifted (got '$STATUSLINE_CMD', expected '$EXPECTED_STATUSLINE')"; fi
-  if [[ "$EXPECTED_STATUSLINE" == */* ]]; then
-    if [ -x "$EXPECTED_STATUSLINE" ]; then ok "statusline executable"; else bad "statusline script not executable: $EXPECTED_STATUSLINE"; fi
-  elif command -v "$EXPECTED_STATUSLINE" >/dev/null 2>&1; then
-    ok "statusline bin resolves on PATH: $(command -v "$EXPECTED_STATUSLINE")"
+  if [ -n "$MODE_ERR" ]; then
+    bad "statusLine expectation is UNKNOWN: the expectation mode was not established ($MODE_ERR)"
   else
-    bad "statusline bin not on PATH: $EXPECTED_STATUSLINE"
+    EXPECTED_STATUSLINE="$(python3 "$REPO/scripts/meta-bridge-state.py" desired-statusline --repo "$REPO" ${PLUGIN_ARGS[@]+"${PLUGIN_ARGS[@]}"} | python3 -c 'import json,sys; print(json.load(sys.stdin).get("command", ""))')"
+    if [ "$STATUSLINE_CMD" = "$EXPECTED_STATUSLINE" ]; then ok "statusLine.command matches expected (dev: checkout path; installed: entwurf-statusline bin shim): $STATUSLINE_CMD"; else bad "statusLine.command drifted (got '$STATUSLINE_CMD', expected '$EXPECTED_STATUSLINE')"; fi
+    if [[ "$EXPECTED_STATUSLINE" == */* ]]; then
+      if [ -x "$EXPECTED_STATUSLINE" ]; then ok "statusline executable"; else bad "statusline script not executable: $EXPECTED_STATUSLINE"; fi
+    elif command -v "$EXPECTED_STATUSLINE" >/dev/null 2>&1; then
+      ok "statusline bin resolves on PATH: $(command -v "$EXPECTED_STATUSLINE")"
+    else
+      bad "statusline bin not on PATH: $EXPECTED_STATUSLINE"
+    fi
+    SAMPLE_STATUSLINE_OUT="$(printf '%s' '{"session_id":"doctor-no-record","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-sonnet-5"},"context_window":{"context_window_size":200000,"used_percentage":1,"current_usage":{"input_tokens":1}}}' | "$EXPECTED_STATUSLINE" 2>/dev/null || true)"
+    # The identity row may carry the #98 B unread badge between `cc` and the model letter:
+    # ` ✉N` when mail is waiting, nothing when the mailbox is empty, ` ✉?` when the count
+    # could not be taken. All three are healthy renders, so the shape test admits any of them.
+    if [ "$(printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | wc -l | tr -d ' ')" = "2" ] && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '1p' | grep -q 'tmp' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q '🪛' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -qE ' cc( ✉([0-9]+|\?))? \| s'; then ok "statusline synthetic execution emits two rows (work context + identity)"; else bad "statusline synthetic execution failed or omitted two-row work/identity marker"; fi
+    # The synthetic feeds a session_id with no meta-record, so the garden id does not
+    # resolve and there is no mailbox to count. `✉?` is the required answer: a statusline
+    # that drew nothing there would be claiming "no mail" about a mailbox it never opened —
+    # the exact silence #98 was opened to remove.
+    if printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q '✉?'; then ok "statusline badge distinguishes 'could not count' (✉?) from zero on the no-record synthetic"; else bad "statusline badge omitted ✉? for the no-record synthetic (a false zero would be indistinguishable from an empty mailbox)"; fi
   fi
-  SAMPLE_STATUSLINE_OUT="$(printf '%s' '{"session_id":"doctor-no-record","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-sonnet-5"},"context_window":{"context_window_size":200000,"used_percentage":1,"current_usage":{"input_tokens":1}}}' | "$EXPECTED_STATUSLINE" 2>/dev/null || true)"
-  # The identity row may carry the #98 B unread badge between `cc` and the model letter:
-  # ` ✉N` when mail is waiting, nothing when the mailbox is empty, ` ✉?` when the count
-  # could not be taken. All three are healthy renders, so the shape test admits any of them.
-  if [ "$(printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | wc -l | tr -d ' ')" = "2" ] && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '1p' | grep -q 'tmp' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q '🪛' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -qE ' cc( ✉([0-9]+|\?))? \| s'; then ok "statusline synthetic execution emits two rows (work context + identity)"; else bad "statusline synthetic execution failed or omitted two-row work/identity marker"; fi
-  # The synthetic feeds a session_id with no meta-record, so the garden id does not
-  # resolve and there is no mailbox to count. `✉?` is the required answer: a statusline
-  # that drew nothing there would be claiming "no mail" about a mailbox it never opened —
-  # the exact silence #98 was opened to remove.
-  if printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q '✉?'; then ok "statusline badge distinguishes 'could not count' (✉?) from zero on the no-record synthetic"; else bad "statusline badge omitted ✉? for the no-record synthetic (a false zero would be indistinguishable from an empty mailbox)"; fi
 else
   bad "cannot validate statusline without python3"
 fi
@@ -669,9 +725,12 @@ PY
     [ -n "$LIVE_MCP_DESC" ] || LIVE_MCP_DESC="(unprintable live command)"
     # Ownership axis. `|| true` on the pipeline only: a state.py failure must read as
     # UNKNOWN-and-loud below, never abort the doctor before the delivery drive.
-    DESIRED_MCP="$( { python3 "$REPO/scripts/meta-bridge-state.py" desired-mcp --repo "$REPO" \
+    DESIRED_MCP=""
+    [ -n "$MODE_ERR" ] || DESIRED_MCP="$( { python3 "$REPO/scripts/meta-bridge-state.py" desired-mcp --repo "$REPO" ${PLUGIN_ARGS[@]+"${PLUGIN_ARGS[@]}"} \
       | python3 -c 'import json,sys; print(json.dumps(json.load(sys.stdin), sort_keys=True))'; } 2>/dev/null || true)"
-    if [ -z "$DESIRED_MCP" ]; then
+    if [ -n "$MODE_ERR" ]; then
+      bad "live-vs-desired MCP ownership is UNKNOWN: the expectation mode was not established ($MODE_ERR)"
+    elif [ -z "$DESIRED_MCP" ]; then
       bad "could not compute the desired MCP entry (meta-bridge-state.py desired-mcp failed) — live-vs-desired ownership is UNKNOWN"
     elif [ "$LIVE_MCP" = "$DESIRED_MCP" ]; then
       ok "live mcpServers.entwurf-bridge equals desired_mcp() for this mode (installed: bin shim; clone: this checkout's start.sh)"

package/scripts/mutants/herdr-activation.json

@@ -316,6 +316,112 @@
 			"timeoutSeconds": 420,
 			"signature": "[QK:HAC-REBIND-ATOMIC-CHECKPOINT]",
 			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "HAC-PI-STATE-PATHS-SHARED",
+			"title": "resolving the provider owner record with `??` turns an empty XDG_DATA_HOME into a relative path no writer uses, so the preflight sees no owner and the ledger lands on a host the provider writer then refuses",
+			"subject": "scripts/herdr-plugin-activate.mjs",
+			"find": ["\t\tconst piState = piStatePaths(env);"],
+			"replace": [
+				"\t\tconst piState = { packageState: piStatePaths(env).packageState, providerState: path.join(env.XDG_DATA_HOME ?? path.join(env.HOME, \".local\", \"share\"), \"entwurf\", \"pi-provider\", \"install-state.json\") };"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-PI-STATE-PATHS-SHARED]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "HAC-NO-LEDGER-LEFTOVERS-REPORTED",
+			"title": "answering 'nothing to undo' whenever the ledger is absent is a false success over the journal, runtime or cache an aborted install left behind",
+			"subject": "scripts/herdr-plugin-deactivate.mjs",
+			"find": ["\t\tif (leftovers.length === 0) {"],
+			"replace": ["\t\tif (true) {"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-NO-LEDGER-LEFTOVERS-REPORTED]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "HAC-LEDGER-PATH-KIND",
+			"title": "reading the ledger without lstat lets a dangling symlink answer ENOENT, i.e. 'no ledger', and every verb then acts as if nothing had ever been activated",
+			"subject": "scripts/herdr-activation.mjs",
+			"find": ["\tif (!kind.isFile()) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:HAC-LEDGER-PATH-KIND]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "DOCTOR-MODE-DERIVED",
+			"title": "a resolver that never answers plugin mode leaves the doctor computing bare-bin expectations on a plugin-activated host, so the activation's correct absolute wiring is reported as drift and the supported route can never be certified (#136)",
+			"subject": "scripts/herdr-activation.mjs",
+			"find": ["\treturn activeDir;\n}"],
+			"replace": ["\treturn null;\n}"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:DOCTOR-MODE-DERIVED]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "DOCTOR-MODE-CHECKOUT-NEVER-DERIVES",
+			"title": "dropping the runtime-package precondition lets a checkout's doctor read the plugin ledger and adopt its absolute wiring as its own expectations, so the checkout certifies a runtime it does not own (#136)",
+			"subject": "scripts/herdr-activation.mjs",
+			"find": ["\t\tif (!same) return null;"],
+			"replace": ["\t\tvoid same;"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:DOCTOR-MODE-CHECKOUT-NEVER-DERIVES]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "DOCTOR-MODE-UNCERTIFIED-DIES",
+			"title": "swallowing the reader's refusal turns an uncertified ledger into 'not plugin mode', so a doctor silently falls back to bare expectations over a record nobody can vouch for (#136)",
+			"subject": "scripts/herdr-activation.mjs",
+			"find": [
+				"\tconst ledger = readCertifiedLedger(resolveActivationLayout(env));\n\tif (ledger === null) {\n\t\tif (override === undefined) return null;"
+			],
+			"replace": [
+				"\tlet ledger = null;\n\ttry {\n\t\tledger = readCertifiedLedger(resolveActivationLayout(env));\n\t} catch {\n\t\tledger = null;\n\t}\n\tif (ledger === null) {\n\t\tif (override === undefined || override !== undefined) return null;"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:DOCTOR-MODE-UNCERTIFIED-DIES]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "DOCTOR-MODE-OVERRIDE-AGREES",
+			"title": "an override that need not agree with the ledger lets any caller-named root become the doctor's expectation, so the doctor would certify absolute commands pointing anywhere (#136)",
+			"subject": "scripts/herdr-activation.mjs",
+			"find": ["\tif (override !== undefined && override !== activeDir) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:DOCTOR-MODE-OVERRIDE-AGREES]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "DOCTOR-PLUGIN-MODE-GREEN",
+			"title": "a doctor that resolves plugin mode but never passes it to its desired-state calls still expects bare bins, so the plugin activation's absolute wiring stays falsely red (#136). One mutant for the shared wire on purpose: omitting the mode at any single one of the three call sites also turns P1 red, but no per-site mutant proves that",
+			"subject": "scripts/meta-bridge-doctor.sh",
+			"find": ["    PLUGIN_ARGS=(--plugin-runtime \"$MODE_ROOT\")"],
+			"replace": ["    : \"$MODE_ROOT\""],
+			"gate": ["bash", "run.sh", "check-meta-doctor-oracle"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:DOCTOR-PLUGIN-MODE-GREEN]",
+			"signatureSource": "scripts/check-meta-doctor-oracle.sh",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "DOCTOR-MODE-ADMISSION-CLAUSES",
+			"title": "dropping the phase clause lets a ledger caught mid-activation or mid-teardown admit plugin mode, so the doctor certifies absolute wiring the activation has not finished writing or is already removing (#136)",
+			"subject": "scripts/herdr-activation.mjs",
+			"find": ["\tif (ledger.phase !== \"active\") refuse(`activation ledger phase is ${ledger.phase}, not active`);"],
+			"replace": ["\tvoid refuse;"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:DOCTOR-MODE-ADMISSION-CLAUSES]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
 		}
 	]
 }