@junghanacs/entwurf 0.34.1 → 0.34.2

package/CHANGELOG.md

@@ -4,6 +4,108 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.34.2 - 2026-10-11
+
+### Release coordination
+
+- **A patch cut for #136.** Coordinated by the Claude Code Fable citizen `20261011T132613-9a46b6`,
+  implemented by Claude Code Opus `20261008T094901-5d295e` as sole writer on the thinkpad that
+  holds the failing installation, and independently reviewed by a pi `gpt-6.1-sol` sibling. GLG
+  authorized the commits, main and this release. This section is written at prepare time: the
+  `check:full` and exact-SHA CI results will be recorded at make time in the GitHub release and
+  #136, not claimed here.
+- **GLG waived the LIVE `release-gate --cut` for this cut** (doctor-only change, no LIVE surface
+  touched). The deterministic floor `check:full` and the exact-SHA CI body are this release's
+  evidence, and acceptance 4 (host rebind + new Claude session) is owed after publication. This is
+  not a PASS and not a standing waiver.
+- **The plugin runtime lock rides `herdr-checkout` for this window.** `certifyLockCoherence`
+  (`scripts/herdr-runtime.mjs:353-361`) refuses an npm lock whose version differs from the
+  checkout's package, so `plugins/herdr/runtime-lock.json` leaves npm 0.34.1 for the closed
+  `herdr-checkout` source from this prep until the post-publish npm 0.34.2 re-pin; the plugin
+  manifest moves with that re-pin. A host already on npm 0.34.1 is unaffected until then and
+  upgrades same-source; a host that installs the plugin from `main` inside the window gets a
+  checkout-source runtime and needs `herdr-plugin-deactivate` before the npm reinstall.
+
+### Fixed
+
+- **`doctor-meta-bridge` certifies a Herdr plugin installation (#136).** The plugin activation
+  writes Claude's MCP and statusLine as absolute commands under the stable runtime, but the doctor
+  computed its three expectations (`meta-bridge-state.py check`, `desired-statusline`,
+  `desired-mcp`) without that mode. It expected bare bins and reported correct wiring as drift, so
+  no plugin host could reach a green doctor. The doctor now learns its mode from the certified
+  activation ledger through one narrow call (`resolveDoctorPluginRuntime`,
+  `scripts/herdr-doctor-mode.mjs`). Derived plugin mode needs all four clauses:
+  - the ledger phase is `active`;
+  - `claude-code` was activated;
+  - the ledger's runtimeRoot is this host's stable root;
+  - the doctor runs from that runtime's package.
+  A flagless checkout doctor never opens the ledger. The explicit `--plugin-runtime <root>`
+  override bypasses only the repo clause and still reads and certifies the ledger, which it must
+  agree with. A refusal reports each expectation as UNKNOWN, never a bare-bin fallback, and
+  the runtime sections still run. The doctor prints the mode it used on one line.
+- **`run.sh doctor-meta-bridge` forwards its arguments.** The verb was never shifted, so it rode
+  into the doctor's argv; the override was unreachable through the operator entrypoint.
+
+### Docs
+
+- **CONTRIBUTING matches the scheduling rule.** A gate, mutant or matrix change runs only its
+  affected exact-argv groups as PARTIAL receipts; the whole qualification body runs once per cut,
+  in the prepared SHA's CI. CONTRIBUTING still told a gate-changing PR to run the body itself.
+
+### Verification
+
+- New cells: `check-herdr-activation` D1-D6 and `check-meta-doctor-oracle` P1-P3. The existing
+  clone control is unchanged (P4). Six mutants joined the `herdr-activation` lane (now 34).
+  PARTIAL receipts: herdr-activation group 33/33 and doctor-oracle group 2/2 killed, control ok.
+  No whole body ran in development.
+- **Host acceptance before publication (thinkpad, live plugin 0.34.1 wiring).** The patched
+  checkout doctor with `--plugin-runtime <stable root>` named `mode: plugin-runtime … (activation
+  ledger)`. Its only FAIL was writer-version parity, the declared non-goal of a checkout doctor on
+  a plugin host. The seven drift lines the shipped doctor printed are gone.
+- **Owed after publication.** After the plugin is re-pinned to 0.34.2 and rebound on that host, a
+  flagless runtime-absolute `doctor-meta-bridge` must exit 0 and a new Claude session must call
+  `entwurf_self`. That is what closes #136.
+
+## v2026.10.9-herdr.0.34.1 — Herdr Entwurf plugin 0.34.1
+
+A Herdr plugin snapshot, not a core release: no package version, npm artifact or core tag moves.
+
+### Herdr plugin
+
+- **Runtime re-pinned to the published 0.34.1 (#135).** `plugins/herdr/runtime-lock.json` returns
+  from the `herdr-checkout` verification carrier the 0.34.1 preparation rode to the npm production
+  source: `@junghanacs/entwurf@0.34.1` with the registry's measured sha512
+  (`sha512-AiB88Ext…GDxA==`). The manifest version moves 0.34.0 → 0.34.1; `min_herdr_version`
+  stays 0.9.0. A plugin host now receives the #135 fixes listed under 0.34.1: owner preflight
+  before acquisition, the no-ledger deactivate, and the regular-file-or-nothing ledger address.
+- **Upgrading.** A host on the npm 0.34.0 snapshot stays on the npm source, so its next
+  `herdr plugin install` is a same-source rebind under the plugin README's conditions. A host that
+  installed while the lock named `herdr-checkout` — the 0.30.1 plugin, or `main` during the 0.34.1
+  preparation window — holds a checkout-source runtime and ledger, and npm is a different
+  acquisition source, refused rather than inherited (`activation-artifact-source-drifted`). Run
+  `herdr-plugin-deactivate` by its absolute runtime path, then `herdr plugin install` again.
+- **The READMEs no longer state a current release.** The root README's hardcoded release block and
+  the plugin README's snapshot and carrier prose went stale with every version bump; they now point
+  at `runtime-lock.json`, `herdr-plugin.toml`, Releases and this file. The source-switch rules and
+  the 0.34.0 runtime's no-ledger limit stay, the latter as a historical fact.
+
+### Verification
+
+- **Registry, measured before the pin.** One scheduled observation, after a 300 s delay:
+  version 0.34.1 published at 2026-10-09T14:29:48.184Z with `latest` → 0.34.1, and the downloaded
+  tarball re-hashed to the artifact accepted as 0.34.1 (sha256 `73407ba8…`, 13587297 bytes), with
+  `dist.integrity` re-derived equal. Dist-tags before publication were not captured, so no
+  before/after claim is made about them.
+- **VERIFY's 0.34.0 public-ref row is closed with its measured receipts:** `--ref main` PASS at
+  `b5d15d8` and `8ed4d1a`, both acquiring npm 0.34.0. That is a main-ref receipt, not a tag-ref
+  or native claim.
+- No gate, mutant or matrix changed, so no qualification PARTIAL is owed. The npm-source re-proof
+  for this pin — the focused Herdr gates, a real-npm 0.34.0 → 0.34.1 swap and torn-swap recovery,
+  an installed registry consumer, the registry-file container consumer, the public `main`
+  first-user path and the exact-SHA CI run — is recorded in the GitHub release, not claimed here.
+  A `--ref <tag>` install, a citizen drawn as a ROW in a real Herdr pane, and native hosts stay
+  unmeasured.
+
 ## 0.34.1 - 2026-10-09
 
 ### Release coordination

package/CONTRIBUTING.md

@@ -30,7 +30,7 @@ pnpm check              # everyday core (prints wall time; <=60s on the referenc
 pnpm run check:full     # full deterministic floor — the required PR gate
 ```
 
-The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory; zero COMMITTED mutants executed — the self-test runs only its synthetic fixture mutants in tmp fixture repos — ~20s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on a branch push whose diff touched the qualification surface (and unconditionally on dispatch or the weekly schedule) and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling"). No install or build lifecycle script installs git hooks: a global `core.hooksPath` guard that chains to repository-local hooks runs its own checks, then delegates — to `.husky/pre-commit` here, unless an executable `.git/hooks/pre-commit` takes precedence.
+The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory; zero COMMITTED mutants executed — the self-test runs only its synthetic fixture mutants in tmp fixture repos — ~20s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on a branch push whose diff touched the qualification surface (and unconditionally on dispatch or the weekly schedule). Development never runs that whole body: a gate, mutant or matrix change runs only its affected exact-argv groups once, as PARTIAL receipts (`./run.sh check-gate-qualification --group '<argv JSON>' --receipt <absolute path outside the repo>`), and the whole body runs once per cut, in the prepared SHA's CI. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling"). No install or build lifecycle script installs git hooks: a global `core.hooksPath` guard that chains to repository-local hooks runs its own checks, then delegates — to `.husky/pre-commit` here, unless an executable `.git/hooks/pre-commit` takes precedence.
 
 For changes that touch backend launch, session lifecycle, or `_meta` shape, also run
 the live ACP smokes that cover the touched rail — at minimum:

package/README.md

@@ -27,11 +27,8 @@ Claude and Cortex Code are ACP backends. Codex and Antigravity stay native so th
 retain their own tools and work context. Capabilities differ by rail: a shipped
 citizen is not a promise of every lifecycle operation.
 
-> **Current release: [0.33.0](https://github.com/junghan0611/entwurf/releases/tag/v0.33.0)**
-> ([`fea9b3d`](https://github.com/junghan0611/entwurf/commit/fea9b3dc4779ac5deb34e239abc8e0b5e3e95382)).
-> Includes the pinned Pi 1.1.0 native durable app/TUI and one explicit native-module ingress;
-> `npm` `latest` is `0.33.0`. What that cut ran and did not run is in its CHANGELOG section.
-> Release history and detailed evidence belong in [CHANGELOG](./CHANGELOG.md).
+[Releases](https://github.com/junghan0611/entwurf/releases) contain each cut's notes and acceptance
+receipts; [CHANGELOG](./CHANGELOG.md) records source history.
 
 ## Install
 
@@ -88,8 +85,8 @@ models/auth, queues, SQLite, transcripts and recovery remain upstream-owned:
 [Hard Rule 17](./AGENTS.md#hard-rules), **supply the missing surface; do not become the harness**.
 
 Optional `--native-module <absolute file>` initializes trusted ESM before runtime/TUI
-imports, then installs its default native Extension after the contact. After 0.33.0 (#134):
-`--native-module-dir <absolute directory>` loads the top-level `*.extension.mjs` files of that
+imports, then installs its default native Extension after the contact.
+`--native-module-dir <absolute directory>` (#134) loads the top-level `*.extension.mjs` files of that
 one named directory in byte-wise order instead, and the durable TUI keeps a live
 background-task badge on screen at any terminal size. No automatic module discovery or
 classic Pi API shim; guards are not a sandbox or rollback.

package/VERIFY.md

@@ -96,7 +96,7 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 
 > **The herdr rail is an on-demand axis until it has run.** `smoke-herdr-fresh-call-live` opens a real caller inside a real herdr pane, has it invoke the PUBLIC `entwurf_fresh_call`, and reads the child's nonce callback — the one axis no deterministic gate reaches, since the rail is selected from the caller's own process environment. **The release aggregate does not yet require the herdr rail**: herdr is optional (a cut on a host without it must not block), and first evidence precedes promotion — a rail whose first acceptance run is days old has not earned a place in the gate that blocks every cut. Run it directly with `LIVE=1 ./run.sh smoke-herdr-fresh-call-live` whenever a cut changes herdr rail code, and promote it to a MUST only after the axis has a run history to point at. Without `LIVE=1`, or without herdr/pi/claude on PATH, it reports protocol SKIP — never a pass.
 
-> **The plugin's FIRST USER PATH is its own on-demand axis, and an npm acquisition receipt holds only for the ref it ran on (#118 홉 1).** Every other herdr gate proves the plugin against a source this repository controls: `check-herdr-plugin-build` drives a stub, and `smoke-herdr-plugin-build-live` redirects the product remote to a local bare clone with git `insteadOf` and asserts `identity.kind === "herdr-checkout"`. npm has been the production authority class since `dd84ac0`; the 0.30.0 follow-up re-pinned `@junghanacs/entwurf@0.30.0` with its published sha512 after the candidate windows rode `herdr-checkout` (`8b92e09`), and the 0.30.1 preparation rode that closed verification carrier again without inventing a registry integrity. The last published plugin snapshot `v2026.10.9-herdr.0.34.0` pins the published `@junghanacs/entwurf@0.34.0` with its measured sha512 (#132); 0.31–0.33 were never pinned. This checkout's unpublished 0.34.1 preparation rides the closed `herdr-checkout` verification carrier again, without inventing a registry integrity: it has no published npm SRI and is not a plugin pair. The source re-proof has separate dated npm rows: 2026-09-23 public `main=113ca53`, plugin 0.5.0, runtime 0.25.0 (CHANGELOG 0.25.1), and the 0.30.0 re-pin accepted at public `506c46f` in the [#126 thread](https://github.com/junghan0611/entwurf/issues/126). Neither certifies the 0.34.0 registry acquisition. That pin's real-npm swap / torn-swap recovery was measured locally on 2026-10-09 by driving the registry-shipped `scripts/herdr-runtime.mjs` (byte-equal to this checkout's) with its own npm acquisition: a 0.33.0 → 0.34.0 swap, and the same upgrade torn between its two renames then resumed, where the last-good 0.33.0 tree was restored before 0.34.0 was acquired again. Both ended `runtime-ready` at observed digest `sha256-e9d995ff…`, the accepted 0.34.0 artifact. That local receipt is recorded in the [#132 thread](https://github.com/junghan0611/entwurf/issues/132); it covers runtime recovery, not this smoke's cells. The public-ref acceptance of this smoke is PENDING the prepared push, and its actual result will be recorded there; checkout candidate evidence does not transfer. `LIVE=1 ./run.sh smoke-herdr-raw-install-live [--ref <REF>]` fills that row in a clean `node:24` container with no socket, config, cache or repo mounted, no `insteadOf`, the public remote spelled as a user would type it, and pi / herdr / Claude Code installed in the IMAGE BUILD as scaffolding (Hard Rule 17 — the product face begins at `herdr integration install pi`). herdr itself comes from `scripts/install-herdr-ci.sh` against `scripts/fixtures/herdr-supply.json`, so no version or digest lives here. `--ref` defaults to `main` rather than a pinned SHA because receipt (a) is defined as what a user gets today; the resolved commit is printed, so the receipt stays exact. It takes a REMOTE REF and not an arbitrary commit — measured on herdr 0.9.1, `--ref <sha>` fails as `couldn't find remote ref`, because the checkout fetches by name — so a candidate is addressed by its branch and pinned by the resolved commit the gate prints. **Its first question is a measurement, not an assumption:** herdr registers a plugin through a running server and falls back to `persist_plugin_offline` only on a connection error (`src/cli/plugin.rs:914-981,1016-1021` @ `c77af189`, 0.9.0 source), and a container has no server. The 2026-09-23 PASS installed with no server on the 0.9.1 binary `113ca53`'s `herdr-supply.json` pins, so that install path worked on 0.9.1 — inferred from the PASS, not a direct observation of the fallback branch; a later "no" on another herdr is #118 investigation output rather than a completion. `--yes` is always passed so a non-interactive exit 2 (`:189`) can never be misread as a missing server. **At a ref whose lock names `herdr-checkout` the acquisition axis reports a NAMED SKIP rather than a red, and the rest of the journey still runs.** That lock is the candidate carrier a cut legitimately sits on — 0.23.0 was tagged that way and `dd84ac0` pinned npm afterwards — so a red there would report a broken install when what is true is that the ref does not lock npm. What is asserted at BOTH lock kinds is that the runtime came from the source the ref locks, and the package name is read from the checkout manifest rather than the lock, because a `herdr-checkout` lock carries no `name` (`herdr-runtime.mjs:317-328`) and joining `undefined` throws instead of failing an assertion. **Cells [6]–[9] carry it past the install into the USE path (#118 H1-4/H1-5).** An install is not a use, so the same container then runs what those bytes became: the compiled bridge entry, the three `REQUIRED_BINS` as executables, and a real `entwurf check-bridge` printing its exact eight-verb set — the installed-runtime row below, measured rather than inferred from the bootstrap's refusal to install without them. Then the pi that this plugin WIRED is started with no `-e` and no `--no-extensions`, because the subject is the wiring and not this checkout: one `get_state` in `--mode rpc` costs zero tokens and needs no provider argument (a bogus `--provider` exits 1 before session_start; omitting the pair lets pi resolve the default the extension itself registers), and while that session is alive the cell reads its V3 record, its gardenId-keyed control socket, and the installed `entwurf peer-facts` reporting it `alive`. The plugin's own status fan is then driven with NEITHER side stubbed, in both states a user can be in: with no herdr server it must name `herdr-agent-list-failed` and go red rather than draw an empty table, and under a headless `herdr server` — scaffolding for that second read only, stopped again before the teardown — it exits 0 and COUNTS the citizen as `unobserved` instead of dropping it. Last, the shipped `entwurf herdr-plugin-deactivate` runs from the installed bin, deletes the runtime it is executing from, and the plugin reinstalls onto the host it fully left — the deactivation row, on the npm source. **What these cells still do not close:** swap / torn-swap recovery on the npm source, the package-consumer proof, and the fan drawing a citizen as a ROW — that needs `placement.kind === "herdr-pane"`, so the pi session must live in a herdr pane a session reference joins, and a headless container has no panes. **This smoke carries no test beside behavior and no mutant**, and that is a property of its class rather than an omission: it is a real-live container journey whose oracle is the container's own end state, so there is no pure seam to assert against and nothing a source mutation could kill deterministically. Like the other two herdr LIVE lanes it is **on-demand and not an aggregate MUST** — herdr is optional, a cut on a host without it must not block, and first evidence precedes promotion. Without `LIVE=1`, or without a usable Docker daemon, it reports a named SKIP; `ENTWURF_REQUIRE_DOCKER=1` turns the Docker absence red. Neither skip is a pass.
+> **The plugin's FIRST USER PATH is its own on-demand axis, and an npm acquisition receipt holds only for the ref it ran on (#118 홉 1).** Every other herdr gate proves the plugin against a source this repository controls: `check-herdr-plugin-build` drives a stub, and `smoke-herdr-plugin-build-live` redirects the product remote to a local bare clone with git `insteadOf` and asserts `identity.kind === "herdr-checkout"`. npm has been the production authority class since `dd84ac0`; the 0.30.0 follow-up re-pinned `@junghanacs/entwurf@0.30.0` with its published sha512 after the candidate windows rode `herdr-checkout` (`8b92e09`), and the 0.30.1 preparation rode that closed verification carrier again without inventing a registry integrity. The plugin snapshot `v2026.10.9-herdr.0.34.0` pinned the published `@junghanacs/entwurf@0.34.0` with its measured sha512 (#132); 0.31–0.33 were never pinned. The 0.34.1 preparation rode the closed `herdr-checkout` verification carrier again without inventing a registry integrity, and the snapshot `v2026.10.9-herdr.0.34.1` re-pins the published `@junghanacs/entwurf@0.34.1` with its measured sha512 (#135). The source re-proof has separate dated npm rows: 2026-09-23 public `main=113ca53`, plugin 0.5.0, runtime 0.25.0 (CHANGELOG 0.25.1), and the 0.30.0 re-pin accepted at public `506c46f` in the [#126 thread](https://github.com/junghan0611/entwurf/issues/126). Neither certifies the 0.34.0 registry acquisition. That pin's real-npm swap / torn-swap recovery was measured locally on 2026-10-09 by driving the registry-shipped `scripts/herdr-runtime.mjs` (byte-equal to this checkout's) with its own npm acquisition: a 0.33.0 → 0.34.0 swap, and the same upgrade torn between its two renames then resumed, where the last-good 0.33.0 tree was restored before 0.34.0 was acquired again. Both ended `runtime-ready` at observed digest `sha256-e9d995ff…`, the accepted 0.34.0 artifact. That local receipt is recorded in the [#132 thread](https://github.com/junghan0611/entwurf/issues/132); it covers runtime recovery, not this smoke's cells. This smoke's public-ref acceptance of the 0.34.0 pin was measured locally at `--ref main`: PASS at resolved `b5d15d8` and again at the docs follow-up `8ed4d1a`, each acquiring `kind=npm @junghanacs/entwurf@0.34.0` — a main-ref receipt, not a tag-ref, native or full-Herdr claim. The 0.34.1 re-pin's npm-source rows — swap / torn-swap recovery, this smoke at a public ref, and the package consumer — are its own, recorded with that pin and never inherited from 0.34.0; checkout candidate evidence does not transfer. `LIVE=1 ./run.sh smoke-herdr-raw-install-live [--ref <REF>]` fills that row in a clean `node:24` container with no socket, config, cache or repo mounted, no `insteadOf`, the public remote spelled as a user would type it, and pi / herdr / Claude Code installed in the IMAGE BUILD as scaffolding (Hard Rule 17 — the product face begins at `herdr integration install pi`). herdr itself comes from `scripts/install-herdr-ci.sh` against `scripts/fixtures/herdr-supply.json`, so no version or digest lives here. `--ref` defaults to `main` rather than a pinned SHA because receipt (a) is defined as what a user gets today; the resolved commit is printed, so the receipt stays exact. It takes a REMOTE REF and not an arbitrary commit — measured on herdr 0.9.1, `--ref <sha>` fails as `couldn't find remote ref`, because the checkout fetches by name — so a candidate is addressed by its branch and pinned by the resolved commit the gate prints. **Its first question is a measurement, not an assumption:** herdr registers a plugin through a running server and falls back to `persist_plugin_offline` only on a connection error (`src/cli/plugin.rs:914-981,1016-1021` @ `c77af189`, 0.9.0 source), and a container has no server. The 2026-09-23 PASS installed with no server on the 0.9.1 binary `113ca53`'s `herdr-supply.json` pins, so that install path worked on 0.9.1 — inferred from the PASS, not a direct observation of the fallback branch; a later "no" on another herdr is #118 investigation output rather than a completion. `--yes` is always passed so a non-interactive exit 2 (`:189`) can never be misread as a missing server. **At a ref whose lock names `herdr-checkout` the acquisition axis reports a NAMED SKIP rather than a red, and the rest of the journey still runs.** That lock is the candidate carrier a cut legitimately sits on — 0.23.0 was tagged that way and `dd84ac0` pinned npm afterwards — so a red there would report a broken install when what is true is that the ref does not lock npm. What is asserted at BOTH lock kinds is that the runtime came from the source the ref locks, and the package name is read from the checkout manifest rather than the lock, because a `herdr-checkout` lock carries no `name` (`herdr-runtime.mjs:317-328`) and joining `undefined` throws instead of failing an assertion. **Cells [6]–[9] carry it past the install into the USE path (#118 H1-4/H1-5).** An install is not a use, so the same container then runs what those bytes became: the compiled bridge entry, the three `REQUIRED_BINS` as executables, and a real `entwurf check-bridge` printing its exact eight-verb set — the installed-runtime row below, measured rather than inferred from the bootstrap's refusal to install without them. Then the pi that this plugin WIRED is started with no `-e` and no `--no-extensions`, because the subject is the wiring and not this checkout: one `get_state` in `--mode rpc` costs zero tokens and needs no provider argument (a bogus `--provider` exits 1 before session_start; omitting the pair lets pi resolve the default the extension itself registers), and while that session is alive the cell reads its V3 record, its gardenId-keyed control socket, and the installed `entwurf peer-facts` reporting it `alive`. The plugin's own status fan is then driven with NEITHER side stubbed, in both states a user can be in: with no herdr server it must name `herdr-agent-list-failed` and go red rather than draw an empty table, and under a headless `herdr server` — scaffolding for that second read only, stopped again before the teardown — it exits 0 and COUNTS the citizen as `unobserved` instead of dropping it. Last, the shipped `entwurf herdr-plugin-deactivate` runs from the installed bin, deletes the runtime it is executing from, and the plugin reinstalls onto the host it fully left — the deactivation row, on the npm source. **What these cells still do not close:** swap / torn-swap recovery on the npm source, the package-consumer proof, and the fan drawing a citizen as a ROW — that needs `placement.kind === "herdr-pane"`, so the pi session must live in a herdr pane a session reference joins, and a headless container has no panes. **This smoke carries no test beside behavior and no mutant**, and that is a property of its class rather than an omission: it is a real-live container journey whose oracle is the container's own end state, so there is no pure seam to assert against and nothing a source mutation could kill deterministically. Like the other two herdr LIVE lanes it is **on-demand and not an aggregate MUST** — herdr is optional, a cut on a host without it must not block, and first evidence precedes promotion. Without `LIVE=1`, or without a usable Docker daemon, it reports a named SKIP; `ENTWURF_REQUIRE_DOCKER=1` turns the Docker absence red. Neither skip is a pass.
 
 > **The Herdr plugin's install-time build has two axes, and one of them needs the network (#116 M3-b3).** `check-herdr-plugin-build` is deterministic and rides `check:hermetic`: the listing reaches the runner through its own spawn seam (there is no fake `herdr` binary in this repo), and the one cell that drives the REAL binary reports a named SKIP on a host without it — `ENTWURF_REQUIRE_HERDR=1` makes that absence red. What it cannot have is the real acquisition: `npm pack git+https://github.com/junghan0611/entwurf.git#<full sha>` builds the bridge through `prepare`, which installs devDependencies from the registry. So `LIVE=1 ./run.sh smoke-herdr-plugin-build-live` owns that axis, and its cells are **two kinds of evidence, labelled as such**: three are the real Herdr journey — a real `herdr plugin install` driving the real `[[build]]`, with the UNCHANGED product remote redirected to a local bare clone by git `insteadOf` (the one substitution, which is what makes an unpushed candidate testable) — covering remote-commit available, the `{pi}` → `{pi, claude-code}` reinstall with OpenCode as a zero-write negative control and exactly ONE counted vendor MCP owner entry, and the post-build Herdr-commit gap (where the ledger has already rebound to the gap commit, so the honest assertion is that transition and not unchanged bytes). The fourth cell — remote-commit **unavailable** — calls the shipped runtime leaf directly with the fixed product argv and is therefore **acquisition-leaf evidence, not a journey**; routing it through Herdr would add a second explanation for one red. Its oracle is the honest one too: active runtime, ledger and harness bytes preserved, while the journal is left as the certified `installing` retry authority the transaction deliberately writes before acquiring, and a normal install afterwards is green. Its Claude cell is where the vendor question the deterministic gates refuse to claim gets answered — whether Claude Code accepts an ABSOLUTE executable as an MCP command — and it reports a named skip on a host without `claude`, never a pass. Like the herdr fresh-call rail, this smoke is **on-demand and not an aggregate MUST**. The release aggregate does not require the plugin build smoke: herdr is optional, a cut on a host without it must not block, and first evidence precedes promotion.
 

package/docs/setup-clean-host.md

@@ -195,8 +195,8 @@ root-bound — an install from another root rewrites it rather than refusing; no
 `PI_CODING_AGENT_DIR`, Claude config) changed between runs or a host that changes between the plugin's
 early owner check and its installed recheck, which can still refuse after the download; and the plugin's
 deactivate, finding no activation ledger, reports what is left at its addresses and neither reclaims nor
-reuses it. The no-ledger diagnostic is not in the published 0.34.0 runtime; a plugin host receives it only
-from a later published runtime the plugin pins.
+reuses it. The 0.34.0 runtime predates that no-ledger diagnostic; a plugin host runs the runtime its
+`runtime-lock.json` pins.
 
 ## 2. Optional pi adapter / ACP plugin
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.34.1",
+	"version": "0.34.2",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, Antigravity, and Codex CLI; Claude and Snowflake Cortex Code ACP backends.",
 	"license": "MIT",
 	"author": {

package/run.sh

@@ -7634,6 +7634,8 @@ case "$cmd" in
     # global plugin install, USER MCP reach, meta-record store integrity, hook log
     # no-ERROR, and actual SessionStart creation evidence. A plugin present with
     # zero claude-code meta-records is a SILENT MISS -> non-zero exit.
+    # #136: the only argument is `--plugin-runtime <root>`; shift the verb so the doctor sees it.
+    shift || true
     (cd "$REPO_DIR" && bash scripts/meta-bridge-doctor.sh "$@")
     ;;
   install-copilot-bridge)

package/scripts/check-gate-qualification.ts

@@ -3471,7 +3471,7 @@ let manifestCount: number;
 		"herdr-placement": 13,
 		"herdr-plugin": 25,
 		"herdr-plugin-profile": 14,
-		"herdr-activation": 28,
+		"herdr-activation": 34,
 		"herdr-plugin-build": 20,
 		"herdr-runtime-bootstrap": 31,
 		"herdr-fresh-call": 38,

package/scripts/check-herdr-activation.ts

@@ -183,6 +183,7 @@ interface Mod {
 	resolveEntwurfDataRoot: (env: NodeJS.ProcessEnv) => string;
 	LEDGER_PHASES: string[];
 	COMPONENT_STATES: string[];
+	resolveDoctorPluginRuntime: (env: NodeJS.ProcessEnv, opts: { repo: string; override?: string }) => string | null;
 }
 
 const mod = (await import(pathToFileURL(ACTIVATION).href)) as Mod;
@@ -204,6 +205,7 @@ const {
 	resolveEntwurfDataRoot,
 	LEDGER_PHASES,
 	COMPONENT_STATES,
+	resolveDoctorPluginRuntime,
 } = mod;
 
 /** The pi pin package.json declares (an exact production dependency since #130) — the SSOT
@@ -1484,4 +1486,82 @@ function ledgerWith(
 	);
 }
 
+// ── 29. the doctor's expectation mode comes from the activation ledger (#136) ────
+// `doctor-meta-bridge` must compute the plugin activation's ABSOLUTE expectations exactly when the
+// ledger authorised that wiring, and never adopt it from a checkout. The oracle for the returned
+// root is `runtimeRootOf`, computed here independently of the resolver.
+{
+	const env = world("doctor-mode");
+	seedRuntime(env);
+	const active = runtimeRootOf(env);
+	const runtimeRepo = path.join(active, "node_modules", "@junghanacs", "entwurf");
+	const layout = resolveActivationLayout(env);
+	const mode = (opts: { repo: string; override?: string }): string | null => {
+		try {
+			return resolveDoctorPluginRuntime(env, opts);
+		} catch (err) {
+			return `refused:${(err as { code?: string }).code ?? String(err)}`;
+		}
+	};
+	// D2 — no ledger: a doctor running from the runtime package is simply not in plugin mode.
+	const absent = mode({ repo: runtimeRepo });
+	writeLedger(layout, ledgerFor(env, ["pi", "claude-code"]));
+	// D1 — runtime package + an active ledger that activated claude-code at THIS stable root.
+	const derived = mode({ repo: runtimeRepo });
+	ok(
+		"[QK:DOCTOR-MODE-DERIVED] a doctor running from the plugin runtime's package derives plugin-runtime mode from " +
+			`an active ledger that activated claude-code at this host's stable root, and from nothing else (no-ledger=${absent} derived=${derived})`,
+		absent === null && derived === active,
+	);
+	// D3 — the checkout never derives, and never even opens the ledger: an uncertified body is
+	// planted first, so reading it would throw instead of returning null.
+	fs.writeFileSync(layout.ledgerPath, "not json\n");
+	const checkout = mode({ repo: REPO });
+	ok(
+		"[QK:DOCTOR-MODE-CHECKOUT-NEVER-DERIVES] a doctor whose repo is not the runtime package returns no plugin mode " +
+			`without opening the ledger, so a checkout never adopts plugin wiring (checkout=${checkout})`,
+		checkout === null,
+	);
+	// D5 — on a reading path an uncertified ledger dies with the reader's own refusal, never null.
+	fs.unlinkSync(layout.ledgerPath);
+	fs.symlinkSync(path.join(env.HOME as string, "nowhere.json"), layout.ledgerPath);
+	const viaRuntime = mode({ repo: runtimeRepo });
+	const viaOverride = mode({ repo: REPO, override: active });
+	fs.unlinkSync(layout.ledgerPath);
+	ok(
+		"[QK:DOCTOR-MODE-UNCERTIFIED-DIES] an uncertified ledger on either reading path (runtime-repo derivation, explicit " +
+			`override) refuses with the reader's own code, never 'not plugin mode' (runtime=${viaRuntime} override=${viaOverride})`,
+		viaRuntime === "refused:activation-ledger-uncertified" && viaOverride === "refused:activation-ledger-uncertified",
+	);
+	// D4 — the admission clauses on a reading path, each on a CERTIFIED ledger so only the clause can
+	// refuse: a phase other than active, a ledger that never activated claude-code, and a runtimeRoot
+	// that is not this host's stable root. Each is refused by name, never read as 'not plugin mode'.
+	writeLedger(layout, ledgerWith(env, "activating", { pi: "active", "claude-code": "pending" }));
+	const notActive = mode({ repo: runtimeRepo });
+	writeLedger(layout, ledgerFor(env, ["pi"]));
+	const piOnly = mode({ repo: runtimeRepo });
+	writeLedger(layout, {
+		...ledgerFor(env, ["pi", "claude-code"]),
+		runtimeRoot: path.join(env.HOME as string, "another-runtime", "active"),
+	});
+	const foreignRoot = mode({ repo: runtimeRepo });
+	ok(
+		"[QK:DOCTOR-MODE-ADMISSION-CLAUSES] on the runtime repo a certified ledger still admits plugin mode only when " +
+			"phase is active, claude-code was activated and its runtimeRoot is this host's stable root — each other case " +
+			`is refused by name (activating=${notActive} pi-only=${piOnly} foreign-root=${foreignRoot})`,
+		notActive === "refused:doctor-plugin-runtime-unadmitted" &&
+			piOnly === "refused:doctor-plugin-runtime-unadmitted" &&
+			foreignRoot === "refused:doctor-plugin-runtime-unadmitted",
+	);
+	// D6 — the override must agree with the ledger's root; agreeing, it is admitted from a checkout.
+	writeLedger(layout, ledgerFor(env, ["pi", "claude-code"]));
+	const elsewhere = mode({ repo: REPO, override: path.join(env.HOME as string, "elsewhere") });
+	const agreeing = mode({ repo: REPO, override: active });
+	ok(
+		"[QK:DOCTOR-MODE-OVERRIDE-AGREES] an explicit --plugin-runtime is admitted only when it names the ledger's own " +
+			`stable root (elsewhere=${elsewhere} agreeing=${agreeing})`,
+		elsewhere === "refused:doctor-plugin-runtime-unadmitted" && agreeing === active,
+	);
+}
+
 console.log(`\ncheck-herdr-activation: ${passed} assertions passed`);

package/scripts/check-meta-doctor-oracle.sh

@@ -227,6 +227,8 @@ ok "fake live entwurf MCP bridge running as a child of the stand-in Claude pid (
 # --- doctor driver -----------------------------------------------------------
 DOC_OUT=""
 DOC_RC=0
+# #136: arguments for the plugin-runtime block at the end; empty for every clone cell.
+DOC_ARGS=()
 run_doctor() {
   set +e
   # Deliberate cross-harness poison. Before the doctor scrubbed these carriers, the
@@ -237,7 +239,7 @@ run_doctor() {
   DOC_OUT="$(PI_SESSION_ID=ambient-pi-session-must-not-win \
     PI_AGENT_ID=ambient-pi-agent/must-not-win \
     ENTWURF_META_SENDER_MARKER="$TMP/ambient-sender-marker-must-not-win.json" \
-    bash "$REPO/scripts/meta-bridge-doctor.sh" 2>&1)"
+    bash "$REPO/scripts/meta-bridge-doctor.sh" ${DOC_ARGS[@]+"${DOC_ARGS[@]}"} 2>&1)"
   DOC_RC=$?
   set -e
 }
@@ -713,5 +715,88 @@ else
   bad "doctor stayed red after reverting every mutation (a restore is incomplete):"$'\n'"$(printf '%s\n' "$DOC_OUT" | grep -E '^  FAIL' | sed 's/^/        /')"
 fi
 
+# --- 6. #136: a Herdr plugin activation's ABSOLUTE wiring ---------------------
+# The plugin activation runs the same installer with ENTWURF_PLUGIN_RUNTIME, so Claude's MCP and
+# statusLine name absolute bins under the stable runtime. The doctor must learn that mode from the
+# activation ledger and certify the wiring, not call it drift. FIXTURE HONESTY: the two runtime
+# bins are wrappers onto this checkout's own launcher and statusline, and the ledger is written by
+# the shipped writer with a fixture artifact identity; no npm runtime is installed here.
+echo "[plugin-runtime] the installer's absolute wiring, certified through the activation ledger"
+ACTIVE="$XDG_DATA_HOME/entwurf/herdr-plugin/runtime/active"
+mkdir -p "$ACTIVE/node_modules/.bin" "$ACTIVE/node_modules/@junghanacs/entwurf"
+printf '#!/usr/bin/env bash\nexec bash "%s/mcp/entwurf-bridge/start.sh" "$@"\n' "$REPO" > "$ACTIVE/node_modules/.bin/entwurf-bridge"
+printf '#!/usr/bin/env bash\nexec "%s/scripts/meta-bridge-statusline.sh" "$@"\n' "$REPO" > "$ACTIVE/node_modules/.bin/entwurf-statusline"
+chmod +x "$ACTIVE/node_modules/.bin/entwurf-bridge" "$ACTIVE/node_modules/.bin/entwurf-statusline"
+if ENTWURF_PLUGIN_RUNTIME="$ACTIVE" bash "$REPO/scripts/meta-bridge-install.sh" >"$TMP/install-plugin.log" 2>&1; then
+  ok "real meta-bridge-install.sh wires the plugin-runtime mode (absolute bins under the sandbox stable root)"
+else
+  bad "plugin-runtime install-meta-bridge failed in the sandbox:"$'\n'"$(sed 's/^/        install| /' "$TMP/install-plugin.log")"
+fi
+rm -rf "$PLANTED"
+mkdir -p "$PLANTED"
+cp -r "$ASM/$PLUGIN/." "$PLANTED/"
+write_ledger() {
+  node --input-type=module - "$REPO/scripts/herdr-activation.mjs" "$ACTIVE" "$1" <<'JS'
+import { pathToFileURL } from "node:url";
+const [modPath, active, backends] = process.argv.slice(2);
+const m = await import(pathToFileURL(modPath).href);
+const states = Object.fromEntries(backends.split(",").map((b) => [b, "active"]));
+m.writeLedger(m.resolveActivationLayout(process.env), m.ledgerBody({
+	phase: "active",
+	runtimeRoot: active,
+	artifactIdentity: { kind: "npm", name: "@junghanacs/entwurf", version: "0.34.1", expectedIntegrity: "sha512-fixture", observedDigest: `sha256-${"c".repeat(64)}` },
+	roots: m.resolveComponentRoots(process.env),
+	states,
+}));
+JS
+}
+write_ledger "pi,claude-code"
+DOC_ARGS=(--plugin-runtime "$ACTIVE")
+
+# P1 — the plugin wiring the installer wrote is certified: PASS, and the doctor names its mode.
+# The [QK:] token lives on the `bad` line only (see M9b).
+run_doctor
+if [ "$DOC_RC" -eq 0 ] && printf '%s\n' "$DOC_OUT" | grep -q 'meta-bridge doctor: PASS' \
+   && printf '%s\n' "$DOC_OUT" | grep -qF "mode: plugin-runtime $ACTIVE (activation ledger)" \
+   && printf '%s\n' "$DOC_OUT" | grep -qF 'live mcpServers.entwurf-bridge equals desired_mcp()'; then
+  ok "plugin-runtime wiring reaches doctor PASS through the activation ledger, and the doctor names that mode"
+else
+  bad "[QK:DOCTOR-PLUGIN-MODE-GREEN] the plugin activation's absolute wiring did NOT reach PASS (exit $DOC_RC):"$'\n'"$(printf '%s\n' "$DOC_OUT" | grep -E '^  (FAIL|WARN)|mode:' | sed 's/^/        /')"
+fi
+
+# P2 — genuine drift stays red in plugin mode: an absolute statusLine under the same root, but not ours.
+cp "$CLAUDE_CONFIG_DIR/settings.json" "$TMP/settings-p2.bak"
+python3 - "$CLAUDE_CONFIG_DIR/settings.json" "$ACTIVE/node_modules/.bin/evil" <<'PY'
+import json, sys
+p = sys.argv[1]
+d = json.load(open(p, encoding="utf-8"))
+d["statusLine"]["command"] = sys.argv[2]
+json.dump(d, open(p, "w", encoding="utf-8"), indent=2)
+PY
+expect_red "plugin-mode statusLine repointed under the same runtime root" "statusLine.command drifted"
+cp "$TMP/settings-p2.bak" "$CLAUDE_CONFIG_DIR/settings.json"
+
+# P3 — a ledger that did not activate claude-code admits no plugin mode. The refusal is named,
+# and it is NOT an early exit: the store and live-owner sections still run (Hard Rule 13).
+write_ledger "pi"
+expect_red "override against a ledger that never activated claude-code" "doctor-plugin-runtime-unadmitted"
+# Each of the three expectation sites says UNKNOWN for that reason (never a bare-bin fallback),
+# and the runtime axes still run: the live command still DELIVERS, the store and owner join report.
+for claim in \
+  'managed settings/MCP keyset is UNKNOWN: the expectation mode was not established' \
+  'statusLine expectation is UNKNOWN: the expectation mode was not established' \
+  'live-vs-desired MCP ownership is UNKNOWN: the expectation mode was not established' \
+  'live bridge command DELIVERS' \
+  '[meta-record store]' \
+  '[live Claude MCP owner join]'
+do
+  if printf '%s\n' "$DOC_OUT" | sed -n '/expectation mode refused: doctor-plugin-runtime-unadmitted/,$p' | grep -qF "$claim"; then
+    ok "after the mode refusal the doctor still reports: $claim"
+  else
+    bad "after the mode refusal the doctor never reported: $claim"
+  fi
+done
+write_ledger "pi,claude-code"
+
 echo
 if [ "$fail" -eq 0 ]; then echo "check-meta-doctor-oracle: PASS"; else echo "check-meta-doctor-oracle: FAIL (see above)"; exit 1; fi

package/scripts/herdr-activation.mjs

@@ -28,7 +28,7 @@
 
 import fs from "node:fs";
 import path from "node:path";
-import { artifactStage, certifyArtifactIdentity, sameArtifactRequest } from "./herdr-runtime.mjs";
+import { artifactStage, certifyArtifactIdentity, resolveRuntimeLayout, sameArtifactRequest } from "./herdr-runtime.mjs";
 
 /** Ledger format. Bump only with a reader that understands both. */
 export const ACTIVATION_SCHEMA_VERSION = 2;
@@ -502,6 +502,55 @@ export function piStatePaths(env) {
 	});
 }
 
+/**
+ * Which expectations `doctor-meta-bridge` must compute (#136): the stable active root when this
+ * host's Claude wiring was written by a plugin activation, otherwise null (clone / installed).
+ *
+ * The plugin activation writes Claude's MCP and statusLine as ABSOLUTE commands under the stable
+ * runtime. A doctor that does not know that expects bare bins and calls correct wiring drifted. The
+ * mode is read from the record that authorised the wiring, the certified activation ledger, never
+ * from settings, environment or a path guess:
+ *   - phase `active`, `claude-code` activated, and the ledger's runtimeRoot is THIS host's stable root;
+ *   - without an override, only a doctor running FROM that runtime's package derives the mode. A
+ *     checkout's doctor returns null without opening the ledger, so it never adopts plugin wiring;
+ *   - an explicit override must agree with the ledger, or it is refused.
+ * An absent ledger is "not plugin mode"; an uncertified one throws the reader's own refusal.
+ */
+export function resolveDoctorPluginRuntime(env, { repo, override } = {}) {
+	const activeDir = resolveRuntimeLayout(env).activeDir;
+	if (override === undefined) {
+		const runtimePackage = path.join(activeDir, "node_modules", "@junghanacs", "entwurf");
+		let same = false;
+		try {
+			same = fs.realpathSync(repo) === fs.realpathSync(runtimePackage);
+		} catch {
+			// Bounded probe: no runtime package at the stable address means this repo is not it.
+			same = false;
+		}
+		if (!same) return null;
+	}
+	const ledger = readCertifiedLedger(resolveActivationLayout(env));
+	if (ledger === null) {
+		if (override === undefined) return null;
+		throw new ActivationError(
+			"doctor-plugin-runtime-unadmitted",
+			"--plugin-runtime was given but no activation ledger exists",
+		);
+	}
+	const refuse = (clause) => {
+		throw new ActivationError("doctor-plugin-runtime-unadmitted", clause);
+	};
+	if (ledger.phase !== "active") refuse(`activation ledger phase is ${ledger.phase}, not active`);
+	if (!ledger.activatedBackends.includes("claude-code")) refuse("the activation ledger did not activate claude-code");
+	if (ledger.runtimeRoot !== activeDir) {
+		refuse(`the ledger's runtimeRoot ${ledger.runtimeRoot} is not this host's stable runtime root ${activeDir}`);
+	}
+	if (override !== undefined && override !== activeDir) {
+		refuse(`--plugin-runtime ${override} does not name the ledger's runtime root ${activeDir}`);
+	}
+	return activeDir;
+}
+
 /** A component row, in the one shape the certifier accepts. */
 export function componentRow(backend, state) {
 	return Object.freeze({ backend, state });

package/scripts/herdr-doctor-mode.mjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+/**
+ * herdr-doctor-mode — the one call `meta-bridge-doctor.sh` makes to learn its expectation mode (#136).
+ *
+ *   node herdr-doctor-mode.mjs <repo> [<plugin-runtime override>]
+ *
+ * Prints the stable active root (plugin-runtime mode) or nothing (clone / installed), exit 0.
+ * A refusal prints `code: detail` to stderr and exits 3. Any other exit is a crash the doctor
+ * reports as UNKNOWN. All judgement lives in `resolveDoctorPluginRuntime`; nothing is decided here.
+ */
+import { resolveDoctorPluginRuntime } from "./herdr-activation.mjs";
+
+const [repo, override] = process.argv.slice(2);
+if (!repo) {
+	process.stderr.write("usage: herdr-doctor-mode.mjs <repo> [<plugin-runtime>]\n");
+	process.exit(2);
+}
+let root;
+try {
+	root = resolveDoctorPluginRuntime(process.env, { repo, override });
+} catch (err) {
+	if (err?.name !== "ActivationError") throw err;
+	process.stderr.write(`${err.message}\n`);
+	process.exit(3);
+}
+if (root !== null) process.stdout.write(`${root}\n`);

package/scripts/meta-bridge-doctor.sh

@@ -17,6 +17,18 @@ MKT_NAME="meta-bridge-local"
 PLUGIN="entwurf-meta-receive"
 CLAUDE_CFG="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
 REPO="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# #136: the one argument. A Herdr plugin activation wires Claude with ABSOLUTE commands under the
+# stable runtime; the mode is normally derived from the activation ledger (see [expectation mode]),
+# and this override exists so a checkout's doctor can name that root. It must agree with the ledger.
+PLUGIN_RUNTIME_OVERRIDE=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --plugin-runtime)
+      [ -n "${2:-}" ] || { echo "meta-bridge-doctor: --plugin-runtime requires a value" >&2; exit 2; }
+      PLUGIN_RUNTIME_OVERRIDE="$2"; shift 2 ;;
+    *) echo "usage: meta-bridge-doctor.sh [--plugin-runtime <stable active runtime root>]" >&2; exit 2 ;;
+  esac
+done
 # The live artifact lives under the XDG data dir (dev clone and installed package
 # alike — never the checkout). Prefer the path RECORDED in install-state so a doctor
 # run under a different XDG_DATA_HOME than install still hashes the REAL assembled
@@ -110,6 +122,44 @@ if command -v node >/dev/null; then
   if [ "${MJ:-0}" -ge 24 ]; then ok "node $NV (>= 24, supported axis)"; else bad "node $NV too old (need >= 24; there is no Node 22 lane)"; fi
 else bad "node not on PATH"; fi
 
+echo "[expectation mode]"
+# #136: which expectations the three desired-state calls below compute. The judgement is the
+# activation owner's (`resolveDoctorPluginRuntime`, herdr-activation.mjs) reached through one narrow
+# call, so no second reader of the ledger exists. A refusal is NOT a fallback to bare expectations:
+# each call site then reports UNKNOWN, and every other section still runs (Hard Rule 13).
+PLUGIN_ARGS=()
+MODE_ERR=""
+if ! command -v node >/dev/null; then
+  MODE_ERR="node not on PATH, so the activation ledger could not be read"
+  bad "expectation mode is UNKNOWN: $MODE_ERR"
+else
+  MODE_STDERR="$(mktemp -t entwurf-doctor-mode.XXXXXX)"
+  set +e
+  if [ -n "$PLUGIN_RUNTIME_OVERRIDE" ]; then
+    MODE_ROOT="$(node "$REPO/scripts/herdr-doctor-mode.mjs" "$REPO" "$PLUGIN_RUNTIME_OVERRIDE" 2>"$MODE_STDERR")"
+  else
+    MODE_ROOT="$(node "$REPO/scripts/herdr-doctor-mode.mjs" "$REPO" 2>"$MODE_STDERR")"
+  fi
+  MODE_RC=$?
+  set -e
+  MODE_DETAIL="$(tr '\n' ' ' < "$MODE_STDERR" | cut -c1-400)"
+  rm -f "$MODE_STDERR"
+  if [ "$MODE_RC" -eq 3 ]; then
+    MODE_ERR="$MODE_DETAIL"
+    bad "expectation mode refused: $MODE_ERR"
+  elif [ "$MODE_RC" -ne 0 ]; then
+    MODE_ERR="herdr-doctor-mode.mjs exited $MODE_RC: $MODE_DETAIL"
+    bad "expectation mode is UNKNOWN: $MODE_ERR"
+  elif [ -n "$MODE_ROOT" ]; then
+    PLUGIN_ARGS=(--plugin-runtime "$MODE_ROOT")
+    ok "mode: plugin-runtime $MODE_ROOT (activation ledger)"
+  elif [ "$LIB_EXT" = "js" ]; then
+    ok "mode: installed (no activation ledger, or this package is not the plugin runtime)"
+  else
+    ok "mode: clone (this checkout is not the plugin runtime)"
+  fi
+fi
+
 echo "[managed config state]"
 if command -v python3 >/dev/null; then
   # state.py check is the effect-based keyset-survival guard: it asserts every
@@ -123,7 +173,9 @@ if command -v python3 >/dev/null; then
   # which key drifted — silent instead of fail-loud. As an `if` condition the
   # substitution's nonzero status is consumed (set -e suspended), so we always
   # reach the detail. stderr (drift detail) is captured via `2>&1 >/dev/null`.
-  if CHECK_ERR="$(python3 "$REPO/scripts/meta-bridge-state.py" check --repo "$REPO" --asm "$ASM" 2>&1 >/dev/null)"; then
+  if [ -n "$MODE_ERR" ]; then
+    bad "managed settings/MCP keyset is UNKNOWN: the expectation mode was not established ($MODE_ERR)"
+  elif CHECK_ERR="$(python3 "$REPO/scripts/meta-bridge-state.py" check --repo "$REPO" --asm "$ASM" ${PLUGIN_ARGS[@]+"${PLUGIN_ARGS[@]}"} 2>&1 >/dev/null)"; then
     ok "state file present and managed settings/MCP keyset survives intact"
   else
     bad "managed settings/MCP keyset missing or overwritten — another consumer may have clobbered a pi-owned key. Re-run ./run.sh install-meta-bridge. Drift detail:"
@@ -565,25 +617,29 @@ except Exception:
     print('')
 PY
 )"
-  EXPECTED_STATUSLINE="$(python3 "$REPO/scripts/meta-bridge-state.py" desired-statusline --repo "$REPO" | python3 -c 'import json,sys; print(json.load(sys.stdin).get("command", ""))')"
-  if [ "$STATUSLINE_CMD" = "$EXPECTED_STATUSLINE" ]; then ok "statusLine.command matches expected (dev: checkout path; installed: entwurf-statusline bin shim): $STATUSLINE_CMD"; else bad "statusLine.command drifted (got '$STATUSLINE_CMD', expected '$EXPECTED_STATUSLINE')"; fi
-  if [[ "$EXPECTED_STATUSLINE" == */* ]]; then
-    if [ -x "$EXPECTED_STATUSLINE" ]; then ok "statusline executable"; else bad "statusline script not executable: $EXPECTED_STATUSLINE"; fi
-  elif command -v "$EXPECTED_STATUSLINE" >/dev/null 2>&1; then
-    ok "statusline bin resolves on PATH: $(command -v "$EXPECTED_STATUSLINE")"
+  if [ -n "$MODE_ERR" ]; then
+    bad "statusLine expectation is UNKNOWN: the expectation mode was not established ($MODE_ERR)"
   else
-    bad "statusline bin not on PATH: $EXPECTED_STATUSLINE"
+    EXPECTED_STATUSLINE="$(python3 "$REPO/scripts/meta-bridge-state.py" desired-statusline --repo "$REPO" ${PLUGIN_ARGS[@]+"${PLUGIN_ARGS[@]}"} | python3 -c 'import json,sys; print(json.load(sys.stdin).get("command", ""))')"
+    if [ "$STATUSLINE_CMD" = "$EXPECTED_STATUSLINE" ]; then ok "statusLine.command matches expected (dev: checkout path; installed: entwurf-statusline bin shim): $STATUSLINE_CMD"; else bad "statusLine.command drifted (got '$STATUSLINE_CMD', expected '$EXPECTED_STATUSLINE')"; fi
+    if [[ "$EXPECTED_STATUSLINE" == */* ]]; then
+      if [ -x "$EXPECTED_STATUSLINE" ]; then ok "statusline executable"; else bad "statusline script not executable: $EXPECTED_STATUSLINE"; fi
+    elif command -v "$EXPECTED_STATUSLINE" >/dev/null 2>&1; then
+      ok "statusline bin resolves on PATH: $(command -v "$EXPECTED_STATUSLINE")"
+    else
+      bad "statusline bin not on PATH: $EXPECTED_STATUSLINE"
+    fi
+    SAMPLE_STATUSLINE_OUT="$(printf '%s' '{"session_id":"doctor-no-record","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-sonnet-5"},"context_window":{"context_window_size":200000,"used_percentage":1,"current_usage":{"input_tokens":1}}}' | "$EXPECTED_STATUSLINE" 2>/dev/null || true)"
+    # The identity row may carry the #98 B unread badge between `cc` and the model letter:
+    # ` ✉N` when mail is waiting, nothing when the mailbox is empty, ` ✉?` when the count
+    # could not be taken. All three are healthy renders, so the shape test admits any of them.
+    if [ "$(printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | wc -l | tr -d ' ')" = "2" ] && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '1p' | grep -q 'tmp' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q '🪛' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -qE ' cc( ✉([0-9]+|\?))? \| s'; then ok "statusline synthetic execution emits two rows (work context + identity)"; else bad "statusline synthetic execution failed or omitted two-row work/identity marker"; fi
+    # The synthetic feeds a session_id with no meta-record, so the garden id does not
+    # resolve and there is no mailbox to count. `✉?` is the required answer: a statusline
+    # that drew nothing there would be claiming "no mail" about a mailbox it never opened —
+    # the exact silence #98 was opened to remove.
+    if printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q '✉?'; then ok "statusline badge distinguishes 'could not count' (✉?) from zero on the no-record synthetic"; else bad "statusline badge omitted ✉? for the no-record synthetic (a false zero would be indistinguishable from an empty mailbox)"; fi
   fi
-  SAMPLE_STATUSLINE_OUT="$(printf '%s' '{"session_id":"doctor-no-record","workspace":{"current_dir":"/tmp"},"model":{"id":"claude-sonnet-5"},"context_window":{"context_window_size":200000,"used_percentage":1,"current_usage":{"input_tokens":1}}}' | "$EXPECTED_STATUSLINE" 2>/dev/null || true)"
-  # The identity row may carry the #98 B unread badge between `cc` and the model letter:
-  # ` ✉N` when mail is waiting, nothing when the mailbox is empty, ` ✉?` when the count
-  # could not be taken. All three are healthy renders, so the shape test admits any of them.
-  if [ "$(printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | wc -l | tr -d ' ')" = "2" ] && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '1p' | grep -q 'tmp' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q '🪛' && printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -qE ' cc( ✉([0-9]+|\?))? \| s'; then ok "statusline synthetic execution emits two rows (work context + identity)"; else bad "statusline synthetic execution failed or omitted two-row work/identity marker"; fi
-  # The synthetic feeds a session_id with no meta-record, so the garden id does not
-  # resolve and there is no mailbox to count. `✉?` is the required answer: a statusline
-  # that drew nothing there would be claiming "no mail" about a mailbox it never opened —
-  # the exact silence #98 was opened to remove.
-  if printf '%s\n' "$SAMPLE_STATUSLINE_OUT" | sed -n '2p' | grep -q '✉?'; then ok "statusline badge distinguishes 'could not count' (✉?) from zero on the no-record synthetic"; else bad "statusline badge omitted ✉? for the no-record synthetic (a false zero would be indistinguishable from an empty mailbox)"; fi
 else
   bad "cannot validate statusline without python3"
 fi
@@ -669,9 +725,12 @@ PY
     [ -n "$LIVE_MCP_DESC" ] || LIVE_MCP_DESC="(unprintable live command)"
     # Ownership axis. `|| true` on the pipeline only: a state.py failure must read as
     # UNKNOWN-and-loud below, never abort the doctor before the delivery drive.
-    DESIRED_MCP="$( { python3 "$REPO/scripts/meta-bridge-state.py" desired-mcp --repo "$REPO" \
+    DESIRED_MCP=""
+    [ -n "$MODE_ERR" ] || DESIRED_MCP="$( { python3 "$REPO/scripts/meta-bridge-state.py" desired-mcp --repo "$REPO" ${PLUGIN_ARGS[@]+"${PLUGIN_ARGS[@]}"} \
       | python3 -c 'import json,sys; print(json.dumps(json.load(sys.stdin), sort_keys=True))'; } 2>/dev/null || true)"
-    if [ -z "$DESIRED_MCP" ]; then
+    if [ -n "$MODE_ERR" ]; then
+      bad "live-vs-desired MCP ownership is UNKNOWN: the expectation mode was not established ($MODE_ERR)"
+    elif [ -z "$DESIRED_MCP" ]; then
       bad "could not compute the desired MCP entry (meta-bridge-state.py desired-mcp failed) — live-vs-desired ownership is UNKNOWN"
     elif [ "$LIVE_MCP" = "$DESIRED_MCP" ]; then
       ok "live mcpServers.entwurf-bridge equals desired_mcp() for this mode (installed: bin shim; clone: this checkout's start.sh)"

package/scripts/mutants/herdr-activation.json

@@ -351,6 +351,77 @@
 			"timeoutSeconds": 300,
 			"signature": "[QK:HAC-LEDGER-PATH-KIND]",
 			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "DOCTOR-MODE-DERIVED",
+			"title": "a resolver that never answers plugin mode leaves the doctor computing bare-bin expectations on a plugin-activated host, so the activation's correct absolute wiring is reported as drift and the supported route can never be certified (#136)",
+			"subject": "scripts/herdr-activation.mjs",
+			"find": ["\treturn activeDir;\n}"],
+			"replace": ["\treturn null;\n}"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:DOCTOR-MODE-DERIVED]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "DOCTOR-MODE-CHECKOUT-NEVER-DERIVES",
+			"title": "dropping the runtime-package precondition lets a checkout's doctor read the plugin ledger and adopt its absolute wiring as its own expectations, so the checkout certifies a runtime it does not own (#136)",
+			"subject": "scripts/herdr-activation.mjs",
+			"find": ["\t\tif (!same) return null;"],
+			"replace": ["\t\tvoid same;"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:DOCTOR-MODE-CHECKOUT-NEVER-DERIVES]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "DOCTOR-MODE-UNCERTIFIED-DIES",
+			"title": "swallowing the reader's refusal turns an uncertified ledger into 'not plugin mode', so a doctor silently falls back to bare expectations over a record nobody can vouch for (#136)",
+			"subject": "scripts/herdr-activation.mjs",
+			"find": [
+				"\tconst ledger = readCertifiedLedger(resolveActivationLayout(env));\n\tif (ledger === null) {\n\t\tif (override === undefined) return null;"
+			],
+			"replace": [
+				"\tlet ledger = null;\n\ttry {\n\t\tledger = readCertifiedLedger(resolveActivationLayout(env));\n\t} catch {\n\t\tledger = null;\n\t}\n\tif (ledger === null) {\n\t\tif (override === undefined || override !== undefined) return null;"
+			],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:DOCTOR-MODE-UNCERTIFIED-DIES]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "DOCTOR-MODE-OVERRIDE-AGREES",
+			"title": "an override that need not agree with the ledger lets any caller-named root become the doctor's expectation, so the doctor would certify absolute commands pointing anywhere (#136)",
+			"subject": "scripts/herdr-activation.mjs",
+			"find": ["\tif (override !== undefined && override !== activeDir) {"],
+			"replace": ["\tif (false) {"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:DOCTOR-MODE-OVERRIDE-AGREES]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
+		},
+		{
+			"claim": "DOCTOR-PLUGIN-MODE-GREEN",
+			"title": "a doctor that resolves plugin mode but never passes it to its desired-state calls still expects bare bins, so the plugin activation's absolute wiring stays falsely red (#136). One mutant for the shared wire on purpose: omitting the mode at any single one of the three call sites also turns P1 red, but no per-site mutant proves that",
+			"subject": "scripts/meta-bridge-doctor.sh",
+			"find": ["    PLUGIN_ARGS=(--plugin-runtime \"$MODE_ROOT\")"],
+			"replace": ["    : \"$MODE_ROOT\""],
+			"gate": ["bash", "run.sh", "check-meta-doctor-oracle"],
+			"timeoutSeconds": 600,
+			"signature": "[QK:DOCTOR-PLUGIN-MODE-GREEN]",
+			"signatureSource": "scripts/check-meta-doctor-oracle.sh",
+			"build": { "argv": ["bash", "scripts/build-bridge.sh"], "output": "mcp/entwurf-bridge/dist" }
+		},
+		{
+			"claim": "DOCTOR-MODE-ADMISSION-CLAUSES",
+			"title": "dropping the phase clause lets a ledger caught mid-activation or mid-teardown admit plugin mode, so the doctor certifies absolute wiring the activation has not finished writing or is already removing (#136)",
+			"subject": "scripts/herdr-activation.mjs",
+			"find": ["\tif (ledger.phase !== \"active\") refuse(`activation ledger phase is ${ledger.phase}, not active`);"],
+			"replace": ["\tvoid refuse;"],
+			"gate": ["bash", "run.sh", "check-herdr-activation"],
+			"timeoutSeconds": 300,
+			"signature": "[QK:DOCTOR-MODE-ADMISSION-CLAUSES]",
+			"signatureSource": "scripts/check-herdr-activation.ts"
 		}
 	]
 }