@junghanacs/entwurf 0.34.1 → 0.35.0

package/CHANGELOG.md

@@ -4,6 +4,223 @@ All notable changes to this project will be documented here. Format follows [Kee
 
 ## Unreleased
 
+## 0.35.0 - 2026-10-12
+
+### Collaboration and qualification
+
+- **A renewed demo after the 0.12.0 transition.** This is the first newly recorded
+  collaboration demo release since the 0.12.0 hard cut from `pi-shell-acp` to `entwurf`.
+  The capability is visible again in a real shared workbench, while #137 reduces redundant
+  qualification work without introducing a blanket plugin or data-file exemption.
+- **Real Pi ↔ native Claude Code collaboration in Herdr (#138).** The README now shows the
+  accepted whole-workbench recording below the hero, linked to the Herdr section. The original
+  GIF bytes were published without captions or a retake; recording tooling remains separate.
+- **Restore maintainer demo recipes and source tooling (#138).** The checkout now carries
+  the take/renderer/helpers and Node fixtures, including the actual whole-Herdr recipe and
+  original publication provenance. A new LIVE take is distinct from the private original;
+  missing historical tool versions are not invented. Archived v1 scripts refuse before any
+  command. Every LIVE scene refuses a non-approved selector or OpenRouter redirect first, and
+  missing LIVE cannot allocate capture resources; mixed subject/terminal tails are
+  kept, absent recording cannot certify success, and rerendering preserves the original
+  take's agg input. The renderer refuses publication destinations and parent aliases;
+  publication still requires separate review and copy. Source tests have their own discovered
+  Node floor and type fence, while maintainer TypeScript stays out of the installed package.
+  Neither source tooling nor the narrow privacy scan certifies a package consumer, original
+  capture replay, or whole-host/public-readability acceptance.
+- **Avoid redundant qualification for untouched TOML find ranges (#137).** Push replay reads
+  manifests at the named HEAD and checks every joined find span on both blobs. Only exact-once,
+  unmoved, untouched TOML spans may skip. Markdown/JSON data stays file-level, because a
+  shorter presence literal or a later duplicate JSON key outside the find can re-satisfy an
+  oracle. Code/unknown subjects, signature sources and deciding machinery also remain
+  file-level, and uncertainty runs the body. The FULL floor and exact-SHA core
+  release qualification obligation are unchanged. The earlier source landing kept 0.34.2;
+  this separate preparation moves the core package to 0.35.0.
+
+### Release boundary and verification
+
+- **Reviewed source, not borrowed release evidence.** The implementation commit `52cdd7f`
+  follows the final consistency closure and independent review. Its frozen source candidate
+  passed the FULL deterministic floor in 762 seconds with HEAD, index and work surface
+  unchanged. Affected PARTIAL groups killed all 24 release-gate and 12 demo claims at their
+  owning QK signatures, with four green controls; the other 904 claims were not run locally.
+  The set now contains 940 distinct claims. Those local receipts are development evidence,
+  not a whole qualification pass. The later test-only checkpoint `41a8d78` closes fixture
+  cleanup on green and assertion-red paths, including the fake recorder's owned teardown.
+  Its affected demo PARTIAL killed all 12 claims at their QKs with two green controls,
+  followed by frozen FULL 766s/0 on identical source/index/HEAD. All five measured fixture
+  prefixes had zero new residue; historical and original/native evidence was preserved.
+- **Whole qualification BODY deferred by explicit operator instruction for this cut.**
+  The operator requested main publication without repeating the approximately 95-minute
+  qualification body. The ordinary push uses a one-commit `[skip ci]` marker to prevent its
+  automatic start; the existing `workflow_dispatch` with `qualify=false` can run the four
+  ordinary CI jobs without the body. This changes no product gate or workflow wiring.
+  A floor-only run is not exact-SHA whole qualification acceptance, and no skipped BODY
+  is reported as PASS. The unchanged release oracle would refuse it; make's preserved
+  artifact/tag/GitHub Release sequence remains pending, rather than bypassing that oracle.
+- **Supply the real GIF decoder to the offline CI floor, not to the product.** The first
+  floor-only main run `38170795980` passed the three install/artifact jobs but stopped
+  `check:full` on the new demo fixtures because Ubuntu lacked `ffprobe` (`ENOENT`).
+  The check job now installs Ubuntu's `ffmpeg` package before the FULL floor and records
+  the decoder version. The fixtures still fake the renderer/caption tools and judge real
+  GIF bytes through `ffprobe`; no decoding assertion or missing-tool failure is skipped.
+  This is job-only scaffolding, not operator/global or npm setup. The CI recovery result
+  belongs in #137/#138's live checkpoint; the original failed run remains historical.
+- **Native Codex LIVE is explicitly deferred for this cut, to the next release.** The operator
+  requested its exclusion from this verification. No native Codex sibling/app-server or turn
+  is started, and its product MUST wiring remains intact. This is an unmeasured per-cut
+  exception, not PASS or a standing waiver. Other required axes remain required; record
+  their actual outcomes and any named Codex SKIP separately, never round that SKIP green.
+  The earlier frozen versioned candidate's LIVE aggregate ran in
+  `/tmp/entwurf-release-gate-0.35.0.wypGz0/release-gate.log`: MUST PASS=23 FAIL=0 SKIP=1
+  (only native Codex), BEHAVIOR PASS=1 FAIL=0 SKIP=0, standard `--cut` exit 1 / BLOCKED.
+  Its runtime observation predates the test-only fixture checkpoint and is not borrowed
+  as that changed candidate's full release acceptance.
+- **Unpublished candidate verification carrier.** The npm-source lock must agree with the
+  checkout's core version, so the 0.35.0 preparation temporarily uses the existing closed
+  `herdr-checkout` carrier without inventing an npm integrity. The published 0.34.2 pin and
+  Herdr manifest version remain historical/separate; this is not a Herdr 0.35.0 snapshot.
+  A host that changes acquisition source must explicitly deactivate/activate, never inherit
+  an activation. Operator installations are not rewired by this preparation. After the
+  operator publishes core 0.35.0, the later Herdr snapshot must re-pin the measured registry
+  bytes and perform literal #137 next-plugin acceptance; neither is claimed here.
+- **Publication boundary.** The latest instruction narrows this lane to the 0.35.0 main
+  preparation and ordinary push, then a completion handoff. npm publication belongs to
+  the operator; after it, the Herdr plugin's separate 0.35.0 snapshot and measured npm
+  re-pin can follow. No npm publication, Herdr version bump or registry pin is executed
+  here. No accepted make artifact, core tag or GitHub Release is claimed prematurely.
+
+## v2026.10.11-herdr.0.34.2 — Herdr Entwurf plugin 0.34.2
+
+A Herdr plugin snapshot, not a core release: no package version, npm artifact or core tag moves.
+
+### Herdr plugin
+
+- **Runtime re-pinned to the published 0.34.2 (#136).** `plugins/herdr/runtime-lock.json` returns
+  from the `herdr-checkout` verification carrier the 0.34.2 preparation rode to the npm production
+  source: `@junghanacs/entwurf@0.34.2` with the registry's measured sha512
+  (`sha512-RbEkv3Ha…s/5ksg==`). The manifest version moves 0.34.1 → 0.34.2; `min_herdr_version`
+  stays 0.9.0. The checkout window is closed. A plugin host now receives the #136 fix: its
+  runtime's `doctor-meta-bridge` derives plugin-runtime mode from the activation ledger and
+  certifies the activation's absolute wiring.
+- **Upgrading.** A host on the npm 0.34.1 snapshot stays on the npm source, so its next
+  `herdr plugin install` is a same-source rebind under the plugin README's conditions. A host that
+  installed from `main` while the lock named `herdr-checkout` needs `herdr-plugin-deactivate` by
+  its absolute runtime path, then `herdr plugin install` again.
+
+### Verification
+
+- **Registry, measured before the pin.** `npm view` reports version 0.34.2 with `latest` →
+  0.34.2 and `repair` → 0.12.8-repair.1. The downloaded tarball is 13595042 bytes with sha256
+  `e75efb0c…c009`, equal to the artifact accepted as 0.34.2. Its sha512, computed independently
+  from those bytes, equals `dist.integrity`. A sandboxed `pi install
+  npm:@junghanacs/entwurf@0.34.2` resolved the bridge to the registry install and listed the
+  `entwurf` models.
+- The focused Herdr gates, `pnpm check`, the public `main` install journey and the exact-SHA CI run
+  on the pushed commit will be recorded in the GitHub release and #136, not claimed here. No gate, mutant or matrix changed, so no
+  qualification PARTIAL is owed.
+
+## 0.34.2 - 2026-10-11
+
+### Release coordination
+
+- **A patch cut for #136.** Coordinated by the Claude Code Fable citizen `20261011T132613-9a46b6`,
+  implemented by Claude Code Opus `20261008T094901-5d295e` as sole writer on the thinkpad that
+  holds the failing installation, and independently reviewed by a pi `gpt-6.1-sol` sibling. GLG
+  authorized the commits, main and this release. This section is written at prepare time: the
+  `check:full` and exact-SHA CI results will be recorded at make time in the GitHub release and
+  #136, not claimed here.
+- **GLG waived the LIVE `release-gate --cut` for this cut** (doctor-only change, no LIVE surface
+  touched). The deterministic floor `check:full` and the exact-SHA CI body are this release's
+  evidence, and acceptance 4 (host rebind + new Claude session) is owed after publication. This is
+  not a PASS and not a standing waiver.
+- **The plugin runtime lock rides `herdr-checkout` for this window.** `certifyLockCoherence`
+  (`scripts/herdr-runtime.mjs:353-361`) refuses an npm lock whose version differs from the
+  checkout's package, so `plugins/herdr/runtime-lock.json` leaves npm 0.34.1 for the closed
+  `herdr-checkout` source from this prep until the post-publish npm 0.34.2 re-pin; the plugin
+  manifest moves with that re-pin. A host already on npm 0.34.1 is unaffected until then and
+  upgrades same-source; a host that installs the plugin from `main` inside the window gets a
+  checkout-source runtime and needs `herdr-plugin-deactivate` before the npm reinstall.
+
+### Fixed
+
+- **`doctor-meta-bridge` certifies a Herdr plugin installation (#136).** The plugin activation
+  writes Claude's MCP and statusLine as absolute commands under the stable runtime, but the doctor
+  computed its three expectations (`meta-bridge-state.py check`, `desired-statusline`,
+  `desired-mcp`) without that mode. It expected bare bins and reported correct wiring as drift, so
+  no plugin host could reach a green doctor. The doctor now learns its mode from the certified
+  activation ledger through one narrow call (`resolveDoctorPluginRuntime`,
+  `scripts/herdr-doctor-mode.mjs`). Derived plugin mode needs all four clauses:
+  - the ledger phase is `active`;
+  - `claude-code` was activated;
+  - the ledger's runtimeRoot is this host's stable root;
+  - the doctor runs from that runtime's package.
+  A flagless checkout doctor never opens the ledger. The explicit `--plugin-runtime <root>`
+  override bypasses only the repo clause and still reads and certifies the ledger, which it must
+  agree with. A refusal reports each expectation as UNKNOWN, never a bare-bin fallback, and
+  the runtime sections still run. The doctor prints the mode it used on one line.
+- **`run.sh doctor-meta-bridge` forwards its arguments.** The verb was never shifted, so it rode
+  into the doctor's argv; the override was unreachable through the operator entrypoint.
+
+### Docs
+
+- **CONTRIBUTING matches the scheduling rule.** A gate, mutant or matrix change runs only its
+  affected exact-argv groups as PARTIAL receipts; the whole qualification body runs once per cut,
+  in the prepared SHA's CI. CONTRIBUTING still told a gate-changing PR to run the body itself.
+
+### Verification
+
+- New cells: `check-herdr-activation` D1-D6 and `check-meta-doctor-oracle` P1-P3. The existing
+  clone control is unchanged (P4). Six mutants joined the `herdr-activation` lane (now 34).
+  PARTIAL receipts: herdr-activation group 33/33 and doctor-oracle group 2/2 killed, control ok.
+  No whole body ran in development.
+- **Host acceptance before publication (thinkpad, live plugin 0.34.1 wiring).** The patched
+  checkout doctor with `--plugin-runtime <stable root>` named `mode: plugin-runtime … (activation
+  ledger)`. Its only FAIL was writer-version parity, the declared non-goal of a checkout doctor on
+  a plugin host. The seven drift lines the shipped doctor printed are gone.
+- **Owed after publication.** After the plugin is re-pinned to 0.34.2 and rebound on that host, a
+  flagless runtime-absolute `doctor-meta-bridge` must exit 0 and a new Claude session must call
+  `entwurf_self`. That is what closes #136.
+
+## v2026.10.9-herdr.0.34.1 — Herdr Entwurf plugin 0.34.1
+
+A Herdr plugin snapshot, not a core release: no package version, npm artifact or core tag moves.
+
+### Herdr plugin
+
+- **Runtime re-pinned to the published 0.34.1 (#135).** `plugins/herdr/runtime-lock.json` returns
+  from the `herdr-checkout` verification carrier the 0.34.1 preparation rode to the npm production
+  source: `@junghanacs/entwurf@0.34.1` with the registry's measured sha512
+  (`sha512-AiB88Ext…GDxA==`). The manifest version moves 0.34.0 → 0.34.1; `min_herdr_version`
+  stays 0.9.0. A plugin host now receives the #135 fixes listed under 0.34.1: owner preflight
+  before acquisition, the no-ledger deactivate, and the regular-file-or-nothing ledger address.
+- **Upgrading.** A host on the npm 0.34.0 snapshot stays on the npm source, so its next
+  `herdr plugin install` is a same-source rebind under the plugin README's conditions. A host that
+  installed while the lock named `herdr-checkout` — the 0.30.1 plugin, or `main` during the 0.34.1
+  preparation window — holds a checkout-source runtime and ledger, and npm is a different
+  acquisition source, refused rather than inherited (`activation-artifact-source-drifted`). Run
+  `herdr-plugin-deactivate` by its absolute runtime path, then `herdr plugin install` again.
+- **The READMEs no longer state a current release.** The root README's hardcoded release block and
+  the plugin README's snapshot and carrier prose went stale with every version bump; they now point
+  at `runtime-lock.json`, `herdr-plugin.toml`, Releases and this file. The source-switch rules and
+  the 0.34.0 runtime's no-ledger limit stay, the latter as a historical fact.
+
+### Verification
+
+- **Registry, measured before the pin.** One scheduled observation, after a 300 s delay:
+  version 0.34.1 published at 2026-10-09T14:29:48.184Z with `latest` → 0.34.1, and the downloaded
+  tarball re-hashed to the artifact accepted as 0.34.1 (sha256 `73407ba8…`, 13587297 bytes), with
+  `dist.integrity` re-derived equal. Dist-tags before publication were not captured, so no
+  before/after claim is made about them.
+- **VERIFY's 0.34.0 public-ref row is closed with its measured receipts:** `--ref main` PASS at
+  `b5d15d8` and `8ed4d1a`, both acquiring npm 0.34.0. That is a main-ref receipt, not a tag-ref
+  or native claim.
+- No gate, mutant or matrix changed, so no qualification PARTIAL is owed. The npm-source re-proof
+  for this pin — the focused Herdr gates, a real-npm 0.34.0 → 0.34.1 swap and torn-swap recovery,
+  an installed registry consumer, the registry-file container consumer, the public `main`
+  first-user path and the exact-SHA CI run — is recorded in the GitHub release, not claimed here.
+  A `--ref <tag>` install, a citizen drawn as a ROW in a real Herdr pane, and native hosts stay
+  unmeasured.
+
 ## 0.34.1 - 2026-10-09
 
 ### Release coordination

package/CONTRIBUTING.md

@@ -30,7 +30,7 @@ pnpm check              # everyday core (prints wall time; <=60s on the referenc
 pnpm run check:full     # full deterministic floor — the required PR gate
 ```
 
-The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory; zero COMMITTED mutants executed — the self-test runs only its synthetic fixture mutants in tmp fixture repos — ~20s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on a branch push whose diff touched the qualification surface (and unconditionally on dispatch or the weekly schedule) and a gate-changing PR must run once itself. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling"). No install or build lifecycle script installs git hooks: a global `core.hooksPath` guard that chains to repository-local hooks runs its own checks, then delegates — to `.husky/pre-commit` here, unless an executable `.git/hooks/pre-commit` takes precedence.
+The deterministic floor is tiered (#70). `pnpm check` is the everyday core (biome, tsc, the vitest lanes, and the fast contract gates); `pnpm run check:full` adds the hermetic-integration and package/install tiers — including `check-gate-manifests`, the qualification HEAD (runner self-test, manifest-set validation, declared lane inventory; zero COMMITTED mutants executed — the self-test runs only its synthetic fixture mutants in tmp fixture repos — ~20s), but not the separately scheduled mutant-EXECUTING body `check-gate-qualification`, which CI runs on a branch push whose diff touched the qualification surface (and unconditionally on dispatch or the weekly schedule). Development never runs that whole body: a gate, mutant or matrix change runs only its affected exact-argv groups once, as PARTIAL receipts (`./run.sh check-gate-qualification --group '<argv JSON>' --receipt <absolute path outside the repo>`), and the whole body runs once per cut, in the prepared SHA's CI. Exact membership is the named `check:*` scripts in `package.json`. Run `check:full` once on your frozen commit candidate — the pre-commit hook (`.husky/pre-commit`) carries only fast static checks (whitespace, lint, typecheck), not the full floor, so a green `pnpm run check:full` before commit is the evidence that your change holds (scheduling contract: AGENTS.md "Verification scheduling"). No install or build lifecycle script installs git hooks: a global `core.hooksPath` guard that chains to repository-local hooks runs its own checks, then delegates — to `.husky/pre-commit` here, unless an executable `.git/hooks/pre-commit` takes precedence.
 
 For changes that touch backend launch, session lifecycle, or `_meta` shape, also run
 the live ACP smokes that cover the touched rail — at minimum:

package/README.md

@@ -6,6 +6,13 @@ transcript, authentication, tools, or runtime.
 
 ![entwurf — a forged screwdriver for garden-citizen dispatch](docs/assets/entwurf-hero.jpg)
 
+**Pi ↔ native Claude Code inside the [Herdr workbench](#herdr-workbench).**
+A recorded source-checkout demo: callback → task → native Bash → reply.
+[Source recipe and original provenance](demo/README.md#whole-herdr-pi--native-claude-code-138)
+(the recipe creates a new take; the original private capture is not shipped).
+
+![Pi and native Claude Code collaborating inside Herdr](docs/assets/entwurf-demo.gif)
+
 [![npm](https://img.shields.io/npm/v/@junghanacs/entwurf?logo=npm)](https://www.npmjs.com/package/@junghanacs/entwurf) · maintained by [junghanacs.com](https://junghanacs.com/)
 
 A sibling is a visible session with its own runtime boundary, not a disposable
@@ -27,11 +34,8 @@ Claude and Cortex Code are ACP backends. Codex and Antigravity stay native so th
 retain their own tools and work context. Capabilities differ by rail: a shipped
 citizen is not a promise of every lifecycle operation.
 
-> **Current release: [0.33.0](https://github.com/junghan0611/entwurf/releases/tag/v0.33.0)**
-> ([`fea9b3d`](https://github.com/junghan0611/entwurf/commit/fea9b3dc4779ac5deb34e239abc8e0b5e3e95382)).
-> Includes the pinned Pi 1.1.0 native durable app/TUI and one explicit native-module ingress;
-> `npm` `latest` is `0.33.0`. What that cut ran and did not run is in its CHANGELOG section.
-> Release history and detailed evidence belong in [CHANGELOG](./CHANGELOG.md).
+[Releases](https://github.com/junghan0611/entwurf/releases) contain each cut's notes and acceptance
+receipts; [CHANGELOG](./CHANGELOG.md) records source history.
 
 ## Install
 
@@ -88,8 +92,8 @@ models/auth, queues, SQLite, transcripts and recovery remain upstream-owned:
 [Hard Rule 17](./AGENTS.md#hard-rules), **supply the missing surface; do not become the harness**.
 
 Optional `--native-module <absolute file>` initializes trusted ESM before runtime/TUI
-imports, then installs its default native Extension after the contact. After 0.33.0 (#134):
-`--native-module-dir <absolute directory>` loads the top-level `*.extension.mjs` files of that
+imports, then installs its default native Extension after the contact.
+`--native-module-dir <absolute directory>` (#134) loads the top-level `*.extension.mjs` files of that
 one named directory in byte-wise order instead, and the durable TUI keeps a live
 background-task badge on screen at any terminal size. No automatic module discovery or
 classic Pi API shim; guards are not a sandbox or rollback.

package/VERIFY.md

@@ -58,6 +58,15 @@ install and pack gates that consume a tarball; gates that spawn a subprocess or
 gates that read product source as text; and the mutant EXECUTION COORDINATES described below. A
 new hand-built gate needs a reason one of those five applies.
 
+The maintainer demo lane (#138) is source-only Node strip-types/CLI and subprocess
+fixtures, not an installed adapter contract. Its `demo/**/*.test.ts` uses `node:test`,
+so `check-demo-reproducibility` discovers and runs it separately in the deterministic
+floor, with sandboxed HOME/XDG and fake version-only Pi metadata. Do not add Node tests
+to the Vitest include and call them reached. Take/renderer/helper TS stays out of the
+package; the paired scripts type fence checks it. Fake-tool tests, private original
+capture, a new opt-in LIVE take, published GIF approval and exact release/package
+acceptance remain distinct axes; see [the source recipe](./demo/README.md).
+
 **Four rules bind a migrated gate that carries mutants**, and each of them was measured rather
 than assumed (#119 V3 slice 2):
 
@@ -87,6 +96,7 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 
 - **Deterministic floor — two tiers (#70):** `pnpm check` is the everyday CORE — toolchain (lint + typecheck), the vitest lanes, and the pure-unit / behavioral-contract / source-topology gates plus the cheap static coherence checks. It prints its own total wall time; acceptance is ≤60s on the reference host `oracle` (an operator measurement, never a hard wall-clock gate on arbitrary hosts). `pnpm run check:full` is the FULL deterministic floor — the core plus the hermetic-integration and package/install tiers — and is what the frozen-candidate protocol, push CI, release-gate, and `prepublishOnly` run. Exact membership is the named `check:*` group scripts in `package.json` (the executable SSOT — this document records meaning and principles, not the command list); a gate changes tier by semantic-class decision, never by getting faster or slower. One core member assumes a build output: the beside test `pi-extensions/entwurf-control.test.ts` (reached through `check-tests-beside-behavior`) registers the COMPILED bridge and refuses by name when it is absent. `prepare` normally builds it at install; after an `--ignore-scripts` install or a bridge source change, run `pnpm run build-bridge` (in the sandbox candidate when verifying one) before the core. The FULL tier carries the qualification HEAD (`check-gate-manifests`, through `check:hermetic`); the everyday core does not, and neither tier carries the separately scheduled mutant-executing body (`check-gate-qualification`).
 - **Discriminating power of that floor:** `./run.sh check-gate-qualification` (scheduled, not ambient: the whole body runs only as the bare call — in the CI `check` job on a branch push that touched the qualification surface, and — for a cut — at the prepared SHA, where the exact-SHA release oracle requires that CI step once and the prepared state awaits it, never presumed PASS; a cut therefore batches its commits into that one prepared push (#132 took the cut's body off the local `release-gate`). Development runs no whole body (#133): a lane that changes a gate/mutant/matrix runs its affected exact-argv groups once, after review, as PARTIAL receipts — `./run.sh check-gate-qualification --group '<argv JSON>' --receipt <absolute path outside the repo>`, whose arguments reach the runner's parser unchanged and are refused there by name, before any body or snapshot, when malformed, missing or repeated. A receipt is a measurement of one group, never a qualification pass. Neither form is inside the default check chains; a semver TAG push triggers no CI at all, and the exact-SHA evidence a release quotes is whichever run at that commit CARRIES the body — the branch run when the push touched the qualification surface, else a dispatch run; a push that touched none of the qualification surface skips the body, and `workflow_dispatch -f qualify=true` plus a weekly `schedule` run it unconditionally — the exact-SHA release oracle refuses a SHA whose body step did not conclude success) re-plants committed defect mutants (`scripts/mutants/*.json`, one per closed defect class) in an isolated snapshot repo and requires each to turn its gate red **bounded and at its claimed `[QK:<claim>]` signature** — a wrong-reason red fails, a baseline-red control voids the whole group, and the runner is negative-controlled on every run (zero-match/multi-match/survived/wrong-reason/hang/control-red/impurity). This measures whether the deterministic gates still *block* what they claim to block; it is **not a new evidence level** (L0–L5 are untouched) and never substitutes for LIVE evidence. Per-cut records cite claim IDs + killed mutant IDs — "N checks passed" alone is not evidence. `check-agy-permission-matrix` complements it with the enumerated permission contract space (literal cells + stated exclusion rules, oracle independent of the SUT). The gate's HEAD is separable and IS in the floor: `check-gate-manifests` runs the runner self-test, validates the committed manifest set against the origin index, and asserts the declared lane inventory, while executing zero COMMITTED mutants (the self-test runs only its synthetic fixture mutants, in tmp fixture repos) and never snapshotting the repo — three of the five reds qualification has ever produced in CI died in that head, in under five seconds.
+  - **Push matching is conservative and hunk-aware (#137).** Git ranges read mutant manifests from the named HEAD commit, not a later working tree. Signature sources and the existing deciding machinery always match at file level, including paths that are also subjects. Only TOML subjects (`.toml`) may skip, and only when every mutant's joined `find` span occurs exactly once on both blobs, stays on the same lines, and intersects no zero-context diff hunk. Markdown, JSON, code and unknown subject types remain file-level. An outside-find early return/import/caller change can weaken a code mutant without editing its literal find. A presence/`includes` oracle whose required literal is shorter than the find can be re-satisfied by an out-of-span restatement; a scratch-repo probe measured exactly that false SKIP for `ADMISSION-LEGACY-DOCUMENTED` in `DELIVERY.md`. A later duplicate JSON key wins under `JSON.parse`, which every current JSON data oracle uses. TOML refuses a redefined key, and the current TOML oracles are exact-count/absence checks; a future TOML subject with a presence oracle reopens this boundary. `QUALIFY-FILTER-TOML-ONLY-REFINEMENT` pins Markdown/JSON at file level. Moved, absent, ambiguous, binary or unreadable spans/diffs/manifests run the body with a named reason; renames are compared as delete/add. `--files-from` has no hunk evidence and retains path identity. There is no Herdr filename or release-shape exemption. Span matching is not proof of unchanged kill-power. The rule narrows per-push qualification to those declared TOML spans; forced/scheduled and exact-SHA release qualification remain the backstop. This narrows redundant data-only pushes, never the FULL floor or exact-SHA release body's obligation; a body-less plugin SHA cannot supply the core SHA's evidence.
   - **The snapshot is source-only (#125).** It replicates the git work surface and never copies an ignored artifact from the checkout. A gate that consumes an ignored build output — the compiled `entwurf-bridge` a pi citizen registers — declares it on each of its mutants (`"build": {"argv": [...], "output": "<dir>"}`, one declaration per gate group). For that group only, the runner builds the output from the snapshot's own bytes before the control, rebuilds it after every mutation and from the restored bytes before the post-control (which must reproduce the baseline digest), never counts a build red as a kill, voids a run whose gate writes into the output, and removes the output when the group ends. The runner self-test owns this as `[QK:QUALIFY-BUILD-*]`.
 - **Live floor:** `LIVE=1 ./run.sh release-gate <scratch-project-dir> --cut` — `pnpm run check:full` + the v2-native live gates + the ACP plugin acceptance floor. It reports a **two-tier summary**:
   - **MUST tier** (release-blocking — owns the exit code; "green" applies only here): `pnpm run check:full`, `smoke-entwurf-v2-matrix-live`, `check-bridge`, `doctor-pi-provider` (#81 — `check-bridge` proves the launcher this checkout SHIPS; this proves the invocation the operator's pi provider actually EXECS, by booting it and requiring the entwurf verb set back, because `command -v` answers yes for a command that exits 127; wired as a step on 2026-08-19 after a relocated pnpm cmd-shim cost a cut sixteen LIVE steps before the same fact surfaced at `smoke-acp-bundled-mcp-live`), the resident-garden-guard zero-token half (record birth / record-keyed socket / attach-on-reopen), the `smoke-acp-*-live` ACP plugin smokes (socket-citizen / raw-turn / overlay / provider / session-reuse / carrier-augment / memory-containment / rgg / mcp / skill / bundled-mcp / v2-send), the axis wired in on 2026-07-31 that the aggregate had simply never listed (`smoke-claude-native-resume-live`), `smoke-entwurf-chain-live` — the cross-harness delivery chain (native Claude Code → pi GPT → pi ACP Sonnet → mailbox terminus) proving sender identity and replyability at every hop plus a real read receipt at the end — the integrated `smoke-mux-lifecycle-live` (its own note below), and the two OMP steps 0.16.0 wired: `smoke-omp-receive-live` (the addressed roundtrip into a live omp citizen; it reads the capability registry and decides its own outcome rather than passing by default) and `smoke-omp-fresh-live` (the clause 7 receipt the release stop now requires). (`smoke-session-id-name` is gone — #50 C3: its `--session-id`/`--name` substrate has no entwurf consumer anymore.)
@@ -96,7 +106,7 @@ that moved out of `scripts/` and into a file beside its subject would otherwise
 
 > **The herdr rail is an on-demand axis until it has run.** `smoke-herdr-fresh-call-live` opens a real caller inside a real herdr pane, has it invoke the PUBLIC `entwurf_fresh_call`, and reads the child's nonce callback — the one axis no deterministic gate reaches, since the rail is selected from the caller's own process environment. **The release aggregate does not yet require the herdr rail**: herdr is optional (a cut on a host without it must not block), and first evidence precedes promotion — a rail whose first acceptance run is days old has not earned a place in the gate that blocks every cut. Run it directly with `LIVE=1 ./run.sh smoke-herdr-fresh-call-live` whenever a cut changes herdr rail code, and promote it to a MUST only after the axis has a run history to point at. Without `LIVE=1`, or without herdr/pi/claude on PATH, it reports protocol SKIP — never a pass.
 
-> **The plugin's FIRST USER PATH is its own on-demand axis, and an npm acquisition receipt holds only for the ref it ran on (#118 홉 1).** Every other herdr gate proves the plugin against a source this repository controls: `check-herdr-plugin-build` drives a stub, and `smoke-herdr-plugin-build-live` redirects the product remote to a local bare clone with git `insteadOf` and asserts `identity.kind === "herdr-checkout"`. npm has been the production authority class since `dd84ac0`; the 0.30.0 follow-up re-pinned `@junghanacs/entwurf@0.30.0` with its published sha512 after the candidate windows rode `herdr-checkout` (`8b92e09`), and the 0.30.1 preparation rode that closed verification carrier again without inventing a registry integrity. The last published plugin snapshot `v2026.10.9-herdr.0.34.0` pins the published `@junghanacs/entwurf@0.34.0` with its measured sha512 (#132); 0.31–0.33 were never pinned. This checkout's unpublished 0.34.1 preparation rides the closed `herdr-checkout` verification carrier again, without inventing a registry integrity: it has no published npm SRI and is not a plugin pair. The source re-proof has separate dated npm rows: 2026-09-23 public `main=113ca53`, plugin 0.5.0, runtime 0.25.0 (CHANGELOG 0.25.1), and the 0.30.0 re-pin accepted at public `506c46f` in the [#126 thread](https://github.com/junghan0611/entwurf/issues/126). Neither certifies the 0.34.0 registry acquisition. That pin's real-npm swap / torn-swap recovery was measured locally on 2026-10-09 by driving the registry-shipped `scripts/herdr-runtime.mjs` (byte-equal to this checkout's) with its own npm acquisition: a 0.33.0 → 0.34.0 swap, and the same upgrade torn between its two renames then resumed, where the last-good 0.33.0 tree was restored before 0.34.0 was acquired again. Both ended `runtime-ready` at observed digest `sha256-e9d995ff…`, the accepted 0.34.0 artifact. That local receipt is recorded in the [#132 thread](https://github.com/junghan0611/entwurf/issues/132); it covers runtime recovery, not this smoke's cells. The public-ref acceptance of this smoke is PENDING the prepared push, and its actual result will be recorded there; checkout candidate evidence does not transfer. `LIVE=1 ./run.sh smoke-herdr-raw-install-live [--ref <REF>]` fills that row in a clean `node:24` container with no socket, config, cache or repo mounted, no `insteadOf`, the public remote spelled as a user would type it, and pi / herdr / Claude Code installed in the IMAGE BUILD as scaffolding (Hard Rule 17 — the product face begins at `herdr integration install pi`). herdr itself comes from `scripts/install-herdr-ci.sh` against `scripts/fixtures/herdr-supply.json`, so no version or digest lives here. `--ref` defaults to `main` rather than a pinned SHA because receipt (a) is defined as what a user gets today; the resolved commit is printed, so the receipt stays exact. It takes a REMOTE REF and not an arbitrary commit — measured on herdr 0.9.1, `--ref <sha>` fails as `couldn't find remote ref`, because the checkout fetches by name — so a candidate is addressed by its branch and pinned by the resolved commit the gate prints. **Its first question is a measurement, not an assumption:** herdr registers a plugin through a running server and falls back to `persist_plugin_offline` only on a connection error (`src/cli/plugin.rs:914-981,1016-1021` @ `c77af189`, 0.9.0 source), and a container has no server. The 2026-09-23 PASS installed with no server on the 0.9.1 binary `113ca53`'s `herdr-supply.json` pins, so that install path worked on 0.9.1 — inferred from the PASS, not a direct observation of the fallback branch; a later "no" on another herdr is #118 investigation output rather than a completion. `--yes` is always passed so a non-interactive exit 2 (`:189`) can never be misread as a missing server. **At a ref whose lock names `herdr-checkout` the acquisition axis reports a NAMED SKIP rather than a red, and the rest of the journey still runs.** That lock is the candidate carrier a cut legitimately sits on — 0.23.0 was tagged that way and `dd84ac0` pinned npm afterwards — so a red there would report a broken install when what is true is that the ref does not lock npm. What is asserted at BOTH lock kinds is that the runtime came from the source the ref locks, and the package name is read from the checkout manifest rather than the lock, because a `herdr-checkout` lock carries no `name` (`herdr-runtime.mjs:317-328`) and joining `undefined` throws instead of failing an assertion. **Cells [6]–[9] carry it past the install into the USE path (#118 H1-4/H1-5).** An install is not a use, so the same container then runs what those bytes became: the compiled bridge entry, the three `REQUIRED_BINS` as executables, and a real `entwurf check-bridge` printing its exact eight-verb set — the installed-runtime row below, measured rather than inferred from the bootstrap's refusal to install without them. Then the pi that this plugin WIRED is started with no `-e` and no `--no-extensions`, because the subject is the wiring and not this checkout: one `get_state` in `--mode rpc` costs zero tokens and needs no provider argument (a bogus `--provider` exits 1 before session_start; omitting the pair lets pi resolve the default the extension itself registers), and while that session is alive the cell reads its V3 record, its gardenId-keyed control socket, and the installed `entwurf peer-facts` reporting it `alive`. The plugin's own status fan is then driven with NEITHER side stubbed, in both states a user can be in: with no herdr server it must name `herdr-agent-list-failed` and go red rather than draw an empty table, and under a headless `herdr server` — scaffolding for that second read only, stopped again before the teardown — it exits 0 and COUNTS the citizen as `unobserved` instead of dropping it. Last, the shipped `entwurf herdr-plugin-deactivate` runs from the installed bin, deletes the runtime it is executing from, and the plugin reinstalls onto the host it fully left — the deactivation row, on the npm source. **What these cells still do not close:** swap / torn-swap recovery on the npm source, the package-consumer proof, and the fan drawing a citizen as a ROW — that needs `placement.kind === "herdr-pane"`, so the pi session must live in a herdr pane a session reference joins, and a headless container has no panes. **This smoke carries no test beside behavior and no mutant**, and that is a property of its class rather than an omission: it is a real-live container journey whose oracle is the container's own end state, so there is no pure seam to assert against and nothing a source mutation could kill deterministically. Like the other two herdr LIVE lanes it is **on-demand and not an aggregate MUST** — herdr is optional, a cut on a host without it must not block, and first evidence precedes promotion. Without `LIVE=1`, or without a usable Docker daemon, it reports a named SKIP; `ENTWURF_REQUIRE_DOCKER=1` turns the Docker absence red. Neither skip is a pass.
+> **The plugin's FIRST USER PATH is its own on-demand axis, and an npm acquisition receipt holds only for the ref it ran on (#118 홉 1).** Every other herdr gate proves the plugin against a source this repository controls: `check-herdr-plugin-build` drives a stub, and `smoke-herdr-plugin-build-live` redirects the product remote to a local bare clone with git `insteadOf` and asserts `identity.kind === "herdr-checkout"`. npm has been the production authority class since `dd84ac0`; the 0.30.0 follow-up re-pinned `@junghanacs/entwurf@0.30.0` with its published sha512 after the candidate windows rode `herdr-checkout` (`8b92e09`), and the 0.30.1 preparation rode that closed verification carrier again without inventing a registry integrity. The plugin snapshot `v2026.10.9-herdr.0.34.0` pinned the published `@junghanacs/entwurf@0.34.0` with its measured sha512 (#132); 0.31–0.33 were never pinned. The 0.34.1 preparation rode the closed `herdr-checkout` verification carrier again without inventing a registry integrity, and the snapshot `v2026.10.9-herdr.0.34.1` re-pins the published `@junghanacs/entwurf@0.34.1` with its measured sha512 (#135). The 0.34.2 preparation rode the same carrier, and the snapshot `v2026.10.11-herdr.0.34.2` re-pins the published `@junghanacs/entwurf@0.34.2` with its measured sha512 (#136). The source re-proof has separate dated npm rows: 2026-09-23 public `main=113ca53`, plugin 0.5.0, runtime 0.25.0 (CHANGELOG 0.25.1), and the 0.30.0 re-pin accepted at public `506c46f` in the [#126 thread](https://github.com/junghan0611/entwurf/issues/126). Neither certifies the 0.34.0 registry acquisition. That pin's real-npm swap / torn-swap recovery was measured locally on 2026-10-09 by driving the registry-shipped `scripts/herdr-runtime.mjs` (byte-equal to this checkout's) with its own npm acquisition: a 0.33.0 → 0.34.0 swap, and the same upgrade torn between its two renames then resumed, where the last-good 0.33.0 tree was restored before 0.34.0 was acquired again. Both ended `runtime-ready` at observed digest `sha256-e9d995ff…`, the accepted 0.34.0 artifact. That local receipt is recorded in the [#132 thread](https://github.com/junghan0611/entwurf/issues/132); it covers runtime recovery, not this smoke's cells. This smoke's public-ref acceptance of the 0.34.0 pin was measured locally at `--ref main`: PASS at resolved `b5d15d8` and again at the docs follow-up `8ed4d1a`, each acquiring `kind=npm @junghanacs/entwurf@0.34.0` — a main-ref receipt, not a tag-ref, native or full-Herdr claim. The 0.34.1 re-pin's npm-source rows — swap / torn-swap recovery, this smoke at a public ref, and the package consumer — are its own, recorded with that pin and never inherited from 0.34.0; checkout candidate evidence does not transfer. `LIVE=1 ./run.sh smoke-herdr-raw-install-live [--ref <REF>]` fills that row in a clean `node:24` container with no socket, config, cache or repo mounted, no `insteadOf`, the public remote spelled as a user would type it, and pi / herdr / Claude Code installed in the IMAGE BUILD as scaffolding (Hard Rule 17 — the product face begins at `herdr integration install pi`). herdr itself comes from `scripts/install-herdr-ci.sh` against `scripts/fixtures/herdr-supply.json`, so no version or digest lives here. `--ref` defaults to `main` rather than a pinned SHA because receipt (a) is defined as what a user gets today; the resolved commit is printed, so the receipt stays exact. It takes a REMOTE REF and not an arbitrary commit — measured on herdr 0.9.1, `--ref <sha>` fails as `couldn't find remote ref`, because the checkout fetches by name — so a candidate is addressed by its branch and pinned by the resolved commit the gate prints. **Its first question is a measurement, not an assumption:** herdr registers a plugin through a running server and falls back to `persist_plugin_offline` only on a connection error (`src/cli/plugin.rs:914-981,1016-1021` @ `c77af189`, 0.9.0 source), and a container has no server. The 2026-09-23 PASS installed with no server on the 0.9.1 binary `113ca53`'s `herdr-supply.json` pins, so that install path worked on 0.9.1 — inferred from the PASS, not a direct observation of the fallback branch; a later "no" on another herdr is #118 investigation output rather than a completion. `--yes` is always passed so a non-interactive exit 2 (`:189`) can never be misread as a missing server. **At a ref whose lock names `herdr-checkout` the acquisition axis reports a NAMED SKIP rather than a red, and the rest of the journey still runs.** That lock is the candidate carrier a cut legitimately sits on — 0.23.0 was tagged that way and `dd84ac0` pinned npm afterwards — so a red there would report a broken install when what is true is that the ref does not lock npm. What is asserted at BOTH lock kinds is that the runtime came from the source the ref locks, and the package name is read from the checkout manifest rather than the lock, because a `herdr-checkout` lock carries no `name` (`herdr-runtime.mjs:317-328`) and joining `undefined` throws instead of failing an assertion. **Cells [6]–[9] carry it past the install into the USE path (#118 H1-4/H1-5).** An install is not a use, so the same container then runs what those bytes became: the compiled bridge entry, the three `REQUIRED_BINS` as executables, and a real `entwurf check-bridge` printing its exact eight-verb set — the installed-runtime row below, measured rather than inferred from the bootstrap's refusal to install without them. Then the pi that this plugin WIRED is started with no `-e` and no `--no-extensions`, because the subject is the wiring and not this checkout: one `get_state` in `--mode rpc` costs zero tokens and needs no provider argument (a bogus `--provider` exits 1 before session_start; omitting the pair lets pi resolve the default the extension itself registers), and while that session is alive the cell reads its V3 record, its gardenId-keyed control socket, and the installed `entwurf peer-facts` reporting it `alive`. The plugin's own status fan is then driven with NEITHER side stubbed, in both states a user can be in: with no herdr server it must name `herdr-agent-list-failed` and go red rather than draw an empty table, and under a headless `herdr server` — scaffolding for that second read only, stopped again before the teardown — it exits 0 and COUNTS the citizen as `unobserved` instead of dropping it. Last, the shipped `entwurf herdr-plugin-deactivate` runs from the installed bin, deletes the runtime it is executing from, and the plugin reinstalls onto the host it fully left — the deactivation row, on the npm source. **What these cells still do not close:** swap / torn-swap recovery on the npm source, the package-consumer proof, and the fan drawing a citizen as a ROW — that needs `placement.kind === "herdr-pane"`, so the pi session must live in a herdr pane a session reference joins, and a headless container has no panes. **This smoke carries no test beside behavior and no mutant**, and that is a property of its class rather than an omission: it is a real-live container journey whose oracle is the container's own end state, so there is no pure seam to assert against and nothing a source mutation could kill deterministically. Like the other two herdr LIVE lanes it is **on-demand and not an aggregate MUST** — herdr is optional, a cut on a host without it must not block, and first evidence precedes promotion. Without `LIVE=1`, or without a usable Docker daemon, it reports a named SKIP; `ENTWURF_REQUIRE_DOCKER=1` turns the Docker absence red. Neither skip is a pass.
 
 > **The Herdr plugin's install-time build has two axes, and one of them needs the network (#116 M3-b3).** `check-herdr-plugin-build` is deterministic and rides `check:hermetic`: the listing reaches the runner through its own spawn seam (there is no fake `herdr` binary in this repo), and the one cell that drives the REAL binary reports a named SKIP on a host without it — `ENTWURF_REQUIRE_HERDR=1` makes that absence red. What it cannot have is the real acquisition: `npm pack git+https://github.com/junghan0611/entwurf.git#<full sha>` builds the bridge through `prepare`, which installs devDependencies from the registry. So `LIVE=1 ./run.sh smoke-herdr-plugin-build-live` owns that axis, and its cells are **two kinds of evidence, labelled as such**: three are the real Herdr journey — a real `herdr plugin install` driving the real `[[build]]`, with the UNCHANGED product remote redirected to a local bare clone by git `insteadOf` (the one substitution, which is what makes an unpushed candidate testable) — covering remote-commit available, the `{pi}` → `{pi, claude-code}` reinstall with OpenCode as a zero-write negative control and exactly ONE counted vendor MCP owner entry, and the post-build Herdr-commit gap (where the ledger has already rebound to the gap commit, so the honest assertion is that transition and not unchanged bytes). The fourth cell — remote-commit **unavailable** — calls the shipped runtime leaf directly with the fixed product argv and is therefore **acquisition-leaf evidence, not a journey**; routing it through Herdr would add a second explanation for one red. Its oracle is the honest one too: active runtime, ledger and harness bytes preserved, while the journal is left as the certified `installing` retry authority the transaction deliberately writes before acquiring, and a normal install afterwards is green. Its Claude cell is where the vendor question the deterministic gates refuse to claim gets answered — whether Claude Code accepts an ABSOLUTE executable as an MCP command — and it reports a named skip on a host without `claude`, never a pass. Like the herdr fresh-call rail, this smoke is **on-demand and not an aggregate MUST**. The release aggregate does not require the plugin build smoke: herdr is optional, a cut on a host without it must not block, and first evidence precedes promotion.