@junghanacs/entwurf 0.34.1 → 0.35.0

package/scripts/check-herdr-activation.ts

@@ -183,6 +183,7 @@ interface Mod {
 	resolveEntwurfDataRoot: (env: NodeJS.ProcessEnv) => string;
 	LEDGER_PHASES: string[];
 	COMPONENT_STATES: string[];
+	resolveDoctorPluginRuntime: (env: NodeJS.ProcessEnv, opts: { repo: string; override?: string }) => string | null;
 }
 
 const mod = (await import(pathToFileURL(ACTIVATION).href)) as Mod;
@@ -204,6 +205,7 @@ const {
 	resolveEntwurfDataRoot,
 	LEDGER_PHASES,
 	COMPONENT_STATES,
+	resolveDoctorPluginRuntime,
 } = mod;
 
 /** The pi pin package.json declares (an exact production dependency since #130) — the SSOT
@@ -1484,4 +1486,82 @@ function ledgerWith(
 	);
 }
 
+// ── 29. the doctor's expectation mode comes from the activation ledger (#136) ────
+// `doctor-meta-bridge` must compute the plugin activation's ABSOLUTE expectations exactly when the
+// ledger authorised that wiring, and never adopt it from a checkout. The oracle for the returned
+// root is `runtimeRootOf`, computed here independently of the resolver.
+{
+	const env = world("doctor-mode");
+	seedRuntime(env);
+	const active = runtimeRootOf(env);
+	const runtimeRepo = path.join(active, "node_modules", "@junghanacs", "entwurf");
+	const layout = resolveActivationLayout(env);
+	const mode = (opts: { repo: string; override?: string }): string | null => {
+		try {
+			return resolveDoctorPluginRuntime(env, opts);
+		} catch (err) {
+			return `refused:${(err as { code?: string }).code ?? String(err)}`;
+		}
+	};
+	// D2 — no ledger: a doctor running from the runtime package is simply not in plugin mode.
+	const absent = mode({ repo: runtimeRepo });
+	writeLedger(layout, ledgerFor(env, ["pi", "claude-code"]));
+	// D1 — runtime package + an active ledger that activated claude-code at THIS stable root.
+	const derived = mode({ repo: runtimeRepo });
+	ok(
+		"[QK:DOCTOR-MODE-DERIVED] a doctor running from the plugin runtime's package derives plugin-runtime mode from " +
+			`an active ledger that activated claude-code at this host's stable root, and from nothing else (no-ledger=${absent} derived=${derived})`,
+		absent === null && derived === active,
+	);
+	// D3 — the checkout never derives, and never even opens the ledger: an uncertified body is
+	// planted first, so reading it would throw instead of returning null.
+	fs.writeFileSync(layout.ledgerPath, "not json\n");
+	const checkout = mode({ repo: REPO });
+	ok(
+		"[QK:DOCTOR-MODE-CHECKOUT-NEVER-DERIVES] a doctor whose repo is not the runtime package returns no plugin mode " +
+			`without opening the ledger, so a checkout never adopts plugin wiring (checkout=${checkout})`,
+		checkout === null,
+	);
+	// D5 — on a reading path an uncertified ledger dies with the reader's own refusal, never null.
+	fs.unlinkSync(layout.ledgerPath);
+	fs.symlinkSync(path.join(env.HOME as string, "nowhere.json"), layout.ledgerPath);
+	const viaRuntime = mode({ repo: runtimeRepo });
+	const viaOverride = mode({ repo: REPO, override: active });
+	fs.unlinkSync(layout.ledgerPath);
+	ok(
+		"[QK:DOCTOR-MODE-UNCERTIFIED-DIES] an uncertified ledger on either reading path (runtime-repo derivation, explicit " +
+			`override) refuses with the reader's own code, never 'not plugin mode' (runtime=${viaRuntime} override=${viaOverride})`,
+		viaRuntime === "refused:activation-ledger-uncertified" && viaOverride === "refused:activation-ledger-uncertified",
+	);
+	// D4 — the admission clauses on a reading path, each on a CERTIFIED ledger so only the clause can
+	// refuse: a phase other than active, a ledger that never activated claude-code, and a runtimeRoot
+	// that is not this host's stable root. Each is refused by name, never read as 'not plugin mode'.
+	writeLedger(layout, ledgerWith(env, "activating", { pi: "active", "claude-code": "pending" }));
+	const notActive = mode({ repo: runtimeRepo });
+	writeLedger(layout, ledgerFor(env, ["pi"]));
+	const piOnly = mode({ repo: runtimeRepo });
+	writeLedger(layout, {
+		...ledgerFor(env, ["pi", "claude-code"]),
+		runtimeRoot: path.join(env.HOME as string, "another-runtime", "active"),
+	});
+	const foreignRoot = mode({ repo: runtimeRepo });
+	ok(
+		"[QK:DOCTOR-MODE-ADMISSION-CLAUSES] on the runtime repo a certified ledger still admits plugin mode only when " +
+			"phase is active, claude-code was activated and its runtimeRoot is this host's stable root — each other case " +
+			`is refused by name (activating=${notActive} pi-only=${piOnly} foreign-root=${foreignRoot})`,
+		notActive === "refused:doctor-plugin-runtime-unadmitted" &&
+			piOnly === "refused:doctor-plugin-runtime-unadmitted" &&
+			foreignRoot === "refused:doctor-plugin-runtime-unadmitted",
+	);
+	// D6 — the override must agree with the ledger's root; agreeing, it is admitted from a checkout.
+	writeLedger(layout, ledgerFor(env, ["pi", "claude-code"]));
+	const elsewhere = mode({ repo: REPO, override: path.join(env.HOME as string, "elsewhere") });
+	const agreeing = mode({ repo: REPO, override: active });
+	ok(
+		"[QK:DOCTOR-MODE-OVERRIDE-AGREES] an explicit --plugin-runtime is admitted only when it names the ledger's own " +
+			`stable root (elsewhere=${elsewhere} agreeing=${agreeing})`,
+		elsewhere === "refused:doctor-plugin-runtime-unadmitted" && agreeing === active,
+	);
+}
+
 console.log(`\ncheck-herdr-activation: ${passed} assertions passed`);

package/scripts/check-meta-doctor-oracle.sh

@@ -227,6 +227,8 @@ ok "fake live entwurf MCP bridge running as a child of the stand-in Claude pid (
 # --- doctor driver -----------------------------------------------------------
 DOC_OUT=""
 DOC_RC=0
+# #136: arguments for the plugin-runtime block at the end; empty for every clone cell.
+DOC_ARGS=()
 run_doctor() {
   set +e
   # Deliberate cross-harness poison. Before the doctor scrubbed these carriers, the
@@ -237,7 +239,7 @@ run_doctor() {
   DOC_OUT="$(PI_SESSION_ID=ambient-pi-session-must-not-win \
     PI_AGENT_ID=ambient-pi-agent/must-not-win \
     ENTWURF_META_SENDER_MARKER="$TMP/ambient-sender-marker-must-not-win.json" \
-    bash "$REPO/scripts/meta-bridge-doctor.sh" 2>&1)"
+    bash "$REPO/scripts/meta-bridge-doctor.sh" ${DOC_ARGS[@]+"${DOC_ARGS[@]}"} 2>&1)"
   DOC_RC=$?
   set -e
 }
@@ -713,5 +715,88 @@ else
   bad "doctor stayed red after reverting every mutation (a restore is incomplete):"$'\n'"$(printf '%s\n' "$DOC_OUT" | grep -E '^  FAIL' | sed 's/^/        /')"
 fi
 
+# --- 6. #136: a Herdr plugin activation's ABSOLUTE wiring ---------------------
+# The plugin activation runs the same installer with ENTWURF_PLUGIN_RUNTIME, so Claude's MCP and
+# statusLine name absolute bins under the stable runtime. The doctor must learn that mode from the
+# activation ledger and certify the wiring, not call it drift. FIXTURE HONESTY: the two runtime
+# bins are wrappers onto this checkout's own launcher and statusline, and the ledger is written by
+# the shipped writer with a fixture artifact identity; no npm runtime is installed here.
+echo "[plugin-runtime] the installer's absolute wiring, certified through the activation ledger"
+ACTIVE="$XDG_DATA_HOME/entwurf/herdr-plugin/runtime/active"
+mkdir -p "$ACTIVE/node_modules/.bin" "$ACTIVE/node_modules/@junghanacs/entwurf"
+printf '#!/usr/bin/env bash\nexec bash "%s/mcp/entwurf-bridge/start.sh" "$@"\n' "$REPO" > "$ACTIVE/node_modules/.bin/entwurf-bridge"
+printf '#!/usr/bin/env bash\nexec "%s/scripts/meta-bridge-statusline.sh" "$@"\n' "$REPO" > "$ACTIVE/node_modules/.bin/entwurf-statusline"
+chmod +x "$ACTIVE/node_modules/.bin/entwurf-bridge" "$ACTIVE/node_modules/.bin/entwurf-statusline"
+if ENTWURF_PLUGIN_RUNTIME="$ACTIVE" bash "$REPO/scripts/meta-bridge-install.sh" >"$TMP/install-plugin.log" 2>&1; then
+  ok "real meta-bridge-install.sh wires the plugin-runtime mode (absolute bins under the sandbox stable root)"
+else
+  bad "plugin-runtime install-meta-bridge failed in the sandbox:"$'\n'"$(sed 's/^/        install| /' "$TMP/install-plugin.log")"
+fi
+rm -rf "$PLANTED"
+mkdir -p "$PLANTED"
+cp -r "$ASM/$PLUGIN/." "$PLANTED/"
+write_ledger() {
+  node --input-type=module - "$REPO/scripts/herdr-activation.mjs" "$ACTIVE" "$1" <<'JS'
+import { pathToFileURL } from "node:url";
+const [modPath, active, backends] = process.argv.slice(2);
+const m = await import(pathToFileURL(modPath).href);
+const states = Object.fromEntries(backends.split(",").map((b) => [b, "active"]));
+m.writeLedger(m.resolveActivationLayout(process.env), m.ledgerBody({
+	phase: "active",
+	runtimeRoot: active,
+	artifactIdentity: { kind: "npm", name: "@junghanacs/entwurf", version: "0.34.1", expectedIntegrity: "sha512-fixture", observedDigest: `sha256-${"c".repeat(64)}` },
+	roots: m.resolveComponentRoots(process.env),
+	states,
+}));
+JS
+}
+write_ledger "pi,claude-code"
+DOC_ARGS=(--plugin-runtime "$ACTIVE")
+
+# P1 — the plugin wiring the installer wrote is certified: PASS, and the doctor names its mode.
+# The [QK:] token lives on the `bad` line only (see M9b).
+run_doctor
+if [ "$DOC_RC" -eq 0 ] && printf '%s\n' "$DOC_OUT" | grep -q 'meta-bridge doctor: PASS' \
+   && printf '%s\n' "$DOC_OUT" | grep -qF "mode: plugin-runtime $ACTIVE (activation ledger)" \
+   && printf '%s\n' "$DOC_OUT" | grep -qF 'live mcpServers.entwurf-bridge equals desired_mcp()'; then
+  ok "plugin-runtime wiring reaches doctor PASS through the activation ledger, and the doctor names that mode"
+else
+  bad "[QK:DOCTOR-PLUGIN-MODE-GREEN] the plugin activation's absolute wiring did NOT reach PASS (exit $DOC_RC):"$'\n'"$(printf '%s\n' "$DOC_OUT" | grep -E '^  (FAIL|WARN)|mode:' | sed 's/^/        /')"
+fi
+
+# P2 — genuine drift stays red in plugin mode: an absolute statusLine under the same root, but not ours.
+cp "$CLAUDE_CONFIG_DIR/settings.json" "$TMP/settings-p2.bak"
+python3 - "$CLAUDE_CONFIG_DIR/settings.json" "$ACTIVE/node_modules/.bin/evil" <<'PY'
+import json, sys
+p = sys.argv[1]
+d = json.load(open(p, encoding="utf-8"))
+d["statusLine"]["command"] = sys.argv[2]
+json.dump(d, open(p, "w", encoding="utf-8"), indent=2)
+PY
+expect_red "plugin-mode statusLine repointed under the same runtime root" "statusLine.command drifted"
+cp "$TMP/settings-p2.bak" "$CLAUDE_CONFIG_DIR/settings.json"
+
+# P3 — a ledger that did not activate claude-code admits no plugin mode. The refusal is named,
+# and it is NOT an early exit: the store and live-owner sections still run (Hard Rule 13).
+write_ledger "pi"
+expect_red "override against a ledger that never activated claude-code" "doctor-plugin-runtime-unadmitted"
+# Each of the three expectation sites says UNKNOWN for that reason (never a bare-bin fallback),
+# and the runtime axes still run: the live command still DELIVERS, the store and owner join report.
+for claim in \
+  'managed settings/MCP keyset is UNKNOWN: the expectation mode was not established' \
+  'statusLine expectation is UNKNOWN: the expectation mode was not established' \
+  'live-vs-desired MCP ownership is UNKNOWN: the expectation mode was not established' \
+  'live bridge command DELIVERS' \
+  '[meta-record store]' \
+  '[live Claude MCP owner join]'
+do
+  if printf '%s\n' "$DOC_OUT" | sed -n '/expectation mode refused: doctor-plugin-runtime-unadmitted/,$p' | grep -qF "$claim"; then
+    ok "after the mode refusal the doctor still reports: $claim"
+  else
+    bad "after the mode refusal the doctor never reported: $claim"
+  fi
+done
+write_ledger "pi,claude-code"
+
 echo
 if [ "$fail" -eq 0 ]; then echo "check-meta-doctor-oracle: PASS"; else echo "check-meta-doctor-oracle: FAIL (see above)"; exit 1; fi

package/scripts/check-release-gate-outcomes.ts

@@ -43,7 +43,7 @@
 // Pure + subprocess, no network/model — IN pnpm run check:full.
 
 import { strict as assert } from "node:assert";
-import { execFileSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
 import { copyFileSync, globSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, join } from "node:path";
@@ -650,6 +650,164 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 	}
 }
 
+// ===========================================================================
+// 8g. #137: TOML data-subject hunks, not path identity; Markdown/JSON data and
+// code/signatures/machinery remain file-level. Hermetic like 8f: real history is NOT
+// in a qualification snapshot.
+// ==========================================================================
+{
+	const tmp = mkdtempSync(join(tmpdir(), "entwurf-qualify-hunks-"));
+	const git = (...args: string[]) =>
+		execFileSync("git", ["-c", "core.hooksPath=/dev/null", "-c", "user.email=g@e", "-c", "user.name=g", ...args], {
+			cwd: tmp,
+			stdio: "ignore",
+		});
+	const head = () => execFileSync("git", ["rev-parse", "HEAD"], { cwd: tmp, encoding: "utf8" }).trim();
+	const data = 'version = "1"\n[[panes]]\ncommand = ["node", "build.mjs"]\n# outside\n';
+	const wrong: string[] = [];
+	try {
+		git("init", "-q", "-b", "main");
+		mkdirSync(join(tmp, "scripts/mutants"), { recursive: true });
+		mkdirSync(join(tmp, "fixture"));
+		mkdirSync(join(tmp, "scripts/fixtures"));
+		copyFileSync(join(REPO_DIR, "scripts/ci-qualify-decide.sh"), join(tmp, "scripts/ci-qualify-decide.sh"));
+		const manifest = JSON.stringify({
+			mutants: [
+				{ subject: "fixture/data.toml", find: ["[[panes]]"] },
+				{ subject: "fixture/data.toml", find: ['command = ["node", "build.mjs"]'] },
+				{ subject: "fixture/data.toml", find: ["[[panes]]", 'command = ["node", "build.mjs"]'] },
+				{ subject: "fixture/code.ts", find: ["return 1"], signatureSource: "fixture/signature.md" },
+				{ subject: "fixture/signature.md", find: ["signature"] },
+				{ subject: "fixture/joined.toml", find: ["alpha = 1", "beta = 2"] },
+				{ subject: "fixture/doc.md", find: ["Legacy rows are documented: kept for history."] },
+				{ subject: "fixture/reg.json", find: ['"mode": "self-fetch",'] },
+				{ subject: "scripts/fixtures/pin.json", find: ['"pinned": 1'] },
+				{ subject: "scripts/ci-qualify-decide.sh", find: ["set -euo pipefail"] },
+			],
+		});
+		writeFileSync(join(tmp, "scripts/mutants/fixture.json"), manifest);
+		writeFileSync(join(tmp, "fixture/data.toml"), data);
+		writeFileSync(join(tmp, "fixture/code.ts"), "// outside\nfunction f() { return 1; }\n");
+		writeFileSync(join(tmp, "fixture/signature.md"), "signature\n# outside\n");
+		writeFileSync(join(tmp, "fixture/joined.toml"), "version = 1\nalpha = 1\nbeta = 2\n");
+		const doc = "# Doc\nLegacy rows are documented: kept for history.\n# outside\n";
+		const reg = '{\n"copilot": {\n"mode": "self-fetch",\n"level": 6\n}\n}\n';
+		writeFileSync(join(tmp, "fixture/doc.md"), doc);
+		writeFileSync(join(tmp, "fixture/reg.json"), reg);
+		writeFileSync(join(tmp, "scripts/fixtures/pin.json"), '{\n"version": 1,\n"pinned": 1\n}\n');
+		git("add", "-A");
+		git("commit", "-qm", "seed");
+		const base = head();
+		const nonToml: string[] = [];
+		const check = (name: string, expected: boolean, reason?: string, before = base, into = wrong) => {
+			const r = spawnSync("bash", [join(tmp, "scripts/ci-qualify-decide.sh"), before, head()], {
+				cwd: tmp,
+				encoding: "utf8",
+				env: { ...process.env, CI_EVENT_NAME: "push", CI_FORCED: "false" },
+			});
+			if (r.status !== 0 || r.stdout.trim() !== `run_body=${expected}` || (reason && !r.stderr.includes(reason)))
+				into.push(`${name}: status=${r.status}, out=${r.stdout.trim()}, err=${r.stderr.trim()}`);
+		};
+		const commit = () => {
+			git("add", "-A");
+			git("commit", "-qm", "cell");
+		};
+		const reset = () => git("reset", "--hard", base); // ONLY this test-owned throwaway repository.
+		writeFileSync(join(tmp, "fixture/data.toml"), data.replace('version = "1"', 'version = "2"'));
+		commit();
+		check("outside", false, "fixture/data.toml: no find range touched");
+		// A replay must read HEAD's manifest, not an unrelated dirty worktree's find.
+		writeFileSync(
+			join(tmp, "scripts/mutants/fixture.json"),
+			'{"mutants":[{"subject":"fixture/data.toml","find":["version"]}]}',
+		);
+		check("HEAD manifest, not dirty worktree", false);
+		reset();
+		for (const [name, content] of [
+			["panes line", data.replace("[[panes]]", "[[panes]] # changed")],
+			["command line", data.replace('command = ["node", "build.mjs"]', 'command = ["node", "build.mjs"] # changed')],
+			["moved", `# inserted above\n${data}`],
+			["ambiguous", `${data}[[panes]]\n`],
+			["missing find", data.replace("[[panes]]", "[[other]]")],
+		] as const) {
+			writeFileSync(join(tmp, "fixture/data.toml"), content);
+			commit();
+			check(name, true);
+			reset();
+		}
+		git("rm", "fixture/data.toml");
+		commit();
+		check("deleted subject", true);
+		reset();
+		git("mv", "fixture/data.toml", "fixture/renamed.toml");
+		commit();
+		check("renamed subject", true);
+		reset();
+		writeFileSync(join(tmp, "fixture/code.ts"), "// outside changed\nfunction f() { return 1; }\n");
+		commit();
+		check("code outside find remains file-level", true);
+		reset();
+		writeFileSync(join(tmp, "fixture/signature.md"), "signature\n# outside changed\n");
+		commit();
+		check("signature also data subject remains file-level", true);
+		reset();
+		writeFileSync(join(tmp, "fixture/joined.toml"), "version = 1\nalpha = 1\nbeta = 2 # changed\n");
+		commit();
+		check("only multiline find, second line touched", true);
+		reset();
+		writeFileSync(join(tmp, "scripts/fixtures/pin.json"), '{\n"version": 2,\n"pinned": 1\n}\n');
+		commit();
+		check("machinery also data subject remains file-level", true);
+		reset();
+		writeFileSync(
+			join(tmp, "scripts/ci-qualify-decide.sh"),
+			`${readFileSync(join(tmp, "scripts/ci-qualify-decide.sh"), "utf8")}\n# outside find\n`,
+		);
+		commit();
+		check("machinery also subject remains file-level", true);
+		reset();
+		// Outside an untouched exact-once span, a shorter presence literal (measured on DELIVERY.md)
+		// or a later JSON duplicate key (JSON.parse: last wins) can re-satisfy the oracle.
+		writeFileSync(join(tmp, "fixture/doc.md"), `${doc}Legacy rows are documented\n`);
+		commit();
+		check("markdown restatement outside find", true, "conservative:", base, nonToml);
+		reset();
+		writeFileSync(
+			join(tmp, "fixture/reg.json"),
+			reg.replace("6\n}\n}\n", '6\n},\n"copilot": { "level": 6, "mode": "self-fetch" }\n}\n'),
+		);
+		commit();
+		check("json duplicate key outside find", true, "conservative:", base, nonToml);
+		reset();
+		// The first quoted name must still fail open after a >pipe-buffer list:
+		// printf | grep -q can lose its match to SIGPIPE under pipefail.
+		writeFileSync(join(tmp, '000"quoted'), "x\n");
+		for (let i = 0; i < 768; i++) writeFileSync(join(tmp, "fixture", `${i}_${"x".repeat(180)}.txt`), "x\n");
+		commit();
+		check("large quoted changed-name list", true, "quoted changed path cannot be read honestly");
+		reset();
+		check("unreadable range", true, "fail-open 4", "f".repeat(40));
+		git("rm", "scripts/mutants/fixture.json");
+		commit();
+		check("missing manifests", true);
+		assert.ok(
+			wrong.length === 0,
+			"[QK:QUALIFY-FILTER-SUBJECT-HUNKS] only untouched, unmoved, exact-once TOML find ranges may skip; " +
+				"unknown ranges run, and code/signature/machinery retain file-level protection. " +
+				wrong.join("; "),
+		);
+		assert.ok(
+			nonToml.length === 0,
+			"[QK:QUALIFY-FILTER-TOML-ONLY-REFINEMENT] Markdown and JSON subjects stay file-level: an untouched exact-once " +
+				"find does not pin kill-power when a shorter presence literal or a later duplicate JSON key outside it can " +
+				"re-satisfy the oracle. " +
+				nonToml.join("; "),
+		);
+	} finally {
+		rmSync(tmp, { recursive: true, force: true });
+	}
+}
+
 // ===========================================================================
 // 9. Every gate a mutant manifest NAMES runs inside `pnpm run check:full`
 //

package/scripts/ci-qualify-decide.sh

@@ -28,37 +28,117 @@ fail_open() {
 }
 
 collect_paths_from_manifests() {
-	python3 - "$REPO_DIR" <<'PY'
+	python3 - "$REPO_DIR" "${1:-}" <<'PY'
 import glob
 import json
 import os
 import sys
+import subprocess
 
-repo = sys.argv[1]
-out = set()
-for path in sorted(glob.glob(os.path.join(repo, "scripts/mutants/*.json"))):
-	with open(path, encoding="utf-8") as handle:
-		manifest = json.load(handle)
+repo, rev = sys.argv[1:]
+def git(*args):
+	return subprocess.check_output(["git", "-C", repo, *args])
+paths = (git("ls-tree", "-r", "--name-only", rev, "scripts/mutants").decode().splitlines()
+	if rev else sorted(glob.glob(os.path.join(repo, "scripts/mutants/*.json"))))
+paths = [p for p in paths if p.endswith(".json")]
+if not paths:
+	raise ValueError("no mutant manifests")
+out, signatures, subjects = set(), set(), {}
+for path in paths:
+	if rev:
+		manifest = json.loads(git("show", f"{rev}:{path}"))
+	else:
+		with open(path, encoding="utf-8") as handle:
+			manifest = json.load(handle)
 	for mutant in manifest.get("mutants", []):
 		subject = mutant.get("subject")
 		if subject:
 			out.add(subject)
+			find = mutant.get("find")
+			# The runner joins a find ARRAY into ONE multiline occurrence.
+			needle = "\n".join(find) if isinstance(find, list) and all(isinstance(s, str) for s in find) else None
+			subjects.setdefault(subject, []).append(needle)
 		signature_source = mutant.get("signatureSource")
 		if signature_source:
 			out.add(signature_source)
-for entry in sorted(out):
-	print(entry)
+			signatures.add(signature_source)
+if not out or any(any(c in p for c in '\n\r\t"\\') for p in out):
+	raise ValueError("empty or unrepresentable manifest paths")
+print(json.dumps({"paths": sorted(out), "signatures": sorted(signatures), "subjects": subjects}))
 PY
 }
 
-# A changed path matters when it is a mutant's subject or signature source, or
-# when it sits in the machinery that decides what those mutants prove.
+load_manifest_surface() {
+	MANIFEST_DATA="$(collect_paths_from_manifests "${1:-}")" || fail_open 6 "missing/unreadable mutant manifests"
+	MANIFEST_PATHS="$(printf '%s' "$MANIFEST_DATA" | python3 -c 'import json,sys;print("\n".join(json.load(sys.stdin)["paths"]))')" || fail_open 6 "unreadable manifest paths"
+	SIGNATURE_PATHS="$(printf '%s' "$MANIFEST_DATA" | python3 -c 'import json,sys;print("\n".join(json.load(sys.stdin)["signatures"]))')" || fail_open 6 "unreadable signature paths"
+}
+
+# Return success ONLY when every exact-once TOML find span is demonstrably
+# untouched and unmoved on BOTH blobs. Any uncertainty leaves the body armed.
+subject_find_untouched() {
+	python3 - "$REPO_DIR" "$BEFORE" "$HEAD_SHA" "$1" 3<<< "$MANIFEST_DATA" <<'PY'
+import json
+import os
+import re
+import subprocess
+import sys
+
+repo, before, head, path = sys.argv[1:]
+def git(*args):
+	return subprocess.check_output(["git", "-C", repo, *args], stderr=subprocess.DEVNULL).decode("utf-8")
+def span(source, needle):
+	if not needle or source.count(needle) != 1:
+		raise ValueError("find absent or ambiguous")
+	start = source[:source.index(needle)].count("\n") + 1
+	return start, start + needle.count("\n") - int(needle.endswith("\n"))
+try:
+	finds = json.load(os.fdopen(3))["subjects"].get(path)
+	if not finds or any(not needle for needle in finds):
+		raise ValueError("missing find spans")
+	old, new = git("show", f"{before}:{path}"), git("show", f"{head}:{path}")
+	if "\0" in old or "\0" in new:
+		raise ValueError("binary subject")
+	diff = git("diff", "--no-renames", "--no-ext-diff", "--no-textconv", "--no-color", "-U0", before, head, "--", path)
+	if "Binary files " in diff or "GIT binary patch" in diff:
+		raise ValueError("binary diff")
+	hunks = []
+	for line in diff.splitlines():
+		if not line.startswith("@@"):
+			continue
+		match = re.fullmatch(r"@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(?: .*)?", line)
+		if not match:
+			raise ValueError("unreadable hunk")
+		a, b, c, d = match.groups()
+		hunks.append((int(a), int(b or 1), int(c), int(d or 1)))
+	if not hunks:
+		raise ValueError("no readable text hunks")
+	for needle in set(finds):
+		os_, oe = span(old, needle)
+		ns, ne = span(new, needle)
+		if (os_, oe) != (ns, ne):
+			raise ValueError("find range moved")
+		for a, b, c, d in hunks:
+			if (b > 0 and a <= oe and a + b - 1 >= os_) or (d > 0 and c <= ne and c + d - 1 >= ns):
+				raise ValueError("find range touched")
+except (ValueError, KeyError, TypeError, OSError, subprocess.SubprocessError) as error:
+	print(f"ci-qualify-decide: fail-open 7 {path}: {error} -> run_body=true", file=sys.stderr)
+	sys.exit(1)
+print(f"ci-qualify-decide: {path}: no find range touched (all exact-once spans unmoved)", file=sys.stderr)
+PY
+}
+
+# Signature sources and machinery MUST precede subjects: many paths are BOTH.
+# Code/unknown subjects retain file-level protection; only TOML data gets hunk
+# refinement (#137 non-goal: no skipping code/gate/mutant/matrix changes). TOML
+# refuses a redefined key, but a shorter Markdown presence literal or a later JSON
+# duplicate key outside an untouched find can still re-satisfy an oracle.
 matches_qualification_surface() {
 	local file="$1"
 	local subject
 	while IFS= read -r subject; do
-		[ "$file" = "$subject" ] && { echo "manifest-subject"; return 0; }
-	done <<< "$MANIFEST_PATHS"
+		[ "$file" = "$subject" ] && { echo "manifest-signature-source"; return 0; }
+	done <<< "$SIGNATURE_PATHS"
 	case "$file" in
 		scripts/mutants/*) echo "glob:scripts/mutants/**"; return 0 ;;
 		scripts/check-*) echo "glob:scripts/check-*"; return 0 ;;
@@ -73,6 +153,20 @@ matches_qualification_surface() {
 		# that stopped covering something cannot hide behind its own change.
 		scripts/ci-qualify-decide.sh) echo "exact:scripts/ci-qualify-decide.sh"; return 0 ;;
 	esac
+	while IFS= read -r subject; do
+		if [ "$file" = "$subject" ]; then
+			if [ "${MATCH_MODE:-files}" = range ]; then
+				case "$file" in
+					*.toml) ;;
+					*) echo "conservative:non-toml-subject"; return 0 ;;
+				esac
+				if subject_find_untouched "$file"; then
+					return 1
+				fi
+			fi
+			echo "manifest-subject"; return 0
+		fi
+	done <<< "$MANIFEST_PATHS"
 	return 1
 }
 
@@ -98,13 +192,12 @@ decide_from_files() {
 	fi
 }
 
-MANIFEST_PATHS="$(collect_paths_from_manifests)"
-[ -n "$MANIFEST_PATHS" ] || { echo "ABORT: no mutant manifests read from $REPO_DIR/scripts/mutants" >&2; exit 1; }
-
 if [ "${1:-}" = "--files-from" ]; then
+	MATCH_MODE=files
+	load_manifest_surface
 	SRC="${2:-}"
 	[ -n "$SRC" ] || { echo "ABORT: --files-from needs a path or -" >&2; exit 1; }
-	if [ "$SRC" = "-" ]; then FILES="$(cat)"; else FILES="$(cat "$SRC")"; fi
+	if [ "$SRC" = "-" ]; then FILES="$(cat)"; else FILES="$(cat "$SRC")"; fi || fail_open 4 "unreadable files-from input"
 	decide_from_files "$FILES"
 	exit 0
 fi
@@ -154,6 +247,10 @@ esac
 git -C "$REPO_DIR" cat-file -e "$BEFORE^{commit}" 2>/dev/null || fail_open 4 "before=$BEFORE is not a commit object in this checkout"
 git -C "$REPO_DIR" cat-file -e "$HEAD_SHA^{commit}" 2>/dev/null || fail_open 4 "head=$HEAD_SHA is not a commit object in this checkout"
 
-CHANGED="$(git -C "$REPO_DIR" diff --name-only "$BEFORE".."$HEAD_SHA" 2>/dev/null)" || fail_open 4 "git diff $BEFORE..$HEAD_SHA failed"
+MATCH_MODE=range
+load_manifest_surface "$HEAD_SHA"
+CHANGED="$(git -C "$REPO_DIR" diff --no-renames --no-ext-diff --no-textconv --name-only "$BEFORE".."$HEAD_SHA" 2>/dev/null)" || fail_open 4 "git diff $BEFORE..$HEAD_SHA failed"
+# Git quotes unrepresentable changed names; never interpret those as absent paths.
+if grep -q '^"' <<< "$CHANGED"; then fail_open 4 "quoted changed path cannot be read honestly"; fi
 
 decide_from_files "$CHANGED"

package/scripts/herdr-activation.mjs

@@ -28,7 +28,7 @@
 
 import fs from "node:fs";
 import path from "node:path";
-import { artifactStage, certifyArtifactIdentity, sameArtifactRequest } from "./herdr-runtime.mjs";
+import { artifactStage, certifyArtifactIdentity, resolveRuntimeLayout, sameArtifactRequest } from "./herdr-runtime.mjs";
 
 /** Ledger format. Bump only with a reader that understands both. */
 export const ACTIVATION_SCHEMA_VERSION = 2;
@@ -502,6 +502,55 @@ export function piStatePaths(env) {
 	});
 }
 
+/**
+ * Which expectations `doctor-meta-bridge` must compute (#136): the stable active root when this
+ * host's Claude wiring was written by a plugin activation, otherwise null (clone / installed).
+ *
+ * The plugin activation writes Claude's MCP and statusLine as ABSOLUTE commands under the stable
+ * runtime. A doctor that does not know that expects bare bins and calls correct wiring drifted. The
+ * mode is read from the record that authorised the wiring, the certified activation ledger, never
+ * from settings, environment or a path guess:
+ *   - phase `active`, `claude-code` activated, and the ledger's runtimeRoot is THIS host's stable root;
+ *   - without an override, only a doctor running FROM that runtime's package derives the mode. A
+ *     checkout's doctor returns null without opening the ledger, so it never adopts plugin wiring;
+ *   - an explicit override must agree with the ledger, or it is refused.
+ * An absent ledger is "not plugin mode"; an uncertified one throws the reader's own refusal.
+ */
+export function resolveDoctorPluginRuntime(env, { repo, override } = {}) {
+	const activeDir = resolveRuntimeLayout(env).activeDir;
+	if (override === undefined) {
+		const runtimePackage = path.join(activeDir, "node_modules", "@junghanacs", "entwurf");
+		let same = false;
+		try {
+			same = fs.realpathSync(repo) === fs.realpathSync(runtimePackage);
+		} catch {
+			// Bounded probe: no runtime package at the stable address means this repo is not it.
+			same = false;
+		}
+		if (!same) return null;
+	}
+	const ledger = readCertifiedLedger(resolveActivationLayout(env));
+	if (ledger === null) {
+		if (override === undefined) return null;
+		throw new ActivationError(
+			"doctor-plugin-runtime-unadmitted",
+			"--plugin-runtime was given but no activation ledger exists",
+		);
+	}
+	const refuse = (clause) => {
+		throw new ActivationError("doctor-plugin-runtime-unadmitted", clause);
+	};
+	if (ledger.phase !== "active") refuse(`activation ledger phase is ${ledger.phase}, not active`);
+	if (!ledger.activatedBackends.includes("claude-code")) refuse("the activation ledger did not activate claude-code");
+	if (ledger.runtimeRoot !== activeDir) {
+		refuse(`the ledger's runtimeRoot ${ledger.runtimeRoot} is not this host's stable runtime root ${activeDir}`);
+	}
+	if (override !== undefined && override !== activeDir) {
+		refuse(`--plugin-runtime ${override} does not name the ledger's runtime root ${activeDir}`);
+	}
+	return activeDir;
+}
+
 /** A component row, in the one shape the certifier accepts. */
 export function componentRow(backend, state) {
 	return Object.freeze({ backend, state });

package/scripts/herdr-doctor-mode.mjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+/**
+ * herdr-doctor-mode — the one call `meta-bridge-doctor.sh` makes to learn its expectation mode (#136).
+ *
+ *   node herdr-doctor-mode.mjs <repo> [<plugin-runtime override>]
+ *
+ * Prints the stable active root (plugin-runtime mode) or nothing (clone / installed), exit 0.
+ * A refusal prints `code: detail` to stderr and exits 3. Any other exit is a crash the doctor
+ * reports as UNKNOWN. All judgement lives in `resolveDoctorPluginRuntime`; nothing is decided here.
+ */
+import { resolveDoctorPluginRuntime } from "./herdr-activation.mjs";
+
+const [repo, override] = process.argv.slice(2);
+if (!repo) {
+	process.stderr.write("usage: herdr-doctor-mode.mjs <repo> [<plugin-runtime>]\n");
+	process.exit(2);
+}
+let root;
+try {
+	root = resolveDoctorPluginRuntime(process.env, { repo, override });
+} catch (err) {
+	if (err?.name !== "ActivationError") throw err;
+	process.stderr.write(`${err.message}\n`);
+	process.exit(3);
+}
+if (root !== null) process.stdout.write(`${root}\n`);