@junghanacs/entwurf 0.34.2 → 0.35.0

package/demo/herdr-pi-cc-20261011.provenance.json

@@ -0,0 +1,64 @@
+{
+	"schemaVersion": 1,
+	"scene": "whole-Herdr Pi to native Claude Code",
+	"take": "take-herdr-pi-cc-2026-10-11T11-57-22-297Z",
+	"startedAt": "2026-10-11T11:57:22.299Z",
+	"stage": "SOURCE checkout, not an npm consumer",
+	"gif": {
+		"path": "docs/assets/entwurf-demo.gif",
+		"sha256": "b686739b5c68fa458dd47c844711aea0f6ab5819eb3eb5d2850449922fa084c0",
+		"bytes": 1835518,
+		"seconds": 43.5,
+		"width": 1126,
+		"height": 764,
+		"frames": 340,
+		"captions": false
+	},
+	"cast": {
+		"sha256": "bbf8a409c58f8b48e88346d232a66ee41ac0c2acf8e605a3f568fd7d40857cf2",
+		"public": false
+	},
+	"runtime": {
+		"entwurf": "0.34.2",
+		"pi": "1.1.0",
+		"herdr": "0.9.3",
+		"gitHead": "9f4c9983fed1dd0ba619bc5a50f0f5abccefeef4",
+		"gitDirty": true,
+		"measuredPiModel": "openai-codex/gpt-6.1-sol",
+		"requestedClaudeAlias": "sonnet",
+		"measuredClaudeNativeModel": "claude-sonnet-5-5"
+	},
+	"auditedOriginalSourceSha256": {
+		"demo/take-herdr-pi-cc.ts": "f9cd30f1bb5b06236559a9f1283f0e030b300f6a17858d778c40d246327a6349",
+		"demo/lib/take-recorder.ts": "d47d824b90a7265c5ab6e7c4bf313b4f81b27cef836b4ddd15f971f3de386256",
+		"demo/render-take.ts": "f6e68157d7f8fb1f0e00a359efaa04aa30eeca1112ce2571661f39aea826b55d",
+		"demo/lib/herdr-take.ts": "57089d883323b2582aadd7f54f63cfce541f3a2c584bb6940313fbcdc940d83e"
+	},
+	"render": {
+		"aggArgs": [
+			"--idle-time-limit",
+			"2",
+			"--speed",
+			"1",
+			"--last-frame-duration",
+			"8",
+			"--font-size",
+			"14",
+			"--theme",
+			"monokai"
+		],
+		"trimmedTailEvents": 2,
+		"trimmedWhat": "recorder teardown: herdr client exit (alt-screen exit + server shut down line)",
+		"renderedAt": "2026-10-11T11:58:32.828Z",
+		"aggVersion": null,
+		"ffprobeVersion": null,
+		"toolVersionEvidence": "not recorded for this original; current versions cannot fill historical fields"
+	},
+	"limits": [
+		"Original cast, manifests and native records remain private; this tree cannot replay that capture.",
+		"The tracked command is a new LIVE take recipe, not byte-identical reproduction.",
+		"Current maintainer source is amended; original source hashes are historical observations, not a complete import-closure seal.",
+		"Operator approved the rough original pixels; this is not privacy or public-readability certification.",
+		"No claim of 0.35.0 release, published-package acceptance or future Herdr plugin observation follows from this take."
+	]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@junghanacs/entwurf",
-	"version": "0.34.2",
+	"version": "0.35.0",
 	"description": "Garden-citizen dispatch substrate and meta-bridge for pi, Claude Code, Copilot CLI, OMP, Antigravity, and Codex CLI; Claude and Snowflake Cortex Code ACP backends.",
 	"license": "MIT",
 	"author": {
@@ -40,6 +40,8 @@
 		"scripts/",
 		"prompts/",
 		"demo/README.md",
+		"demo/herdr-pi-cc-20261011.provenance.json",
+		"!demo/**/*.ts",
 		"demo/demo.sh",
 		"demo/demo-baseline.sh",
 		"docs/setup-clean-host.md",
@@ -186,7 +188,7 @@
 		"check:core": "pnpm run check:toolchain && pnpm run check:vitest && pnpm run check:contracts",
 		"check:toolchain": "pnpm lint && pnpm typecheck",
 		"check:vitest": "./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior",
-		"check:contracts": "./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-pi-durable-beside",
+		"check:contracts": "./run.sh check-demo-reproducibility && ./run.sh check-shell-quote && ./run.sh check-entwurf-session-identity && ./run.sh check-meta-session && ./run.sh check-meta-v3-record && ./run.sh check-mailbox-receipt-state && ./run.sh check-entwurf-capabilities && ./run.sh check-harness-admission-parity && ./run.sh check-capability-bundle-reach && ./run.sh check-meta-mailbox-state-write && ./run.sh check-meta-receiver-marker && ./run.sh check-meta-capability-source && ./run.sh check-model-lock && ./run.sh check-dep-versions && ./run.sh check-node-floor-coherence && ./run.sh check-claude-floor-coherence && ./run.sh check-copilot-statusline && ./run.sh check-pi-import-surface && ./run.sh check-env-namespace && ./run.sh check-pi-runtime-version && ./run.sh check-pi-preflight && ./run.sh check-project-trust-handler && ./run.sh check-entwurf-v2-contract && ./run.sh check-entwurf-v2-send && ./run.sh check-entwurf-v2-runner && ./run.sh check-control-send-receipt && ./run.sh check-compaction-send-guard && ./run.sh check-entwurf-resume-args && ./run.sh check-entwurf-v2-native-push && ./run.sh check-entwurf-v2-production && ./run.sh check-entwurf-v2-surface && ./run.sh check-entwurf-bridge-pi-free && ./run.sh check-resume-launch-identity && ./run.sh check-mux-placement && ./run.sh check-mux-launch && ./run.sh check-mux-resume-call && ./run.sh check-mux-parent-artifact && ./run.sh check-mux-launcher-fence && ./run.sh check-entwurf-v2-visible-resume && ./run.sh check-control-socket-path && ./run.sh check-meta-listing && ./run.sh check-entwurf-fact-provider && ./run.sh check-herdr-placement && ./run.sh check-herdr-fresh-call && ./run.sh check-herdr-supply && ./run.sh check-fresh-call-dispatch && ./run.sh check-entwurf-peers-surface && ./run.sh check-entwurf-self-address && ./run.sh check-entwurf-deliverability && ./run.sh check-native-push-adapter && ./run.sh check-native-push-register && ./run.sh check-auth-boundary && ./run.sh check-acp-overlay && ./run.sh check-acp-tool-surface && ./run.sh check-acp-event-mapper && ./run.sh check-acp-prompt-builder && ./run.sh check-acp-config && ./run.sh check-acp-session-store && ./run.sh check-acp-carrier-augment && ./run.sh check-acp-foreground-only && ./run.sh check-acp-vendor-rejection && ./run.sh check-codex-sender-identity && ./run.sh check-codex-native-push && ./run.sh check-pi-durable-beside",
 		"check:hermetic": "./run.sh check-bridge-delivery && ./run.sh smoke-pi-attach && ./run.sh check-fresh-cut-gate && ./run.sh check-hook-launch-topology && ./run.sh check-meta-hook-session-switch && ./run.sh check-copilot-birth-hook && ./run.sh check-copilot-receive-arm && ./run.sh check-copilot-launch && ./run.sh check-pi-launch && ./run.sh check-codex-app-server-launch && ./run.sh check-meta-identity-consumers && ./run.sh check-socket-probe && ./run.sh smoke-meta-honesty && ./run.sh check-meta-doctor-oracle && ./run.sh check-agy-permission-matrix && ./run.sh smoke-agy-statusline-state && ./run.sh smoke-copilot-statusline-state && ./run.sh smoke-copilot-mcp-state && ./run.sh smoke-omp-bridge-state && ./run.sh smoke-omp-mcp-state && ./run.sh smoke-omp-receive-state && ./run.sh check-omp-birth-hook && ./run.sh check-omp-receive-arm && ./run.sh check-omp-fresh-preflight && ./run.sh smoke-agy-hooks-state && ./run.sh smoke-pi-provider-state && ./run.sh smoke-user-scope-citizen && ./run.sh smoke-meta-prune && ./run.sh smoke-meta-keyset-guard && ./run.sh check-meta-manifest-schema && ./run.sh check-entwurf-control-rpc && ./run.sh check-entwurf-bridge-boot && ./run.sh check-probe-bridge-command && ./run.sh check-meta-facts && ./run.sh check-peer-facts && ./run.sh check-herdr-plugin && ./run.sh check-herdr-plugin-profile && ./run.sh check-herdr-plugin-build && ./run.sh check-herdr-runtime-bootstrap && ./run.sh check-herdr-activation && ./run.sh check-agy-sender-identity && ./run.sh check-acp-provider-surface && ./run.sh check-acp-stop-reason && ./run.sh check-acp-prompt-lifecycle && ./run.sh check-acp-usage-accounting && ./run.sh check-acp-launch-namespace && ./run.sh check-acp-stream-hooks && ./run.sh check-acp-backend-preflight && ./run.sh check-acp-session-reuse && ./run.sh check-typing-call-fence && ./run.sh check-gate-manifests && ./run.sh check-release-gate-outcomes && ./run.sh check-probe-ordering && ./run.sh check-probe-cli-shim && ./run.sh check-acp-cortex && ./run.sh check-codex-bridge-identity && ./run.sh check-pi-bridge-sender && ./run.sh check-pi-mcp-register && ./run.sh check-pi-mcp-bridge && ./run.sh check-codex-birth-hook && ./run.sh smoke-codex-config-state && ./run.sh smoke-codex-birth && ./run.sh check-herdr-sandbox",
 		"check:package": "./run.sh check-install-surface && ./run.sh smoke-meta-install-state && ./run.sh smoke-agy-install-state && ./run.sh smoke-setup-verdict && ./run.sh check-pack-pin-matcher && ./run.sh check-pack-consumer-roots && ./run.sh check-package-source-routing && ./run.sh check-install-preflight && ./run.sh check-pack"
 	},

package/run.sh

@@ -134,6 +134,7 @@ Usage:
   ./run.sh check-omp-birth-hook       # #87 gate: drives the real OMP assembler into a temp dir, imports the ASSEMBLED index.ts into a MOCK omp host and fires session_start/session_switch. tui mints one backend:"omp" record + a sender marker keyed to the host's OWN pid (the one-process join) + the garden id on the status line; print/rpc/json mint NOTHING (hasUI is true on the rpc rows, as in the vendor); switch attaches on the same native id and mints the replacement on a new one; the CERTIFIED receiver reader still finds no marker. Also the four-root joint binding: extension and omp-labeled bridge child resolve the same sessions/mailbox/senders/receivers bundle against test-built literals (never the production resolver as its own oracle), under a poisoned PI_CODING_AGENT_DIR and under four distinct ENTWURF_META_* overrides; the override grammar is absolute-or-~ and both halves plus the doctor refuse anything else by name; and a drifted provenance label selects no root policy at all. Hermetic; no omp, no model turn
   ./run.sh check-pi-durable-contact   # #129 L-identity gate, CHECKOUT-ONLY (an installed package refuses it in run_ts). Opens the REAL durable app from THIS checkout's verified carrier (pi/pi-durable/carrier/ under its resolver, against the checkout's pinned pi SDK set — refused by name first) with the pi-durable contact, births the citizen and runs its tools adapter-direct through a privately emitted branch bridge (ENTWURF_PI_DURABLE_BRIDGE_ENTRY; its registry must match this checkout). Matrix roots {default, explicit} x {fresh, --continue}: one record keyed by the durable session dir, sender marker on the spawned host pid, exactly one bridge child whose /proc PPID is that host, poisoned identity carriers kept from it, its four root carriers bound to the roots written, the receiver ARMED (raw marker owned by the host pid + start key as pi-durable-host, joined to the sender marker; removed on close), self = the record and replyable, peers from an outside bridge, same garden id on reopen; the bundle's compiled owner join must admit pi-durable-host. Reaps only the host/bridges it owns on any failure. Harness-bypassed: no model turn, no ToolTask. Missing inputs → SKIP (97), never a pass
   ./run.sh check-pi-durable-send      # #129 L-send FIRST CELL, CHECKOUT-ONLY. Same input as check-pi-durable-contact. One native durable turn: the app's own controller input → GenerationTask → ToolTask → the contact's entwurf_v2 → the private bridge → a seeded self-fetch target (C2 recipe, owned by a separate idle child). S = a 127.0.0.1 scripted OpenAI-compatible endpoint configured through the app's documented models.json (dummy key, PI_OFFLINE); H = the native ToolTask path; V (a vendor turn) is NOT run. Oracles: the wire (tools offered, v2 schema = the bridge's tools/list, exactly two requests, the tool result + receipt in the second), the raw mailbox (.msg 1, signal, sender = the host record), the native view (one call, its settled result, root current). Not exactly-once, not recovery, not a recipient turn. Missing inputs → SKIP (97)
+  ./run.sh check-demo-reproducibility # source-checkout-only: discover offline demo Node tests; no LIVE, model, render or publication
   ./run.sh check-pi-durable-beside    # #129 mutant execution coordinate (VERIFY rule 3): run_vitest over the six pi-durable beside tests (adapter, carrier/SDK-set verifier, preflight, owner join, carrier relocation/resolver/emitter/task footer, native-module file and directory ingress) — the pi-durable qualification lane's gate argv. Same files check-tests-beside-behavior already runs.
   ./run.sh check-pi-durable-receive   # #129 L-receive FIRST CELL, CHECKOUT-ONLY. Same input (the bundle must carry the pi-durable-host owner join). The host driver gives the app NO input; a seeded claude-code sender (marker owned by a separate idle child, handed to a gate-owned sending bridge through ENTWURF_META_SENDER_MARKER) enqueues one message, the host's doorbell admits its notice to the ROOT conversation, and the scripted model drains it with entwurf_inbox_read. S withholds response #1 until the ENQUEUE receipt, the .delivered bytes, the signal, the host-owned receiver marker and the notice are captured. Oracles: receiver() admission, native view, raw archive (.delivered.read + lastReadAt), wire (exactly two requests, drain result = view), and after a green reap a forensic read-only SQLite copy (submission row by request id = reported id, root, input, done, placed entry = the notice). V NOT run. Missing inputs → SKIP (97)
   ./run.sh check-copilot-receive-arm  # #82 RAIL 5 gate: the REAL receiver installer + the REAL extension.mjs forked with a stubbed SDK. Arms only after birth, marker owned by the WATCHER pid, self-fetch dispatch answer, doorbell carries the garden id and NOT the body, id-drift/foreign-parent refusals. Hermetic; no Copilot, no model turn
@@ -1029,6 +1030,37 @@ check_capability_bundle_reach() {
   run_ts scripts/check-capability-bundle-reach.ts
 }
 
+check_demo_reproducibility() {
+  # Source-only Node strip-types/CLI and subprocess fixtures, not adapter Vitest tests.
+  # Discovery lives beside demo behavior; no filename list or npm TS crossing.
+  section "demo reproducibility (offline source fixtures, no model or recording)"
+  case "$REPO_DIR" in */node_modules/*) fail "check-demo-reproducibility is source-checkout-only"; return 1 ;; esac
+  local -a tests=()
+  local f
+  while IFS= read -r f; do [ -n "$f" ] && tests+=("$f"); done < <(cd "$REPO_DIR" && find demo -type f -name '*.test.ts' -print | LC_ALL=C sort)
+  if [ "${#tests[@]}" -eq 0 ]; then
+    fail "[QK:DEMO-TEST-DISCOVERY] demo test discovery is empty — no fixtures is not a passing floor"
+    return 1
+  fi
+  (
+    local sandbox name
+    sandbox=$(mktemp -d /tmp/entwurf-demo-unit.XXXXXX)
+    trap 'rm -rf -- "$sandbox"' EXIT
+    while IFS= read -r name; do
+      case "$name" in ENTWURF_*|HERDR_*|PI_SESSION_ID|PI_AGENT_ID|CLAUDECODE|CLAUDE_CODE_SESSION_ID|TMUX|TMUX_PANE|LIVE) unset "$name" ;; esac
+    done < <(compgen -e)
+    export HOME="$sandbox/home" PI_CODING_AGENT_DIR="$sandbox/pi"
+    export XDG_CONFIG_HOME="$sandbox/config" XDG_DATA_HOME="$sandbox/data" XDG_STATE_HOME="$sandbox/state" XDG_CACHE_HOME="$sandbox/cache" XDG_RUNTIME_DIR="$sandbox/runtime"
+    mkdir -m 700 "$HOME" "$PI_CODING_AGENT_DIR" "$XDG_CONFIG_HOME" "$XDG_DATA_HOME" "$XDG_STATE_HOME" "$XDG_CACHE_HOME" "$XDG_RUNTIME_DIR" "$sandbox/bin"
+    # Take.finish records PATH versions; fixtures must not depend on an installed Pi or run it.
+    printf '#!/bin/sh\n[ "$1" = --version ] && { printf "offline-fixture\\n"; exit 0; }\nexit 81\n' > "$sandbox/bin/pi"
+    chmod +x "$sandbox/bin/pi"
+    export PATH="$sandbox/bin:$PATH"
+    cd "$REPO_DIR"
+    node --test "${tests[@]}"
+  )
+}
+
 check_bridge_delivery() {
   # demo/demo.sh scene 3, recovered as a deterministic gate. demo drove two real pi
   # panes so it proved DELIVERY through the installed binary (at model cost); what
@@ -3756,6 +3788,8 @@ check_pack() {
     # pi-extensions/ so it also covers any future allowlist entry; `plugins/` needs no
     # companion negation because `^plugins/` above already refuses that whole tree.
     '\.test\.[cm]?[jt]s$'
+    # Maintainer take/renderer/helper TS is source-only, including non-test implementations.
+    '^demo/.*\.ts$'
   )
 
   local pass=1 f pat hit
@@ -8175,6 +8209,9 @@ case "$cmd" in
   check-pi-queue-oracle)
     check_pi_queue_oracle
     ;;
+  check-demo-reproducibility)
+    check_demo_reproducibility
+    ;;
   check-tests-beside-behavior)
     check_tests_beside_behavior
     ;;

package/scripts/check-gate-qualification.ts

@@ -3455,6 +3455,7 @@ let manifestCount: number;
 		"codex-native": 82,
 		"compaction-send-guard": 7,
 		"control-socket-disconnect": 4,
+		"demo-reproducibility": 12,
 		"copilot-birth": 19,
 		"copilot-launch": 14,
 		"pi-launch": 9,
@@ -3493,7 +3494,7 @@ let manifestCount: number;
 		"omp-fresh": 24,
 		"omp-receive": 11,
 		"probe-ordering": 1,
-		"release-gate": 22,
+		"release-gate": 24,
 		"retired-sent-surface": 2,
 		"resume-args": 6,
 		"resume-launch-identity": 6,

package/scripts/check-release-gate-outcomes.ts

@@ -43,7 +43,7 @@
 // Pure + subprocess, no network/model — IN pnpm run check:full.
 
 import { strict as assert } from "node:assert";
-import { execFileSync } from "node:child_process";
+import { execFileSync, spawnSync } from "node:child_process";
 import { copyFileSync, globSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, join } from "node:path";
@@ -650,6 +650,164 @@ function runSubcommand(sub: string, env: Record<string, string | undefined>): {
 	}
 }
 
+// ===========================================================================
+// 8g. #137: TOML data-subject hunks, not path identity; Markdown/JSON data and
+// code/signatures/machinery remain file-level. Hermetic like 8f: real history is NOT
+// in a qualification snapshot.
+// ==========================================================================
+{
+	const tmp = mkdtempSync(join(tmpdir(), "entwurf-qualify-hunks-"));
+	const git = (...args: string[]) =>
+		execFileSync("git", ["-c", "core.hooksPath=/dev/null", "-c", "user.email=g@e", "-c", "user.name=g", ...args], {
+			cwd: tmp,
+			stdio: "ignore",
+		});
+	const head = () => execFileSync("git", ["rev-parse", "HEAD"], { cwd: tmp, encoding: "utf8" }).trim();
+	const data = 'version = "1"\n[[panes]]\ncommand = ["node", "build.mjs"]\n# outside\n';
+	const wrong: string[] = [];
+	try {
+		git("init", "-q", "-b", "main");
+		mkdirSync(join(tmp, "scripts/mutants"), { recursive: true });
+		mkdirSync(join(tmp, "fixture"));
+		mkdirSync(join(tmp, "scripts/fixtures"));
+		copyFileSync(join(REPO_DIR, "scripts/ci-qualify-decide.sh"), join(tmp, "scripts/ci-qualify-decide.sh"));
+		const manifest = JSON.stringify({
+			mutants: [
+				{ subject: "fixture/data.toml", find: ["[[panes]]"] },
+				{ subject: "fixture/data.toml", find: ['command = ["node", "build.mjs"]'] },
+				{ subject: "fixture/data.toml", find: ["[[panes]]", 'command = ["node", "build.mjs"]'] },
+				{ subject: "fixture/code.ts", find: ["return 1"], signatureSource: "fixture/signature.md" },
+				{ subject: "fixture/signature.md", find: ["signature"] },
+				{ subject: "fixture/joined.toml", find: ["alpha = 1", "beta = 2"] },
+				{ subject: "fixture/doc.md", find: ["Legacy rows are documented: kept for history."] },
+				{ subject: "fixture/reg.json", find: ['"mode": "self-fetch",'] },
+				{ subject: "scripts/fixtures/pin.json", find: ['"pinned": 1'] },
+				{ subject: "scripts/ci-qualify-decide.sh", find: ["set -euo pipefail"] },
+			],
+		});
+		writeFileSync(join(tmp, "scripts/mutants/fixture.json"), manifest);
+		writeFileSync(join(tmp, "fixture/data.toml"), data);
+		writeFileSync(join(tmp, "fixture/code.ts"), "// outside\nfunction f() { return 1; }\n");
+		writeFileSync(join(tmp, "fixture/signature.md"), "signature\n# outside\n");
+		writeFileSync(join(tmp, "fixture/joined.toml"), "version = 1\nalpha = 1\nbeta = 2\n");
+		const doc = "# Doc\nLegacy rows are documented: kept for history.\n# outside\n";
+		const reg = '{\n"copilot": {\n"mode": "self-fetch",\n"level": 6\n}\n}\n';
+		writeFileSync(join(tmp, "fixture/doc.md"), doc);
+		writeFileSync(join(tmp, "fixture/reg.json"), reg);
+		writeFileSync(join(tmp, "scripts/fixtures/pin.json"), '{\n"version": 1,\n"pinned": 1\n}\n');
+		git("add", "-A");
+		git("commit", "-qm", "seed");
+		const base = head();
+		const nonToml: string[] = [];
+		const check = (name: string, expected: boolean, reason?: string, before = base, into = wrong) => {
+			const r = spawnSync("bash", [join(tmp, "scripts/ci-qualify-decide.sh"), before, head()], {
+				cwd: tmp,
+				encoding: "utf8",
+				env: { ...process.env, CI_EVENT_NAME: "push", CI_FORCED: "false" },
+			});
+			if (r.status !== 0 || r.stdout.trim() !== `run_body=${expected}` || (reason && !r.stderr.includes(reason)))
+				into.push(`${name}: status=${r.status}, out=${r.stdout.trim()}, err=${r.stderr.trim()}`);
+		};
+		const commit = () => {
+			git("add", "-A");
+			git("commit", "-qm", "cell");
+		};
+		const reset = () => git("reset", "--hard", base); // ONLY this test-owned throwaway repository.
+		writeFileSync(join(tmp, "fixture/data.toml"), data.replace('version = "1"', 'version = "2"'));
+		commit();
+		check("outside", false, "fixture/data.toml: no find range touched");
+		// A replay must read HEAD's manifest, not an unrelated dirty worktree's find.
+		writeFileSync(
+			join(tmp, "scripts/mutants/fixture.json"),
+			'{"mutants":[{"subject":"fixture/data.toml","find":["version"]}]}',
+		);
+		check("HEAD manifest, not dirty worktree", false);
+		reset();
+		for (const [name, content] of [
+			["panes line", data.replace("[[panes]]", "[[panes]] # changed")],
+			["command line", data.replace('command = ["node", "build.mjs"]', 'command = ["node", "build.mjs"] # changed')],
+			["moved", `# inserted above\n${data}`],
+			["ambiguous", `${data}[[panes]]\n`],
+			["missing find", data.replace("[[panes]]", "[[other]]")],
+		] as const) {
+			writeFileSync(join(tmp, "fixture/data.toml"), content);
+			commit();
+			check(name, true);
+			reset();
+		}
+		git("rm", "fixture/data.toml");
+		commit();
+		check("deleted subject", true);
+		reset();
+		git("mv", "fixture/data.toml", "fixture/renamed.toml");
+		commit();
+		check("renamed subject", true);
+		reset();
+		writeFileSync(join(tmp, "fixture/code.ts"), "// outside changed\nfunction f() { return 1; }\n");
+		commit();
+		check("code outside find remains file-level", true);
+		reset();
+		writeFileSync(join(tmp, "fixture/signature.md"), "signature\n# outside changed\n");
+		commit();
+		check("signature also data subject remains file-level", true);
+		reset();
+		writeFileSync(join(tmp, "fixture/joined.toml"), "version = 1\nalpha = 1\nbeta = 2 # changed\n");
+		commit();
+		check("only multiline find, second line touched", true);
+		reset();
+		writeFileSync(join(tmp, "scripts/fixtures/pin.json"), '{\n"version": 2,\n"pinned": 1\n}\n');
+		commit();
+		check("machinery also data subject remains file-level", true);
+		reset();
+		writeFileSync(
+			join(tmp, "scripts/ci-qualify-decide.sh"),
+			`${readFileSync(join(tmp, "scripts/ci-qualify-decide.sh"), "utf8")}\n# outside find\n`,
+		);
+		commit();
+		check("machinery also subject remains file-level", true);
+		reset();
+		// Outside an untouched exact-once span, a shorter presence literal (measured on DELIVERY.md)
+		// or a later JSON duplicate key (JSON.parse: last wins) can re-satisfy the oracle.
+		writeFileSync(join(tmp, "fixture/doc.md"), `${doc}Legacy rows are documented\n`);
+		commit();
+		check("markdown restatement outside find", true, "conservative:", base, nonToml);
+		reset();
+		writeFileSync(
+			join(tmp, "fixture/reg.json"),
+			reg.replace("6\n}\n}\n", '6\n},\n"copilot": { "level": 6, "mode": "self-fetch" }\n}\n'),
+		);
+		commit();
+		check("json duplicate key outside find", true, "conservative:", base, nonToml);
+		reset();
+		// The first quoted name must still fail open after a >pipe-buffer list:
+		// printf | grep -q can lose its match to SIGPIPE under pipefail.
+		writeFileSync(join(tmp, '000"quoted'), "x\n");
+		for (let i = 0; i < 768; i++) writeFileSync(join(tmp, "fixture", `${i}_${"x".repeat(180)}.txt`), "x\n");
+		commit();
+		check("large quoted changed-name list", true, "quoted changed path cannot be read honestly");
+		reset();
+		check("unreadable range", true, "fail-open 4", "f".repeat(40));
+		git("rm", "scripts/mutants/fixture.json");
+		commit();
+		check("missing manifests", true);
+		assert.ok(
+			wrong.length === 0,
+			"[QK:QUALIFY-FILTER-SUBJECT-HUNKS] only untouched, unmoved, exact-once TOML find ranges may skip; " +
+				"unknown ranges run, and code/signature/machinery retain file-level protection. " +
+				wrong.join("; "),
+		);
+		assert.ok(
+			nonToml.length === 0,
+			"[QK:QUALIFY-FILTER-TOML-ONLY-REFINEMENT] Markdown and JSON subjects stay file-level: an untouched exact-once " +
+				"find does not pin kill-power when a shorter presence literal or a later duplicate JSON key outside it can " +
+				"re-satisfy the oracle. " +
+				nonToml.join("; "),
+		);
+	} finally {
+		rmSync(tmp, { recursive: true, force: true });
+	}
+}
+
 // ===========================================================================
 // 9. Every gate a mutant manifest NAMES runs inside `pnpm run check:full`
 //

package/scripts/ci-qualify-decide.sh

@@ -28,37 +28,117 @@ fail_open() {
 }
 
 collect_paths_from_manifests() {
-	python3 - "$REPO_DIR" <<'PY'
+	python3 - "$REPO_DIR" "${1:-}" <<'PY'
 import glob
 import json
 import os
 import sys
+import subprocess
 
-repo = sys.argv[1]
-out = set()
-for path in sorted(glob.glob(os.path.join(repo, "scripts/mutants/*.json"))):
-	with open(path, encoding="utf-8") as handle:
-		manifest = json.load(handle)
+repo, rev = sys.argv[1:]
+def git(*args):
+	return subprocess.check_output(["git", "-C", repo, *args])
+paths = (git("ls-tree", "-r", "--name-only", rev, "scripts/mutants").decode().splitlines()
+	if rev else sorted(glob.glob(os.path.join(repo, "scripts/mutants/*.json"))))
+paths = [p for p in paths if p.endswith(".json")]
+if not paths:
+	raise ValueError("no mutant manifests")
+out, signatures, subjects = set(), set(), {}
+for path in paths:
+	if rev:
+		manifest = json.loads(git("show", f"{rev}:{path}"))
+	else:
+		with open(path, encoding="utf-8") as handle:
+			manifest = json.load(handle)
 	for mutant in manifest.get("mutants", []):
 		subject = mutant.get("subject")
 		if subject:
 			out.add(subject)
+			find = mutant.get("find")
+			# The runner joins a find ARRAY into ONE multiline occurrence.
+			needle = "\n".join(find) if isinstance(find, list) and all(isinstance(s, str) for s in find) else None
+			subjects.setdefault(subject, []).append(needle)
 		signature_source = mutant.get("signatureSource")
 		if signature_source:
 			out.add(signature_source)
-for entry in sorted(out):
-	print(entry)
+			signatures.add(signature_source)
+if not out or any(any(c in p for c in '\n\r\t"\\') for p in out):
+	raise ValueError("empty or unrepresentable manifest paths")
+print(json.dumps({"paths": sorted(out), "signatures": sorted(signatures), "subjects": subjects}))
 PY
 }
 
-# A changed path matters when it is a mutant's subject or signature source, or
-# when it sits in the machinery that decides what those mutants prove.
+load_manifest_surface() {
+	MANIFEST_DATA="$(collect_paths_from_manifests "${1:-}")" || fail_open 6 "missing/unreadable mutant manifests"
+	MANIFEST_PATHS="$(printf '%s' "$MANIFEST_DATA" | python3 -c 'import json,sys;print("\n".join(json.load(sys.stdin)["paths"]))')" || fail_open 6 "unreadable manifest paths"
+	SIGNATURE_PATHS="$(printf '%s' "$MANIFEST_DATA" | python3 -c 'import json,sys;print("\n".join(json.load(sys.stdin)["signatures"]))')" || fail_open 6 "unreadable signature paths"
+}
+
+# Return success ONLY when every exact-once TOML find span is demonstrably
+# untouched and unmoved on BOTH blobs. Any uncertainty leaves the body armed.
+subject_find_untouched() {
+	python3 - "$REPO_DIR" "$BEFORE" "$HEAD_SHA" "$1" 3<<< "$MANIFEST_DATA" <<'PY'
+import json
+import os
+import re
+import subprocess
+import sys
+
+repo, before, head, path = sys.argv[1:]
+def git(*args):
+	return subprocess.check_output(["git", "-C", repo, *args], stderr=subprocess.DEVNULL).decode("utf-8")
+def span(source, needle):
+	if not needle or source.count(needle) != 1:
+		raise ValueError("find absent or ambiguous")
+	start = source[:source.index(needle)].count("\n") + 1
+	return start, start + needle.count("\n") - int(needle.endswith("\n"))
+try:
+	finds = json.load(os.fdopen(3))["subjects"].get(path)
+	if not finds or any(not needle for needle in finds):
+		raise ValueError("missing find spans")
+	old, new = git("show", f"{before}:{path}"), git("show", f"{head}:{path}")
+	if "\0" in old or "\0" in new:
+		raise ValueError("binary subject")
+	diff = git("diff", "--no-renames", "--no-ext-diff", "--no-textconv", "--no-color", "-U0", before, head, "--", path)
+	if "Binary files " in diff or "GIT binary patch" in diff:
+		raise ValueError("binary diff")
+	hunks = []
+	for line in diff.splitlines():
+		if not line.startswith("@@"):
+			continue
+		match = re.fullmatch(r"@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(?: .*)?", line)
+		if not match:
+			raise ValueError("unreadable hunk")
+		a, b, c, d = match.groups()
+		hunks.append((int(a), int(b or 1), int(c), int(d or 1)))
+	if not hunks:
+		raise ValueError("no readable text hunks")
+	for needle in set(finds):
+		os_, oe = span(old, needle)
+		ns, ne = span(new, needle)
+		if (os_, oe) != (ns, ne):
+			raise ValueError("find range moved")
+		for a, b, c, d in hunks:
+			if (b > 0 and a <= oe and a + b - 1 >= os_) or (d > 0 and c <= ne and c + d - 1 >= ns):
+				raise ValueError("find range touched")
+except (ValueError, KeyError, TypeError, OSError, subprocess.SubprocessError) as error:
+	print(f"ci-qualify-decide: fail-open 7 {path}: {error} -> run_body=true", file=sys.stderr)
+	sys.exit(1)
+print(f"ci-qualify-decide: {path}: no find range touched (all exact-once spans unmoved)", file=sys.stderr)
+PY
+}
+
+# Signature sources and machinery MUST precede subjects: many paths are BOTH.
+# Code/unknown subjects retain file-level protection; only TOML data gets hunk
+# refinement (#137 non-goal: no skipping code/gate/mutant/matrix changes). TOML
+# refuses a redefined key, but a shorter Markdown presence literal or a later JSON
+# duplicate key outside an untouched find can still re-satisfy an oracle.
 matches_qualification_surface() {
 	local file="$1"
 	local subject
 	while IFS= read -r subject; do
-		[ "$file" = "$subject" ] && { echo "manifest-subject"; return 0; }
-	done <<< "$MANIFEST_PATHS"
+		[ "$file" = "$subject" ] && { echo "manifest-signature-source"; return 0; }
+	done <<< "$SIGNATURE_PATHS"
 	case "$file" in
 		scripts/mutants/*) echo "glob:scripts/mutants/**"; return 0 ;;
 		scripts/check-*) echo "glob:scripts/check-*"; return 0 ;;
@@ -73,6 +153,20 @@ matches_qualification_surface() {
 		# that stopped covering something cannot hide behind its own change.
 		scripts/ci-qualify-decide.sh) echo "exact:scripts/ci-qualify-decide.sh"; return 0 ;;
 	esac
+	while IFS= read -r subject; do
+		if [ "$file" = "$subject" ]; then
+			if [ "${MATCH_MODE:-files}" = range ]; then
+				case "$file" in
+					*.toml) ;;
+					*) echo "conservative:non-toml-subject"; return 0 ;;
+				esac
+				if subject_find_untouched "$file"; then
+					return 1
+				fi
+			fi
+			echo "manifest-subject"; return 0
+		fi
+	done <<< "$MANIFEST_PATHS"
 	return 1
 }
 
@@ -98,13 +192,12 @@ decide_from_files() {
 	fi
 }
 
-MANIFEST_PATHS="$(collect_paths_from_manifests)"
-[ -n "$MANIFEST_PATHS" ] || { echo "ABORT: no mutant manifests read from $REPO_DIR/scripts/mutants" >&2; exit 1; }
-
 if [ "${1:-}" = "--files-from" ]; then
+	MATCH_MODE=files
+	load_manifest_surface
 	SRC="${2:-}"
 	[ -n "$SRC" ] || { echo "ABORT: --files-from needs a path or -" >&2; exit 1; }
-	if [ "$SRC" = "-" ]; then FILES="$(cat)"; else FILES="$(cat "$SRC")"; fi
+	if [ "$SRC" = "-" ]; then FILES="$(cat)"; else FILES="$(cat "$SRC")"; fi || fail_open 4 "unreadable files-from input"
 	decide_from_files "$FILES"
 	exit 0
 fi
@@ -154,6 +247,10 @@ esac
 git -C "$REPO_DIR" cat-file -e "$BEFORE^{commit}" 2>/dev/null || fail_open 4 "before=$BEFORE is not a commit object in this checkout"
 git -C "$REPO_DIR" cat-file -e "$HEAD_SHA^{commit}" 2>/dev/null || fail_open 4 "head=$HEAD_SHA is not a commit object in this checkout"
 
-CHANGED="$(git -C "$REPO_DIR" diff --name-only "$BEFORE".."$HEAD_SHA" 2>/dev/null)" || fail_open 4 "git diff $BEFORE..$HEAD_SHA failed"
+MATCH_MODE=range
+load_manifest_surface "$HEAD_SHA"
+CHANGED="$(git -C "$REPO_DIR" diff --no-renames --no-ext-diff --no-textconv --name-only "$BEFORE".."$HEAD_SHA" 2>/dev/null)" || fail_open 4 "git diff $BEFORE..$HEAD_SHA failed"
+# Git quotes unrepresentable changed names; never interpret those as absent paths.
+if grep -q '^"' <<< "$CHANGED"; then fail_open 4 "quoted changed path cannot be read honestly"; fi
 
 decide_from_files "$CHANGED"