@junghanacs/entwurf 0.38.1 → 0.39.0

package/pi-extensions/lib/win32-native.js

@@ -0,0 +1,198 @@
+/**
+ * win32-native — the Windows preview's native surface (#78), and the only way to reach it.
+ *
+ * Node cannot open a file without following a final-component reparse point on Windows
+ * (libuv `UV_FS_O_NOFOLLOW` is 0), and it cannot check who owns a named pipe before
+ * talking to it. Those two capabilities come from one Entwurf-owned N-API addon,
+ * `native/win32-x64/entwurf_win.node`, built in CI from `native/win32/entwurf_win.c` and
+ * shipped beside `native/win32-x64/manifest.json`. This module verifies the manifest and
+ * the addon bytes BEFORE `process.dlopen`, and refuses by name otherwise:
+ *
+ *   ENTWURF_WIN32_UNSUPPORTED     not win32-x64, no addon in this install (an ordinary
+ *                                 Linux pack), a Node without the N-API floor, or a
+ *                                 verified addon this host cannot load
+ *   ENTWURF_WIN32_NATIVE_DRIFT    the manifest is malformed, or the addon bytes are not the
+ *                                 bytes the manifest names
+ *
+ * There is no repair, no download and no fallback: a refusal is the whole answer.
+ *
+ * Authored as `.js` for the reason `control-socket-path.js` is: it is imported from the
+ * tsc-emit root program and from the strip-types lanes alike. `meta-session.ts` reaches it
+ * only through a win32-only `createRequire`, so the installers that copy `meta-session.ts`
+ * on their own are unchanged on Linux and macOS. Keep dependency-free except node builtins.
+ */
+
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const WIN32_UNSUPPORTED_CODE = "ENTWURF_WIN32_UNSUPPORTED";
+export const WIN32_DRIFT_CODE = "ENTWURF_WIN32_NATIVE_DRIFT";
+
+const PACKAGE_NAME = "@junghanacs/entwurf";
+const NATIVE_DIR = path.join("native", "win32-x64");
+const ADDON_FILE = "entwurf_win.node";
+const SHA256 = /^[0-9a-f]{64}$/;
+// The addon is built against exactly this N-API version (native/win32/binding.gyp, build.mjs). A
+// manifest that declares any other value describes some other build: drift, not a floor to honour.
+const ADDON_NAPI_VERSION = 8;
+// One addon object per process, even if two module instances of this file exist (a
+// transpiling loader and Node's own loader can each evaluate it once).
+const SLOT = Symbol.for("entwurf.win32-native.addon");
+// DOS device names open a device, not a file, at any directory. The addon's GetFileType
+// check refuses a non-disk handle anyway; this keeps the open from ever being attempted.
+const DOS_DEVICE = /^(con|prn|aux|nul|com[0-9¹²³]|lpt[0-9¹²³]|conin\$|conout\$)$/i;
+
+/**
+ * @param {string} code
+ * @param {string} message
+ * @param {unknown} [cause]
+ * @returns {Error & { code: string }}
+ */
+function refusal(code, message, cause) {
+	const err = /** @type {Error & { code: string }} */ (new Error(message, cause === undefined ? undefined : { cause }));
+	err.code = code;
+	return err;
+}
+
+/**
+ * The package root, found from where THIS module lives: the source depth
+ * (`<root>/pi-extensions/lib/`) first, then the compiled depth
+ * (`<root>/mcp/entwurf-bridge/dist/pi-extensions/lib/`). The root is the directory whose
+ * `package.json` names this package; `null` when neither depth does.
+ *
+ * @param {string} [from]
+ * @returns {string | null}
+ */
+export function win32NativePackageRoot(from = path.dirname(fileURLToPath(import.meta.url))) {
+	for (const up of [
+		["..", ".."],
+		["..", "..", "..", "..", ".."],
+	]) {
+		const root = path.resolve(from, ...up);
+		let name;
+		try {
+			name = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"))?.name;
+		} catch {
+			continue;
+		}
+		if (name === PACKAGE_NAME) return root;
+	}
+	return null;
+}
+
+/**
+ * Verify `<root>/native/win32-x64/` and return the addon path to load. Pure apart from
+ * reading the two files, so the refusals are provable on any host.
+ *
+ * @param {string} root
+ * @param {{ napi?: string | undefined }} [versions]
+ * @returns {{ addonPath: string, sha256: string, napiVersion: number }}
+ */
+export function verifyWin32NativeAt(root, versions = process.versions) {
+	const dir = path.join(root, NATIVE_DIR);
+	const manifestPath = path.join(dir, "manifest.json");
+	let raw;
+	try {
+		raw = fs.readFileSync(manifestPath, "utf8");
+	} catch (err) {
+		if (/** @type {{ code?: unknown }} */ (err).code === "ENOENT") {
+			throw refusal(
+				WIN32_UNSUPPORTED_CODE,
+				`this entwurf install carries no Windows addon (${manifestPath} is absent): only the Windows preview ` +
+					"artifact runs on Windows; an ordinary pack does not.",
+			);
+		}
+		throw refusal(WIN32_DRIFT_CODE, `cannot read ${manifestPath}`, err);
+	}
+	let manifest;
+	try {
+		manifest = JSON.parse(raw);
+	} catch (err) {
+		throw refusal(WIN32_DRIFT_CODE, `${manifestPath} is not JSON`, err);
+	}
+	if (
+		manifest?.schema !== 1 ||
+		manifest.platform !== "win32" ||
+		manifest.arch !== "x64" ||
+		manifest.file !== ADDON_FILE ||
+		typeof manifest.sha256 !== "string" ||
+		!SHA256.test(manifest.sha256) ||
+		manifest.napiVersion !== ADDON_NAPI_VERSION
+	) {
+		throw refusal(WIN32_DRIFT_CODE, `${manifestPath} does not describe one win32-x64 ${ADDON_FILE}`);
+	}
+	const napi = Number(versions.napi);
+	if (!(napi >= ADDON_NAPI_VERSION)) {
+		throw refusal(
+			WIN32_UNSUPPORTED_CODE,
+			`the Windows addon needs N-API ${ADDON_NAPI_VERSION}; this Node offers ${versions.napi ?? "none"}`,
+		);
+	}
+	const addonPath = path.join(dir, ADDON_FILE);
+	let bytes;
+	try {
+		bytes = fs.readFileSync(addonPath);
+	} catch (err) {
+		throw refusal(WIN32_DRIFT_CODE, `the manifest names ${addonPath}, which cannot be read`, err);
+	}
+	const sha256 = createHash("sha256").update(bytes).digest("hex");
+	if (sha256 !== manifest.sha256) {
+		throw refusal(
+			WIN32_DRIFT_CODE,
+			`${addonPath} is not the addon its manifest names (sha256 ${sha256} != ${manifest.sha256})`,
+		);
+	}
+	return { addonPath, sha256, napiVersion: ADDON_NAPI_VERSION };
+}
+
+/**
+ * @typedef {object} Win32NativeAddon
+ * @property {(file: string) => Buffer} readNoFollow
+ * @property {(name: string, line: string, timeoutMs: number) => Promise<{ responseLine: string, serverPid: number }>} pipeRpc
+ * @property {(name: string, timeoutMs: number) => Promise<{ serverPid: number }>} pipeProbe
+ * @property {() => { live: number, cancelledIncomplete: number }} ioStats
+ */
+
+/** @returns {Win32NativeAddon} */
+export function win32Native() {
+	const held = /** @type {Record<symbol, Win32NativeAddon | undefined>} */ (/** @type {unknown} */ (process))[SLOT];
+	if (held) return held;
+	if (process.platform !== "win32" || process.arch !== "x64") {
+		throw refusal(
+			WIN32_UNSUPPORTED_CODE,
+			`the Windows native surface exists only on win32-x64, not ${process.platform}-${process.arch}`,
+		);
+	}
+	const root = win32NativePackageRoot();
+	if (root === null) {
+		throw refusal(WIN32_UNSUPPORTED_CODE, `cannot find the ${PACKAGE_NAME} package root beside this module`);
+	}
+	const { addonPath } = verifyWin32NativeAt(root);
+	const module = { exports: {} };
+	try {
+		process.dlopen(module, addonPath);
+	} catch (err) {
+		throw refusal(WIN32_UNSUPPORTED_CODE, `this host cannot load the verified Windows addon ${addonPath}`, err);
+	}
+	const addon = /** @type {Win32NativeAddon} */ (module.exports);
+	/** @type {Record<symbol, Win32NativeAddon | undefined>} */ (/** @type {unknown} */ (process))[SLOT] = addon;
+	return addon;
+}
+
+/**
+ * Read a record's bytes on Windows, refusing a final-component reparse point (`ELOOP`) and
+ * a non-regular entry (`ENTWURF_ENOTREG`) on the very handle the read uses. Over 16 MiB is
+ * `EFBIG`; other Win32 failures are `EWIN32_<n>`.
+ *
+ * @param {string} file
+ * @returns {Buffer}
+ */
+export function win32ReadNoFollow(file) {
+	const stem = path.win32.basename(file).split(".")[0].replace(/[ ]+$/, "");
+	if (DOS_DEVICE.test(stem)) {
+		throw refusal("ENTWURF_ENOTREG", `${path.win32.basename(file)} names a DOS device, never a record`);
+	}
+	return win32Native().readNoFollow(file);
+}

package/run.sh

@@ -1340,6 +1340,15 @@ check_control_send_receipt() {
   run_vitest pi-extensions/lib/control-send-receipt.test.ts
 }
 
+check_win32_preview() {
+  # MUTANT EXECUTION COORDINATE, not a discovery path — the Windows preview's (#78) loader and
+  # platform wiring tests are found by check-tests-beside-behavior like every other beside-behaviour
+  # lane. This case exists because the WIN32-* mutants name it as gate argv. The addon's own Win32
+  # behaviour is measured only on Windows, by windows-native-preview.yml.
+  section "Windows preview loader + platform wiring (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/win32-native.test.ts pi-extensions/lib/win32-wiring.test.ts
+}
+
 check_entwurf_v2_native_push() {
   # MUTANT EXECUTION COORDINATE, not a discovery path — the test is found by
   # check-tests-beside-behavior like every other beside-behaviour lane. This case exists
@@ -2667,6 +2676,8 @@ for (const [job] of ciJobs) {
 // to what is already bound is not a safety net; it is a restatement.
 // pnpm-lock.yaml is excluded on purpose: those engine ranges belong to third-
 // party dependencies and are not this repo's supported axis.
+// native/win32/package-lock.json (#78) is excluded for the same reason: a generated
+// lock of the Windows addon's build-only dependency tree (node-gyp), never shipped.
 // `--cached` ONLY — deliberately not `--others`. The corpus must be the
 // candidate contract (what is tracked/staged), never the operator's working
 // directory: an un-ignored scratch file would otherwise turn this gate RED on
@@ -2676,7 +2687,7 @@ for (const [job] of ciJobs) {
 // before the commit that would ship it. (Review lane, 2026-07-21.)
 const tracked = execFileSync('git', ['ls-files', '--cached', '--', '*.sh', '*.json', '*.ts', '*.md', '*.yml', '*.yaml'], { encoding: 'utf8' })
   .split('\n')
-  .filter((f) => f && f !== 'pnpm-lock.yaml' && f !== 'CHANGELOG.md' && f !== 'NEXT.md');
+  .filter((f) => f && f !== 'pnpm-lock.yaml' && f !== 'native/win32/package-lock.json' && f !== 'CHANGELOG.md' && f !== 'NEXT.md');
 assert.ok(tracked.length >= 20,
   `git ls-files returned ${tracked.length} first-party files — the sweep lost its corpus and would pass vacuously`);
 
@@ -3851,6 +3862,14 @@ check_pack() {
     "pi/pi-durable/carrier/LICENSE"
     "pi/meta-bridge-omp/entwurf-meta-omp/package.json"
     "mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
+    # #78 — the Windows preview loader. The compiled meta-session reaches it only through a
+    # win32-only createRequire, not the import graph, so its compiled copy is pinned by name.
+    "pi-extensions/lib/win32-native.js"
+    "mcp/entwurf-bridge/dist/pi-extensions/lib/win32-native.js"
+    # #78 — the MIT notice for node-gyp's win_delay_load_hook.cc, which build.mjs compiles into the
+    # Windows addon. It rides every pack (one per-FILE entry), so the preview carrier never ships
+    # without it; build.mjs refuses unless it equals the pinned node-gyp LICENSE.
+    "LICENSES/node-gyp.txt"
     "scripts/postinstall-chmod.cjs"
     "pi/entwurf-capabilities.json"
     "pi/meta-bridge/.claude-plugin/marketplace.json"
@@ -3925,6 +3944,9 @@ check_pack() {
     '\.test\.[cm]?[jt]s$'
     # Maintainer take/renderer/helper TS is source-only, including non-test implementations.
     '^demo/.*\.ts$'
+    # #78 — the Windows addon's C source, gyp file and build pin are CI build inputs, never a
+    # consumer repair surface: only the built native/win32-x64/ carrier may ship.
+    '^native/win32/'
   )
   # #141: the owned pi-durable source, its typecheck fence and the retired overlay patch are maintainer
   # input. An installed consumer runs the emitted carrier JS (and its LICENSE) only — Rule 11: compiled
@@ -3957,6 +3979,20 @@ check_pack() {
     pass=0
   fi
 
+  # #78 — a pack carries the Windows addon not at all, or as exactly a verified addon + manifest
+  # pair (pack_win32_carrier_verdict, proven on owned fixtures by check-pack-win32-carrier).
+  # "present" means the carrier verified, never that the build was approved for publication.
+  local carrier_verdict
+  carrier_verdict=$(pack_win32_carrier_verdict "$file_list" "$REPO_DIR")
+  case "$carrier_verdict" in
+    absent) echo "[check-pack] win32 addon: absent (not a Windows preview artifact)" ;;
+    present\ *) echo "[check-pack] win32 addon: present sha256=${carrier_verdict#present } (carrier verified; not a publication approval)" ;;
+    *)
+      fail "[check-pack] native/win32-x64/ is not one verified addon + manifest pair: $carrier_verdict"
+      pass=0
+      ;;
+  esac
+
   local total
   total=$(printf '%s\n' "$file_list" | wc -l | tr -d ' ')
   echo "[check-pack] $total files in tarball"
@@ -3969,6 +4005,68 @@ check_pack() {
   return 1
 }
 
+# #78 — the Windows addon carrier decision, shared by check_pack (the real tarball list) and
+# check_pack_win32_carrier (owned fake-byte fixtures). $1 = tarball file list, $2 = the package root
+# holding native/win32-x64/. Prints ONE verdict: `absent`, `pair-broken`, `invalid <code>` or
+# `present <sha256>`. The manifest + bytes check IS the loader's own verifyWin32NativeAt (manifest
+# shape, N-API 8, digest), so the pack and the consumer cannot disagree about what a carrier is.
+pack_win32_carrier_verdict() {
+  local list="$1" root="$2" carrier
+  carrier=$(grep -E '^native/win32-x64/' <<<"$list" | sort || true)
+  if [ -z "$carrier" ]; then echo "absent"; return 0; fi
+  if [ "$carrier" != $'native/win32-x64/entwurf_win.node\nnative/win32-x64/manifest.json' ]; then echo "pair-broken"; return 0; fi
+  node -e '
+    import(require("node:url").pathToFileURL(process.argv[1]).href).then((m) => {
+      try { process.stdout.write(`present ${m.verifyWin32NativeAt(process.argv[2], { napi: "8" }).sha256}`); }
+      catch (err) { process.stdout.write(`invalid ${err.code ?? "uncoded"}`); }
+    });' "$REPO_DIR/pi-extensions/lib/win32-native.js" "$root"
+}
+
+check_pack_win32_carrier() {
+  section "pack: Windows addon carrier verdict (owned fake-byte fixtures)"
+  # Fake bytes and node-written manifests, never a PE: this proves the pair/digest/ABI decision,
+  # not a loadable addon (windows-native-preview.yml owns that, on installed bytes).
+  local fx pair=$'native/win32-x64/entwurf_win.node\nnative/win32-x64/manifest.json' got
+  fx=$(mktemp -d "${TMPDIR:-/tmp}/entwurf-pack-carrier.XXXXXX")
+  trap 'rm -rf -- "$fx"' RETURN
+  win32_carrier_cell() { # name napiVersion -> a root with a matching addon + manifest
+    mkdir -p "$fx/$1/native/win32-x64"
+    printf 'fake addon %s\n' "$1" >"$fx/$1/native/win32-x64/entwurf_win.node"
+    node -e '
+      const fs = require("node:fs"), dir = process.argv[1];
+      const sha = require("node:crypto").createHash("sha256").update(fs.readFileSync(dir + "/entwurf_win.node")).digest("hex");
+      fs.writeFileSync(dir + "/manifest.json", JSON.stringify({ schema: 1, platform: "win32", arch: "x64", file: "entwurf_win.node", sha256: sha, napiVersion: Number(process.argv[2]) }));
+    ' "$fx/$1/native/win32-x64" "$2"
+  }
+  win32_carrier_cell match 8
+  win32_carrier_cell drift 8 && printf 'changed\n' >"$fx/drift/native/win32-x64/entwurf_win.node"
+  win32_carrier_cell abi 7
+  win32_carrier_cell garbled 8 && printf 'not json' >"$fx/garbled/native/win32-x64/manifest.json"
+  local want_sha
+  want_sha=$(sha256sum "$fx/match/native/win32-x64/entwurf_win.node" | cut -d' ' -f1)
+  got=$(pack_win32_carrier_verdict "package.json" "$fx/match")
+  [ "$got" = "absent" ] || { fail "[check-pack-win32-carrier] a list without native/win32-x64/ must be absent — got: $got"; return 1; }
+  for cell in drift abi garbled; do
+    got=$(pack_win32_carrier_verdict "$pair" "$fx/$cell")
+    [ "$got" = "invalid ENTWURF_WIN32_NATIVE_DRIFT" ] || {
+      fail "[QK:WIN32-PACK-DIGEST] the $cell carrier (changed byte / N-API 7 / unparsable manifest) must be invalid as drift, never present — got: $got"
+      return 1
+    }
+  done
+  # The positive cell comes after the refusals, so a weakened check dies on its own QK first.
+  got=$(pack_win32_carrier_verdict "$pair" "$fx/match")
+  [ "$got" = "present $want_sha" ] || { fail "[check-pack-win32-carrier] a matching pair must be present $want_sha — got: $got"; return 1; }
+  local list
+  for list in 'native/win32-x64/entwurf_win.node' 'native/win32-x64/manifest.json' "$pair"$'\nnative/win32-x64/x.dll'; do
+    got=$(pack_win32_carrier_verdict "$list" "$fx/match")
+    [ "$got" = "pair-broken" ] || {
+      fail "[QK:WIN32-PACK-PAIR] native/win32-x64/ must carry exactly the addon + manifest pair — $(tr '\n' ' ' <<<"$list") gave: $got"
+      return 1
+    }
+  done
+  echo "[check-pack-win32-carrier] ok — absent, present, three drift shapes and three broken pairs decided by the shared verdict"
+}
+
 # The pin-leak filter for the install tree's .pnpm listing, shared by the real scan and its
 # self-test below. TWO properties are load-bearing and each has its own cell below.
 #
@@ -7378,6 +7476,9 @@ case "$cmd" in
   check-control-send-receipt)
     check_control_send_receipt
     ;;
+  check-win32-preview)
+    check_win32_preview
+    ;;
   check-entwurf-v2-native-push)
     check_entwurf_v2_native_push
     ;;
@@ -8489,6 +8590,9 @@ case "$cmd" in
   check-pack-pin-matcher)
     check_pack_pin_matcher
     ;;
+  check-pack-win32-carrier)
+    check_pack_win32_carrier
+    ;;
   check-pack-consumer-roots)
     check_pack_consumer_roots
     ;;

package/scripts/check-entwurf-self-address.ts

@@ -263,8 +263,19 @@ ok(
 // call: the dir is still this adapter's own policy (ENTWURF_DIR honours the env
 // override the pi side does not), but the join is not re-authored here.
 ok(
-	"buildStrictPiSenderEnvelope existsSync-probes the canonical socket via the shared grammar (controlSocketPathIn(ENTWURF_DIR, …))",
-	/existsSync\s*\(/.test(piBody) && /controlSocketPathIn\s*\(\s*ENTWURF_DIR\s*,/.test(piBody),
+	"buildStrictPiSenderEnvelope probes the canonical address via the shared grammar (controlSocketPathIn(ENTWURF_DIR, …))",
+	/controlAddressPresent\s*\(\s*socketPath\s*\)/.test(piBody) &&
+		/controlSocketPathIn\s*\(\s*ENTWURF_DIR\s*,/.test(piBody),
+);
+// The presence probe keeps the socket-file existsSync off Windows; on Windows (#78) the address
+// is a named pipe, which only the owner-validated probe may touch (a stat would connect).
+const presentBody = functionBody("controlAddressPresent");
+ok(
+	"controlAddressPresent: existsSync(socketPath) off Windows, the owner-validated pipe probe on it",
+	/existsSync\s*\(\s*socketPath\s*\)/.test(presentBody) &&
+		/process\.platform === "win32"\)\s*return \(await probeSocketLiveness\(socketPath\)\) === "alive"/.test(
+			presentBody,
+		),
 );
 
 const metaBuilder = functionBody("buildMetaSenderEnvelope");
@@ -280,8 +291,8 @@ ok(
 
 const selfRegion = toolRegion("entwurf_self");
 ok(
-	"entwurf_self existsSync-probes the pi socket (alive vs expected, no synthesized path lie)",
-	/existsSync\s*\(/.test(selfRegion),
+	"entwurf_self probes the pi control address (alive vs expected, no synthesized path lie)",
+	/controlAddressPresent\s*\(\s*socketPath\s*\)/.test(selfRegion),
 );
 
 // ── SLICE INTEGRITY (before any claim is read off the slice) ─────────────────

package/scripts/check-gate-qualification.ts

@@ -3488,7 +3488,7 @@ let manifestCount: number;
 		"mux-fresh-call": 65,
 		"mux-launcher-fence": 8,
 		"mux-parent-artifact": 3,
-		"pack-install": 3,
+		"pack-install": 5,
 		"pi-package-ownership": 8,
 		"qualification-ledger": 42,
 		"mux-resume-call": 10,
@@ -3506,6 +3506,7 @@ let manifestCount: number;
 		"typing-call-fence": 1,
 		"v2-surface": 13,
 		"v2-visible-resume": 18,
+		"win32-preview": 19,
 	};
 	const laneTally: Record<string, number> = {};
 	for (const man of manifests) laneTally[man.lane] = (laneTally[man.lane] ?? 0) + man.mutants.length;

package/scripts/mutants/pack-install.json

@@ -4,7 +4,7 @@
 	"mutants": [
 		{
 			"claim": "PACK-INSTALL-PIN-MATCHER-BOUNDED",
-			"title": "the pin-leak matcher loses its version boundary and blesses substring lookalikes — @0.85.10 reads as the pinned 0.85.1 and the gate announces a verified tree it never verified (independent review, 2026-08-25)",
+			"title": "the pin-leak matcher loses its version boundary and blesses substring lookalikes \u2014 @0.85.10 reads as the pinned 0.85.1 and the gate announces a verified tree it never verified (independent review, 2026-08-25)",
 			"subject": "run.sh",
 			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.3\\.0(_|$)' || true"],
 			"replace": ["  grep '^@earendil-works+' | grep -v '@0\\.87\\.1' || true"],
@@ -15,7 +15,7 @@
 		},
 		{
 			"claim": "PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE",
-			"title": "the pin-leak matcher narrows back to the pi-* families and goes blind to a non-pi member of the same runtime closure — @earendil-works/chord (new in pi 0.85.0, a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol) floats unpinned while the gate prints a verified pin (measured 2026-09-06 on a real 0.85.1 install tree)",
+			"title": "the pin-leak matcher narrows back to the pi-* families and goes blind to a non-pi member of the same runtime closure \u2014 @earendil-works/chord (new in pi 0.85.0, a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol) floats unpinned while the gate prints a verified pin (measured 2026-09-06 on a real 0.85.1 install tree)",
 			"subject": "run.sh",
 			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.3\\.0(_|$)' || true"],
 			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@1\\.3\\.0(_|$)' || true"],
@@ -34,6 +34,32 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:PACK-INSTALL-CONSUMER-ROOTS-CONTAINED]",
 			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "WIN32-PACK-PAIR",
+			"title": "the Windows carrier pair check becomes a presence test, so an addon without its manifest, or with an extra DLL beside it, is packed as a carrier",
+			"subject": "run.sh",
+			"find": [
+				"  if [ \"$carrier\" != $'native/win32-x64/entwurf_win.node\\nnative/win32-x64/manifest.json' ]; then echo \"pair-broken\"; return 0; fi"
+			],
+			"replace": ["  if ! grep -q 'entwurf_win.node' <<<\"$carrier\"; then echo \"pair-broken\"; return 0; fi"],
+			"gate": ["bash", "run.sh", "check-pack-win32-carrier"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:WIN32-PACK-PAIR]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "WIN32-PACK-DIGEST",
+			"title": "the pack stops verifying the carrier with the loader's own check, so changed bytes or a foreign N-API manifest are packed as `present`",
+			"subject": "run.sh",
+			"find": [
+				"      try { process.stdout.write(`present ${m.verifyWin32NativeAt(process.argv[2], { napi: \"8\" }).sha256}`); }"
+			],
+			"replace": ["      try { process.stdout.write(`present unverified`); }"],
+			"gate": ["bash", "run.sh", "check-pack-win32-carrier"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:WIN32-PACK-DIGEST]",
+			"signatureSource": "run.sh"
 		}
 	]
 }