@junghanacs/entwurf 0.38.1 → 0.40.0

package/run.sh

@@ -328,6 +328,9 @@ Usage:
   ./run.sh meta-bridge-prune          # 1.0.0 meta-bridge Phase 4: LISTING-ONLY store hygiene — classify orphan/stale/ambiguous/keep, print manual rm commands, delete NOTHING ([dir] [--ttl-days N])
   ./run.sh meta-bridge-fresh-cut      # the ONE generation verb (the verb every v3-only rejection names): quiesce-check live sockets/markers/native-push conversations (refusing any surface it cannot inspect), archive meta-sessions/ + meta-mailbox/ to `<dir>.archive-<ts>`, clear dead transport residue, open an empty v3 generation. No migration, no restore — the archive is forensic only. EXIT CONTRACT (#54, `--help` prints it): 0 complete / 1 NOTHING MOVED (re-run, do not setup) / 2 usage / 3 cut transition incomplete (inspect) / 4 cut complete but residue cleanup failed (`setup` may run; re-run only before new citizen birth, otherwise remove residue manually)
   ./run.sh meta-facts                 # #65 owner-normalized READ-ONLY store projection: deterministic JSON {schemaVersion:1, storeDir, citizens: full v3 records sorted by gardenId, defects: {filename,message}} — THE listing contract emitted by the owner so consumers stop copying the certification. No liveness/sockets/transcript contents. EXIT: 0 readable (defects in-band; missing store = empty), 2 usage, 3 unreadable ([dir])
+  ./run.sh check-remote-pair-installed # #107 rail 3, CHECKOUT-ONLY: install a caller-supplied candidate tarball (--tgz <abs>) into a sandboxed consumer prefix, check its compiled remote-pair surface, run the installed `entwurf remote-pair-receive` (usage exit 2 = twin reached), run the T2 roundtrip cells against the installed bridge+entry, and audit that the subject processes resolve every module inside the consumer prefix (with a checkout control). Never repacks; no real ssh, no model
+  ./run.sh check-remote-pair-installed-audit # #107 rail 3: the deterministic counterpart of check-remote-pair-installed — its checkout-invisibility acceptance primitive proven on synthetic logs (real path, root boundary). In check:vitest
+  ./run.sh remote-pair-receive        # #107 rail 1: the RECEIVING half of one operator-declared remote pair. Reads ONE JSON claim {from,fromAgentId,fromCwd,target,message,wantsReply} on stdin, refuses a from/target outside the declared pair before any mutation (a scope limit under the same-operator SSH account trust model, not authentication), then hands a match to the existing v2 dispatch. Ambient sender carriers are never read. Installed, run_ts runs its compiled twin (dist/scripts/remote-pair-receive.js). EXIT: 0 dispatched / 4 dispatched, the dispatch reported an error (delivery not inferred) / 3 pair refused / 2 invalid claim or declaration (JSON receipt) or wrong argv (usage on stderr, no receipt) / 1 uncaught dispatch or store throw (no receipt; the sender reads it as indeterminate) (--pair <absolute declaration file>)
   ./run.sh peer-facts                 # #116 M2-a owner-normalized READ-ONLY peer projection: the same listEntwurfFacts provider through the same renderer entwurf_peers uses, emitted as deterministic JSON {schemaVersion:1, storeDir, peers, diagnostics} so a consumer never re-implements the placement join (whose pi half is a measured vendor floor). NOT the same bytes as an entwurf_peers call and deliberately so: that surface is a human listing (observationLimit, text over the wire), this is a machine projection with UNBOUNDED observation, because a rationed row says `unobserved` and a machine cannot tell that from "nobody could look". `placement` stays a STRUCTURED tagged union ({kind:"herdr-pane",paneId} / unobserved / none / ambiguous) — never the human `herdr <pane>` string. Publishes NO socket coordinate (ENTWURF_DIR selects what is PROBED, #50 C4) and NO herdr agent_status / interactive_ready / screen text. One placement read per listing, no watcher. EXIT: 0 readable (diagnostics in-band; missing store = empty), 2 usage, 3 unreadable ([dir])
   ./run.sh meta-bridge-managed-keys   # 0.10.0 meta-bridge: print the SSOT of settings keys entwurf OWNS (consumers read this to stay disjoint — keyset-owner invariant)
   ./run.sh check-keyset-overlap <fragment.json...>  # 0.10.0 meta-bridge: PREVENTIVE keyset guard — fail if a consumer fragment collides with any pi-owned key (cross-repo; not in pnpm check)
@@ -1340,6 +1343,15 @@ check_control_send_receipt() {
   run_vitest pi-extensions/lib/control-send-receipt.test.ts
 }
 
+check_win32_preview() {
+  # MUTANT EXECUTION COORDINATE, not a discovery path — the Windows preview's (#78) loader and
+  # platform wiring tests are found by check-tests-beside-behavior like every other beside-behaviour
+  # lane. This case exists because the WIN32-* mutants name it as gate argv. The addon's own Win32
+  # behaviour is measured only on Windows, by windows-native-preview.yml.
+  section "Windows preview loader + platform wiring (mutant execution coordinate)"
+  run_vitest pi-extensions/lib/win32-native.test.ts pi-extensions/lib/win32-wiring.test.ts
+}
+
 check_entwurf_v2_native_push() {
   # MUTANT EXECUTION COORDINATE, not a discovery path — the test is found by
   # check-tests-beside-behavior like every other beside-behaviour lane. This case exists
@@ -2667,6 +2679,8 @@ for (const [job] of ciJobs) {
 // to what is already bound is not a safety net; it is a restatement.
 // pnpm-lock.yaml is excluded on purpose: those engine ranges belong to third-
 // party dependencies and are not this repo's supported axis.
+// native/win32/package-lock.json (#78) is excluded for the same reason: a generated
+// lock of the Windows addon's build-only dependency tree (node-gyp), never shipped.
 // `--cached` ONLY — deliberately not `--others`. The corpus must be the
 // candidate contract (what is tracked/staged), never the operator's working
 // directory: an un-ignored scratch file would otherwise turn this gate RED on
@@ -2676,7 +2690,7 @@ for (const [job] of ciJobs) {
 // before the commit that would ship it. (Review lane, 2026-07-21.)
 const tracked = execFileSync('git', ['ls-files', '--cached', '--', '*.sh', '*.json', '*.ts', '*.md', '*.yml', '*.yaml'], { encoding: 'utf8' })
   .split('\n')
-  .filter((f) => f && f !== 'pnpm-lock.yaml' && f !== 'CHANGELOG.md' && f !== 'NEXT.md');
+  .filter((f) => f && f !== 'pnpm-lock.yaml' && f !== 'native/win32/package-lock.json' && f !== 'CHANGELOG.md' && f !== 'NEXT.md');
 assert.ok(tracked.length >= 20,
   `git ls-files returned ${tracked.length} first-party files — the sweep lost its corpus and would pass vacuously`);
 
@@ -3376,6 +3390,17 @@ check_acp_sdk_surface() {
   run_vitest test/acp-sdk-surface.contract.test.ts
 }
 
+check_remote_pair_installed_audit() {
+  # #107 rail 3. The deterministic counterpart of `check-remote-pair-installed`: that gate needs a
+  # caller-supplied tarball, so it cannot run in the floor or carry mutants, and its
+  # checkout-invisibility verdict rests on one acceptance primitive
+  # (scripts/lib/remote-pair-installed-audit.ts). This proves that primitive on tiny synthetic
+  # logs and files. `test/**` is not discovered by check-tests-beside-behavior, so it needs this
+  # public coordinate. Zero network, zero child process.
+  section "remote-pair installed-closure audit (synthetic logs)"
+  run_vitest test/remote-pair-installed-audit.test.ts
+}
+
 check_pi_queue_oracle() {
   # #120 P2. The PUBLIC execution coordinate for `test/pi-queue.oracle.test.ts`, and the reason it
   # needs one: the discovery door below selects `pi-extensions/**/*.test.ts` and
@@ -3818,6 +3843,12 @@ check_pack() {
     # out: the placement join it emits is the copy a herdr-side consumer would
     # otherwise fork, and such a consumer runs against an installed host.
     "mcp/entwurf-bridge/dist/scripts/peer-facts.js"
+    # #107 — the receiving host's entry the sender's ssh runs (run_ts twin), plus the three
+    # remote-pair libs the bridge's entwurf_v2 handler and that entry import.
+    "mcp/entwurf-bridge/dist/scripts/remote-pair-receive.js"
+    "mcp/entwurf-bridge/dist/pi-extensions/lib/remote-pair-receive.js"
+    "mcp/entwurf-bridge/dist/pi-extensions/lib/remote-pair-send.js"
+    "mcp/entwurf-bridge/dist/pi-extensions/lib/remote-pair-transport.js"
     # #87 Bundle B — omp-receive-doctor drives this operator projection through
     # run.sh, so installed node_modules must have the compiled twin too.
     "mcp/entwurf-bridge/dist/scripts/omp-receive-facts.js"
@@ -3851,6 +3882,14 @@ check_pack() {
     "pi/pi-durable/carrier/LICENSE"
     "pi/meta-bridge-omp/entwurf-meta-omp/package.json"
     "mcp/entwurf-bridge/dist/pi-extensions/lib/meta-session.js"
+    # #78 — the Windows preview loader. The compiled meta-session reaches it only through a
+    # win32-only createRequire, not the import graph, so its compiled copy is pinned by name.
+    "pi-extensions/lib/win32-native.js"
+    "mcp/entwurf-bridge/dist/pi-extensions/lib/win32-native.js"
+    # #78 — the MIT notice for node-gyp's win_delay_load_hook.cc, which build.mjs compiles into the
+    # Windows addon. It rides every pack (one per-FILE entry), so the preview carrier never ships
+    # without it; build.mjs refuses unless it equals the pinned node-gyp LICENSE.
+    "LICENSES/node-gyp.txt"
     "scripts/postinstall-chmod.cjs"
     "pi/entwurf-capabilities.json"
     "pi/meta-bridge/.claude-plugin/marketplace.json"
@@ -3925,6 +3964,9 @@ check_pack() {
     '\.test\.[cm]?[jt]s$'
     # Maintainer take/renderer/helper TS is source-only, including non-test implementations.
     '^demo/.*\.ts$'
+    # #78 — the Windows addon's C source, gyp file and build pin are CI build inputs, never a
+    # consumer repair surface: only the built native/win32-x64/ carrier may ship.
+    '^native/win32/'
   )
   # #141: the owned pi-durable source, its typecheck fence and the retired overlay patch are maintainer
   # input. An installed consumer runs the emitted carrier JS (and its LICENSE) only — Rule 11: compiled
@@ -3957,6 +3999,20 @@ check_pack() {
     pass=0
   fi
 
+  # #78 — a pack carries the Windows addon not at all, or as exactly a verified addon + manifest
+  # pair (pack_win32_carrier_verdict, proven on owned fixtures by check-pack-win32-carrier).
+  # "present" means the carrier verified, never that the build was approved for publication.
+  local carrier_verdict
+  carrier_verdict=$(pack_win32_carrier_verdict "$file_list" "$REPO_DIR")
+  case "$carrier_verdict" in
+    absent) echo "[check-pack] win32 addon: absent (not a Windows preview artifact)" ;;
+    present\ *) echo "[check-pack] win32 addon: present sha256=${carrier_verdict#present } (carrier verified; not a publication approval)" ;;
+    *)
+      fail "[check-pack] native/win32-x64/ is not one verified addon + manifest pair: $carrier_verdict"
+      pass=0
+      ;;
+  esac
+
   local total
   total=$(printf '%s\n' "$file_list" | wc -l | tr -d ' ')
   echo "[check-pack] $total files in tarball"
@@ -3969,6 +4025,68 @@ check_pack() {
   return 1
 }
 
+# #78 — the Windows addon carrier decision, shared by check_pack (the real tarball list) and
+# check_pack_win32_carrier (owned fake-byte fixtures). $1 = tarball file list, $2 = the package root
+# holding native/win32-x64/. Prints ONE verdict: `absent`, `pair-broken`, `invalid <code>` or
+# `present <sha256>`. The manifest + bytes check IS the loader's own verifyWin32NativeAt (manifest
+# shape, N-API 8, digest), so the pack and the consumer cannot disagree about what a carrier is.
+pack_win32_carrier_verdict() {
+  local list="$1" root="$2" carrier
+  carrier=$(grep -E '^native/win32-x64/' <<<"$list" | sort || true)
+  if [ -z "$carrier" ]; then echo "absent"; return 0; fi
+  if [ "$carrier" != $'native/win32-x64/entwurf_win.node\nnative/win32-x64/manifest.json' ]; then echo "pair-broken"; return 0; fi
+  node -e '
+    import(require("node:url").pathToFileURL(process.argv[1]).href).then((m) => {
+      try { process.stdout.write(`present ${m.verifyWin32NativeAt(process.argv[2], { napi: "8" }).sha256}`); }
+      catch (err) { process.stdout.write(`invalid ${err.code ?? "uncoded"}`); }
+    });' "$REPO_DIR/pi-extensions/lib/win32-native.js" "$root"
+}
+
+check_pack_win32_carrier() {
+  section "pack: Windows addon carrier verdict (owned fake-byte fixtures)"
+  # Fake bytes and node-written manifests, never a PE: this proves the pair/digest/ABI decision,
+  # not a loadable addon (windows-native-preview.yml owns that, on installed bytes).
+  local fx pair=$'native/win32-x64/entwurf_win.node\nnative/win32-x64/manifest.json' got
+  fx=$(mktemp -d "${TMPDIR:-/tmp}/entwurf-pack-carrier.XXXXXX")
+  trap 'rm -rf -- "$fx"' RETURN
+  win32_carrier_cell() { # name napiVersion -> a root with a matching addon + manifest
+    mkdir -p "$fx/$1/native/win32-x64"
+    printf 'fake addon %s\n' "$1" >"$fx/$1/native/win32-x64/entwurf_win.node"
+    node -e '
+      const fs = require("node:fs"), dir = process.argv[1];
+      const sha = require("node:crypto").createHash("sha256").update(fs.readFileSync(dir + "/entwurf_win.node")).digest("hex");
+      fs.writeFileSync(dir + "/manifest.json", JSON.stringify({ schema: 1, platform: "win32", arch: "x64", file: "entwurf_win.node", sha256: sha, napiVersion: Number(process.argv[2]) }));
+    ' "$fx/$1/native/win32-x64" "$2"
+  }
+  win32_carrier_cell match 8
+  win32_carrier_cell drift 8 && printf 'changed\n' >"$fx/drift/native/win32-x64/entwurf_win.node"
+  win32_carrier_cell abi 7
+  win32_carrier_cell garbled 8 && printf 'not json' >"$fx/garbled/native/win32-x64/manifest.json"
+  local want_sha
+  want_sha=$(sha256sum "$fx/match/native/win32-x64/entwurf_win.node" | cut -d' ' -f1)
+  got=$(pack_win32_carrier_verdict "package.json" "$fx/match")
+  [ "$got" = "absent" ] || { fail "[check-pack-win32-carrier] a list without native/win32-x64/ must be absent — got: $got"; return 1; }
+  for cell in drift abi garbled; do
+    got=$(pack_win32_carrier_verdict "$pair" "$fx/$cell")
+    [ "$got" = "invalid ENTWURF_WIN32_NATIVE_DRIFT" ] || {
+      fail "[QK:WIN32-PACK-DIGEST] the $cell carrier (changed byte / N-API 7 / unparsable manifest) must be invalid as drift, never present — got: $got"
+      return 1
+    }
+  done
+  # The positive cell comes after the refusals, so a weakened check dies on its own QK first.
+  got=$(pack_win32_carrier_verdict "$pair" "$fx/match")
+  [ "$got" = "present $want_sha" ] || { fail "[check-pack-win32-carrier] a matching pair must be present $want_sha — got: $got"; return 1; }
+  local list
+  for list in 'native/win32-x64/entwurf_win.node' 'native/win32-x64/manifest.json' "$pair"$'\nnative/win32-x64/x.dll'; do
+    got=$(pack_win32_carrier_verdict "$list" "$fx/match")
+    [ "$got" = "pair-broken" ] || {
+      fail "[QK:WIN32-PACK-PAIR] native/win32-x64/ must carry exactly the addon + manifest pair — $(tr '\n' ' ' <<<"$list") gave: $got"
+      return 1
+    }
+  done
+  echo "[check-pack-win32-carrier] ok — absent, present, three drift shapes and three broken pairs decided by the shared verdict"
+}
+
 # The pin-leak filter for the install tree's .pnpm listing, shared by the real scan and its
 # self-test below. TWO properties are load-bearing and each has its own cell below.
 #
@@ -4472,6 +4590,12 @@ _check_pack_install_impl() {
     "mcp/entwurf-bridge/dist/scripts/meta-facts.js"
     # #116 M2-a — the owner-normalized peer projection (see check-pack).
     "mcp/entwurf-bridge/dist/scripts/peer-facts.js"
+    # #107 — the receiving host's entry the sender's ssh runs (run_ts twin), plus the three
+    # remote-pair libs the bridge's entwurf_v2 handler and that entry import.
+    "mcp/entwurf-bridge/dist/scripts/remote-pair-receive.js"
+    "mcp/entwurf-bridge/dist/pi-extensions/lib/remote-pair-receive.js"
+    "mcp/entwurf-bridge/dist/pi-extensions/lib/remote-pair-send.js"
+    "mcp/entwurf-bridge/dist/pi-extensions/lib/remote-pair-transport.js"
     # #87 Bundle B — omp-receive-doctor reaches this through the installed dispatcher.
     "mcp/entwurf-bridge/dist/scripts/omp-receive-facts.js"
     # 0.12.5 — node_modules-safe plugin hook + lib (see check-pack). The installed
@@ -7378,6 +7502,9 @@ case "$cmd" in
   check-control-send-receipt)
     check_control_send_receipt
     ;;
+  check-win32-preview)
+    check_win32_preview
+    ;;
   check-entwurf-v2-native-push)
     check_entwurf_v2_native_push
     ;;
@@ -8311,6 +8438,21 @@ case "$cmd" in
     shift || true
     run_ts scripts/meta-facts.ts "$@"
     ;;
+  check-remote-pair-installed)
+    # #107 rail 3, CHECKOUT-ONLY install gate: installs a caller-supplied candidate tarball into a
+    # sandboxed consumer prefix and drives that install's bridge and entry through the T2 scene,
+    # auditing that the subject processes resolve nothing outside the prefix. Never repacks.
+    shift || true
+    run_ts scripts/check-remote-pair-installed.ts "$@"
+    ;;
+  remote-pair-receive)
+    # #107 rail 1: the receiving host's entry for one declared remote pair. The pair
+    # check runs before the v2 dispatch, so a claim outside the pair mutates nothing;
+    # a match reaches the same record/owner/deliverability checks every local send does.
+    # Installed, run_ts runs its compiled twin; the sending host's ssh reaches it through the bin.
+    shift || true
+    run_ts scripts/remote-pair-receive.ts "$@"
+    ;;
   peer-facts)
     # #116 M2-a READ-ONLY projection of the OBSERVED peer listing: one provider
     # (`listEntwurfFacts`) through one renderer (`renderEntwurfPeers().payload`), so
@@ -8380,6 +8522,9 @@ case "$cmd" in
   check-pi-queue-oracle)
     check_pi_queue_oracle
     ;;
+  check-remote-pair-installed-audit)
+    check_remote_pair_installed_audit
+    ;;
   check-demo-reproducibility)
     check_demo_reproducibility
     ;;
@@ -8489,6 +8634,9 @@ case "$cmd" in
   check-pack-pin-matcher)
     check_pack_pin_matcher
     ;;
+  check-pack-win32-carrier)
+    check_pack_win32_carrier
+    ;;
   check-pack-consumer-roots)
     check_pack_consumer_roots
     ;;

package/scripts/check-entwurf-self-address.ts

@@ -263,8 +263,19 @@ ok(
 // call: the dir is still this adapter's own policy (ENTWURF_DIR honours the env
 // override the pi side does not), but the join is not re-authored here.
 ok(
-	"buildStrictPiSenderEnvelope existsSync-probes the canonical socket via the shared grammar (controlSocketPathIn(ENTWURF_DIR, …))",
-	/existsSync\s*\(/.test(piBody) && /controlSocketPathIn\s*\(\s*ENTWURF_DIR\s*,/.test(piBody),
+	"buildStrictPiSenderEnvelope probes the canonical address via the shared grammar (controlSocketPathIn(ENTWURF_DIR, …))",
+	/controlAddressPresent\s*\(\s*socketPath\s*\)/.test(piBody) &&
+		/controlSocketPathIn\s*\(\s*ENTWURF_DIR\s*,/.test(piBody),
+);
+// The presence probe keeps the socket-file existsSync off Windows; on Windows (#78) the address
+// is a named pipe, which only the owner-validated probe may touch (a stat would connect).
+const presentBody = functionBody("controlAddressPresent");
+ok(
+	"controlAddressPresent: existsSync(socketPath) off Windows, the owner-validated pipe probe on it",
+	/existsSync\s*\(\s*socketPath\s*\)/.test(presentBody) &&
+		/process\.platform === "win32"\)\s*return \(await probeSocketLiveness\(socketPath\)\) === "alive"/.test(
+			presentBody,
+		),
 );
 
 const metaBuilder = functionBody("buildMetaSenderEnvelope");
@@ -280,8 +291,8 @@ ok(
 
 const selfRegion = toolRegion("entwurf_self");
 ok(
-	"entwurf_self existsSync-probes the pi socket (alive vs expected, no synthesized path lie)",
-	/existsSync\s*\(/.test(selfRegion),
+	"entwurf_self probes the pi control address (alive vs expected, no synthesized path lie)",
+	/controlAddressPresent\s*\(\s*socketPath\s*\)/.test(selfRegion),
 );
 
 // ── SLICE INTEGRITY (before any claim is read off the slice) ─────────────────

package/scripts/check-gate-qualification.ts

@@ -3488,7 +3488,7 @@ let manifestCount: number;
 		"mux-fresh-call": 65,
 		"mux-launcher-fence": 8,
 		"mux-parent-artifact": 3,
-		"pack-install": 3,
+		"pack-install": 5,
 		"pi-package-ownership": 8,
 		"qualification-ledger": 42,
 		"mux-resume-call": 10,
@@ -3497,6 +3497,12 @@ let manifestCount: number;
 		"omp-receive": 11,
 		"probe-ordering": 1,
 		"release-gate": 21,
+		"remote-pair-display": 3,
+		"remote-pair-installed-audit": 2,
+		"remote-pair-receive": 8,
+		"remote-pair-roundtrip": 5,
+		"remote-pair-send": 12,
+		"remote-pair-transport": 4,
 		"retired-sent-surface": 2,
 		"resume-args": 6,
 		"resume-launch-identity": 7,
@@ -3506,6 +3512,7 @@ let manifestCount: number;
 		"typing-call-fence": 1,
 		"v2-surface": 13,
 		"v2-visible-resume": 18,
+		"win32-preview": 19,
 	};
 	const laneTally: Record<string, number> = {};
 	for (const man of manifests) laneTally[man.lane] = (laneTally[man.lane] ?? 0) + man.mutants.length;

package/scripts/check-remote-pair-installed.ts

@@ -0,0 +1,242 @@
+#!/usr/bin/env node
+/**
+ * check-remote-pair-installed — #107 rail 3: the remote pair on an INSTALLED package.
+ *
+ * `./run.sh check-remote-pair-installed --tgz <absolute candidate tarball>`
+ *
+ * Why this is a scripts/ gate and not a source-adjacent vitest test: its subject is an ARTIFACT.
+ * It installs a caller-supplied tarball into a fresh consumer prefix with npm and then drives
+ * that install's own processes (its bridge `start.sh` → compiled dist, its `run.sh` → run_ts →
+ * compiled entry). A test beside the source can only reach the source.
+ *
+ * What it does, once, with every writable root (HOME, npm cache/userconfig, XDG, PI agent dir)
+ * inside one temp sandbox:
+ *   1. copies the given tarball into the sandbox and installs THAT copy (never repacks; the copy's
+ *      sha256 is printed). npm reads the package's declared dependencies from the registry into the
+ *      sandbox cache — a network read, but no model, no operator config and no ssh;
+ *   2. checks the installed package carries the receive entry's compiled twin and the remote libs;
+ *   3. runs the installed `entwurf remote-pair-receive` with wrong argv: usage on stderr, exit 2 —
+ *      the compiled twin was reached through run_ts, not a TS crossing;
+ *   4. runs the existing T2 scene (pi-extensions/lib/remote-pair-roundtrip.test.ts) with its subject
+ *      switched to this install: real installed bridge, stand-in ssh → installed run.sh → installed
+ *      entry → production dispatch, with the same mailbox/provenance/receipt/reverse-dispatch oracles;
+ *   5. audits checkout invisibility: a preload resolve hook records every module each SUBJECT
+ *      process resolves; every file must sit (by real path) inside the consumer prefix. The
+ *      orchestrator (vitest + its fixture writer) is this checkout and is not audited;
+ *   6. control: the same hook on this checkout's own `run.sh remote-pair-receive` must report a
+ *      checkout path, so the audit can see the thing it refuses.
+ *
+ * The subject switch (ENTWURF_REMOTE_PAIR_INSTALLED_PKG and the resolve-hook variables) is set
+ * here and only here: it changes what the T2 cells measure, so it must not be set ambiently.
+ *
+ * Mutation proof covers only the audit's acceptance primitive (scripts/lib/remote-pair-installed-audit.ts);
+ * the install, compiled-surface, twin and roundtrip cells are actual-runtime evidence with the
+ * checkout control, not mutation-qualified.
+ *
+ * Not claimed: the published npm artifact (this is whatever tarball the caller passes), real sshd,
+ * a real remote host, a durable host reading or replying, or the check-pack/check-pack-install floor.
+ */
+
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { filesOutsideRoot as outside } from "./lib/remote-pair-installed-audit.ts";
+
+const LABEL = "check-remote-pair-installed";
+const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+const args = process.argv.slice(2);
+if (args.length !== 2 || args[0] !== "--tgz" || !path.isAbsolute(args[1])) {
+	console.error(`usage: ./run.sh ${LABEL} --tgz <absolute candidate tarball>`);
+	process.exit(2);
+}
+const tgz = args[1];
+if (!fs.lstatSync(tgz).isFile()) {
+	console.error(`${LABEL}: --tgz must be a regular file (${tgz})`);
+	process.exit(2);
+}
+
+let passed = 0;
+let failed = 0;
+function ok(label: string, cond: boolean, detail = ""): void {
+	if (cond) {
+		passed++;
+		console.log(`  ok    ${label}`);
+	} else {
+		failed++;
+		console.log(`  FAIL  ${label}${detail ? `\n        ${detail}` : ""}`);
+	}
+}
+
+const sandbox = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-remote-pair-installed-"));
+const consumer = path.join(sandbox, "consumer");
+const npmHome = path.join(sandbox, "npm-home");
+const logs = path.join(sandbox, "resolve-logs");
+const hook = path.join(sandbox, "resolve-hook.mjs");
+for (const d of [consumer, npmHome, logs]) fs.mkdirSync(d, { recursive: true });
+
+function sandboxEnv(home: string): NodeJS.ProcessEnv {
+	return {
+		PATH: process.env.PATH ?? "",
+		HOME: home,
+		XDG_CONFIG_HOME: path.join(home, ".config"),
+		XDG_DATA_HOME: path.join(home, ".local", "share"),
+		XDG_STATE_HOME: path.join(home, ".local", "state"),
+		XDG_CACHE_HOME: path.join(home, ".cache"),
+		PI_CODING_AGENT_DIR: path.join(home, ".pi", "agent"),
+	};
+}
+
+fs.writeFileSync(
+	hook,
+	[
+		'import { appendFileSync } from "node:fs";',
+		'import { registerHooks } from "node:module";',
+		"const log = process.env.ENTWURF_REMOTE_PAIR_RESOLVE_LOG;",
+		"if (log) {",
+		"\tregisterHooks({",
+		"\t\tresolve(specifier, context, next) {",
+		"\t\t\tconst r = next(specifier, context);",
+		'\t\t\tappendFileSync(log, r.url + "\\n");',
+		"\t\t\treturn r;",
+		"\t\t},",
+		"\t});",
+		"}",
+		"",
+	].join("\n"),
+);
+
+function hookEnv(label: string): NodeJS.ProcessEnv {
+	return { NODE_OPTIONS: `--import=${hook}`, ENTWURF_REMOTE_PAIR_RESOLVE_LOG: path.join(logs, `${label}.log`) };
+}
+
+// The artifact is a snapshot: copy the caller's file into the sandbox once, then hash and install
+// THAT copy, so what is measured is exactly what is installed. Never repacked.
+const snapshot = path.join(sandbox, "artifact", path.basename(tgz));
+fs.mkdirSync(path.dirname(snapshot), { recursive: true });
+fs.copyFileSync(tgz, snapshot);
+const sha = createHash("sha256").update(fs.readFileSync(snapshot)).digest("hex");
+console.log(
+	`[${LABEL}] caller tarball ${tgz}\n[${LABEL}] snapshot ${snapshot}\n[${LABEL}] snapshot sha256 ${sha}\n[${LABEL}] sandbox ${sandbox}`,
+);
+
+try {
+	// 1. Install as-is.
+	fs.writeFileSync(
+		path.join(consumer, "package.json"),
+		JSON.stringify({ name: "remote-pair-consumer", private: true }),
+	);
+	const npm = spawnSync("npm", ["install", snapshot, "--no-audit", "--no-fund"], {
+		cwd: consumer,
+		encoding: "utf8",
+		env: {
+			...sandboxEnv(npmHome),
+			npm_config_cache: path.join(sandbox, "npm-cache"),
+			npm_config_userconfig: path.join(npmHome, ".npmrc"),
+		},
+	});
+	ok(
+		"[QK:RPI-INSTALLED] npm installs the given tarball into a fresh consumer prefix",
+		npm.status === 0,
+		npm.stderr.slice(-800),
+	);
+	const pkg = path.join(consumer, "node_modules", "@junghanacs", "entwurf");
+	const pkgStat = fs.existsSync(pkg) ? fs.lstatSync(pkg) : null;
+	ok(
+		"[QK:RPI-INSTALLED] the package is a real directory inside the consumer (not a link to a checkout)",
+		pkgStat !== null && pkgStat.isDirectory() && !pkgStat.isSymbolicLink(),
+	);
+	if (failed) throw new Error("install failed; later cells would not measure the artifact");
+
+	// 2. The compiled surface is in the package.
+	for (const rel of [
+		"mcp/entwurf-bridge/dist/scripts/remote-pair-receive.js",
+		"mcp/entwurf-bridge/dist/pi-extensions/lib/remote-pair-receive.js",
+		"mcp/entwurf-bridge/dist/pi-extensions/lib/remote-pair-send.js",
+		"mcp/entwurf-bridge/dist/pi-extensions/lib/remote-pair-transport.js",
+	]) {
+		ok(`[QK:RPI-COMPILED-SURFACE] the installed package carries ${rel}`, fs.existsSync(path.join(pkg, rel)));
+	}
+
+	// 3. The installed bin reaches the compiled twin.
+	const home = path.join(sandbox, "usage-home");
+	const usage = spawnSync(path.join(pkg, "run.sh"), ["remote-pair-receive"], {
+		encoding: "utf8",
+		env: { ...sandboxEnv(home), ...hookEnv("installed-usage") },
+	});
+	ok(
+		"[QK:RPI-INSTALLED-ENTRY-TWIN] the installed `entwurf remote-pair-receive` answers wrong argv with usage on stderr, exit 2, no receipt",
+		usage.status === 2 && /usage: entwurf remote-pair-receive/.test(usage.stderr) && usage.stdout === "",
+		`status=${usage.status} stdout=${usage.stdout.slice(0, 200)} stderr=${usage.stderr.slice(0, 300)}`,
+	);
+
+	// 4. The T2 scene against the install.
+	const vitest = spawnSync(
+		path.join(REPO, "node_modules", ".bin", "vitest"),
+		["run", "pi-extensions/lib/remote-pair-roundtrip.test.ts"],
+		{
+			cwd: REPO,
+			encoding: "utf8",
+			env: {
+				...process.env,
+				ENTWURF_REMOTE_PAIR_INSTALLED_PKG: pkg,
+				ENTWURF_REMOTE_PAIR_RESOLVE_HOOK: hook,
+				ENTWURF_REMOTE_PAIR_RESOLVE_LOG_DIR: logs,
+			},
+		},
+	);
+	const summary = (vitest.stdout.match(/Tests\s+.*$/m) ?? [""])[0].trim();
+	ok(
+		"[QK:RPI-ROUNDTRIP-ON-INSTALL] the T2 cells (A→B, reverse dispatch, opt-in absent off, other host refuses, both socket dirs) pass against the installed bridge and entry",
+		vitest.status === 0 && /^Tests\s+5 passed\b/.test(summary),
+		`${summary}\n${vitest.stdout
+			.split("\n")
+			.filter((l) => /×|FAIL|Error/.test(l))
+			.slice(0, 10)
+			.join("\n")}`,
+	);
+
+	// 5. Checkout invisibility of the subject processes.
+	const all = fs.readdirSync(logs).map((n) => path.join(logs, n));
+	const bridgeLogs = all.filter((f) => path.basename(f).startsWith("bridge-"));
+	const entryLogs = all.filter((f) => path.basename(f).startsWith("entry-"));
+	const subjectLogs = [...bridgeLogs, ...entryLogs, ...all.filter((f) => path.basename(f) === "installed-usage.log")];
+	ok(
+		"[QK:RPI-AUDIT-SAW-SUBJECTS] the resolve hook recorded the installed bridge processes and the installed entry processes",
+		bridgeLogs.some((f) => fs.statSync(f).size > 0) && entryLogs.some((f) => fs.statSync(f).size > 0),
+		`bridge logs=${bridgeLogs.length} entry logs=${entryLogs.length}`,
+	);
+	const audit = outside(subjectLogs, consumer);
+	ok(
+		`[QK:RPI-CHECKOUT-INVISIBLE] every module the installed subject processes resolved (${audit.total}) sits inside the consumer prefix`,
+		audit.total > 0 && audit.outside.length === 0,
+		audit.outside.slice(0, 10).join("\n        "),
+	);
+
+	// 6. Control: the audit sees a checkout when there is one.
+	const control = spawnSync(path.join(REPO, "run.sh"), ["remote-pair-receive"], {
+		encoding: "utf8",
+		env: { ...sandboxEnv(path.join(sandbox, "control-home")), ...hookEnv("control-checkout") },
+	});
+	const controlAudit = outside([path.join(logs, "control-checkout.log")], consumer);
+	const realRepo = fs.realpathSync(REPO);
+	ok(
+		"[QK:RPI-AUDIT-CONTROL] the same audit on this checkout's own entry reports checkout paths (the detector is live)",
+		control.status === 2 && controlAudit.outside.some((p) => p.startsWith(`${realRepo}${path.sep}`)),
+		`status=${control.status} outside=${controlAudit.outside.length}`,
+	);
+} catch (err) {
+	ok(`[${LABEL}] gate ran to completion`, false, err instanceof Error ? err.message : String(err));
+} finally {
+	// Synthetic fixture data only. Kept on failure so the resolve logs and npm output can be read.
+	if (failed === 0) fs.rmSync(sandbox, { recursive: true, force: true });
+	else console.log(`[${LABEL}] kept the sandbox for diagnosis: ${sandbox}`);
+}
+
+console.log(
+	`\n${LABEL}: ${passed} passed, ${failed} failed — installed artifact ${sha.slice(0, 12)}; no real ssh, no model`,
+);
+process.exit(failed === 0 ? 0 : 1);

package/scripts/lib/remote-pair-installed-audit.ts

@@ -0,0 +1,25 @@
+/**
+ * The acceptance primitive of `check-remote-pair-installed`'s checkout-invisibility cell (#107 rail 3),
+ * as a pure function over resolve-hook logs so it can be proven on tiny synthetic files
+ * (test/remote-pair-installed-audit.test.ts). Each log line is one URL a subject process resolved.
+ * A `file:` URL counts and is judged by its REAL path; anything else (node: builtins) is ignored.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+
+/** Every file the logs name that is NOT inside `root` (both compared by real path), and how many file URLs were read. */
+export function filesOutsideRoot(logFiles: readonly string[], root: string): { total: number; outside: string[] } {
+	const realRoot = fs.realpathSync(root);
+	const out = new Set<string>();
+	let total = 0;
+	for (const f of logFiles) {
+		for (const url of fs.readFileSync(f, "utf8").split("\n").filter(Boolean)) {
+			if (!url.startsWith("file:")) continue;
+			total++;
+			const real = fs.realpathSync(fileURLToPath(url));
+			if (real !== realRoot && !real.startsWith(`${realRoot}${path.sep}`)) out.add(real);
+		}
+	}
+	return { total, outside: [...out].sort() };
+}

package/scripts/mutants/control-send-receipt.json

@@ -166,10 +166,10 @@
 			"title": "the pi queue oracle's public coordinate is dropped from `check:vitest`, so the file that proves every claim the receipt makes about a receiver's queues is green only when somebody runs `pnpm test` by hand — the discovery door deliberately does not select `test/**`, so nothing else would notice",
 			"subject": "package.json",
 			"find": [
-				"\"check:vitest\": \"./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior\""
+				"\"check:vitest\": \"./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-pi-queue-oracle && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit\""
 			],
 			"replace": [
-				"\"check:vitest\": \"./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-tests-beside-behavior\""
+				"\"check:vitest\": \"./run.sh check-mux-fresh-call && ./run.sh check-acp-sdk-surface && ./run.sh check-tests-beside-behavior && ./run.sh check-remote-pair-installed-audit\""
 			],
 			"gate": ["bash", "run.sh", "check-tests-beside-behavior"],
 			"timeoutSeconds": 600,

package/scripts/mutants/pack-install.json

@@ -4,7 +4,7 @@
 	"mutants": [
 		{
 			"claim": "PACK-INSTALL-PIN-MATCHER-BOUNDED",
-			"title": "the pin-leak matcher loses its version boundary and blesses substring lookalikes — @0.85.10 reads as the pinned 0.85.1 and the gate announces a verified tree it never verified (independent review, 2026-08-25)",
+			"title": "the pin-leak matcher loses its version boundary and blesses substring lookalikes \u2014 @0.85.10 reads as the pinned 0.85.1 and the gate announces a verified tree it never verified (independent review, 2026-08-25)",
 			"subject": "run.sh",
 			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.3\\.0(_|$)' || true"],
 			"replace": ["  grep '^@earendil-works+' | grep -v '@0\\.87\\.1' || true"],
@@ -15,7 +15,7 @@
 		},
 		{
 			"claim": "PACK-INSTALL-PIN-MATCHER-COVERS-CLOSURE",
-			"title": "the pin-leak matcher narrows back to the pi-* families and goes blind to a non-pi member of the same runtime closure — @earendil-works/chord (new in pi 0.85.0, a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol) floats unpinned while the gate prints a verified pin (measured 2026-09-06 on a real 0.85.1 install tree)",
+			"title": "the pin-leak matcher narrows back to the pi-* families and goes blind to a non-pi member of the same runtime closure \u2014 @earendil-works/chord (new in pi 0.85.0, a runtime dependency of pi-coding-agent/pi-agent-core/pi-client/pi-protocol) floats unpinned while the gate prints a verified pin (measured 2026-09-06 on a real 0.85.1 install tree)",
 			"subject": "run.sh",
 			"find": ["  grep '^@earendil-works+' | grep -Ev '@1\\.3\\.0(_|$)' || true"],
 			"replace": ["  grep '^@earendil-works+pi-' | grep -Ev '@1\\.3\\.0(_|$)' || true"],
@@ -34,6 +34,32 @@
 			"timeoutSeconds": 120,
 			"signature": "[QK:PACK-INSTALL-CONSUMER-ROOTS-CONTAINED]",
 			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "WIN32-PACK-PAIR",
+			"title": "the Windows carrier pair check becomes a presence test, so an addon without its manifest, or with an extra DLL beside it, is packed as a carrier",
+			"subject": "run.sh",
+			"find": [
+				"  if [ \"$carrier\" != $'native/win32-x64/entwurf_win.node\\nnative/win32-x64/manifest.json' ]; then echo \"pair-broken\"; return 0; fi"
+			],
+			"replace": ["  if ! grep -q 'entwurf_win.node' <<<\"$carrier\"; then echo \"pair-broken\"; return 0; fi"],
+			"gate": ["bash", "run.sh", "check-pack-win32-carrier"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:WIN32-PACK-PAIR]",
+			"signatureSource": "run.sh"
+		},
+		{
+			"claim": "WIN32-PACK-DIGEST",
+			"title": "the pack stops verifying the carrier with the loader's own check, so changed bytes or a foreign N-API manifest are packed as `present`",
+			"subject": "run.sh",
+			"find": [
+				"      try { process.stdout.write(`present ${m.verifyWin32NativeAt(process.argv[2], { napi: \"8\" }).sha256}`); }"
+			],
+			"replace": ["      try { process.stdout.write(`present unverified`); }"],
+			"gate": ["bash", "run.sh", "check-pack-win32-carrier"],
+			"timeoutSeconds": 120,
+			"signature": "[QK:WIN32-PACK-DIGEST]",
+			"signatureSource": "run.sh"
 		}
 	]
 }