@junghanacs/entwurf 0.45.0 → 0.51.0

package/scripts/check-herdr-fresh-call.ts

@@ -26,6 +26,8 @@
  *   HFC-ENCODE-NO-CONTROL       the encoded argv carries zero Unicode Cc — including the C1
  *                               block and DEL, which JSON.stringify leaves literal
  *   HFC-ENCODE-MAX-TASK         a maximum public task encodes and stays Cc-free
+ *   HFC-CODEX-CWD-NO-FALLBACK   a known Codex caller with no record cwd is refused on the agent-start
+ *                               branch — its process directory is never read, no herdr call is made
  *   HFC-PREMUTATION-ONLY        every refusal happens before the first herdr call
  *   HFC-CALLER-WORKSPACE        the caller's workspace comes from herdr's own answer about the
  *                               caller's own pane, never from parsing a pane id, and an
@@ -51,7 +53,9 @@
  *                               anybody has reported that agent's session id
  *   HFC-ORPHAN-NAMED            every failed reclaim names its reason instead of going quiet
  *   HFC-INPUT-PARITY            the caller-facing input contract is the SHARED one, word for word
- *   HFC-CWD-EMPTY-IS-OMITTED    `cwd: ""` means "no cwd", as it does on the other rail
+ *   HFC-CWD-CALLER-DEFAULT      an omitted cwd is sent as the CALLER's directory (process dir, or a
+ *                               known Codex caller's record dir), never left to herdr's default
+ *   HFC-CWD-EMPTY-IS-OMITTED    `cwd: ""` means "no cwd requested", as it does on the other rail
  *   HFC-CWD-HASH-IS-DATA        a `#` in the start directory is DATA here — the tmux rail's
  *                               format-token refusal is not imported, because its reason is
  *                               false on a rail with no format expansion
@@ -98,9 +102,11 @@ import {
 	encodeBirthPrompt,
 	HERDR_AGENT_SESSION_POLL_MS,
 	HERDR_AGENT_SESSION_SETTLE_MS,
+	HERDR_AGENT_START_BACKENDS,
 	HERDR_CLI_TIMEOUT_MS,
 	HERDR_FRESH_CALL_BACKENDS,
 	HERDR_FRESH_CALL_OPENING_LINE,
+	HERDR_LAYOUT_LAUNCH_BACKENDS,
 	HERDR_MAX_OUTPUT_BYTES,
 	HERDR_START_READY_MS,
 	HERDR_START_TIMEOUT_MS,
@@ -121,6 +127,8 @@ import {
 const REPO_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const MODULE = "pi-extensions/lib/herdr-fresh-call.ts";
 const MODULE_SRC = fs.readFileSync(path.join(REPO_DIR, MODULE), "utf8");
+/** #157 A-L1: the two pi-durable leaves the herdr layout branch imports, by their import specifier. */
+const PI_DURABLE_LEAVES: readonly string[] = ["./pi-durable-fresh-preflight.ts", "./pi-durable-runtime.ts"];
 
 let passed = 0;
 function ok(label: string, cond: boolean): void {
@@ -344,7 +352,7 @@ async function main(): Promise<void> {
 	const code = MODULE_SRC.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1");
 	const specifiers = [...MODULE_SRC.matchAll(/^import\s[^;]*?from\s+"([^"]+)";$/gm)].map((m) => m[1]);
 	ok(
-		"[QK:HFC-RAIL-IMPORT-FENCE] the herdr rail imports only node builtins, the neutral composition leaf, the callback-env pair, and the dependency-free rails DECLARATION leaf — one mux or entwurf import here would re-couple the two rails and make either one undeletable",
+		"[QK:HFC-RAIL-IMPORT-FENCE] the herdr rail imports only node builtins, the neutral composition leaf, the callback-env pair, the dependency-free rails DECLARATION leaf, and the two pi-durable preflight/runtime leaves whose own imports are node builtins or each other — one mux or entwurf import here would re-couple the two rails and make either one undeletable",
 		specifiers.length > 0 &&
 			specifiers.every(
 				(s) =>
@@ -355,7 +363,18 @@ async function main(): Promise<void> {
 					// example are written, shared with the status pane and the install narration.
 					// It imports nothing itself, so admitting it couples this rail to a constant
 					// rather than to another rail; the mux/entwurf ban below is untouched.
-					s === "../../scripts/herdr-rails.mjs",
+					s === "../../scripts/herdr-rails.mjs" ||
+					// #157 A-L1 — the herdr layout branch runs pi-durable's own unit/carrier/SDK
+					// preflight and package-layout probe. Admitted as LEAVES only: their own imports
+					// are checked below, so neither can carry a mux or entwurf import in transitively.
+					PI_DURABLE_LEAVES.includes(s),
+			) &&
+			PI_DURABLE_LEAVES.every((leaf) =>
+				[
+					...fs
+						.readFileSync(path.join(REPO_DIR, "pi-extensions/lib", leaf), "utf8")
+						.matchAll(/^import\s[^;]*?from\s+"([^"]+)";$/gm),
+				].every((m) => m[1].startsWith("node:") || PI_DURABLE_LEAVES.includes(m[1])),
 			) &&
 			!/from\s+"\.\/(mux-|entwurf-)/.test(code),
 	);
@@ -371,10 +390,13 @@ async function main(): Promise<void> {
 		.split("\n")
 		.filter((line) => /tmux/i.test(line));
 	ok(
-		"[QK:HFC-PILOT-CLOSED] the pilot set is exactly pi + claude-code, and tmux appears in this module ONLY as the refusal of a tmux seat — never as a fallback launch",
-		HERDR_FRESH_CALL_BACKENDS.length === 2 &&
-			HERDR_FRESH_CALL_BACKENDS.includes("pi") &&
-			HERDR_FRESH_CALL_BACKENDS.includes("claude-code") &&
+		"[QK:HFC-PILOT-CLOSED] the agent-start set is exactly pi + claude-code, the layout set exactly pi-durable (#157 A-L1), and the admitted aggregate exactly their union in that order — and tmux appears in this module ONLY as the refusal of a tmux seat, never as a fallback launch",
+		HERDR_AGENT_START_BACKENDS.length === 2 &&
+			HERDR_AGENT_START_BACKENDS.includes("pi") &&
+			HERDR_AGENT_START_BACKENDS.includes("claude-code") &&
+			HERDR_LAYOUT_LAUNCH_BACKENDS.length === 1 &&
+			HERDR_LAYOUT_LAUNCH_BACKENDS[0] === "pi-durable" &&
+			JSON.stringify(HERDR_FRESH_CALL_BACKENDS) === JSON.stringify(["pi", "claude-code", "pi-durable"]) &&
 			tmuxLines.length > 0 &&
 			tmuxLines.every((line) => /tmux-rejected|tmuxSession|rejectTmuxPlacementInHerdrContext|tmuxPlacement/.test(line)),
 	);
@@ -531,12 +553,46 @@ async function main(): Promise<void> {
 			rejectTmuxPlacementInHerdrContext(undefined) === null,
 	);
 	const base = { backend: "pi", model: "openai-codex/gpt-5.6-sol", task: "do it", callerGardenId: CALLER } as const;
+	// #157 A-L1x: placed BEFORE the pre-mutation loop on purpose — `ok` throws at the first failure, and
+	// a fallback in the shared cwd chooser must be named by THIS claim. The loop's own Codex row below is
+	// kept; without this cell it would see the same defect first, as a herdr call.
+	ok(
+		"[QK:HFC-CODEX-CWD-NO-FALLBACK] an agent-start call from a known Codex caller whose record carries no cwd — absent or empty — and with no cwd requested is refused as `codex-caller-cwd-unavailable` with this process's directory (the app-server's) never read and the herdr CLI never invoked, never opened wherever this process happens to be",
+		await (async () => {
+			const processDir = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-herdr-codex."));
+			let processCwdReads = 0;
+			const callerProcessCwd = (): string => {
+				processCwdReads += 1;
+				return processDir;
+			};
+			const variants: Parameters<typeof herdrFreshCall>[0][] = [
+				{ ...base, callerIsCodex: true },
+				{ ...base, callerIsCodex: true, callerCwd: "" },
+			];
+			try {
+				for (const params of variants) {
+					const { run, calls } = neverRun();
+					const result = await herdrFreshCall(params, run, HERDR_ENV, NONCE, undefined, { callerProcessCwd });
+					if (result.ok || result.reason !== "codex-caller-cwd-unavailable" || calls.length !== 0) return false;
+				}
+				return processCwdReads === 0;
+			} catch {
+				// A throw here must still end the gate on THIS claim's token, never before it.
+				return false;
+			} finally {
+				fs.rmSync(processDir, { recursive: true, force: true });
+			}
+		})(),
+	);
 	const refusals: [string, Parameters<typeof herdrFreshCall>[0], NodeJS.ProcessEnv, string][] = [
 		["herdr-context-missing", { ...base }, {}, "herdr-context-missing"],
 		["caller pane", { ...base }, { HERDR_ENV: "1", HERDR_BIN_PATH: "/x/herdr" }, "herdr-caller-pane-missing"],
 		["backend", { ...base, backend: "codex" }, HERDR_ENV, "herdr-backend-unsupported"],
 		["tmux seat", { ...base, placement: { tmuxSession: "org" } }, HERDR_ENV, "herdr-placement-tmux-rejected"],
 		["cwd", { ...base, cwd: "relative/dir" }, HERDR_ENV, "cwd-not-absolute"],
+		// #157 A-L1x: an agent-start call with no cwd from a known Codex caller whose record has none —
+		// refused before any herdr call, never sent to this process's (the app-server's) directory.
+		["codex caller, no record cwd", { ...base, callerIsCodex: true }, HERDR_ENV, "codex-caller-cwd-unavailable"],
 	];
 	// The five INPUT reasons are owned by HFC-INPUT-PARITY below, which asserts both their
 	// words and that they too reach no CLI. Splitting them keeps each mutant attributable: a
@@ -548,7 +604,7 @@ async function main(): Promise<void> {
 		if (result.ok || result.reason !== expected || calls.length !== 0) everyRefusalPreMutation = false;
 	}
 	ok(
-		"[QK:HFC-PREMUTATION-ONLY] the rail-shaped refusals — context, caller pane, backend, tmux seat, cwd — are decided with the herdr CLI never invoked, so a refused call leaves no tab behind",
+		"[QK:HFC-PREMUTATION-ONLY] the rail-shaped refusals — context, caller pane, backend, tmux seat, cwd, a Codex caller with no record cwd — are decided with the herdr CLI never invoked, so a refused call leaves no tab behind",
 		everyRefusalPreMutation,
 	);
 
@@ -930,16 +986,96 @@ async function main(): Promise<void> {
 			}
 		})(),
 	);
+	// Placed BEFORE the empty-cwd cell on purpose: `ok` throws at the first failure, and a tab create
+	// that drops the caller default must be named by THIS claim, not by the older one below.
 	ok(
-		"[QK:HFC-CWD-EMPTY-IS-OMITTED] an empty cwd means OMITTED, exactly as the public verb has always meant it — reading it as a path made a documented no-op into an invalid-directory refusal",
+		"[QK:HFC-CWD-CALLER-DEFAULT] an agent-start call with no cwd starts the sibling where the CALLER is, sent explicitly as `--cwd` (#157 A-L1x) — this process's own directory for an ordinary caller, a known Codex caller's RECORD directory with its process directory (the app-server's) never read, and a requested directory exactly as given — never herdr's own default, which is not a fact about the caller",
 		await (async () => {
-			const { run, calls } = scriptedRun([
-				{ status: 0, stdout: CALLER_PANE_OK },
-				{ status: 0, stdout: TAB_OK },
-				startReplyEchoingArgv(START_OK),
-			]);
-			const result = await herdrFreshCall({ ...base, backend: "claude-code", cwd: "" }, run, HERDR_ENV, NONCE);
-			return result.ok && !calls[1].includes("--cwd") && !("cwd" in result.receipt);
+			const root = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-herdr-cwd."));
+			const processDir = path.join(root, "process");
+			const recordDir = path.join(root, "record");
+			const requestedDir = path.join(root, "requested");
+			for (const dir of [processDir, recordDir, requestedDir]) fs.mkdirSync(dir);
+			const neverRead = (): string => {
+				throw new Error("a Codex caller's process directory was read");
+			};
+			const rows: [Parameters<typeof herdrFreshCall>[0], () => string, string, string, string][] = [
+				[
+					{ ...base, backend: "claude-code" },
+					() => processDir,
+					processDir,
+					"caller-process",
+					"this agent's own process directory",
+				],
+				[
+					{ ...base, backend: "claude-code", callerIsCodex: true, callerCwd: recordDir },
+					neverRead,
+					recordDir,
+					"codex-caller-record",
+					"this Codex caller's own record directory",
+				],
+				[
+					{ ...base, backend: "claude-code", cwd: requestedDir },
+					() => processDir,
+					requestedDir,
+					"requested",
+					"the requested start directory",
+				],
+			];
+			try {
+				for (const [params, callerProcessCwd, dir, source, sourceText] of rows) {
+					const { run, calls } = scriptedRun([
+						{ status: 0, stdout: CALLER_PANE_OK },
+						{ status: 0, stdout: TAB_OK },
+						startReplyEchoingArgv(START_OK),
+					]);
+					const result = await herdrFreshCall(params, run, HERDR_ENV, NONCE, undefined, { callerProcessCwd });
+					if (!result.ok) return false;
+					const at = calls[1].indexOf("--cwd");
+					if (at === -1 || calls[1][at + 1] !== dir) return false;
+					if (result.receipt.cwd !== dir || result.receipt.cwdSource !== source) return false;
+					const text = renderHerdrFreshCall(result).text;
+					if (!text.includes(`  cwd:      ${dir} (${sourceText}, sent explicitly — not an observation)\n`))
+						return false;
+				}
+				return true;
+			} finally {
+				fs.rmSync(root, { recursive: true, force: true });
+			}
+		})(),
+	);
+	ok(
+		'[QK:HFC-CWD-EMPTY-IS-OMITTED] an empty cwd means OMITTED, exactly as the public verb has always meant it — reading it as a path made a documented no-op into an invalid-directory refusal; since #157 A-L1x omitted means the caller\'s own directory, sent explicitly, so `""` and no cwd produce the same tab create',
+		await (async () => {
+			const processDir = fs.mkdtempSync(path.join(os.tmpdir(), "entwurf-herdr-empty."));
+			try {
+				const variants: Parameters<typeof herdrFreshCall>[0][] = [
+					{ ...base, backend: "claude-code", cwd: "" },
+					{ ...base, backend: "claude-code" },
+				];
+				const tabCreates: string[][] = [];
+				for (const params of variants) {
+					const { run, calls } = scriptedRun([
+						{ status: 0, stdout: CALLER_PANE_OK },
+						{ status: 0, stdout: TAB_OK },
+						startReplyEchoingArgv(START_OK),
+					]);
+					const result = await herdrFreshCall(params, run, HERDR_ENV, NONCE, undefined, {
+						callerProcessCwd: () => processDir,
+					});
+					if (!result.ok || result.receipt.cwd !== processDir || result.receipt.cwdSource !== "caller-process")
+						return false;
+					tabCreates.push(calls[1]);
+				}
+				const at = tabCreates[0].indexOf("--cwd");
+				return (
+					JSON.stringify(tabCreates[0]) === JSON.stringify(tabCreates[1]) &&
+					at !== -1 &&
+					tabCreates[0][at + 1] === processDir
+				);
+			} finally {
+				fs.rmSync(processDir, { recursive: true, force: true });
+			}
 		})(),
 	);
 	ok(
@@ -1012,9 +1148,9 @@ async function main(): Promise<void> {
 			const reads = calls.filter((call) => call[0] === "agent" && call[1] === "get");
 			return (
 				result.ok &&
-				result.receipt.witness.state === "reported" &&
-				result.receipt.witness.reads === 2 &&
-				result.receipt.witness.settleMs === 2 * HERDR_AGENT_SESSION_POLL_MS &&
+				result.receipt.witness?.state === "reported" &&
+				result.receipt.witness?.reads === 2 &&
+				result.receipt.witness?.settleMs === 2 * HERDR_AGENT_SESSION_POLL_MS &&
 				reads.length === 2 &&
 				// EXACT NAME, both times. A listing would make us pick "the one that looks like
 				// ours" out of every agent on the server — the guess this rail refuses.
@@ -1040,9 +1176,9 @@ async function main(): Promise<void> {
 			const expectedReads = HERDR_AGENT_SESSION_SETTLE_MS / HERDR_AGENT_SESSION_POLL_MS;
 			return (
 				result.ok &&
-				result.receipt.witness.state === "unavailable" &&
-				result.receipt.witness.settleMs === HERDR_AGENT_SESSION_SETTLE_MS &&
-				result.receipt.witness.reads === expectedReads &&
+				result.receipt.witness?.state === "unavailable" &&
+				result.receipt.witness?.settleMs === HERDR_AGENT_SESSION_SETTLE_MS &&
+				result.receipt.witness?.reads === expectedReads &&
 				// The whole point: nothing was closed, and the window is bounded rather than open.
 				!calls.some((call) => call[0] === "pane" && call[1] === "close") &&
 				clock.elapsed() === HERDR_AGENT_SESSION_SETTLE_MS &&
@@ -1067,8 +1203,8 @@ async function main(): Promise<void> {
 			if (!result.ok) return false;
 			const text = renderHerdrFreshCall(result).text;
 			return (
-				result.receipt.witness.state === "unobserved" &&
-				result.receipt.witness.settleMs === HERDR_AGENT_SESSION_SETTLE_MS &&
+				result.receipt.witness?.state === "unobserved" &&
+				result.receipt.witness?.settleMs === HERDR_AGENT_SESSION_SETTLE_MS &&
 				text.includes("unobserved after") &&
 				text.includes("says nothing about whether the sibling is running") &&
 				// THE DEFECT THIS CELL OWNS: a receipt that never got a readable answer used to
@@ -1092,7 +1228,7 @@ async function main(): Promise<void> {
 			const result = await herdrFreshCall({ ...base, backend: "claude-code" }, run, HERDR_ENV, NONCE, clock);
 			return (
 				result.ok &&
-				result.receipt.witness.state === "unobserved" &&
+				result.receipt.witness?.state === "unobserved" &&
 				!calls.some((call) => call[0] === "pane" && call[1] === "close")
 			);
 		})(),

package/scripts/check-herdr-plugin-build.ts

@@ -99,7 +99,11 @@ interface Profile {
 }
 
 const activation = (await import(pathToFileURL(path.join(REPO, "scripts", "herdr-activation.mjs")).href)) as {
-	writeLedger: (layout: { stateRoot: string; ledgerPath: string }, entry: Record<string, unknown>) => void;
+	writeLedger: (
+		layout: { stateRoot: string; ledgerPath: string },
+		version: number,
+		entry: Record<string, unknown>,
+	) => void;
 	ledgerBody: (args: Record<string, unknown>) => Record<string, unknown>;
 	resolveActivationLayout: (env: NodeJS.ProcessEnv) => { stateRoot: string; ledgerPath: string };
 	resolveComponentRoots: (env: NodeJS.ProcessEnv) => Record<string, { path: string; source: string }>;
@@ -192,6 +196,8 @@ function fixtureAcquire(opts: {
 	log?: string;
 	fail?: boolean;
 	name?: string;
+	/** Extra package files, relative to the package root — e.g. the candidate's own ledger reader. */
+	files?: Record<string, string>;
 }) {
 	const name = opts.name ?? PACKAGE;
 	return ({ identity, prefix }: AcquireArgs) => {
@@ -199,6 +205,10 @@ function fixtureAcquire(opts: {
 		const root = path.join(prefix, "node_modules", name);
 		fs.mkdirSync(path.join(root, path.dirname(COMPILED_ENTRY)), { recursive: true });
 		fs.writeFileSync(path.join(root, "package.json"), `${JSON.stringify({ name, version })}\n`);
+		for (const [rel, body] of Object.entries(opts.files ?? {})) {
+			fs.mkdirSync(path.dirname(path.join(root, rel)), { recursive: true });
+			fs.writeFileSync(path.join(root, rel), body);
+		}
 		fs.writeFileSync(path.join(root, COMPILED_ENTRY), "// compiled entry fixture\n");
 		const bin = path.join(prefix, "node_modules", ".bin");
 		fs.mkdirSync(bin, { recursive: true });
@@ -564,6 +574,7 @@ function drive(
 		).artifactIdentity;
 		activation.writeLedger(
 			activation.resolveActivationLayout(env),
+			2,
 			activation.ledgerBody({
 				phase: "active",
 				runtimeRoot: activeDirOf(env),
@@ -1177,4 +1188,165 @@ function countingSentinel(): { acquire: () => never; calls: () => number } {
 	);
 }
 
+// ── 12. a floor host admits only a candidate whose OWN reader reads its ledger (#153) ─
+{
+	const PI = listing({ pi: "current (v8) (/home/u/.pi)" });
+	const READER = "scripts/herdr-activation.mjs";
+	// The current checkout's reader and the one module it imports: a candidate that knows the floor.
+	const CHECKOUT_READER = {
+		[READER]: fs.readFileSync(path.join(REPO, READER), "utf8"),
+		"scripts/herdr-runtime.mjs": fs.readFileSync(path.join(REPO, "scripts", "herdr-runtime.mjs"), "utf8"),
+	};
+	// Minimal synthetic readers. RAW answers the file's own value, so each variant differs from an
+	// exact answer in ONE respect only.
+	const RAW = 'import fs from "node:fs";\nconst raw = (l) => JSON.parse(fs.readFileSync(l.ledgerPath, "utf8"));\n';
+	const reader = (body: string) => ({ [READER]: body });
+	const THROWS = reader(
+		'export function readCertifiedLedger() {\n\tconst e = new Error("activation-ledger-uncertified: schemaVersion 3");\n\te.code = "activation-ledger-uncertified";\n\tthrow e;\n}\n',
+	);
+	/** A settled pi host on FIXTURE_NPM_LOCK, its ledger written at `version` — or no ledger at all. */
+	const host = (tag: string, version: number | null) => {
+		const env = world(tag);
+		const log = path.join(env.HOME as string, "argv.log");
+		drive(env, PI, { acquire: fixtureAcquire({ activate: "recorder", log }), resolveCommit: () => COMMIT_A });
+		if (version !== null) {
+			const artifactIdentity = (
+				JSON.parse(fs.readFileSync(journalPathOf(env), "utf8")) as { artifactIdentity: Record<string, unknown> }
+			).artifactIdentity;
+			activation.writeLedger(
+				activation.resolveActivationLayout(env),
+				version,
+				activation.ledgerBody({
+					phase: "active",
+					runtimeRoot: activeDirOf(env),
+					artifactIdentity,
+					roots: activation.resolveComponentRoots(env),
+					states: { pi: "active" },
+				}),
+			);
+		}
+		return { env, log };
+	};
+	const ledgerText = (env: NodeJS.ProcessEnv): string => {
+		const p = activation.resolveActivationLayout(env).ledgerPath;
+		return fs.existsSync(p) ? fs.readFileSync(p, "utf8") : "<absent>";
+	};
+	const journalOf = (env: NodeJS.ProcessEnv) =>
+		JSON.parse(fs.readFileSync(journalPathOf(env), "utf8")) as {
+			phase: string;
+			artifactIdentity: Record<string, unknown>;
+			previousRuntime: Record<string, unknown> | null;
+		};
+	/** Rebuild onto ANOTHER integrity — a real candidate to stage — and record every non-herdr spawn. */
+	const rebuild = (h: { env: NodeJS.ProcessEnv; log: string }, files: Record<string, string>) => {
+		const before = {
+			runtime: treeDigest(activeDirOf(h.env)),
+			ledger: ledgerText(h.env),
+			activations: fs.readFileSync(h.log, "utf8"),
+			ready: journalOf(h.env).artifactIdentity,
+		};
+		const calls: string[][] = [];
+		const spawn = (bin: string, argv: string[], opts: unknown): SpawnResult => {
+			if (bin === HERDR_STUB) return { status: 0, stdout: PI, stderr: "" };
+			calls.push([bin, ...argv]);
+			return spawnSync(bin, argv, opts as Record<string, never>) as unknown as SpawnResult;
+		};
+		const run = drive(h.env, PI, {
+			spawn,
+			acquire: fixtureAcquire({ activate: "recorder", log: h.log, files }),
+			readRuntimeLock: () => ({ ...FIXTURE_NPM_LOCK, integrity: FIXTURE_OTHER_INTEGRITY }),
+			resolveCommit: () => COMMIT_B,
+		});
+		const probes = calls.filter((c) => c.includes("--input-type=module"));
+		const runtimeDir = path.dirname(activeDirOf(h.env));
+		const journal = journalOf(h.env);
+		// A refusal of the candidate: the runtime the wiring names, the ledger and the activation log
+		// are byte-identical, nothing is staged or backed up, and the journal is the `installing` retry
+		// authority still carrying the runtime it replaced — not a zero-write rollback.
+		const retained =
+			run.refusal === "herdr-build-candidate-floor-refused" &&
+			treeDigest(activeDirOf(h.env)) === before.runtime &&
+			ledgerText(h.env) === before.ledger &&
+			fs.readFileSync(h.log, "utf8") === before.activations &&
+			!fs.existsSync(path.join(runtimeDir, "staging")) &&
+			!fs.existsSync(path.join(runtimeDir, "previous")) &&
+			journal.phase === "installing" &&
+			JSON.stringify(journal.previousRuntime) === JSON.stringify(before.ready);
+		return {
+			run,
+			probes,
+			retained,
+			stagingReader: probes[0]?.includes(path.join(runtimeDir, "staging", "node_modules", PACKAGE, READER)),
+		};
+	};
+	const show = (r: ReturnType<typeof rebuild>) =>
+		`${r.run.code ?? r.run.refusal}/probes=${r.probes.length}/retained=${r.retained}`;
+
+	const supplied = rebuild(host("floor-supplied", 3), CHECKOUT_READER);
+	ok(
+		"[QK:HPB-FLOOR-PROBE-SUPPLIED] on a 3-ledger host the official build ITSELF supplies the admission: the " +
+			"candidate's own reader is run once, from staging, against this host's ledger, and a candidate whose reader " +
+			"answers exactly the certified ledger is installed and activated. This observes the reader; it does not " +
+			`certify the candidate's whole lifecycle (${show(supplied)} staging-reader=${supplied.stagingReader})`,
+		supplied.run.code === 0 && supplied.probes.length === 1 && supplied.stagingReader === true,
+	);
+
+	const legacy2 = rebuild(host("floor-legacy-2", 2), THROWS);
+	const legacyNone = rebuild(host("floor-legacy-none", null), THROWS);
+	ok(
+		"[QK:HPB-FLOOR-PROBE-LEGACY-UNPROBED] a 2-ledger host and a host with no ledger take the existing path: no " +
+			"probe runs, so even a candidate whose reader would refuse everything is installed — the floor is what " +
+			`turns the observation on, nothing else (two=${show(legacy2)} none=${show(legacyNone)})`,
+		legacy2.run.code === 0 &&
+			legacy2.probes.length === 0 &&
+			legacyNone.run.code === 0 &&
+			legacyNone.probes.length === 0,
+	);
+
+	const exit7 = rebuild(
+		host("floor-exit7", 3),
+		reader(`${RAW}process.exitCode = 7;\nexport const readCertifiedLedger = raw;\n`),
+	);
+	const throws = rebuild(host("floor-throws", 3), THROWS);
+	const absent = rebuild(host("floor-absent", 3), {});
+	ok(
+		"[QK:HPB-FLOOR-PROBE-EXIT-STATUS] the candidate's reader must EXIT 0: one that prints the exact ledger and then " +
+			"exits 7 is refused for its exit alone, and an older reader that refuses the floor, or a candidate with no " +
+			"reader at all, is refused too — each with the active runtime, ledger and activation log byte-identical " +
+			`(exit7=${show(exit7)}/named=${exit7.run.detail.includes("exited 7")} throws=${show(throws)} absent=${show(absent)})`,
+		exit7.retained && exit7.run.detail.includes("exited 7") && throws.retained && absent.retained,
+	);
+
+	const noisy = rebuild(
+		host("floor-stderr", 3),
+		reader(`${RAW}process.stderr.write("noise\\n");\nexport const readCertifiedLedger = raw;\n`),
+	);
+	ok(
+		"[QK:HPB-FLOOR-PROBE-STDERR-SILENT] a reader that answers the exact ledger and exits 0 but writes to stderr is " +
+			"refused: an unexpected word from the candidate is not consent " +
+			`(${show(noisy)} named=${noisy.run.detail.includes("stderr")})`,
+		noisy.retained && noisy.run.detail.includes("stderr"),
+	);
+
+	const nulled = rebuild(host("floor-null", 3), reader("export function readCertifiedLedger() {\n\treturn null;\n}\n"));
+	const lowered = rebuild(
+		host("floor-lowered", 3),
+		reader(`${RAW}export const readCertifiedLedger = (l) => ({ ...raw(l), schemaVersion: 2 });\n`),
+	);
+	const otherPhase = rebuild(
+		host("floor-other-value", 3),
+		reader(`${RAW}export const readCertifiedLedger = (l) => ({ ...raw(l), phase: "activating" });\n`),
+	);
+	const malformed = rebuild(
+		host("floor-malformed", 3),
+		reader(`${RAW}process.stdout.write("noise\\n");\nexport const readCertifiedLedger = raw;\n`),
+	);
+	ok(
+		"[QK:HPB-FLOOR-PROBE-VALUE-EXACT] the reader's answer must be exactly the ledger this build certified, as one " +
+			"JSON value: null, the same ledger lowered to 2, a different phase, and output that is not one JSON value " +
+			`are each refused (null=${show(nulled)} lowered=${show(lowered)} other=${show(otherPhase)} malformed=${show(malformed)})`,
+		nulled.retained && lowered.retained && otherPhase.retained && malformed.retained,
+	);
+}
+
 console.log(`\ncheck-herdr-plugin-build: ${passed} assertions passed`);

package/scripts/check-herdr-plugin.ts

@@ -409,7 +409,7 @@ const PEERS = JSON.stringify({
 	const code = src.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
 	// The checkout's activation module may answer WHERE, and only where. The BODY is certified by
 	// the installed runtime's own copy, because the pane and the writer are two artifacts that can
-	// ship two `ACTIVATION_SCHEMA_VERSION`s and a checkout-side parser would report a newer
+	// ship two sets of admitted ledger versions and a checkout-side parser would report a newer
 	// runtime's ledger as uncertified on a perfectly healthy host. Location is not schema-versioned;
 	// certification is. So: the checkout module is reached for `resolveActivationLayout` and for
 	// nothing else.
@@ -831,7 +831,33 @@ const PEERS = JSON.stringify({
 	console.log("  ok    no aggregate verdict token over the four blocks");
 	passed++;
 
-	// RAILS come from the shared declaration leaf, not from prose in this pane.
+	// The two launch domains stay two (#157 A-L2): pi and claude-code are started by herdr as agents,
+	// pi-durable only gets a tab through one layout request. Literal on purpose, and placed BEFORE the
+	// shared-source claim: a pane that moved pi-durable into the agent-start group would still render
+	// every backend and every example, so only this claim can name that defect.
+	{
+		const rails = r.stdout.slice(r.stdout.indexOf("[3] RAILS"), r.stdout.indexOf("[4] CITIZENS"));
+		const agentStartLabel = rails.indexOf("  through tab create + agent start --kind:");
+		const layoutLabel = rails.indexOf("  through ONE layout.apply request (no herdr agent kind):");
+		const at = (backend: string) => rails.indexOf(`  ${backend}: `);
+		const durableLine = rails.slice(at("pi-durable")).split("\n")[0];
+		assert.ok(
+			rails.includes("3 fresh-call backend(s): 2 through herdr agent start, 1 through one layout request") &&
+				agentStartLabel !== -1 &&
+				agentStartLabel < at("pi") &&
+				at("pi") < at("claude-code") &&
+				at("claude-code") < layoutLabel &&
+				layoutLabel < at("pi-durable") &&
+				durableLine.includes("neither detected nor associated with a session") &&
+				!rails.includes("--kind pi-durable"),
+			`[QK:HPL-RAILS-DOMAINS-DISTINCT] the RAILS block shows the public fresh-call aggregate of three as two launch domains — pi and claude-code under herdr agent start, pi-durable alone under one layout request — and never presents pi-durable as a herdr agent kind or as detected/session-associated (rails block: ${JSON.stringify(rails)})`,
+		);
+		console.log("  ok    rails show agent start (pi, claude-code) and one layout request (pi-durable) as two domains");
+		passed++;
+	}
+
+	// RAILS come from the shared declaration leaf, not from prose in this pane: every backend of the
+	// public fresh-call aggregate, each with its one model SYNTAX example.
 	assert.ok(
 		HERDR_RAILS.HERDR_FRESH_CALL_BACKENDS.every(
 			(b) => r.stdout.includes(`  ${b}: `) && r.stdout.includes(HERDR_RAILS.MODEL_SYNTAX_EXAMPLE[b]),