fix(hub): apply module exclude rules when loading from a directory source

Why: live changeset expansion loaded every entry from a module's directory
(e.g. a lock replacement pointed at the module's source), including the
module's own excluded fixtures (test/_index.yaml entries). Those leaked into
the host registry and collided with the host app's real entries during linking.
Published .wapp packs were already filtered at publish time, so only
directory/replacement sources were affected.

What: loadEntriesForModule now applies the module's wippy.yaml exclude /
exclude_meta rules for directory sources via the same DisableWithOptions stage
the CLI entries loader uses, skipping .wapp packs. Mirrors
cmd/internal/entries/loader.go shouldApplyModuleConfigFilters.

Author: skhaz

boot/deps/hub/dependency_handler.go

@@ -24,6 +24,7 @@ import (
 	"github.com/wippyai/runtime/boot/build"
 	"github.com/wippyai/runtime/boot/build/stages"
 	"github.com/wippyai/runtime/boot/deps/auth"
+	depconfig "github.com/wippyai/runtime/boot/deps/config"
 	"github.com/wippyai/runtime/boot/deps/graph"
 	"github.com/wippyai/runtime/boot/deps/lock"
 	"github.com/wippyai/runtime/boot/deps/wappextract"
@@ -584,7 +585,40 @@ func (h *DependencyHandler) loadEntriesForModule(ctx context.Context, transcoder
 		return nil, err
 	}
 	registerResolvedModuleSourceRoot(ctx, mod.Org+"/"+mod.Name, modulePath)
-	return loadRawEntriesFromPaths(ctx, []string{modulePath}, h.logger, transcoder)
+	entries, err := loadRawEntriesFromPaths(ctx, []string{modulePath}, h.logger, transcoder)
+	if err != nil {
+		return nil, err
+	}
+	return h.applyModuleConfigFilters(ctx, modulePath, entries)
+}
+
+// applyModuleConfigFilters drops entries the module's wippy.yaml excludes
+// (exclude / exclude_meta) when the module is loaded from a directory tree —
+// e.g. a lock replacement pointed at the module's source. Without it a host app
+// picks up the module's own fixtures (test/_index.yaml under namespace "app"),
+// which then collide with the host's real entries during linking. .wapp packs
+// are skipped: they were already filtered at publish time.
+func (h *DependencyHandler) applyModuleConfigFilters(ctx context.Context, modulePath string, entries []regapi.Entry) ([]regapi.Entry, error) {
+	if filepath.Ext(modulePath) == ".wapp" {
+		return entries, nil
+	}
+	cfg, err := depconfig.Load(modulePath)
+	if err != nil {
+		return entries, nil
+	}
+	entryExcludes := cfg.EntryExcludes()
+	if len(entryExcludes) == 0 && len(cfg.ExcludeMeta) == 0 {
+		return entries, nil
+	}
+	filtered := append([]regapi.Entry(nil), entries...)
+	stage := stages.DisableWithOptions(stages.DisableOptions{
+		Entries:     entryExcludes,
+		MetaFilters: cfg.ExcludeMeta,
+	})
+	if err := stage.Execute(ctx, &filtered); err != nil {
+		return nil, NewDependencyLoadError(modulePath, err)
+	}
+	return filtered, nil
 }
 
 func registerResolvedModuleSourceRoot(ctx context.Context, moduleName, modulePath string) {

boot/deps/hub/dependency_handler_test.go

@@ -1236,6 +1236,59 @@ replacements:
 	assert.Equal(t, "0.3.0", modules[0].Version)
 }
 
+func TestDependencyHandler_LoadEntriesForModule_AppliesExcludeMetaForDirectorySource(t *testing.T) {
+	ctx := newTestContext()
+	tmpDir := t.TempDir()
+	lockPath := filepath.Join(tmpDir, "wippy.lock")
+	localMod := filepath.Join(tmpDir, "local-mod")
+	require.NoError(t, os.MkdirAll(localMod, 0755))
+	require.NoError(t, os.WriteFile(filepath.Join(localMod, "wippy.yaml"),
+		[]byte("organization: local\nmodule: mod\nversion: 0.1.0\nexclude_meta:\n  type:\n    - test\n"), 0600))
+	require.NoError(t, os.WriteFile(filepath.Join(localMod, "_index.json"), []byte(`{
+  "namespace": "local.mod",
+  "entries": [
+    { "name": "keep", "kind": "fs.directory", "path": "./keep" },
+    { "name": "drop", "kind": "fs.directory", "meta": { "type": "test" }, "path": "./drop" }
+  ]
+}`), 0600))
+	require.NoError(t, os.WriteFile(lockPath, []byte(`directories:
+  modules: .wippy
+  src: ./src
+modules:
+  - name: local/mod
+    version: 0.1.0
+replacements:
+  - from: local/mod
+    to: ./local-mod
+`), 0600))
+
+	handler, err := NewDependencyHandler(DependencyHandlerOptions{
+		Hub:       &fakeHub{},
+		Logger:    zap.NewNop(),
+		LockPath:  lockPath,
+		VendorDir: t.TempDir(),
+	})
+	require.NoError(t, err)
+
+	transcoder := payload.GetTranscoder(ctx)
+	require.NotNil(t, transcoder)
+
+	entries, err := handler.loadEntriesForModule(ctx, transcoder, ResolvedModule{Org: "local", Name: "mod", Version: "0.1.0"})
+	require.NoError(t, err)
+
+	var hasKeep, hasDrop bool
+	for _, e := range entries {
+		if e.ID == regapi.NewID("local.mod", "keep") {
+			hasKeep = true
+		}
+		if e.ID == regapi.NewID("local.mod", "drop") {
+			hasDrop = true
+		}
+	}
+	assert.True(t, hasKeep, "non-test entry must load")
+	assert.False(t, hasDrop, "test entry must be excluded per the module's exclude_meta")
+}
+
 func TestDependencyHandler_CollectDesiredDependencies_DoesNotPinUpdatedDependency(t *testing.T) {
 	ctx := newTestContext()
 	transcoder := payload.GetTranscoder(ctx)