@junghanacs/entwurf 0.12.0

package/scripts/check-meta-capability-source.ts

@@ -0,0 +1,112 @@
+/**
+ * check-meta-capability-source — deterministic gate for 0.11 Stage 0 step 3D-3:
+ * the capability-source cut-over. mint/parse now read backend honesty metadata
+ * (wakeMode/deliveryLevel) from the capability registry (3C) via metaCapabilityFor,
+ * NOT from META_BACKEND_DESCRIPTORS. No backend, no network, no hook, no fs writes
+ * (the registry is the packaged file). Safe in the `pnpm check` static floor.
+ *
+ * Proves the cut-over without changing observable behaviour:
+ *  - the lookup seam is registry-DRIVEN — fed a doctored registry, metaCapabilityFor
+ *    follows it (so the value is read from the registry, not hardcoded off the const);
+ *    the default still reads the shipped file.
+ *  - mintMetaRecord sources delivery.wakeMode/deliveryLevel through that seam.
+ *  - parseMetaRecord's drift guard is now registry-sourced: a stored wakeMode that
+ *    contradicts the registry canonical is rejected; a consistent one round-trips.
+ *  - behaviour preserved: registry ≡ META_BACKEND_DESCRIPTORS for the 3 existing
+ *    backends (the const survives only as the drift-guard reference, 3C → 3D-3).
+ *
+ * Scope is 3D-3: the SOURCE moves. NOTE (post-3D-4): the consumers proven here are
+ * mintMetaRecord / parseMetaRecord — the V1 (legacy / dual-read) path, which is the
+ * only place wakeMode/deliveryLevel still flow from. The live v2 mint
+ * (mintMetaIdentity) carries NO delivery, so it never sources capability — the v2
+ * record has no wakeMode at all. check-entwurf-capabilities still owns the
+ * registry ≡ const drift guard.
+ */
+
+import assert from "node:assert/strict";
+import {
+	loadMetaCapabilityRegistry,
+	META_BACKEND_DESCRIPTORS,
+	META_BACKENDS,
+	type MetaCapabilityRegistry,
+	MetaRecordError,
+	metaCapabilityFor,
+	mintMetaRecord,
+	parseMetaRecord,
+	serializeMetaRecord,
+} from "../pi-extensions/lib/meta-session.ts";
+
+let passed = 0;
+function ok(label: string, cond: boolean): void {
+	assert.ok(cond, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+function throws(label: string, fn: () => unknown): void {
+	assert.throws(fn, MetaRecordError, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+const MINT = { nativeSessionId: "n-capsrc", transcriptPath: "/tmp/t.jsonl", cwd: "/tmp" };
+
+// --- the seam is registry-driven, not const-hardcoded ----------------------
+// Doctor the shipped registry (flip claude-code's wakeMode) and feed it in: if the
+// lookup follows the doctored value, it is reading from the registry, not the const.
+const shipped = loadMetaCapabilityRegistry();
+const flip = (w: "self-fetch" | "direct-inject") => (w === "self-fetch" ? "direct-inject" : "self-fetch");
+const doctored: MetaCapabilityRegistry = {
+	schemaVersion: shipped.schemaVersion,
+	backends: {
+		...shipped.backends,
+		"claude-code": { ...shipped.backends["claude-code"], wakeMode: flip(shipped.backends["claude-code"].wakeMode) },
+	},
+};
+const doctoredWake = doctored.backends["claude-code"].wakeMode;
+ok(
+	"seam is registry-driven: metaCapabilityFor follows an injected (doctored) registry",
+	metaCapabilityFor("claude-code", doctored).wakeMode === doctoredWake &&
+		doctoredWake !== shipped.backends["claude-code"].wakeMode,
+);
+ok(
+	"seam default reads the shipped registry, not the doctored copy",
+	metaCapabilityFor("claude-code").wakeMode === shipped.backends["claude-code"].wakeMode,
+);
+const load1 = loadMetaCapabilityRegistry();
+const load2 = loadMetaCapabilityRegistry();
+ok("loadMetaCapabilityRegistry memoizes (same object on repeat load)", load1 === load2);
+
+// --- mint sources delivery metadata through the seam -----------------------
+for (const backend of META_BACKENDS) {
+	const cap = metaCapabilityFor(backend);
+	const r = mintMetaRecord({ backend, ...MINT });
+	ok(`mint(${backend}): delivery.wakeMode sourced from the registry`, r.delivery.wakeMode === cap.wakeMode);
+	ok(
+		`mint(${backend}): delivery.deliveryLevel sourced from the registry`,
+		r.delivery.deliveryLevel === cap.deliveryLevel,
+	);
+}
+
+// --- cut-over preserves behaviour: registry ≡ const for the 3 backends ------
+for (const backend of META_BACKENDS) {
+	const cap = metaCapabilityFor(backend);
+	const d = META_BACKEND_DESCRIPTORS[backend];
+	ok(
+		`cut-over preserves behaviour: registry ≡ const for ${backend} (wakeMode/deliveryLevel)`,
+		cap.wakeMode === d.wakeMode && cap.deliveryLevel === d.deliveryLevel,
+	);
+}
+
+// --- parse drift guard is now registry-sourced -----------------------------
+const good = mintMetaRecord({ backend: "claude-code", ...MINT });
+const tampered = JSON.parse(serializeMetaRecord(good)) as { delivery: { wakeMode: string } };
+tampered.delivery.wakeMode = flip(metaCapabilityFor("claude-code").wakeMode); // contradicts the registry canonical
+throws("parse: a wakeMode contradicting the registry canonical throws (drift guard registry-sourced)", () =>
+	parseMetaRecord(JSON.stringify(tampered)),
+);
+ok(
+	"parse: a registry-consistent record round-trips",
+	parseMetaRecord(serializeMetaRecord(good)).delivery.wakeMode === metaCapabilityFor("claude-code").wakeMode,
+);
+
+console.log(`[check-meta-capability-source] ${passed} assertions ok`);

package/scripts/check-meta-dual-consumers.ts

@@ -0,0 +1,154 @@
+/**
+ * check-meta-dual-consumers — deterministic gate for 0.11 Stage 0 step 3D-4 commit1
+ * (green checkpoint). The delivery-agnostic dual-read seam: readMetaIdentityByGardenId
+ * + scanIdentityByNativeId read v1 AND v2 records and return normalized identity, so
+ * the consumers that move onto them (MCP sender-marker check, prune, store-doctor, and
+ * the v2 upsert's existence scan in commit2) survive the v2 cut. Pure + a real temp
+ * dir; no backend, no network, no hook. Safe in the `pnpm check` static floor.
+ *
+ * Proves the dual-read identity seam (the live path + scanIdentityByNativeId now read
+ * v1 AND v2; the v1-only raw readers remain for v1-fixture gates):
+ *  - readMetaIdentityByGardenId normalizes a v1 file (lastSeen→recordUpdatedAt,
+ *    transcriptPath carried, model/parentGardenId null, isEntwurf false) and reads a v2
+ *    file as-is; body/filename gardenId drift fails-fast.
+ *  - scanIdentityByNativeId matches by nativeSessionId across BOTH schemas, returns null
+ *    on no match, skips non-.meta.json, surfaces malformed via onSkip, and — THE G1
+ *    invariant — flags a nativeSessionId duplicated across a v1 AND a v2 file as
+ *    authority ambiguity (throw), so the v2 upsert never mints a duplicate id for an
+ *    existing citizen.
+ *
+ * Scope is commit1 ONLY: dual-read capability, additive. The cut (enqueue/read
+ * record-stamp stop + v2 upsert/migration) is commit2 = 끊을 지점 ②.
+ */
+
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+	type MetaIdentity,
+	MetaRecordError,
+	mintMetaRecord,
+	readMetaIdentityByGardenId,
+	scanIdentityByNativeId,
+	serializeMetaIdentity,
+	serializeMetaRecord,
+} from "../pi-extensions/lib/meta-session.ts";
+
+let passed = 0;
+function ok(label: string, cond: boolean): void {
+	assert.ok(cond, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+function throws(label: string, fn: () => unknown): void {
+	assert.throws(fn, MetaRecordError, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+const T0 = new Date("2026-03-01T12:00:00.000Z");
+
+// A v1 record (mint → serialize) and a v2 identity (hand-built → serialize). The v2
+// id is a pi citizen with a null transcriptPath (nullable-at-birth), exercising the
+// shape v1 never had.
+const v1 = mintMetaRecord(
+	{ backend: "claude-code", nativeSessionId: "n-v1", transcriptPath: "/tmp/t.jsonl", cwd: "/tmp/v1" },
+	T0,
+);
+const v1Json = serializeMetaRecord(v1);
+const V2_GID = "20260301T120000-aaaaaa";
+const v2: MetaIdentity = {
+	schemaVersion: 2,
+	gardenId: V2_GID,
+	backend: "pi",
+	nativeSessionId: "n-v2",
+	cwd: "/tmp/v2",
+	model: null,
+	transcriptPath: null,
+	parentGardenId: null,
+	isEntwurf: false,
+	createdAt: T0.toISOString(),
+	recordUpdatedAt: T0.toISOString(),
+};
+const v2Json = serializeMetaIdentity(v2);
+
+// --- scanIdentityByNativeId: dual-schema in-memory scan --------------------
+const reader = (f: string): string => {
+	if (f === `${v1.gardenId}.meta.json`) return v1Json;
+	if (f === `${V2_GID}.meta.json`) return v2Json;
+	throw new Error(`no fixture for ${f}`);
+};
+const entries = [`${v1.gardenId}.meta.json`, `${V2_GID}.meta.json`, "README.md"];
+
+const foundV1 = scanIdentityByNativeId(entries, "n-v1", reader);
+ok(
+	"scanIdentityByNativeId: matches a v1 record (normalized identity)",
+	foundV1?.gardenId === v1.gardenId && foundV1?.backend === "claude-code",
+);
+const foundV2 = scanIdentityByNativeId(entries, "n-v2", reader);
+ok(
+	"scanIdentityByNativeId: matches a v2 record (pi, null transcriptPath)",
+	foundV2?.gardenId === V2_GID && foundV2?.transcriptPath === null,
+);
+ok(
+	"scanIdentityByNativeId: returns null when no body matches",
+	scanIdentityByNativeId(entries, "n-absent", reader) === null,
+);
+ok(
+	"scanIdentityByNativeId: ignores non-.meta.json entries (README.md not read)",
+	scanIdentityByNativeId(["README.md"], "n-v1", reader) === null,
+);
+
+// THE G1 invariant: the same nativeSessionId in a v1 AND a v2 file is an authority
+// ambiguity across schemas — fail-fast, so the v2 upsert never duplicate-mints.
+const dupReader = (f: string): string =>
+	f === "a.meta.json" ? v1Json : f === "b.meta.json" ? v2Json.replace(`"n-v2"`, `"n-v1"`) : "";
+throws("scanIdentityByNativeId: nativeSessionId duplicated across v1 AND v2 → ambiguity throw (G1)", () =>
+	scanIdentityByNativeId(["a.meta.json", "b.meta.json"], "n-v1", dupReader),
+);
+
+// malformed entry surfaces via onSkip, scan continues to find the good one
+const skipped: string[] = [];
+const mixedReader = (f: string): string => (f === "bad.meta.json" ? "{not json" : v1Json);
+const survived = scanIdentityByNativeId(["bad.meta.json", `${v1.gardenId}.meta.json`], "n-v1", mixedReader, (f) =>
+	skipped.push(f),
+);
+ok(
+	"scanIdentityByNativeId: malformed entry skipped via onSkip, scan continues",
+	survived?.gardenId === v1.gardenId && skipped.length === 1,
+);
+
+// --- readMetaIdentityByGardenId: dual-schema read-by-gardenId on disk ------
+const tmpRoot = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "psa-dualcons-")));
+try {
+	fs.writeFileSync(path.join(tmpRoot, `${v1.gardenId}.meta.json`), v1Json);
+	fs.writeFileSync(path.join(tmpRoot, `${V2_GID}.meta.json`), v2Json);
+
+	const idV1 = readMetaIdentityByGardenId(v1.gardenId, tmpRoot);
+	ok(
+		"readMetaIdentityByGardenId: v1 file normalizes (lastSeen→recordUpdatedAt, transcript carried, model/parent null, not entwurf)",
+		idV1.schemaVersion === 2 &&
+			idV1.recordUpdatedAt === v1.lastSeen &&
+			idV1.transcriptPath === "/tmp/t.jsonl" &&
+			idV1.model === null &&
+			idV1.parentGardenId === null &&
+			idV1.isEntwurf === false,
+	);
+	const idV2 = readMetaIdentityByGardenId(V2_GID, tmpRoot);
+	ok(
+		"readMetaIdentityByGardenId: v2 file reads as-is (pi, null transcriptPath)",
+		idV2.backend === "pi" && idV2.transcriptPath === null,
+	);
+
+	// body/filename gardenId drift is corruption — fail-fast (body is SSOT).
+	const OTHER = "20260301T120000-bbbbbb";
+	fs.writeFileSync(path.join(tmpRoot, `${OTHER}.meta.json`), v2Json); // body says V2_GID, filename says OTHER
+	throws("readMetaIdentityByGardenId: body/filename gardenId drift is corruption", () =>
+		readMetaIdentityByGardenId(OTHER, tmpRoot),
+	);
+} finally {
+	fs.rmSync(tmpRoot, { recursive: true, force: true });
+}
+
+console.log(`[check-meta-dual-consumers] ${passed} assertions ok`);

package/scripts/check-meta-dual-read.ts

@@ -0,0 +1,158 @@
+/**
+ * check-meta-dual-read — deterministic gate for 0.11 Stage 0 step 3D-1: the v2
+ * write shape + the dual-read dispatcher. Pure functions; no fs, no backend, no
+ * API. Safe in the `pnpm check` static floor.
+ *
+ * Proves:
+ *   - serializeMetaIdentity is canonical (stable order, 2-space, trailing \n) and
+ *     round-trips through parseMetaRecordV2,
+ *   - parseMetaRecordAny peeks schemaVersion and routes to the right strict
+ *     parser (v1 keeps delivery; v2 is identity), and refuses unknown versions,
+ *   - parseMetaIdentity reads EITHER version straight to a normalized identity,
+ *   - write → read identity is stable: parseMetaIdentity(serializeMetaIdentity).
+ *
+ * Scope is 3D-1 ONLY: pure serializer + dispatcher. NO fs upsert wiring, NO
+ * readMetaInbox/enqueueMetaMessage change, NO record.delivery removal — those are
+ * 3D-2/3/4. The v1 fixtures here are sanitized (never a real disk record).
+ */
+
+import assert from "node:assert/strict";
+import {
+	type MetaIdentity,
+	MetaRecordError,
+	parseMetaIdentity,
+	parseMetaRecordAny,
+	serializeMetaIdentity,
+} from "../pi-extensions/lib/meta-session.ts";
+
+let passed = 0;
+function ok(label: string, cond: boolean): void {
+	assert.ok(cond, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+function golden(label: string, actual: unknown, expected: unknown): void {
+	assert.deepStrictEqual(actual, expected, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+function throws(label: string, fn: () => unknown): void {
+	assert.throws(fn, MetaRecordError, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+// Sanitized fixtures (synthetic paths; gardenId obeys the SSOT grammar).
+const V1_FIXTURE_JSON = JSON.stringify({
+	schemaVersion: 1,
+	gardenId: "20260101T000000-0a1b2c",
+	backend: "claude-code",
+	nativeSessionId: "n-fixture-0001",
+	transcriptPath: "/synthetic/project/.transcript.jsonl",
+	cwd: "/synthetic/project",
+	createdAt: "2026-01-01T00:00:00.000Z",
+	lastSeen: "2026-01-02T03:04:05.000Z",
+	delivery: {
+		wakeMode: "self-fetch",
+		deliveryLevel: "D6",
+		lastEnqueuedAt: null,
+		lastDeliveredAt: null,
+		lastReadAt: "2026-01-02T03:04:05.000Z",
+	},
+});
+
+// The v2 identity the v1 fixture normalizes to (= the 3A golden).
+const GOLDEN_V2_IDENTITY: MetaIdentity = {
+	schemaVersion: 2,
+	gardenId: "20260101T000000-0a1b2c",
+	backend: "claude-code",
+	nativeSessionId: "n-fixture-0001",
+	cwd: "/synthetic/project",
+	model: null,
+	transcriptPath: "/synthetic/project/.transcript.jsonl",
+	parentGardenId: null,
+	isEntwurf: false,
+	createdAt: "2026-01-01T00:00:00.000Z",
+	recordUpdatedAt: "2026-01-02T03:04:05.000Z",
+};
+
+const V2_PI_IDENTITY: MetaIdentity = {
+	schemaVersion: 2,
+	gardenId: "20260301T120000-abc123",
+	backend: "pi",
+	nativeSessionId: "pi-sess-xyz",
+	cwd: "/synthetic/pi-proj",
+	model: null,
+	transcriptPath: null,
+	parentGardenId: "20260301T115900-aaaaaa",
+	isEntwurf: true,
+	createdAt: "2026-03-01T12:00:00.000Z",
+	recordUpdatedAt: "2026-03-01T12:30:00.000Z",
+};
+
+// --- serializeMetaIdentity (the v2 write shape) -----------------------------
+ok(
+	"serializeMetaIdentity: stable key order, 2-space indent, trailing newline, schemaVersion 2 first",
+	serializeMetaIdentity(GOLDEN_V2_IDENTITY).startsWith(
+		'{\n  "schemaVersion": 2,\n  "gardenId": "20260101T000000-0a1b2c",',
+	) && serializeMetaIdentity(GOLDEN_V2_IDENTITY).endsWith("\n}\n"),
+);
+ok(
+	"serializeMetaIdentity is deterministic (same identity → byte-identical)",
+	serializeMetaIdentity(GOLDEN_V2_IDENTITY) === serializeMetaIdentity({ ...GOLDEN_V2_IDENTITY }),
+);
+ok(
+	"serializeMetaIdentity output carries no v1 delivery/lastSeen keys",
+	!serializeMetaIdentity(GOLDEN_V2_IDENTITY).includes("delivery") &&
+		!serializeMetaIdentity(GOLDEN_V2_IDENTITY).includes("lastSeen"),
+);
+// write → read identity stability (serialize then dual-read back to identity).
+golden(
+	"serialize → parseMetaIdentity round-trips (v2 identity stable)",
+	parseMetaIdentity(serializeMetaIdentity(GOLDEN_V2_IDENTITY)),
+	GOLDEN_V2_IDENTITY,
+);
+golden(
+	"serialize → parseMetaIdentity round-trips (pi identity stable)",
+	parseMetaIdentity(serializeMetaIdentity(V2_PI_IDENTITY)),
+	V2_PI_IDENTITY,
+);
+
+// --- parseMetaRecordAny (the dual-read dispatcher) --------------------------
+const anyV1 = parseMetaRecordAny(V1_FIXTURE_JSON);
+ok(
+	"parseMetaRecordAny(v1) returns the v1 record in its OWN shape (delivery retained)",
+	anyV1.schemaVersion === 1 && "delivery" in anyV1 && anyV1.delivery.lastReadAt === "2026-01-02T03:04:05.000Z",
+);
+const anyV2 = parseMetaRecordAny(serializeMetaIdentity(V2_PI_IDENTITY));
+ok(
+	"parseMetaRecordAny(v2) returns the v2 identity in its OWN shape",
+	anyV2.schemaVersion === 2 && !("delivery" in anyV2),
+);
+
+// --- parseMetaIdentity (dual-read straight to identity) --------------------
+golden(
+	"parseMetaIdentity(v1 raw) → normalized v2 identity golden",
+	parseMetaIdentity(V1_FIXTURE_JSON),
+	GOLDEN_V2_IDENTITY,
+);
+golden(
+	"parseMetaIdentity(v2 raw) → identity (idempotent)",
+	parseMetaIdentity(serializeMetaIdentity(V2_PI_IDENTITY)),
+	V2_PI_IDENTITY,
+);
+
+// --- crash, don't warn -----------------------------------------------------
+throws("parseMetaRecordAny: invalid JSON throws", () => parseMetaRecordAny("{nope"));
+throws("parseMetaRecordAny: array (non-object) throws", () => parseMetaRecordAny("[]"));
+throws("parseMetaRecordAny: unknown schemaVersion (3) throws", () =>
+	parseMetaRecordAny(JSON.stringify({ ...JSON.parse(V1_FIXTURE_JSON), schemaVersion: 3 })),
+);
+throws("parseMetaRecordAny: missing schemaVersion throws", () => parseMetaRecordAny(JSON.stringify({ gardenId: "x" })));
+// the dispatcher delegates to the STRICT per-version parser — a corrupt v2 body
+// (stale v1 delivery under schemaVersion 2) must still be rejected through Any.
+throws("parseMetaRecordAny(v2 with stale delivery) is rejected by the strict v2 parser", () =>
+	parseMetaRecordAny(JSON.stringify({ ...V2_PI_IDENTITY, delivery: {} })),
+);
+
+console.log(`[check-meta-dual-read] ${passed} assertions ok`);

package/scripts/check-meta-listing.ts

@@ -0,0 +1,138 @@
+/**
+ * check-meta-listing — deterministic gate for `listAllMetaIdentities` (0.11
+ * Stage 0 step 4, slice 4a). The meta-store axis the fact-provider consumes.
+ *
+ * Proves the explicit-partial contract (Fable Q2 / GPT힣):
+ *   - valid records → identities, sorted by gardenId,
+ *   - a parse failure does NOT blind the listing — valid records still surface,
+ *     and the corrupt one becomes an explicit error (the 0.10 "corrupt blocks
+ *     registration forever" lesson),
+ *   - body/filename drift (body gardenId ≠ filename) → error, excluded from
+ *     identities (same authority check as readMetaIdentityByGardenId),
+ *   - a throwing reader (file vanished) → error, not a crash,
+ *   - non-`.meta.json` entries ignored,
+ *   - verbatim-or-nothing: an error carries ONLY {filename, message} — never a
+ *     half-parsed identity field (a salvaged gid string as a fact = synthetic),
+ *   - mode "strict" throws on any error; "collect" (default) returns partial,
+ *   - errors sorted by filename.
+ *
+ * Pure; entries/readRecord injected, no IO.
+ */
+
+import assert from "node:assert/strict";
+import {
+	listAllMetaIdentities,
+	type MetaBackendV2,
+	type MetaIdentity,
+	serializeMetaIdentity,
+} from "../pi-extensions/lib/meta-session.ts";
+
+let passed = 0;
+function ok(label: string, cond: boolean): void {
+	assert.ok(cond, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+const GID_A = "20260611T111111-aaaaaa";
+const GID_B = "20260611T222222-bbbbbb";
+
+function rec(gardenId: string, over: Partial<MetaIdentity> = {}): string {
+	const backend: MetaBackendV2 = "pi";
+	return serializeMetaIdentity({
+		schemaVersion: 2,
+		gardenId,
+		backend,
+		nativeSessionId: `n-${gardenId}`,
+		cwd: "/x",
+		model: null,
+		transcriptPath: null,
+		parentGardenId: null,
+		isEntwurf: false,
+		createdAt: "2026-06-11T00:00:00.000Z",
+		recordUpdatedAt: "2026-06-11T00:00:00.000Z",
+		...over,
+	});
+}
+
+function reader(map: Record<string, string>): (filename: string) => string {
+	return (filename: string) => {
+		const v = map[filename];
+		if (v === undefined) throw new Error(`ENOENT: ${filename}`);
+		return v;
+	};
+}
+
+// ── valid records → identities, sorted ──────────────────────────────────────
+{
+	const map = { [`${GID_B}.meta.json`]: rec(GID_B), [`${GID_A}.meta.json`]: rec(GID_A) };
+	const { identities, errors } = listAllMetaIdentities(Object.keys(map), reader(map));
+	ok("2 valid → 2 identities, 0 errors", identities.length === 2 && errors.length === 0);
+	ok("identities sorted by gardenId", identities[0]?.gardenId === GID_A);
+}
+
+// ── corrupt record does NOT blind the listing ───────────────────────────────
+{
+	const map = { [`${GID_A}.meta.json`]: rec(GID_A), [`${GID_B}.meta.json`]: "{ broken json" };
+	const { identities, errors } = listAllMetaIdentities(Object.keys(map), reader(map));
+	ok("corrupt 1 → valid still listed (not blinded)", identities.length === 1 && identities[0]?.gardenId === GID_A);
+	ok("corrupt → exactly 1 error", errors.length === 1);
+	ok("error names the corrupt file", errors[0]?.filename === `${GID_B}.meta.json`);
+}
+
+// ── body/filename drift → error, excluded ───────────────────────────────────
+{
+	const map = { [`${GID_A}.meta.json`]: rec(GID_B) }; // filename A, body claims B
+	const { identities, errors } = listAllMetaIdentities(Object.keys(map), reader(map));
+	ok("drift → excluded from identities", identities.length === 0);
+	ok("drift → 1 error mentioning drift", errors.length === 1 && /drift/.test(errors[0]?.message ?? ""));
+}
+
+// ── throwing reader (file vanished) → error, not crash ──────────────────────
+{
+	const read = (f: string): string => {
+		if (f === `${GID_B}.meta.json`) throw new Error("ENOENT mid-scan");
+		return rec(GID_A);
+	};
+	const { identities, errors } = listAllMetaIdentities([`${GID_A}.meta.json`, `${GID_B}.meta.json`], read);
+	ok("reader throw → error, valid still listed", identities.length === 1 && errors.length === 1);
+}
+
+// ── non-.meta.json ignored ──────────────────────────────────────────────────
+{
+	const map = { [`${GID_A}.meta.json`]: rec(GID_A), "README.txt": "x", "inbox.signal": "y" };
+	const { identities, errors } = listAllMetaIdentities(Object.keys(map), reader(map));
+	ok("non-.meta.json entries ignored", identities.length === 1 && errors.length === 0);
+}
+
+// ── verbatim-or-nothing: error keyset = {filename, message} ─────────────────
+{
+	const map = { [`${GID_A}.meta.json`]: "{ broken" };
+	const { errors } = listAllMetaIdentities(Object.keys(map), reader(map));
+	const keys = Object.keys(errors[0] ?? {}).sort();
+	assert.deepStrictEqual(keys, ["filename", "message"], `error keyset drift: ${keys.join(",")}`);
+	ok("error verbatim-or-nothing (filename + message only, no identity field)", true);
+}
+
+// ── strict vs collect ───────────────────────────────────────────────────────
+{
+	const map = { [`${GID_A}.meta.json`]: rec(GID_A), [`${GID_B}.meta.json`]: "{ broken" };
+	let threw = false;
+	try {
+		listAllMetaIdentities(Object.keys(map), reader(map), { mode: "strict" });
+	} catch {
+		threw = true;
+	}
+	ok("mode strict → throw if any record unreadable", threw);
+	const { identities } = listAllMetaIdentities(Object.keys(map), reader(map), { mode: "collect" });
+	ok("mode collect (default) → partial, no throw", identities.length === 1);
+}
+
+// ── errors sorted by filename ───────────────────────────────────────────────
+{
+	const map = { [`${GID_B}.meta.json`]: "{ x", [`${GID_A}.meta.json`]: "{ y" };
+	const { errors } = listAllMetaIdentities(Object.keys(map), reader(map));
+	ok("errors sorted by filename", errors[0]?.filename === `${GID_A}.meta.json`);
+}
+
+console.log(`\n[check-meta-listing] ${passed} assertions ok`);