@junghanacs/entwurf 0.12.0

package/scripts/check-meta-mailbox-state-write.ts

@@ -0,0 +1,135 @@
+/**
+ * check-meta-mailbox-state-write — deterministic gate for 0.11 Stage 0 step 3D-4
+ * commit2 (the cut). Renamed from check-meta-mailbox-dualwrite: after the cut the
+ * receipt is no longer DUAL-written (record.delivery is gone from the v2 record) —
+ * it lives SOLELY in the mailbox state store. A real temp sessions+mailbox dir; no
+ * backend, no network, no hook. Safe in the `pnpm check` static floor.
+ *
+ * Proves the post-cut contract (H1):
+ *  - the citizen's meta-record FILE is byte-identical before/after enqueue AND read
+ *    (enqueue/read no longer touch the record — invariant ⑤);
+ *  - enqueue stamps state.lastEnqueuedAt, read stamps state.lastReadAt, and the
+ *    enqueue receipt survives the read (field isolation on the state store);
+ *  - lastDeliveredAt is never invented by read (doorbell owns delivery-time);
+ *  - an empty inbox is a no-op on BOTH the record (untouched) and the state
+ *    (state.json never created) — invariant ⑥;
+ *  - a state-store drift makes the read throw fail-loud (partial failure surfaces).
+ *
+ * Scope is 3D-4 ONLY. The record is written as v2 by upsertMetaSession; enqueue/read
+ * read identity (dual-read) and mutate only the mailbox state.
+ */
+
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+	emptyMailboxReceiptState,
+	enqueueMetaMessage,
+	MetaRecordError,
+	mailboxReceiptStatePath,
+	readMailboxReceiptState,
+	readMetaInbox,
+	serializeMailboxReceiptState,
+	upsertMetaSession,
+} from "../pi-extensions/lib/meta-session.ts";
+
+let passed = 0;
+function ok(label: string, cond: boolean): void {
+	assert.ok(cond, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+function golden(label: string, actual: unknown, expected: unknown): void {
+	assert.deepStrictEqual(actual, expected, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+function throws(label: string, fn: () => unknown): void {
+	assert.throws(fn, MetaRecordError, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+const ENQ = new Date("2026-03-01T12:00:00.000Z");
+const ENQ_ISO = "2026-03-01T12:00:00.000Z";
+const RD = new Date("2026-03-01T12:05:00.000Z");
+const RD_ISO = "2026-03-01T12:05:00.000Z";
+
+const tmpRoot = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "psa-statewrite-")));
+const sessionsDir = path.join(tmpRoot, "meta-sessions");
+const mailboxDir = path.join(tmpRoot, "meta-mailbox");
+
+// Seed a real v2 citizen via the upsert write path (the create that writes v2).
+function seed(nativeSessionId: string): string {
+	const res = upsertMetaSession({
+		dir: sessionsDir,
+		input: { backend: "claude-code", nativeSessionId, transcriptPath: "/tmp/t.jsonl", cwd: "/tmp" },
+		now: ENQ,
+	});
+	return res.record.gardenId;
+}
+
+try {
+	// --- enqueue → read: record FILE untouched, receipt lands in state only ----
+	const gidA = seed("n-state-a");
+	const recordFile = path.join(sessionsDir, `${gidA}.meta.json`);
+	const recordBytes0 = fs.readFileSync(recordFile, "utf8");
+
+	enqueueMetaMessage({ gardenId: gidA, body: "hello", sessionsDir, mailboxDir, now: ENQ });
+	ok(
+		"enqueue: the meta-record FILE is byte-identical (enqueue does not touch the record)",
+		fs.readFileSync(recordFile, "utf8") === recordBytes0,
+	);
+	const stateAfterEnq = readMailboxReceiptState({ gardenId: gidA, mailboxDir });
+	ok("enqueue: state.lastEnqueuedAt stamped (sole receipt home)", stateAfterEnq.lastEnqueuedAt === ENQ_ISO);
+	ok("enqueue: read-receipt not pre-stamped", stateAfterEnq.lastReadAt === null);
+
+	const readRes = readMetaInbox({ gardenId: gidA, sessionsDir, mailboxDir, now: RD });
+	ok("read: the queued message drained", readRes.messages.length === 1 && readRes.messages[0].body === "hello");
+	ok("read: result.readAt comes from the state stamp", readRes.readAt === RD_ISO);
+	ok(
+		"read: the meta-record FILE is STILL byte-identical (read does not touch the record)",
+		fs.readFileSync(recordFile, "utf8") === recordBytes0,
+	);
+	const stateAfterRead = readMailboxReceiptState({ gardenId: gidA, mailboxDir });
+	ok("read: state.lastReadAt stamped", stateAfterRead.lastReadAt === RD_ISO);
+	ok("read: enqueue receipt SURVIVES the read (field isolation)", stateAfterRead.lastEnqueuedAt === ENQ_ISO);
+	ok("read: lastDeliveredAt never invented by read (doorbell owns it)", stateAfterRead.lastDeliveredAt === null);
+
+	// --- empty inbox: no-op on BOTH record and state --------------------------
+	const gidB = seed("n-state-b");
+	const recBfile = path.join(sessionsDir, `${gidB}.meta.json`);
+	const recBytesB = fs.readFileSync(recBfile, "utf8");
+	const emptyRes = readMetaInbox({ gardenId: gidB, sessionsDir, mailboxDir, now: RD });
+	ok("empty inbox: nothing drained, readAt null", emptyRes.messages.length === 0 && emptyRes.readAt === null);
+	ok("empty inbox: record FILE untouched", fs.readFileSync(recBfile, "utf8") === recBytesB);
+	ok(
+		"empty inbox: state.json NEVER created (no receipt on the state either)",
+		!fs.existsSync(mailboxReceiptStatePath(mailboxDir, gidB)),
+	);
+
+	// --- partial-failure SURFACES (never swallowed) ---------------------------
+	const gidC = seed("n-state-c");
+	enqueueMetaMessage({ gardenId: gidC, body: "surface me", sessionsDir, mailboxDir, now: ENQ });
+	const OTHER = "20260301T120000-def456";
+	fs.writeFileSync(
+		mailboxReceiptStatePath(mailboxDir, gidC),
+		serializeMailboxReceiptState(emptyMailboxReceiptState(OTHER)),
+	);
+	throws("read: a state-store drift throws (partial failure surfaces, not swallowed)", () =>
+		readMetaInbox({ gardenId: gidC, sessionsDir, mailboxDir, now: RD }),
+	);
+
+	// a fresh citizen (no enqueue/read yet) has an all-null receipt state.
+	const gidD = seed("n-state-d");
+	golden(
+		"a never-touched citizen has an all-null receipt state",
+		readMailboxReceiptState({ gardenId: gidD, mailboxDir }),
+		emptyMailboxReceiptState(gidD),
+	);
+} finally {
+	fs.rmSync(tmpRoot, { recursive: true, force: true });
+}
+
+console.log(`[check-meta-mailbox-state-write] ${passed} assertions ok`);

package/scripts/check-meta-migration.ts

@@ -0,0 +1,212 @@
+/**
+ * check-meta-migration — deterministic gate for 0.11 Stage 0 step 3D-4 commit2:
+ * the v1→v2 delivery-receipt migration (migrateV1DeliveryReceipts) and its
+ * crash-order placement inside upsert. A real temp sessions+mailbox dir; no
+ * backend, no network, no hook. Safe in the `pnpm check` static floor.
+ *
+ * migrateV1DeliveryReceipts — per-field, STATE WINS, 3 timestamps only:
+ *  - empty state + v1 receipts → fills every null field, writes, returns merged;
+ *  - state already set on a field → v1 does NOT overwrite (state wins);
+ *  - v1 all-null OR state already wins on every field v1 has → NO-OP: returns null,
+ *    state.json never created ("migrating nothing is not a receipt", G4);
+ *  - only the 3 timestamps move (wakeMode/deliveryLevel are capability, H2).
+ *
+ * crash-order (inside upsert): a v1 file's receipts migrate to state BEFORE the v2
+ * rewrite. Proven two ways: (a) a v1 record on disk → upsert attach lands the
+ * receipts in state AND rewrites the record to v2; (b) a drift'd state.json makes
+ * the migrate throw, and the record is STILL v1 (rewrite not reached) — so a crash
+ * there is recoverable (next attach re-migrates; state-wins is idempotent).
+ */
+
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import {
+	emptyMailboxReceiptState,
+	META_SCHEMA_VERSION,
+	META_SCHEMA_VERSION_V2,
+	MetaRecordError,
+	mailboxReceiptStatePath,
+	markEnqueued,
+	markRead,
+	migrateV1DeliveryReceipts,
+	mintMetaRecord,
+	parseMetaRecordAny,
+	readMailboxReceiptState,
+	serializeMailboxReceiptState,
+	serializeMetaRecord,
+	upsertMetaSession,
+} from "../pi-extensions/lib/meta-session.ts";
+
+let passed = 0;
+function ok(label: string, cond: boolean): void {
+	assert.ok(cond, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+function throws(label: string, fn: () => unknown): void {
+	assert.throws(fn, MetaRecordError, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+const GID = "20260301T120000-aaaaaa";
+const E_ISO = "2026-03-01T12:00:00.000Z";
+const R_ISO = "2026-03-01T12:05:00.000Z";
+const tmpRoot = fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(), "psa-migrate-")));
+const mailboxDir = path.join(tmpRoot, "mbx");
+
+try {
+	// --- A: empty state + v1 receipts → fill all, write, create state.json -----
+	const merged = migrateV1DeliveryReceipts({
+		gardenId: GID,
+		delivery: { lastEnqueuedAt: E_ISO, lastDeliveredAt: null, lastReadAt: R_ISO },
+		mailboxDir,
+	});
+	ok(
+		"migrate: empty state + v1 receipts fills null fields, returns merged",
+		merged !== null &&
+			merged.lastEnqueuedAt === E_ISO &&
+			merged.lastReadAt === R_ISO &&
+			merged.lastDeliveredAt === null,
+	);
+	ok("migrate: state.json created on a non-empty migration", fs.existsSync(mailboxReceiptStatePath(mailboxDir, GID)));
+
+	// --- B: state wins — a re-migrate with DIFFERENT v1 values changes nothing --
+	const noop = migrateV1DeliveryReceipts({
+		gardenId: GID,
+		delivery: {
+			lastEnqueuedAt: "2099-01-01T00:00:00.000Z",
+			lastDeliveredAt: null,
+			lastReadAt: "2099-01-01T00:00:00.000Z",
+		},
+		mailboxDir,
+	});
+	ok("migrate: state wins — re-migrate over set fields is a no-op (returns null)", noop === null);
+	const after = readMailboxReceiptState({ gardenId: GID, mailboxDir });
+	ok(
+		"migrate: state values unchanged by the losing re-migrate",
+		after.lastEnqueuedAt === E_ISO && after.lastReadAt === R_ISO,
+	);
+
+	// --- C: partial fill — v1 fills only the null field, state keeps the rest ----
+	const GID2 = "20260301T120000-bbbbbb";
+	migrateV1DeliveryReceipts({
+		gardenId: GID2,
+		delivery: { lastEnqueuedAt: E_ISO, lastDeliveredAt: null, lastReadAt: null },
+		mailboxDir,
+	});
+	const partial = migrateV1DeliveryReceipts({
+		gardenId: GID2,
+		delivery: { lastEnqueuedAt: "2099-01-01T00:00:00.000Z", lastDeliveredAt: null, lastReadAt: R_ISO },
+		mailboxDir,
+	});
+	ok(
+		"migrate: partial — fills the still-null lastReadAt, keeps the won lastEnqueuedAt",
+		partial !== null && partial.lastEnqueuedAt === E_ISO && partial.lastReadAt === R_ISO,
+	);
+
+	// --- D: v1 all-null → no-op, NO state.json created --------------------------
+	const GID3 = "20260301T120000-cccccc";
+	const none = migrateV1DeliveryReceipts({
+		gardenId: GID3,
+		delivery: { lastEnqueuedAt: null, lastDeliveredAt: null, lastReadAt: null },
+		mailboxDir,
+	});
+	ok("migrate: v1 all-null is a no-op (returns null)", none === null);
+	ok("migrate: v1 all-null never creates state.json", !fs.existsSync(mailboxReceiptStatePath(mailboxDir, GID3)));
+
+	// --- E: crash-order via upsert — v1 record attaches → receipts migrate + v2 -
+	const sessionsDir = path.join(tmpRoot, "sessions-e");
+	fs.mkdirSync(sessionsDir, { recursive: true });
+	const mbxE = path.join(tmpRoot, "mbx-e");
+	const v1 = markRead(
+		markEnqueued(
+			mintMetaRecord(
+				{ backend: "claude-code", nativeSessionId: "n-mig", transcriptPath: "/t.jsonl", cwd: "/c" },
+				new Date(E_ISO),
+			),
+			new Date(E_ISO),
+		),
+		new Date(R_ISO),
+	);
+	fs.writeFileSync(path.join(sessionsDir, `${v1.gardenId}.meta.json`), serializeMetaRecord(v1));
+	const res = upsertMetaSession({
+		dir: sessionsDir,
+		mailboxDir: mbxE,
+		input: { backend: "claude-code", nativeSessionId: "n-mig", cwd: "/c" },
+		now: new Date(R_ISO),
+	});
+	ok("crash-order: upsert attach rewrote the record to v2", res.record.schemaVersion === META_SCHEMA_VERSION_V2);
+	const migrated = readMailboxReceiptState({ gardenId: v1.gardenId, mailboxDir: mbxE });
+	ok(
+		"crash-order: the v1 record's receipts migrated to state BEFORE the v2 rewrite",
+		migrated.lastEnqueuedAt === E_ISO && migrated.lastReadAt === R_ISO,
+	);
+	const onDisk = parseMetaRecordAny(fs.readFileSync(path.join(sessionsDir, `${v1.gardenId}.meta.json`), "utf8"));
+	ok("crash-order: on-disk record is v2 (delivery gone)", onDisk.schemaVersion === META_SCHEMA_VERSION_V2);
+
+	// --- F: crash-order safety — a drift'd state makes migrate throw, record stays v1
+	const sessionsDir2 = path.join(tmpRoot, "sessions-f");
+	fs.mkdirSync(sessionsDir2, { recursive: true });
+	const mbxF = path.join(tmpRoot, "mbx-f");
+	const v1b = markEnqueued(
+		mintMetaRecord(
+			{ backend: "claude-code", nativeSessionId: "n-drift", transcriptPath: "/t.jsonl", cwd: "/c" },
+			new Date(E_ISO),
+		),
+		new Date(E_ISO),
+	);
+	fs.writeFileSync(path.join(sessionsDir2, `${v1b.gardenId}.meta.json`), serializeMetaRecord(v1b));
+	// plant a drift'd state.json (body claims a DIFFERENT citizen) under v1b's gardenId
+	fs.mkdirSync(path.dirname(mailboxReceiptStatePath(mbxF, v1b.gardenId)), { recursive: true });
+	fs.writeFileSync(
+		mailboxReceiptStatePath(mbxF, v1b.gardenId),
+		serializeMailboxReceiptState(emptyMailboxReceiptState("20260301T120000-dddddd")),
+	);
+	throws("crash-order safety: a drift'd state makes the migrate (hence upsert) throw", () =>
+		upsertMetaSession({
+			dir: sessionsDir2,
+			mailboxDir: mbxF,
+			input: { backend: "claude-code", nativeSessionId: "n-drift", cwd: "/c" },
+			now: new Date(R_ISO),
+		}),
+	);
+	const stillV1 = parseMetaRecordAny(fs.readFileSync(path.join(sessionsDir2, `${v1b.gardenId}.meta.json`), "utf8"));
+	ok(
+		"crash-order safety: record is STILL v1 (v2 rewrite not reached → next attach re-migrates)",
+		stillV1.schemaVersion === META_SCHEMA_VERSION,
+	);
+
+	// --- G: create + attach v2→v2 do NOT migrate (no state.json) ---------------
+	// A fresh create writes v2 with no v1 delivery to migrate; a later attach over the
+	// now-v2 record sees raw.schemaVersion===v2, so the migration branch never runs.
+	const sessionsDir3 = path.join(tmpRoot, "sessions-g");
+	fs.mkdirSync(sessionsDir3, { recursive: true });
+	const mbxG = path.join(tmpRoot, "mbx-g");
+	const created = upsertMetaSession({
+		dir: sessionsDir3,
+		mailboxDir: mbxG,
+		input: { backend: "claude-code", nativeSessionId: "n-fresh", cwd: "/c" },
+		now: new Date(E_ISO),
+	});
+	ok(
+		"create: a fresh v2 create does not migrate (state.json not created)",
+		!fs.existsSync(mailboxReceiptStatePath(mbxG, created.record.gardenId)),
+	);
+	upsertMetaSession({
+		dir: sessionsDir3,
+		mailboxDir: mbxG,
+		input: { backend: "claude-code", nativeSessionId: "n-fresh", cwd: "/c2" },
+		now: new Date(R_ISO),
+	});
+	ok(
+		"attach v2→v2: no migration (raw is v2, state.json still absent)",
+		!fs.existsSync(mailboxReceiptStatePath(mbxG, created.record.gardenId)),
+	);
+} finally {
+	fs.rmSync(tmpRoot, { recursive: true, force: true });
+}
+
+console.log(`[check-meta-migration] ${passed} assertions ok`);

package/scripts/check-meta-receiver-marker.ts

@@ -0,0 +1,185 @@
+/**
+ * check-meta-receiver-marker — deterministic gate for the meta-receiver presence
+ * marker (SE-2 slice 2b). The active-receiver signal a self-fetch backend (Claude
+ * Code) needs: a meta-record proves a session once existed; this marker proves a
+ * live watch owner is still there to be woken. Without it a terminated session's
+ * lingering record reads as a ghost active receiver and replies pile up as mailbox
+ * garbage.
+ *
+ * Proves:
+ *   - write→read round-trip preserves every field; keyed by GARDEN id (not owner pid),
+ *     because deliverability lookup starts from a target garden id.
+ *   - atomic write lands valid JSON at 0600.
+ *   - dead-owner / pid-reuse guard: a marker whose ownerStartKey no longer matches the
+ *     live owner reads as null (inactive), distinct from "no marker". verifyOwner:false
+ *     bypasses it for inspection.
+ *   - armProvenance is constrained to the arm-capable events; "user-prompt-submit" (and
+ *     any other value) is rejected at write — UserPromptSubmit can never mint a presence
+ *     it cannot back.
+ *   - record-backing is NOT checked by the reader (recordBacked is the deliverability
+ *     predicate's explicit fact, so an absent record and a dead owner stay distinct).
+ */
+
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+	META_RECEIVER_ARM_PROVENANCES,
+	metaReceiverMarkerPath,
+	processStartKey,
+	readMetaReceiverMarker,
+	writeMetaReceiverMarker,
+} from "../pi-extensions/lib/meta-session.ts";
+
+let passed = 0;
+function ok(label: string, cond: boolean): void {
+	assert.ok(cond, label);
+	console.log(`  ok    ${label}`);
+	passed++;
+}
+
+const REPO_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const DIR = mkdtempSync(path.join(tmpdir(), "psa-meta-receivers-"));
+const GARDEN = "20260614T120000-aaaaaa";
+
+// ── write → read round-trip, garden-id keyed ────────────────────────────────
+const file = writeMetaReceiverMarker({
+	gardenId: GARDEN,
+	backend: "claude-code",
+	nativeSessionId: "n-recv-a",
+	ownerPid: process.pid, // this live node process — start-key will match on read
+	armProvenance: "session-start",
+	receiversDir: DIR,
+});
+ok(
+	"marker path is keyed by garden id",
+	file === metaReceiverMarkerPath(GARDEN, DIR) && file.endsWith(`${GARDEN}.json`),
+);
+ok("write lands JSON at mode 0600", (statSync(file).mode & 0o777) === 0o600);
+
+const back = readMetaReceiverMarker({ gardenId: GARDEN, receiversDir: DIR });
+ok("read returns a marker for a live owner", back !== null);
+if (back) {
+	ok("round-trip gardenId", back.gardenId === GARDEN);
+	ok("round-trip backend", back.backend === "claude-code");
+	ok("round-trip nativeSessionId", back.nativeSessionId === "n-recv-a");
+	ok("round-trip ownerPid", back.ownerPid === process.pid);
+	ok("ownerStartKey computed at write equals the live owner key", back.ownerStartKey === processStartKey(process.pid));
+	ok("ownerKind defaults to claude-code-cli", back.ownerKind === "claude-code-cli");
+	ok("round-trip armProvenance", back.armProvenance === "session-start");
+	ok("updatedAt present", typeof back.updatedAt === "string" && back.updatedAt.length > 0);
+}
+
+// ── dead-owner / pid-reuse guard ────────────────────────────────────────────
+// A marker whose start-key no longer matches the live pid must read as null.
+const ghostGarden = "20260614T120000-bbbbbb";
+const ghostFile = metaReceiverMarkerPath(ghostGarden, DIR);
+writeFileSync(
+	ghostFile,
+	`${JSON.stringify({
+		gardenId: ghostGarden,
+		backend: "claude-code",
+		nativeSessionId: "n-ghost",
+		ownerPid: process.pid,
+		ownerStartKey: "linux:1", // bogus start-key for this pid → guard must reject
+		ownerKind: "claude-code-cli",
+		armProvenance: "session-start",
+		updatedAt: "2026-06-14T03:00:00.000Z",
+	})}\n`,
+);
+ok(
+	"dead-owner (start-key mismatch) marker reads as null",
+	readMetaReceiverMarker({ gardenId: ghostGarden, receiversDir: DIR }) === null,
+);
+ok(
+	"verifyOwner:false bypasses the guard (inspection only)",
+	readMetaReceiverMarker({ gardenId: ghostGarden, receiversDir: DIR, verifyOwner: false }) !== null,
+);
+
+// ── armProvenance constraint ────────────────────────────────────────────────
+ok(
+	"arm provenances are exactly the arm-capable events",
+	JSON.stringify([...META_RECEIVER_ARM_PROVENANCES].sort()) ===
+		JSON.stringify(["cwd-changed", "file-changed", "session-start"]),
+);
+let upsRejected = false;
+try {
+	writeMetaReceiverMarker({
+		gardenId: GARDEN,
+		backend: "claude-code",
+		nativeSessionId: "n-recv-a",
+		ownerPid: process.pid,
+		// @ts-expect-error — user-prompt-submit is intentionally NOT a valid arm provenance
+		armProvenance: "user-prompt-submit",
+		receiversDir: DIR,
+	});
+} catch {
+	upsRejected = true;
+}
+ok("user-prompt-submit armProvenance is rejected at write (UPS cannot mint presence)", upsRejected);
+
+// ── absent marker, no record-backing requirement ────────────────────────────
+ok(
+	"absent marker reads as null",
+	readMetaReceiverMarker({ gardenId: "20260614T120000-cccccc", receiversDir: DIR }) === null,
+);
+// The round-trip marker above has NO backing meta-record in this dir, yet it read
+// fine — the reader does not gate on record existence (that is the predicate's fact).
+ok("reader does not require a backing record (recordBacked is the predicate's job)", back !== null);
+
+// corrupt file → null, never throw.
+const corruptGarden = "20260614T120000-dddddd";
+writeFileSync(metaReceiverMarkerPath(corruptGarden, DIR), "{ not json");
+ok(
+	"corrupt marker reads as null (no throw)",
+	readMetaReceiverMarker({ gardenId: corruptGarden, receiversDir: DIR }) === null,
+);
+
+// ── HOOK WIRING source guard: the marker is only as honest as where it is written ──
+const hookSrc = readFileSync(path.join(REPO_DIR, "pi-extensions", "meta-bridge-hook.ts"), "utf8");
+
+ok("hook imports + calls writeMetaReceiverMarker", /writeMetaReceiverMarker/.test(hookSrc));
+
+// ownerPid is process.ppid ONLY — never the grandparent (parentPid). The receiver
+// owner is the watchPaths subscriber (the Claude CLI); a grandparent (login shell)
+// outlives the session and would resurrect the ghost active-receiver leak.
+ok("receiver marker ownerPid is process.ppid", /ownerPid\s*=\s*process\.ppid/.test(hookSrc));
+ok("hook does NOT use parentPid (no grandparent owner)", !/parentPid\s*\(/.test(hookSrc));
+
+// UserPromptSubmit must early-return BEFORE the receiver marker write — it cannot
+// arm a watch, so it must never mint a presence. Check the early-return appears
+// before the writeMetaReceiverMarker call site in source order.
+const upsReturnAt = hookSrc.search(/eventName\s*===\s*"UserPromptSubmit"/);
+const recvWriteAt = hookSrc.search(/writeMetaReceiverMarker\s*\(/);
+ok(
+	"UserPromptSubmit early-return precedes the receiver marker write",
+	upsReturnAt >= 0 && recvWriteAt >= 0 && upsReturnAt < recvWriteAt,
+);
+
+// armProvenanceFor maps ONLY the arm-capable events and returns null otherwise — an
+// unknown event must not masquerade as an optimistic session-start.
+const armFnMatch = hookSrc.match(/function armProvenanceFor\([^)]*\)[^{]*\{[\s\S]*?\n\}/);
+ok("armProvenanceFor is present", armFnMatch !== null);
+if (armFnMatch) {
+	const body = armFnMatch[0];
+	ok(
+		"armProvenanceFor maps SessionStart/CwdChanged/FileChanged",
+		/SessionStart/.test(body) && /CwdChanged/.test(body) && /FileChanged/.test(body),
+	);
+	ok(
+		"armProvenanceFor returns null for unknown events (fail-closed, no optimistic session-start)",
+		/return null/.test(body),
+	);
+}
+
+// The receiver marker write rides the watch-arm block (near the inbox.signal arm),
+// not the sender-marker block — keep the two presences from drifting together.
+const signalAt = hookSrc.search(/inbox\.signal/);
+ok(
+	"receiver marker write sits within the watch-arm region (near inbox.signal)",
+	signalAt >= 0 && recvWriteAt > signalAt,
+);
+
+console.log(`\ncheck-meta-receiver-marker: ${passed} checks passed`);