@logicseek/hello-cc 0.1.6 → 0.1.8

package/scripts/regression.mjs

@@ -22,6 +22,9 @@ const fakeBin = path.join(os.tmpdir(), `hcc-reg-bin-${testId}`);
 const outDir = path.join(os.tmpdir(), `hcc-reg-out-${testId}`);
 const tmuxSession = `hcc-reg-${process.pid}`;
 const tmuxSocketName = `hcc-reg-${testId}`.replace(/[^A-Za-z0-9_-]/g, '-');
+const secondProjectRoot = path.join(root, 'second-project');
+const realHome = process.env.HOME || os.homedir();
+const realRegistryFile = path.join(realHome, '.hello-cc', 'projects.json');
 const realTmuxBin = spawnSync('sh', ['-lc', 'command -v tmux || true'], {
   encoding: 'utf8',
   stdio: ['ignore', 'pipe', 'ignore']
@@ -35,7 +38,8 @@ const managedTmuxSessions = new Set();
 const env = {
   ...process.env,
   HOME: home,
-  PATH: `${fakeBin}${path.delimiter}${process.env.PATH || ''}`
+  PATH: `${fakeBin}${path.delimiter}${process.env.PATH || ''}`,
+  SHELL: '/bin/bash'
 };
 for (const key of Object.keys(env)) {
   if (key.startsWith('HCC_')) delete env[key];
@@ -48,6 +52,13 @@ function log(message) {
 }
 
 function fail(message) {
+  if (process.env.GITHUB_ACTIONS === 'true') {
+    const escaped = String(message)
+      .replace(/%/g, '%25')
+      .replace(/\r/g, '%0D')
+      .replace(/\n/g, '%0A');
+    process.stderr.write(`::error::${escaped}\n`);
+  }
   throw new Error(message);
 }
 
@@ -59,6 +70,20 @@ function sh(value) {
   return `'${String(value).replace(/'/g, `'\\''`)}'`;
 }
 
+function canonicalPath(value) {
+  try { return fs.realpathSync(value); }
+  catch { return path.resolve(value); }
+}
+
+function samePath(a, b) {
+  return canonicalPath(a) === canonicalPath(b);
+}
+
+function statusValue(output, key) {
+  const match = String(output || '').match(new RegExp(`^${key}:\\s*(.*)$`, 'm'));
+  return match ? match[1].trim() : '';
+}
+
 function shortHash(value) {
   return crypto.createHash('sha1').update(String(value)).digest('hex').slice(0, 8);
 }
@@ -72,6 +97,10 @@ function tmuxManagedSession(projectRoot, peer) {
   return `hcc-${shortHash(projectRoot)}-${sanitizePeerPart(peer, 'peer')}`.slice(0, 80);
 }
 
+function tmuxManagedSessionPrefix(projectRoot) {
+  return `hcc-${shortHash(projectRoot)}-`;
+}
+
 function run(command, args, options = {}) {
   const result = spawnSync(command, args, {
     cwd: options.cwd || repoRoot,
@@ -140,6 +169,33 @@ function providerBindingRows(provider, sessionName) {
   `).all(provider, sessionName));
 }
 
+function parsePayloadJson(value) {
+  try {
+    const parsed = JSON.parse(value || '{}');
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+function eventPayloads(type, limit = 20, dbPath = path.join(root, '.hello-cc', 'mesh.db')) {
+  const db = new DatabaseSync(dbPath);
+  try {
+    return db.prepare(`
+      SELECT actor, payload
+      FROM events
+      WHERE type = ?
+      ORDER BY id DESC
+      LIMIT ?
+    `).all(type, limit).map((row) => ({
+      actor: row.actor,
+      payload: parsePayloadJson(row.payload)
+    }));
+  } finally {
+    db.close();
+  }
+}
+
 function peerBindingIndexNames(dbPath = path.join(root, '.hello-cc', 'mesh.db')) {
   const db = new DatabaseSync(dbPath);
   try {
@@ -366,7 +422,8 @@ async function assertTmuxGcPolicy() {
     }), t);
   });
 
-  const client = spawnSync('tmux', ['new-session', '-d', '-s', `${tmuxSession}-gc-client`, '-e', `HCC_ROOT=${root}`, 'sh', '-lc', `unset TMUX; exec tmux attach-session -t ${sh(attachedSession)}`], {
+  const attachTmux = realTmuxBin ? `${sh(realTmuxBin)} -L ${sh(tmuxSocketName)}` : 'tmux';
+  const client = spawnSync('tmux', ['new-session', '-d', '-s', `${tmuxSession}-gc-client`, '-e', `HCC_ROOT=${root}`, 'sh', '-lc', `unset TMUX; exec ${attachTmux} attach-session -t ${sh(attachedSession)}`], {
     env,
     encoding: 'utf8',
     stdio: ['ignore', 'pipe', 'pipe']
@@ -773,6 +830,48 @@ function tmuxAvailable() {
   return runMaybe('tmux', ['-V']).status === 0;
 }
 
+function tmuxCleanupEndpoints() {
+  if (!realTmuxBin) return [{ label: 'default', command: 'tmux', args: [] }];
+  return [
+    { label: 'test-socket', command: realTmuxBin, args: ['-L', tmuxSocketName] },
+    { label: 'default', command: realTmuxBin, args: [] }
+  ];
+}
+
+function runMaybeTmuxEndpoint(endpoint, args) {
+  return runMaybe(endpoint.command, [...endpoint.args, ...args]);
+}
+
+function listTmuxSessionsMatching(prefixes, endpoint) {
+  const output = runMaybeTmuxEndpoint(endpoint, ['list-sessions', '-F', '#{session_name}']);
+  if (output.status !== 0) return [];
+  return (output.stdout || '')
+    .split('\n')
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .filter((session) => prefixes.some((prefix) => session.startsWith(prefix)));
+}
+
+function killTmuxSessionOnEndpoint(endpoint, session) {
+  runMaybeTmuxEndpoint(endpoint, ['kill-session', '-t', session]);
+}
+
+function assertNoRegressionTmuxSessionLeak() {
+  const prefixes = [
+    tmuxManagedSessionPrefix(root),
+    tmuxManagedSessionPrefix(secondProjectRoot)
+  ];
+  const leaks = [];
+  for (const endpoint of tmuxCleanupEndpoints()) {
+    for (const session of listTmuxSessionsMatching(prefixes, endpoint)) {
+      leaks.push(`${endpoint.label}:${session}`);
+    }
+  }
+  if (leaks.length) {
+    fail(`regression leaked hcc-managed tmux sessions:\n${leaks.join('\n')}`);
+  }
+}
+
 function trackTmuxPane(pane) {
   if (!pane) return;
   const result = runMaybe('tmux', ['display-message', '-p', '-t', pane, '#S']);
@@ -947,19 +1046,34 @@ async function waitForFile(file, expected, label = file) {
 }
 
 async function waitForFileContent(file, expected, label = file) {
-  await waitFor(() => {
-    if (!fs.existsSync(file)) return false;
-    return fs.readFileSync(file, 'utf8').trim() === expected;
-  }, label);
+  const deadline = Date.now() + 10000;
+  let actual = '(missing)';
+  while (Date.now() < deadline) {
+    if (fs.existsSync(file)) {
+      actual = fs.readFileSync(file, 'utf8').trim();
+      if (actual === expected) break;
+    }
+    await sleep(100);
+  }
+  if (actual !== expected) {
+    fail(`timed out waiting for ${label}\nexpected: ${expected}\nactual: ${actual}`);
+  }
   ensureFile(file, expected);
 }
 
 async function waitForFileLineCount(file, expected, label = file) {
-  await waitFor(() => {
-    if (!fs.existsSync(file)) return false;
-    const lines = fs.readFileSync(file, 'utf8').split('\n').filter(Boolean);
-    return lines.length === expected;
-  }, label);
+  const deadline = Date.now() + 10000;
+  let actual = '(missing)';
+  while (Date.now() < deadline) {
+    if (fs.existsSync(file)) {
+      actual = fs.readFileSync(file, 'utf8').trim();
+      const lines = actual.split('\n').filter(Boolean);
+      if (lines.length === expected) return;
+    }
+    await sleep(100);
+  }
+  const count = actual === '(missing)' ? 0 : actual.split('\n').filter(Boolean).length;
+  fail(`timed out waiting for ${label}\nexpected lines: ${expected}\nactual lines: ${count}\nactual: ${actual}`);
 }
 
 async function waitRuntime() {
@@ -975,6 +1089,19 @@ async function waitRuntime() {
   }, 'runtime');
 }
 
+function processIsAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function waitForProcessExit(pid, label, timeoutMs = 5000) {
+  await waitFor(() => !processIsAlive(pid), label, timeoutMs);
+}
+
 async function expectWebSocketMarker(peer, marker) {
   await new Promise((resolve, reject) => {
     let sawSnapshot = false;
@@ -1001,6 +1128,21 @@ async function expectWebSocketMarker(peer, marker) {
   });
 }
 
+async function openTerminalWebSocket(peer) {
+  return new Promise((resolve, reject) => {
+    const ws = new WebSocket(runtimeWsUrl(peer));
+    const timer = setTimeout(() => reject(new Error(`${peer} websocket open timeout`)), 5000);
+    ws.on('open', () => {
+      clearTimeout(timer);
+      resolve(ws);
+    });
+    ws.on('error', (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+  });
+}
+
 async function expectResizeReplaceSnapshot(peer, marker) {
   await new Promise((resolve, reject) => {
     let sawSnapshot = false;
@@ -1120,17 +1262,20 @@ function startRuntime(options = {}) {
 
 async function stopRuntime() {
   if (!runtimePid) return;
+  const pid = runtimePid;
   hccMaybe(['down']);
-  await waitFor(() => {
+  try {
+    await waitForProcessExit(pid, 'runtime process exit', 5000);
+  } catch (err) {
+    try { process.kill(pid, 'SIGTERM'); } catch {}
     try {
-      process.kill(runtimePid, 0);
-      return false;
+      await waitForProcessExit(pid, 'runtime process exit after SIGTERM', 2000);
     } catch {
-      return true;
+      try { process.kill(pid, 'SIGKILL'); } catch {}
+      try { await waitForProcessExit(pid, 'runtime process exit after SIGKILL', 2000); } catch {}
+      throw err;
     }
-  }, 'runtime process exit', 5000).catch(() => {
-    try { process.kill(runtimePid, 'SIGTERM'); } catch {}
-  });
+  }
   runtimePid = null;
 }
 
@@ -1139,11 +1284,20 @@ function cleanup() {
   if (runtimePid) {
     try { process.kill(runtimePid, 'SIGTERM'); } catch {}
   }
-  if (tmuxStarted) {
-    runMaybe('tmux', ['kill-session', '-t', tmuxSession]);
-  }
-  for (const session of managedTmuxSessions) {
-    runMaybe('tmux', ['kill-session', '-t', session]);
+  const managedPrefixes = [
+    tmuxManagedSessionPrefix(root),
+    tmuxManagedSessionPrefix(secondProjectRoot)
+  ];
+  for (const endpoint of tmuxCleanupEndpoints()) {
+    for (const session of listTmuxSessionsMatching(managedPrefixes, endpoint)) {
+      managedTmuxSessions.add(session);
+    }
+    if (tmuxStarted) {
+      killTmuxSessionOnEndpoint(endpoint, tmuxSession);
+    }
+    for (const session of managedTmuxSessions) {
+      killTmuxSessionOnEndpoint(endpoint, session);
+    }
   }
   if (fs.existsSync(path.join(fakeBin, 'tmux'))) {
     runMaybe('tmux', ['kill-server']);
@@ -1153,8 +1307,36 @@ function cleanup() {
   }
 }
 
+function assertNoRealProjectRegistryLeak() {
+  const after = fs.existsSync(realRegistryFile)
+    ? fs.readFileSync(realRegistryFile, 'utf8')
+    : null;
+  if (!after) return;
+
+  let parsed = null;
+  try {
+    parsed = JSON.parse(after);
+  } catch {
+    fail(`regression changed real project registry with invalid JSON: ${realRegistryFile}`);
+  }
+  const leakedRoots = (parsed?.projects || [])
+    .map((project) => String(project?.root || ''))
+    .filter((projectRoot) => {
+      if (!projectRoot) return false;
+      if (projectRoot === root || projectRoot === home || projectRoot === fakeBin || projectRoot === outDir) return true;
+      return projectRoot.startsWith(`${root}${path.sep}`) ||
+        projectRoot.startsWith(`${home}${path.sep}`) ||
+        projectRoot.startsWith(`${fakeBin}${path.sep}`) ||
+        projectRoot.startsWith(`${outDir}${path.sep}`) ||
+        projectRoot.includes(`hcc-reg-${testId}`);
+    });
+  if (leakedRoots.length) {
+    fail(`regression leaked temporary projects into real registry ${realRegistryFile}:\n${leakedRoots.join('\n')}`);
+  }
+}
+
 async function setupRegression() {
-  log('[1/12] web bootstrap/hooks/shims');
+  log('[1/13] web bootstrap/hooks/shims');
   writeFakeTools();
   fs.mkdirSync(root, { recursive: true });
   fs.mkdirSync(home, { recursive: true });
@@ -1202,7 +1384,12 @@ async function setupRegression() {
     fail(`interactive bash did not keep codex shim first: ${interactiveCodex}`);
   }
   if (!hcc(['install-hooks', '--status']).includes('claude=yes codex=yes')) fail('hooks not installed');
-  if (!hcc(['shim', 'status']).includes('shims installed')) fail('shims not installed');
+  const shimStatusOutput = hcc(['shim', 'status']);
+  if (!shimStatusOutput.includes('claude: installed') ||
+      !shimStatusOutput.includes('codex: installed') ||
+      !shimStatusOutput.includes('status: complete')) {
+    fail(`shims not fully installed:\n${shimStatusOutput}`);
+  }
   const staleShim = path.join(home, '.hcc-shims', 'claude');
   fs.writeFileSync(staleShim, '#!/usr/bin/env bash\necho stale --web-managed\n', { mode: 0o755 });
   const ensured = hccMaybe(['shim', 'ensure', 'claude', staleShim]);
@@ -1213,6 +1400,25 @@ async function setupRegression() {
   if (!refreshedShim.includes('shim ensure "claude"') || refreshedShim.includes('stale --web-managed')) {
     fail(`shim ensure did not refresh stale shim:\n${refreshedShim}`);
   }
+  const deadRealBin = path.join(outDir, 'removed-claude');
+  fs.rmSync(deadRealBin, { force: true });
+  fs.writeFileSync(staleShim, [
+    '#!/usr/bin/env bash',
+    '# hello-cc shim for claude (auto-generated; do not edit manually)',
+    `# Real binary: ${deadRealBin}`,
+    `REAL_BIN=${sh(deadRealBin)}`,
+    'exec "$REAL_BIN" "$@"',
+    ''
+  ].join('\n'), { mode: 0o755 });
+  const rediscovered = hccMaybe(['shim', 'ensure', 'claude', staleShim, deadRealBin]);
+  if (rediscovered.status !== 75) {
+    fail(`shim ensure did not request re-exec for stale real binary:\n${rediscovered.stdout}\n${rediscovered.stderr}`);
+  }
+  const rediscoveredShim = fs.readFileSync(staleShim, 'utf8');
+  const expectedRealBin = path.join(fakeBin, 'claude');
+  if (!rediscoveredShim.includes(`# Real binary: ${expectedRealBin}`) || rediscoveredShim.includes(deadRealBin)) {
+    fail(`shim ensure preserved stale real binary instead of rediscovering PATH binary:\n${rediscoveredShim}`);
+  }
   await stopRuntime();
   assertPeerBindingUniqueConstraints();
   assertLegacySchemaMigration();
@@ -1304,16 +1510,18 @@ async function setupRegression() {
   const childDir = path.join(root, 'packages', 'child');
   fs.mkdirSync(childDir, { recursive: true });
   const childFindRoot = hccFrom(['find-root'], childDir).trim();
-  if (childFindRoot !== childDir) fail(`child find-root mismatch: ${childFindRoot} !== ${childDir}`);
+  if (!samePath(childFindRoot, childDir)) fail(`child find-root mismatch: ${childFindRoot} !== ${childDir}`);
   const childStatus = hccFrom(['status'], childDir);
-  if (!childStatus.includes(`root: ${childDir}`) || !childStatus.includes(`db: ${path.join(childDir, '.hello-cc', 'mesh.db')}`)) {
+  if (!samePath(statusValue(childStatus, 'root'), childDir) ||
+      !samePath(statusValue(childStatus, 'db'), path.join(childDir, '.hello-cc', 'mesh.db'))) {
     fail(`child command did not stay on current path:\n${childStatus}`);
   }
   ensureFile(path.join(childDir, '.hello-cc', 'mesh.db'));
   const explicitChildRoot = hccFrom(['--root', root, 'find-root'], childDir).trim();
-  if (explicitChildRoot !== root) fail(`explicit child find-root mismatch: ${explicitChildRoot} !== ${root}`);
+  if (!samePath(explicitChildRoot, root)) fail(`explicit child find-root mismatch: ${explicitChildRoot} !== ${root}`);
   const explicitChildStatus = hccFrom(['--root', root, 'status'], childDir);
-  if (!explicitChildStatus.includes(`root: ${root}`) || !explicitChildStatus.includes(`db: ${path.join(root, '.hello-cc', 'mesh.db')}`)) {
+  if (!samePath(statusValue(explicitChildStatus, 'root'), root) ||
+      !samePath(statusValue(explicitChildStatus, 'db'), path.join(root, '.hello-cc', 'mesh.db'))) {
     fail(`explicit child command did not use requested root:\n${explicitChildStatus}`);
   }
   const childHookPayload = JSON.stringify({ session_id: 'child-hook-session', cwd: childDir, hook_event_name: 'UserPromptSubmit', prompt: 'status?' });
@@ -1338,7 +1546,7 @@ async function setupRegression() {
 }
 
 async function dbWorkflow() {
-  log('[3/12] db workflow');
+  log('[3/13] db workflow');
   hcc(['register', '--peer', 'human', '--kind', 'human', '--role', 'operator']);
   const created = hcc(['task', 'create', '--from', 'human', '--to', 'codex-a', '--title', 'full regression task', '--body', 'exercise hcc bus']);
   const taskMatch = created.match(/created task #(\d+):/);
@@ -1452,6 +1660,38 @@ async function dbWorkflow() {
     hcc(['task', 'done', '--peer', 'batch-b', '--id', String(task.id), '--summary', 'batch next cleanup']);
   }
   hcc(['task', 'update', '--peer', 'human', '--id', batchNextIds[2], '--status', 'abandoned', '--summary', 'batch next leftover cleanup']);
+
+  const dispatched = hccJson(['task', 'dispatch', '--from', 'human', '--to', 'dispatch-a', '--title', 'dispatch new task', '--body', 'dispatch body', '--no-inject']);
+  if (!dispatched.task || dispatched.task.assignee !== 'dispatch-a' || dispatched.task.owner ||
+      dispatched.injected !== false || dispatched.injection_reason !== 'no_inject' || !dispatched.message_id) {
+    fail(`task dispatch did not create message-only assigned task:\n${JSON.stringify(dispatched, null, 2)}`);
+  }
+  const dispatchInbox = hcc(['msg', 'inbox', '--peer', 'dispatch-a', '--all']);
+  if (!dispatchInbox.includes(`task #${dispatched.task.id}`) || !dispatchInbox.includes('dispatch new task')) {
+    fail(`task dispatch durable message missing:\n${dispatchInbox}`);
+  }
+  const dispatchAudit = eventPayloads('task.dispatched', 20)
+    .find((event) => Number(event.payload?.message_id) === Number(dispatched.message_id));
+  if (!dispatchAudit ||
+      dispatchAudit.actor !== 'human' ||
+      dispatchAudit.payload.actor_peer !== 'human' ||
+      dispatchAudit.payload.target_peer !== 'dispatch-a' ||
+      dispatchAudit.payload.source !== 'cli' ||
+      dispatchAudit.payload.injected !== false ||
+      dispatchAudit.payload.injection_reason !== 'no_inject') {
+    fail(`task dispatch audit payload wrong:\n${JSON.stringify(dispatchAudit, null, 2)}`);
+  }
+  const dispatchExistingCreated = hcc(['task', 'create', '--from', 'human', '--title', 'dispatch existing task']);
+  const dispatchExistingMatch = dispatchExistingCreated.match(/created task #(\d+):/);
+  if (!dispatchExistingMatch) fail(`cannot parse dispatch existing task id: ${dispatchExistingCreated}`);
+  const dispatchExisting = hccJson(['task', 'dispatch', '--from', 'human', '--to', 'dispatch-b', '--id', dispatchExistingMatch[1], '--message', 'custom dispatch existing', '--no-inject']);
+  if (String(dispatchExisting.task?.id) !== dispatchExistingMatch[1] ||
+      dispatchExisting.task.assignee !== 'dispatch-b' ||
+      dispatchExisting.message !== 'custom dispatch existing' ||
+      dispatchExisting.injected !== false) {
+    fail(`task dispatch --id did not assign existing task:\n${JSON.stringify(dispatchExisting, null, 2)}`);
+  }
+
   const takeoverOpen = hcc(['task', 'create', '--from', 'human', '--to', 'takeover-owner', '--title', 'takeover open']);
   const takeoverOpenMatch = takeoverOpen.match(/created task #(\d+):/);
   if (!takeoverOpenMatch) fail(`cannot parse takeover open id: ${takeoverOpen}`);
@@ -1505,7 +1745,8 @@ async function dbWorkflow() {
       !staleLivenessState.automation.next_action.argv.includes('stale')) {
     fail(`state automation did not suggest stale takeover:\n${JSON.stringify(staleLivenessState.automation, null, 2)}`);
   }
-  hcc(['task', 'update', '--peer', 'human', '--force', '--id', staleLivenessTaskId, '--status', 'abandoned', '--summary', 'stale liveness cleanup']);
+  hcc(['task', 'takeover', '--peer', 'human', '--id', staleLivenessTaskId, '--reason', 'stale liveness cleanup', '--policy', 'stale', '--stale-after', '60']);
+  hcc(['task', 'update', '--peer', 'human', '--id', staleLivenessTaskId, '--status', 'abandoned', '--summary', 'stale liveness cleanup']);
   hcc(['task', 'update', '--peer', 'human', '--id', queuedTaskId, '--status', 'abandoned', '--summary', 'queued task cleanup']);
   hcc(['handoff', 'create', '--from', 'codex-a', '--to', 'claude-a', '--task', taskId, '--summary', 'handoff summary', '--tests', 'full script', '--risks', 'none']);
   if (!hcc(['handoff', 'list', '--task', taskId]).includes('handoff summary')) fail('handoff missing');
@@ -1727,13 +1968,14 @@ async function dbWorkflow() {
 }
 
 async function multiProjectWebWorkflow() {
-  log('[4/12] multi-project web');
-  const otherRoot = path.join(root, 'second-project');
+  log('[4/13] multi-project web');
+  const otherRoot = secondProjectRoot;
   fs.mkdirSync(otherRoot, { recursive: true });
   const output = hccFrom(['web', '--local', '--port', String(port), '--no-discover', '--no-guidance'], otherRoot);
   if (!output.includes('web already running in background')) fail(`second project did not reuse global web:\n${output}`);
-  if (!output.includes(`project: ${otherRoot}`)) fail(`second project output did not show its root:\n${output}`);
-  if (!output.includes(encodeURIComponent(otherRoot))) fail(`second project URL did not include project query:\n${output}`);
+  const outputRoot = statusValue(output, 'project');
+  if (!samePath(outputRoot, otherRoot)) fail(`second project output did not show its root:\n${output}`);
+  if (!output.includes(encodeURIComponent(outputRoot))) fail(`second project URL did not include project query:\n${output}`);
 
   const otherRuntimeFile = path.join(otherRoot, '.hello-cc', 'runtime.json');
   ensureFile(otherRuntimeFile);
@@ -1745,8 +1987,9 @@ async function multiProjectWebWorkflow() {
   const projectsResponse = await runtimeFetch('/api/projects', {}, { root: otherRoot });
   const projects = await projectsResponse.json();
   if (!projectsResponse.ok) fail(`projects API failed: ${JSON.stringify(projects)}`);
-  const roots = new Set((projects.projects || []).map((p) => p.root));
-  if (!roots.has(root) || !roots.has(otherRoot)) {
+  const roots = (projects.projects || []).map((p) => p.root);
+  if (!roots.some((projectRoot) => samePath(projectRoot, root)) ||
+      !roots.some((projectRoot) => samePath(projectRoot, otherRoot))) {
     fail(`projects API did not include both roots:\n${JSON.stringify(projects, null, 2)}`);
   }
 
@@ -1907,6 +2150,72 @@ async function multiProjectWebWorkflow() {
     fail(`sessions API did not expose unknown provider binding without marking it shared/known:\n${JSON.stringify(otherShellSession, null, 2)}`);
   }
 
+  const startProvider = async (payload) => {
+    const response = await runtimeFetch('/api/sessions', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        env: {
+          HOME: home,
+          PATH: env.PATH,
+          SHELL: process.env.SHELL || 'bash',
+          HCC_FAKE_STAY_ALIVE: '1'
+        },
+        ...payload
+      })
+    }, { root });
+    const json = await response.json();
+    if (!response.ok) fail(`web provider session start failed: ${JSON.stringify(json)}`);
+    return json.session;
+  };
+  const stopSession = async (id, payload = null) => {
+    const options = payload
+      ? {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify(payload)
+        }
+      : { method: 'POST' };
+    const response = await runtimeFetch(`/api/sessions/${encodeURIComponent(id)}/stop`, options, { root });
+    const json = await response.json();
+    if (!response.ok) fail(`web provider session stop failed: ${JSON.stringify(json)}`);
+    return json.session;
+  };
+
+  const auditSpoofSession = await startProvider({
+    kind: 'shell',
+    command: 'bash --noprofile --norc',
+    auditActorPeer: 'spoofed-web-actor',
+    auditSource: 'spoofed-source'
+  });
+  const auditSpoofPeer = auditSpoofSession.peer_id || auditSpoofSession.id;
+  const attachAudit = eventPayloads('tmux.session.attached', 80)
+    .find((event) => event.payload?.target_peer === auditSpoofPeer);
+  if (!attachAudit ||
+      attachAudit.actor !== 'web' ||
+      attachAudit.payload.actor_peer !== 'web' ||
+      attachAudit.payload.source !== 'web' ||
+      attachAudit.payload.actor_peer === 'spoofed-web-actor' ||
+      attachAudit.payload.source === 'spoofed-source') {
+    fail(`web start audit allowed spoofed actor/source:\n${JSON.stringify({ auditSpoofSession, attachAudit }, null, 2)}`);
+  }
+  await stopSession(auditSpoofSession.id, {
+    auditActorPeer: 'spoofed-stop-actor',
+    auditSource: 'spoofed-source'
+  });
+  const stopAudit = eventPayloads('web.session.stop_requested', 80)
+    .find((event) => event.payload?.target_peer === auditSpoofPeer);
+  if (!stopAudit ||
+      stopAudit.actor !== 'web' ||
+      stopAudit.payload.actor_peer !== 'web' ||
+      stopAudit.payload.target_peer !== auditSpoofPeer ||
+      stopAudit.payload.source !== 'web' ||
+      stopAudit.payload.admin !== true ||
+      stopAudit.payload.actor_peer === 'spoofed-stop-actor' ||
+      stopAudit.payload.source === 'spoofed-source') {
+    fail(`web stop audit allowed spoofed actor/source:\n${JSON.stringify({ auditSpoofSession, stopAudit }, null, 2)}`);
+  }
+
   hcc(['register', '--peer', 'web-action-peer', '--kind', 'codex', '--role', 'peer']);
   hcc(['msg', 'send', '--from', 'human', '--to', 'web-action-peer', '--body', 'web action inbox ok']);
   const actionStatus = await (await runtimeFetch('/api/peers/web-action-peer/actions/status', {}, { root })).json();
@@ -1924,10 +2233,28 @@ async function multiProjectWebWorkflow() {
   const taskOutput = hcc(['task', 'create', '--title', 'web action task', '--body', 'claim through web action']);
   const taskMatch = taskOutput.match(/created task #(\d+):/);
   if (!taskMatch) fail(`cannot parse web action task id:\n${taskOutput}`);
-  const actionNext = await (await runtimeFetch('/api/peers/web-action-peer/actions/task-next', {
+  const rejectedActionNextResponse = await runtimeFetch('/api/peers/web-action-peer/actions/task-next', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: '{}'
+  }, { root });
+  const rejectedActionNext = await rejectedActionNextResponse.json();
+  if (rejectedActionNextResponse.ok || rejectedActionNext.error?.code !== 'PEER_IDENTITY_REQUIRED') {
+    fail(`web task-next accepted unmanaged peer identity:\n${JSON.stringify(rejectedActionNext, null, 2)}`);
+  }
+  const unmanagedTaskAfterReject = hccJson(['task', 'list', '--all']).find((task) => String(task.id) === taskMatch[1]);
+  if (!unmanagedTaskAfterReject || unmanagedTaskAfterReject.owner) {
+    fail(`rejected web task-next still changed task owner:\n${JSON.stringify(unmanagedTaskAfterReject, null, 2)}`);
+  }
+
+  const managedActionSession = await startProvider({ kind: 'shell', command: 'bash --noprofile --norc' });
+  if (!managedActionSession.action_token) {
+    fail(`managed web session did not include action token:\n${JSON.stringify(managedActionSession, null, 2)}`);
+  }
+  const actionNext = await (await runtimeFetch(`/api/peers/${encodeURIComponent(managedActionSession.peer_id || managedActionSession.id)}/actions/task-next`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ action_token: managedActionSession.action_token })
   }, { root })).json();
   if (!actionNext.ok || actionNext.action !== 'task-next' || String(actionNext.data?.task?.id) !== taskMatch[1]) {
     fail(`web task-next action did not claim pending task #${taskMatch[1]}:\n${JSON.stringify(actionNext, null, 2)}`);
@@ -1937,31 +2264,51 @@ async function multiProjectWebWorkflow() {
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ renew_locks: true })
   }, { root })).json();
-  if (!actionHeartbeat.ok || actionHeartbeat.action !== 'heartbeat' || actionHeartbeat.data?.peer !== 'web-action-peer') {
-    fail(`web heartbeat action did not return structured result:\n${JSON.stringify(actionHeartbeat, null, 2)}`);
+  if (actionHeartbeat.ok || actionHeartbeat.error?.code !== 'PEER_IDENTITY_REQUIRED') {
+    fail(`web heartbeat accepted unmanaged peer identity:\n${JSON.stringify(actionHeartbeat, null, 2)}`);
   }
 
-  const startProvider = async (payload) => {
-    const response = await runtimeFetch('/api/sessions', {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        env: {
-          HOME: home,
-          PATH: env.PATH,
-          SHELL: process.env.SHELL || 'bash',
-          HCC_FAKE_STAY_ALIVE: '1'
-        },
-        ...payload
-      })
-    }, { root });
-    const json = await response.json();
-    if (!response.ok) fail(`web provider session start failed: ${JSON.stringify(json)}`);
-    return json.session;
-  };
-  const stopSession = async (id) => {
-    await runtimeFetch(`/api/sessions/${encodeURIComponent(id)}/stop`, { method: 'POST' }, { root });
-  };
+  const ownerTask = hcc(['task', 'create', '--from', 'web-lock-owner', '--title', 'web lock owner task']);
+  const ownerTaskMatch = ownerTask.match(/created task #(\d+):/);
+  if (!ownerTaskMatch) fail(`cannot parse web lock owner task id:\n${ownerTask}`);
+  hcc(['task', 'claim', '--peer', 'web-lock-owner', '--id', ownerTaskMatch[1]]);
+  const rejectedLockResponse = await runtimeFetch(`/api/peers/${encodeURIComponent(managedActionSession.peer_id || managedActionSession.id)}/actions/lock-acquire`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      action_token: managedActionSession.action_token,
+      resource: 'web/identity-spoof-lock',
+      task: Number(ownerTaskMatch[1])
+    })
+  }, { root });
+  const rejectedLock = await rejectedLockResponse.json();
+  if (rejectedLockResponse.ok || rejectedLock.error?.code !== 'TASK_OWNED') {
+    fail(`web lock-acquire did not enforce task owner:\n${JSON.stringify(rejectedLock, null, 2)}`);
+  }
+  const lockRowsAfterReject = hccJson(['lock', 'list', '--all']);
+  if (lockRowsAfterReject.some((lock) => lock.resource === 'web/identity-spoof-lock')) {
+    fail(`rejected web lock-acquire still inserted a lock:\n${JSON.stringify(lockRowsAfterReject, null, 2)}`);
+  }
+  hcc(['task', 'done', '--peer', managedActionSession.peer_id || managedActionSession.id, '--id', taskMatch[1], '--summary', 'web action cleanup'], {
+    env: { ...env, HCC_PEER: managedActionSession.peer_id || managedActionSession.id }
+  });
+  hcc(['task', 'done', '--peer', 'web-lock-owner', '--id', ownerTaskMatch[1], '--summary', 'web lock owner cleanup'], {
+    env: { ...env, HCC_PEER: 'web-lock-owner' }
+  });
+  await stopSession(managedActionSession.id);
+
+  hcc(['register', '--peer', 'detected-msg-peer', '--kind', 'codex', '--role', 'peer']);
+  const spoofedDetectedMessage = await (await runtimeFetch('/api/detected/detected-msg-peer/msg', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ from: 'web-action-peer', body: 'detected sender spoof attempt' })
+  }, { root })).json();
+  if (!spoofedDetectedMessage.ok) fail(`detected message send failed:\n${JSON.stringify(spoofedDetectedMessage, null, 2)}`);
+  const detectedInbox = hccJson(['msg', 'inbox', '--peer', 'detected-msg-peer', '--all']);
+  const detectedMsg = detectedInbox.find((message) => message.body === 'detected sender spoof attempt');
+  if (!detectedMsg || detectedMsg.sender !== 'web') {
+    fail(`detected message sender spoof was not forced to web:\n${JSON.stringify(detectedInbox, null, 2)}`);
+  }
 
   const claudeResumeName = `web-claude-resume-${testId}`;
   const claudeResume = await startProvider({ kind: 'claude', mode: 'resume', resume: claudeResumeName });
@@ -2069,11 +2416,11 @@ async function multiProjectWebWorkflow() {
 
 async function tmuxBackedStartWorkflow() {
   if (!tmuxAvailable()) {
-    log('[5/12] tmux-backed start skipped (tmux not installed)');
+    log('[5/13] tmux-backed start skipped (tmux not installed)');
     return;
   }
 
-  log('[5/12] tmux-backed start + websocket + restore');
+  log('[5/13] tmux-backed start + websocket + restore');
   const file = path.join(outDir, 'pty-ok');
   const started = hcc(['peer', 'start', 'shell-a', '--kind', 'shell', '--', 'bash']);
   const pane = parsePane(started);
@@ -2087,11 +2434,18 @@ async function tmuxBackedStartWorkflow() {
   await expectWebSocketInputVisible('shell-a', 'WS_INPUT_VISIBLE_OK');
   await expectBoundedTmuxStream('tmux-backed FIFO stream');
 
-  await stopRuntime();
+  const heldWs = await openTerminalWebSocket('shell-a');
+  try {
+    await stopRuntime();
+    await waitFor(() => heldWs.readyState === WebSocket.CLOSED || heldWs.readyState === WebSocket.CLOSING, 'runtime websocket close', 2000);
+  } finally {
+    try { heldWs.close(); } catch {}
+  }
   run('tmux', ['display-message', '-p', '-t', pane, '#{pane_id}']);
   startRuntime();
   await waitRuntime();
-  await waitFor(() => hcc(['peer', 'list']).includes('shell-a'), 'tmux-backed peer restore');
+  await waitFor(() => hcc(['peer', 'list']).includes('shell-a'), 'tmux-backed peer restore after websocket shutdown');
+
   const restoredFile = path.join(outDir, 'pty-restored-ok');
   hcc(['inject', 'shell-a', `echo PTY_RESTORED_OK > ${restoredFile}`]);
   await waitForFile(restoredFile, 'PTY_RESTORED_OK', 'tmux restore injection');
@@ -2178,11 +2532,11 @@ async function tmuxBackedStartWorkflow() {
 
 async function shimTmuxWorkflow() {
   if (!tmuxAvailable()) {
-    log('[6/12] shim tmux-backed launch skipped (tmux not installed)');
+    log('[6/13] shim tmux-backed launch skipped (tmux not installed)');
     return;
   }
 
-  log('[6/12] shim tmux-backed launch');
+  log('[6/13] shim tmux-backed launch');
   const shim = path.join(home, '.hcc-shims', 'claude');
   const codexShim = path.join(home, '.hcc-shims', 'codex');
   const claudeVersion = run(shim, ['--version'], { cwd: root, env });
@@ -2253,6 +2607,9 @@ async function shimTmuxWorkflow() {
   const firstEnvFile = path.join(outDir, 'shim-env-first');
   hcc(['inject', peer, `printf '%s\\n' "$HCC_REG_VALUE" > ${firstEnvFile}`]);
   await waitForFile(firstEnvFile, 'shim-first', 'shim first env');
+  const shimInternalEnvFile = path.join(outDir, 'shim-internal-env');
+  hcc(['inject', peer, `printf '%s|%s\\n' "\${HCC_SHIM_ENSURED-unset}" "\${HCC_SKIP_SHIM_INSTALL-unset}" > ${shimInternalEnvFile}`]);
+  await waitForFile(shimInternalEnvFile, 'unset|unset', 'shim internal env cleanup');
 
   const restarted = run(shim, ['--resume', 'shim-regression-session'], {
     cwd: root,
@@ -2274,12 +2631,34 @@ async function shimTmuxWorkflow() {
     HCC_FAKE_STAY_ALIVE: '0',
     HCC_FAKE_LOG: exitedLog
   };
-  const exitedFirst = run(shim, ['--resume', exitedResume], { cwd: root, env: exitedEnv });
+  const exitedFirstResult = runMaybe(shim, ['--resume', exitedResume], { cwd: root, env: exitedEnv });
+  if (exitedFirstResult.status !== 0) {
+    const allShimLines = fs.readFileSync(shim, 'utf8').split('\n');
+    const shimLines = allShimLines
+      .slice(0, 35)
+      .concat(['...'])
+      .concat(allShimLines.slice(139))
+      .map((line, index) => {
+        if (index < 35) return `${index + 1}: ${line}`;
+        if (index === 35) return line;
+        return `${index + 104}: ${line}`;
+      })
+      .join('\n');
+    fail(`${sh([shim, '--resume', exitedResume].join(' '))} failed\n${exitedFirstResult.stdout || ''}${exitedFirstResult.stderr || ''}\nshim excerpt:\n${shimLines}`);
+  }
+  const exitedFirst = exitedFirstResult.stdout || '';
   const exitedPeerMatch = exitedFirst.match(/started\s+(\S+)\s+\(/);
   if (!exitedPeerMatch) fail(`exited shim did not start a peer:\n${exitedFirst}`);
   const exitedPeer = exitedPeerMatch[1];
-  parsePane(exitedFirst);
-  await waitForFileLineCount(exitedLog, 1, 'shim exited first provider launch');
+  const exitedPane = parsePane(exitedFirst);
+  try {
+    await waitForFileLineCount(exitedLog, 1, 'shim exited first provider launch');
+  } catch (err) {
+    const paneCapture = runMaybe('tmux', ['capture-pane', '-p', '-S', '-80', '-t', exitedPane]);
+    const peerList = hccMaybe(['peer', 'list']);
+    const shimHead = fs.readFileSync(shim, 'utf8').split('\n').slice(0, 18).join('\n');
+    fail(`${err.message}\nshim output:\n${exitedFirst}\nshim stderr:\n${exitedFirstResult.stderr || ''}\npeer list:\n${peerList.stdout || ''}${peerList.stderr || ''}\npane ${exitedPane}:\n${paneCapture.stdout || ''}${paneCapture.stderr || ''}\nshim head:\n${shimHead}`);
+  }
   const fallbackFile = path.join(outDir, 'shim-exited-fallback');
   hcc(['inject', exitedPeer, `printf '%s\\n' fallback > ${sh(fallbackFile)}`]);
   await waitForFile(fallbackFile, 'fallback', 'shim exited fallback shell');
@@ -2292,11 +2671,11 @@ async function shimTmuxWorkflow() {
 async function tmuxWorkflow() {
   const tmuxVersion = runMaybe('tmux', ['-V']);
   if (tmuxVersion.status !== 0) {
-    log('[7/12] tmux skipped (tmux not installed)');
+    log('[7/13] tmux skipped (tmux not installed)');
     return;
   }
 
-  log('[7/12] tmux attach + websocket + force');
+  log('[7/13] tmux attach + websocket + force');
   run('tmux', ['new-session', '-d', '-s', tmuxSession, '-c', os.tmpdir(), 'bash --noprofile --norc']);
   tmuxStarted = true;
   const pane = run('tmux', ['display-message', '-p', '-t', `${tmuxSession}:0.0`, '#{pane_id}']).trim();
@@ -2318,23 +2697,33 @@ async function tmuxWorkflow() {
 
 async function askBroadcastWorkflow() {
   if (!tmuxAvailable()) {
-    log('[8/12] ask/broadcast injection skipped (tmux not installed)');
+    log('[8/13] ask/broadcast injection skipped (tmux not installed)');
     return;
   }
 
-  log('[8/12] ask/broadcast injection');
+  log('[8/13] ask/broadcast injection');
   const askFile = path.join(outDir, 'ask-ok');
   parsePane(hcc(['peer', 'start', 'shell-b', '--kind', 'shell', '--', 'bash']));
   hcc(['ask', 'shell-b', `echo ASK_OK > ${askFile}`, '--from', 'human', '--inject']);
   await waitForFile(askFile, 'ASK_OK', 'ask injection');
   if (!hcc(['msg', 'inbox', '--peer', 'shell-b', '--all']).includes('ASK_OK')) fail('ask durable message missing');
+  const shellDefaultDispatch = hccJson(['task', 'dispatch', '--from', 'human', '--to', 'shell-b', '--title', 'shell default dispatch']);
+  if (shellDefaultDispatch.injected !== false || shellDefaultDispatch.injection_reason !== 'unsupported_session_kind') {
+    fail(`task dispatch injected default natural-language prompt into shell session:\n${JSON.stringify(shellDefaultDispatch, null, 2)}`);
+  }
+  const dispatchFile = path.join(outDir, 'dispatch-ok');
+  const shellCommandDispatch = hccJson(['task', 'dispatch', '--from', 'human', '--to', 'shell-b', '--title', 'shell command dispatch', '--message', `echo DISPATCH_OK > ${dispatchFile}`, '--force']);
+  if (!shellCommandDispatch.injected || shellCommandDispatch.delivery !== 'message+inject') {
+    fail(`task dispatch did not inject explicit shell-safe message:\n${JSON.stringify(shellCommandDispatch, null, 2)}`);
+  }
+  await waitForFile(dispatchFile, 'DISPATCH_OK', 'task dispatch injection');
   const broadcastFile = path.join(outDir, 'broadcast-ok');
   hcc(['broadcast', `echo BROADCAST_OK > ${broadcastFile}`, '--from', 'human', '--inject']);
   await waitForFile(broadcastFile, 'BROADCAST_OK', 'broadcast injection');
 }
 
 async function downGcPackWorkflow() {
-  log('[9/12] down/gc/pack');
+  log('[9/13] down/gc/pack');
   hccMaybe(['peer', 'stop', 'shell-a']);
   hccMaybe(['peer', 'stop', 'shell-b']);
   await stopRuntime();
@@ -2378,8 +2767,8 @@ async function downGcPackWorkflow() {
     "tags:\n      - 'v*'",
     'workflow_dispatch:',
     'contents: write',
-    'actions/checkout@v4',
-    'actions/setup-node@v4',
+    'actions/checkout@v5',
+    'actions/setup-node@v5',
     'node-version: 24',
     'npm run release:check',
     'npm run release:github:dry-run',
@@ -2391,7 +2780,7 @@ async function downGcPackWorkflow() {
 }
 
 function oldNameScan() {
-  log('[10/12] old-name scan');
+  log('[10/13] old-name scan');
   const oldNamePattern = [
     'agent' + 'mesh',
     'Agent' + 'mesh',
@@ -2402,20 +2791,144 @@ function oldNameScan() {
     'ACTIVE_' + 'AGENT_' + 'TTL',
     '--' + 'agent\\b'
   ].join('|');
-  const rg = runMaybe('rg', [
-    '-n',
-    '--glob', '!node_modules/**',
-    '--glob', '!*.tgz',
-    '--',
-    oldNamePattern,
-    '.'
-  ]);
-  if (rg.status === 0) fail(`old names found:\n${rg.stdout}`);
-  if (rg.status !== 1) fail(`rg failed:\n${rg.stderr || rg.stdout}`);
+  const oldNameRegex = new RegExp(oldNamePattern);
+  const files = run('git', ['ls-files'])
+    .split('\n')
+    .map((file) => file.trim())
+    .filter(Boolean)
+    .filter((file) => !file.includes('/node_modules/') && !file.endsWith('.tgz'));
+  const matches = [];
+  for (const file of files) {
+    const fullPath = path.join(repoRoot, file);
+    let content = '';
+    try { content = fs.readFileSync(fullPath, 'utf8'); } catch { continue; }
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i += 1) {
+      if (oldNameRegex.test(lines[i])) matches.push(`${file}:${i + 1}: ${lines[i]}`);
+    }
+  }
+  if (matches.length) fail(`old names found:\n${matches.join('\n')}`);
+}
+
+function identityEnforcementWorkflow() {
+  log('[11/13] identity enforcement');
+  const identityRoot = fs.mkdtempSync(path.join(os.tmpdir(), `hcc-reg-identity-root-${testId}-`));
+  const identityHome = fs.mkdtempSync(path.join(os.tmpdir(), `hcc-reg-identity-home-${testId}-`));
+  const identityEnv = {
+    ...env,
+    HOME: identityHome,
+    HCC_PEER: 'real-peer'
+  };
+  delete identityEnv.HCC_ROOT;
+  delete identityEnv.HCC_DB;
+  try {
+    hccFrom(['register', '--peer', 'fake-peer', '--kind', 'codex', '--role', 'peer'], identityRoot, { env: identityEnv });
+    const envOut = hccFrom(['env', '--peer', 'fake-peer'], identityRoot, { env: identityEnv });
+    if (!envOut.includes('HCC_PEER=fake-peer')) {
+      fail(`env did not export explicit target peer:\n${envOut}`);
+    }
+    const created = hccFrom(['task', 'create', '--from', 'fake-peer', '--title', 'identity guard'], identityRoot, { env: identityEnv });
+    const match = created.match(/created task #(\d+):/);
+    if (!match) fail(`cannot parse identity task id:\n${created}`);
+    const taskId = match[1];
+    hccFrom(['task', 'claim', '--peer', 'fake-peer', '--id', taskId], identityRoot, { env: identityEnv });
+
+    const dbPath = path.join(identityRoot, '.hello-cc', 'mesh.db');
+    const db = new DatabaseSync(dbPath);
+    try {
+      const task = db.prepare('SELECT owner, created_by FROM tasks WHERE id = ?').get(Number(taskId));
+      const fakePeer = db.prepare('SELECT id FROM peers WHERE id = ?').get('fake-peer');
+      if (task?.owner !== 'real-peer' || task?.created_by !== 'real-peer' || fakePeer) {
+        fail(`system peer identity was not enforced:\n${JSON.stringify({ task, fakePeer }, null, 2)}`);
+      }
+      db.prepare(`
+        INSERT INTO peers(id, kind, role, worktree, branch, pid, status, capabilities, created_at, last_seen_at)
+        VALUES ('inspect-peer', 'codex', 'peer', ?, '', NULL, 'working', '', 1, 1)
+      `).run(identityRoot);
+      db.prepare(`
+        INSERT INTO peers(id, kind, role, worktree, branch, pid, status, capabilities, created_at, last_seen_at)
+        VALUES ('owner-peer', 'codex', 'peer', ?, '', NULL, 'working', '', 1, 1)
+      `).run(identityRoot);
+      db.prepare(`
+        INSERT INTO tasks(title, body, status, assignee, owner, priority, created_by, created_at, updated_at)
+        VALUES ('owned identity guard', '', 'claimed', NULL, 'owner-peer', 100, 'owner-peer', 1, 1)
+      `).run();
+    } finally {
+      db.close();
+    }
+
+    const statusOut = hccFrom(['status', '--peer', 'inspect-peer'], identityRoot, { env: identityEnv });
+    if (!statusOut.includes('inbox(inspect-peer)')) {
+      fail(`status did not inspect explicit target peer:\n${statusOut}`);
+    }
+    const stateOut = hccFrom(['state', '--peer', 'inspect-peer'], identityRoot, { env: identityEnv });
+    if (!stateOut.includes('peer: inspect-peer')) {
+      fail(`state did not inspect explicit target peer:\n${stateOut}`);
+    }
+
+    const owned = hccFromMaybe(['task', 'done', '--peer', 'owner-peer', '--id', '2', '--summary', 'should not pass'], identityRoot, { env: identityEnv });
+    if (owned.status === 0 || !`${owned.stdout}\n${owned.stderr}`.includes('Task #2 is owned by owner-peer')) {
+      fail(`owned task mutation was not rejected:\nstdout=${owned.stdout}\nstderr=${owned.stderr}`);
+    }
+    const forcedOwned = hccFromMaybe(['task', 'done', '--force', '--peer', 'owner-peer', '--id', '2', '--summary', 'should not pass'], identityRoot, { env: identityEnv });
+    if (forcedOwned.status === 0 || !`${forcedOwned.stdout}\n${forcedOwned.stderr}`.includes('Task #2 is owned by owner-peer')) {
+      fail(`forced owned task mutation was not rejected:\nstdout=${forcedOwned.stdout}\nstderr=${forcedOwned.stderr}`);
+    }
+    const db2 = new DatabaseSync(dbPath);
+    try {
+      const task = db2.prepare('SELECT owner, status FROM tasks WHERE id = 2').get();
+      const notice = db2.prepare(`
+        SELECT sender, recipient, kind
+        FROM messages
+        WHERE task_id = 2 AND kind = 'task.owner-conflict'
+      `).get();
+      if (task?.owner !== 'owner-peer' || task?.status !== 'claimed' ||
+          !notice || notice.sender !== 'real-peer' || notice.recipient !== 'owner-peer') {
+        fail(`owned task mutation did not preserve owner and notify:\n${JSON.stringify({ task, notice }, null, 2)}`);
+      }
+    } finally {
+      db2.close();
+    }
+
+    hccFrom(['run', '--peer', 'fake-runner', '--', process.execPath, '-e', 'process.exit(0)'], identityRoot, { env: identityEnv });
+    const db3 = new DatabaseSync(dbPath);
+    try {
+      const realRunner = db3.prepare('SELECT id, status FROM peers WHERE id = ?').get('real-peer');
+      const fakeRunner = db3.prepare('SELECT id FROM peers WHERE id = ?').get('fake-runner');
+      if (!realRunner || realRunner.status !== 'exited' || fakeRunner) {
+        fail(`run did not enforce system peer identity:\n${JSON.stringify({ realRunner, fakeRunner }, null, 2)}`);
+      }
+    } finally {
+      db3.close();
+    }
+
+    hccFrom(['peer', 'stop', 'fake-target'], identityRoot, { env: identityEnv });
+    const stopRequested = eventPayloads('peer.stop.requested', 5, dbPath)
+      .find((event) => event.payload?.target_peer === 'fake-target');
+    if (!stopRequested ||
+        stopRequested.actor !== 'real-peer' ||
+        stopRequested.payload.actor_peer !== 'real-peer' ||
+        stopRequested.payload.source !== 'cli' ||
+        stopRequested.payload.admin !== true) {
+      fail(`peer stop request did not record real actor and target:\n${JSON.stringify(stopRequested, null, 2)}`);
+    }
+    const stoppedFallback = eventPayloads('peer.stopped', 5, dbPath)
+      .find((event) => event.payload?.target_peer === 'fake-target');
+    if (!stoppedFallback ||
+        stoppedFallback.actor !== 'real-peer' ||
+        stoppedFallback.payload.actor_peer !== 'real-peer' ||
+        stoppedFallback.payload.source !== 'cli' ||
+        stoppedFallback.payload.admin !== true) {
+      fail(`peer stop fallback did not record real actor and target:\n${JSON.stringify(stoppedFallback, null, 2)}`);
+    }
+  } finally {
+    try { fs.rmSync(identityRoot, { recursive: true, force: true }); } catch {}
+    try { fs.rmSync(identityHome, { recursive: true, force: true }); } catch {}
+  }
 }
 
 async function syntaxAndHelp() {
-  log('[11/12] syntax/help');
+  log('[12/13] syntax/help');
   run(process.execPath, ['--check', path.join(repoRoot, 'bin', 'hcc.mjs')]);
   for (const file of libModuleFiles()) {
     run(process.execPath, ['--check', path.join(repoRoot, file)]);
@@ -2601,7 +3114,19 @@ async function syntaxAndHelp() {
     '} = createWebPeerActions({',
     'const peerActionMatch = url.pathname.match(/^\\/api\\/peers\\/([^/]+)\\/actions\\/([^/]+)$/)',
     "const readOnly = ['status', 'state', 'inbox'].includes(action)",
-    "sendJson(res, 200, webPeerAction(reqCtx, peer, action, input));"
+    'resolveWebActionSession(reqCtx, peer, input, req)',
+    'action_token: session.actionToken || null',
+    "const sender = 'web';",
+    'function auditPayload({ actor = null, target = null, source = ',
+    'payload.actor_peer = actor',
+    'payload.target_peer = target',
+    "auditActorPeer: 'web'",
+    "auditSource: 'web'",
+    "addEvent(db, 'peer.start.requested'",
+    "addEvent(db, 'peer.attach.requested'",
+    "addEvent(db, 'peer.stop.requested'",
+    "addEvent(eventDb, 'web.session.stop_requested'",
+    "addEvent(db, 'tmux.session.gc'"
   ]) {
     if (!hccSource.includes(expected)) fail(`web peer action API support missing: ${expected}`);
   }
@@ -2618,9 +3143,17 @@ async function syntaxAndHelp() {
     if (hccSource.includes(helper)) fail(`CLI still embeds web peer action helper: ${helper}`);
   }
   for (const expected of [
+    'function webMutationPeer(peer, input = {})',
     'function webPeerAction(projectCtx, peer, action, input = {})',
+    'function webAuditPayload(peer, input = {}, extra = {})',
+    "source: 'web'",
+    'actor_peer: actorPeer',
+    'target_peer: peer',
+    "throw new CliError('PEER_IDENTITY_MISMATCH'",
+    "throw new CliError('PEER_IDENTITY_REQUIRED'",
     'claimNextTasksForPeer(db, peer, { force: Boolean(input.force), count })',
     'takeOverTaskForPeer(db, peer, id, { reason, policy, staleAfter, source: ',
+    "assertTaskOwnerForMutation(db, peer, task, 'lock-acquire')",
     'const status = statusSummary(projectCtx, peer)',
     "normalized === 'task-next'",
     "normalized === 'lock-acquire'",
@@ -2777,6 +3310,7 @@ async function syntaxAndHelp() {
     'function installShims',
     'function uninstallShims',
     'function verifyShims',
+    'function shimStatus',
     'function findRealBinary',
     'function fsExists'
   ]) {
@@ -2804,7 +3338,8 @@ async function syntaxAndHelp() {
   }
   if (!integrationShimScriptSource.includes('function generateShim') ||
       !integrationShimScriptSource.includes('hello-cc shim for ${tool.name}') ||
-      !integrationShimScriptSource.includes('HCC_SHIM_ENSURED')) {
+      !integrationShimScriptSource.includes('HCC_SHIM_ENSURED') ||
+      !integrationShimScriptSource.includes('HCC_SKIP_SHIM_INSTALL')) {
     fail('integrations shim script module is missing expected generateShim wiring');
   }
   if (!shellPathSource.includes('function installPathEntry') ||
@@ -2829,7 +3364,7 @@ async function syntaxAndHelp() {
     if (typeof integrationHooks[name] !== 'function') fail(`integrations hook module missing export: ${name}`);
     if (setupModule[name] !== integrationHooks[name]) fail(`setup hook export mismatch: ${name}`);
   }
-  for (const name of ['installShims', 'uninstallShims', 'verifyShims', 'findRealBinary']) {
+  for (const name of ['installShims', 'uninstallShims', 'verifyShims', 'shimStatus', 'findRealBinary']) {
     if (typeof integrationShims[name] !== 'function') fail(`integrations shim module missing export: ${name}`);
     if (setupModule[name] !== integrationShims[name]) fail(`setup shim export mismatch: ${name}`);
   }
@@ -2843,6 +3378,147 @@ async function syntaxAndHelp() {
     if (typeof shellPath[name] !== 'function') fail(`shell path module missing export: ${name}`);
     if (setupModule[name] !== shellPath[name]) fail(`setup shell path export mismatch: ${name}`);
   }
+  const bashRc = '# regression rc\n[ -z "$PS1" ] && return\nexport PATH="/late:$PATH"\n';
+  const bashPath = shellPath.insertPathEntry(bashRc, 'bash');
+  if ((bashPath.match(/# hello-cc shims/g) || []).length !== 2 ||
+      bashPath.indexOf('# hello-cc shims (early)') > bashPath.indexOf('[ -z "$PS1" ] && return') ||
+      bashPath.lastIndexOf('# hello-cc shims (final)') < bashPath.indexOf('export PATH="/late:$PATH"')) {
+    fail(`bash shell PATH insertion lost early/final placement:\n${bashPath}`);
+  }
+  const zshPath = shellPath.insertPathEntry('export PATH="$HOME/bin:$PATH"\n', 'zsh');
+  if ((zshPath.match(/# hello-cc shims/g) || []).length !== 1 ||
+      zshPath.includes('# hello-cc shims (early)') ||
+      !zshPath.includes('# hello-cc shims (final)')) {
+    fail(`zsh shell PATH insertion should install one final entry:\n${zshPath}`);
+  }
+  const fishPath = shellPath.insertPathEntry('set -gx PATH $HOME/bin $PATH\n', 'fish');
+  if ((fishPath.match(/# hello-cc shims/g) || []).length !== 1 ||
+      fishPath.includes('# hello-cc shims (early)') ||
+      !fishPath.includes('# hello-cc shims (final)')) {
+    fail(`fish shell PATH insertion should install one final entry:\n${fishPath}`);
+  }
+  const customRc = [
+    'export PATH="$HOME/.hcc-shims:$PATH" # user custom shim dir',
+    shellPath.pathEntryLine('bash', 'final')
+  ].join('\n');
+  const cleanedRc = shellPath.removePathEntryLines(customRc);
+  if (!cleanedRc.includes('user custom shim dir') || cleanedRc.includes('# hello-cc shims')) {
+    fail(`shell PATH cleanup removed a non-hello-cc custom line or kept hello-cc line:\n${cleanedRc}`);
+  }
+  const noProviderHome = fs.mkdtempSync(path.join(os.tmpdir(), 'hcc-no-provider-home-'));
+  try {
+    const noProviderEnv = {
+      ...env,
+      HOME: noProviderHome,
+      PATH: '/usr/bin:/bin',
+      SHELL: '/bin/bash'
+    };
+    const noProviderInstall = run(process.execPath, [hccBin, '--root', root, 'shim', 'install'], { env: noProviderEnv });
+    if (!noProviderInstall.includes('no shims installed')) {
+      fail(`shim install without providers did not report no shims:\n${noProviderInstall}`);
+    }
+    const noProviderBashrc = path.join(noProviderHome, '.bashrc');
+    if (fs.existsSync(noProviderBashrc) && fs.readFileSync(noProviderBashrc, 'utf8').includes('.hcc-shims')) {
+      fail(`shim install without providers modified shell PATH:\n${fs.readFileSync(noProviderBashrc, 'utf8')}`);
+    }
+  } finally {
+    try { fs.rmSync(noProviderHome, { recursive: true, force: true }); } catch {}
+  }
+  const fishHome = fs.mkdtempSync(path.join(os.tmpdir(), 'hcc-fish-home-'));
+  try {
+    const fishEnv = {
+      ...env,
+      HOME: fishHome,
+      SHELL: '/usr/bin/fish'
+    };
+    const fishInstall = run(process.execPath, [hccBin, '--root', root, 'shim', 'install'], { env: fishEnv });
+    const fishRc = path.join(fishHome, '.config', 'fish', 'config.fish');
+    if (!fishInstall.includes('PATH updated') ||
+        !fs.existsSync(fishRc) ||
+        !fs.readFileSync(fishRc, 'utf8').includes('# hello-cc shims (final)')) {
+      fail(`fish shim install did not create config.fish PATH entry:\n${fishInstall}\n${fs.existsSync(fishRc) ? fs.readFileSync(fishRc, 'utf8') : '(missing)'}`);
+    }
+  } finally {
+    try { fs.rmSync(fishHome, { recursive: true, force: true }); } catch {}
+  }
+  const missingRcHome = fs.mkdtempSync(path.join(os.tmpdir(), 'hcc-missing-rc-home-'));
+  try {
+    const missingRcEnv = {
+      ...env,
+      HOME: missingRcHome,
+      SHELL: '/bin/bash'
+    };
+    const uninstallOutput = run(process.execPath, [hccBin, '--root', root, 'shim', 'uninstall'], { env: missingRcEnv });
+    if (uninstallOutput.includes('PATH entry not removed') || !uninstallOutput.includes('PATH entry not present')) {
+      fail(`shim uninstall reported missing shell rc as a failure:\n${uninstallOutput}`);
+    }
+  } finally {
+    try { fs.rmSync(missingRcHome, { recursive: true, force: true }); } catch {}
+  }
+  const partialStatusHome = fs.mkdtempSync(path.join(os.tmpdir(), 'hcc-partial-status-home-'));
+  try {
+    const partialStatusDir = path.join(partialStatusHome, '.hcc-shims');
+    fs.mkdirSync(partialStatusDir, { recursive: true });
+    fs.writeFileSync(path.join(partialStatusDir, 'claude'), '#!/usr/bin/env bash\nexit 0\n', { mode: 0o755 });
+    const partialStatusEnv = {
+      ...env,
+      HOME: partialStatusHome,
+      SHELL: '/bin/bash'
+    };
+    const statusOutput = run(process.execPath, [hccBin, '--root', root, 'shim', 'status'], { env: partialStatusEnv });
+    if (!statusOutput.includes('claude: installed') ||
+        !statusOutput.includes('codex: missing') ||
+        !statusOutput.includes('status: partial')) {
+      fail(`shim status did not report partial install per tool:\n${statusOutput}`);
+    }
+  } finally {
+    try { fs.rmSync(partialStatusHome, { recursive: true, force: true }); } catch {}
+  }
+  const partialShimHome = fs.mkdtempSync(path.join(os.tmpdir(), 'hcc-partial-shim-home-'));
+  const partialShimRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'hcc-partial-shim-root-'));
+  try {
+    const partialShimDir = path.join(partialShimHome, '.hcc-shims');
+    fs.mkdirSync(partialShimDir, { recursive: true });
+    fs.writeFileSync(path.join(partialShimDir, 'claude'), '#!/usr/bin/env bash\nexit 0\n', { mode: 0o755 });
+    const partialShimEnv = {
+      ...env,
+      HOME: partialShimHome,
+      SHELL: '/bin/bash'
+    };
+    run(process.execPath, [hccBin, '--root', partialShimRoot, 'setup', '--quiet'], { env: partialShimEnv });
+    for (const name of ['claude', 'codex']) {
+      if (!fs.existsSync(path.join(partialShimDir, name))) {
+        fail(`setup did not repair partial shim install; missing ${name}`);
+      }
+    }
+  } finally {
+    try { fs.rmSync(partialShimHome, { recursive: true, force: true }); } catch {}
+    try { fs.rmSync(partialShimRoot, { recursive: true, force: true }); } catch {}
+  }
+  const scanHome = fs.mkdtempSync(path.join(os.tmpdir(), 'hcc-scan-home-'));
+  const scanRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'hcc-scan-root-'));
+  try {
+    const scanRealRoot = fs.realpathSync(scanRoot);
+    const claudeSessionsDir = path.join(scanHome, '.claude', 'sessions');
+    fs.mkdirSync(claudeSessionsDir, { recursive: true });
+    fs.writeFileSync(path.join(claudeSessionsDir, 'scan-realpath.json'), JSON.stringify({
+      pid: process.pid,
+      sessionId: 'scan-realpath-session',
+      cwd: scanRoot,
+      status: 'running'
+    }));
+    const scanEnv = {
+      ...env,
+      HOME: scanHome
+    };
+    const scanOutput = run(process.execPath, [hccBin, '--root', scanRealRoot, 'scan'], { env: scanEnv });
+    if (!scanOutput.includes('claude') || !scanOutput.includes('scan-realpath')) {
+      fail(`scan did not match discovered hccRoot through realpath comparison:\n${scanOutput}`);
+    }
+  } finally {
+    try { fs.rmSync(scanHome, { recursive: true, force: true }); } catch {}
+    try { fs.rmSync(scanRoot, { recursive: true, force: true }); } catch {}
+  }
   const cliRuntime = await import(path.join(repoRoot, 'lib', 'cli-runtime.mjs'));
   for (const name of ['commandPath', 'createContext', 'packageRoot', 'shellCommand', 'tailFile']) {
     if (typeof cliRuntime[name] !== 'function') fail(`CLI runtime module missing function: ${name}`);
@@ -3232,11 +3908,13 @@ async function syntaxAndHelp() {
     ],
     events: [
       { id: 7, type: 'message.sent', actor: 'peer-a', task_id: 2, payload: '{}', created_at: 7 },
-      { id: 8, type: 'task.done', actor: 'peer-a', task_id: 2, payload: JSON.stringify({ owner: 'peer-b', summary: 'done summary' }), created_at: 8 }
+      { id: 8, type: 'task.done', actor: 'peer-a', task_id: 2, payload: JSON.stringify({ owner: 'peer-b', summary: 'done summary' }), created_at: 8 },
+      { id: 9, type: 'web.session.stop_requested', actor: 'web', task_id: null, payload: JSON.stringify({ actor_peer: 'web', target_peer: 'peer-b', peer: 'peer-b' }), created_at: 9 },
+      { id: 10, type: 'task.dispatched', actor: 'peer-a', task_id: 2, payload: JSON.stringify({ actor_peer: 'peer-a', target_peer: 'peer-b', peer: 'peer-b', title: 'dispatch timeline' }), created_at: 10 }
     ]
   }, 'peer-b');
   const timelineIds = timelineItems.map((item) => item.id);
-  if (JSON.stringify(timelineIds) !== JSON.stringify(['message:2', 'message:3', 'handoff:4', 'task:5', 'event:8'])) {
+  if (JSON.stringify(timelineIds) !== JSON.stringify(['message:2', 'message:3', 'handoff:4', 'task:5', 'event:8', 'event:9', 'event:10'])) {
     fail(`timelineFromRows filtering/order changed: ${JSON.stringify(timelineItems)}`);
   }
   const inbound = timelineItems.find((item) => item.id === 'message:2');
@@ -4545,6 +5223,10 @@ async function syntaxAndHelp() {
     if (integrationPeerIdentity.resolveCurrentPeer({ root: repoRoot }, {}, 'peer', 'shell').id !== 'env-peer') {
       fail('peer identity resolveCurrentPeer ignored HCC_PEER');
     }
+    const correctedPeer = integrationPeerIdentity.resolveCurrentPeer({ root: repoRoot }, { peer: 'manual-peer' }, 'peer', 'shell');
+    if (correctedPeer.id !== 'env-peer' || correctedPeer.corrected_from !== 'manual-peer') {
+      fail(`peer identity did not correct explicit peer to HCC_PEER: ${JSON.stringify(correctedPeer)}`);
+    }
     delete process.env.HCC_PEER;
     delete process.env.CLAUDE_CODE_SESSION_ID;
     delete process.env.CLAUDECODE;
@@ -4783,12 +5465,25 @@ async function syntaxAndHelp() {
   if (!taskHelp.includes('task next [--peer ID] [--force]') ||
       !taskHelp.includes('[--count N]') ||
       !taskHelp.includes('existing claimed/running/review/blocked task') ||
+      !taskHelp.includes('task dispatch --to ID --title TEXT') ||
+      !taskHelp.includes('task dispatch --to ID --id N') ||
+      !taskHelp.includes('message-only') ||
+      !taskHelp.includes('running managed Claude/Codex terminal') ||
       !taskHelp.includes('task takeover [--peer ID] --id N --reason TEXT') ||
       !taskHelp.includes('[--policy any|blocked|stale|blocked-or-stale]') ||
       !taskHelp.includes('task claim [--peer ID] --id N[,N]') ||
       !taskHelp.includes('task create --title TEXT --parent N')) {
     fail(`task help missing current-task task next semantics:\n${taskHelp}`);
   }
+  for (const expected of [
+    "if (sub === 'dispatch') return taskDispatch",
+    'async function taskDispatch(ctx, args)',
+    "addEvent(eventDb, 'task.dispatched'",
+    'function sessionLooksProviderInteractive(session)',
+    '!customMessage && !sessionLooksProviderInteractive(session)'
+  ]) {
+    if (!hccSource.includes(expected)) fail(`task dispatch source guard missing: ${expected}`);
+  }
   const teamHelp = run(process.execPath, [hccBin, 'team', '--help']);
   if (!teamHelp.includes('hcc team') || !teamHelp.includes('team plan') || !teamHelp.includes('team start') || !teamHelp.includes('team status')) {
     fail(`team help missing expected content:\n${teamHelp}`);
@@ -4817,6 +5512,19 @@ async function syntaxAndHelp() {
       !tmuxHelp.includes('deletion requires --yes')) {
     fail(`tmux help missing DB-backed gc semantics:\n${tmuxHelp}`);
   }
+  const shimHelp = run(process.execPath, [hccBin, 'shim', '--help']);
+  if (!shimHelp.includes('hcc shim') ||
+      !shimHelp.includes('shim install') ||
+      !shimHelp.includes('shim status') ||
+      !shimHelp.includes('shell PATH entry')) {
+    fail(`shim help missing maintenance command content:\n${shimHelp}`);
+  }
+  const installHooksHelp = run(process.execPath, [hccBin, 'install-hooks', '--help']);
+  if (!installHooksHelp.includes('hcc install-hooks') ||
+      !installHooksHelp.includes('install-hooks --status') ||
+      !installHooksHelp.includes('install-hooks --uninstall')) {
+    fail(`install-hooks help missing maintenance command content:\n${installHooksHelp}`);
+  }
   const gcHelp = run(process.execPath, [hccBin, 'gc', '--help']);
   if (!gcHelp.includes('hcc gc') ||
       !gcHelp.includes('gc [--older-than DAYS] [--yes]') ||
@@ -4864,7 +5572,7 @@ async function syntaxAndHelp() {
 }
 
 function uninstallWorkflow() {
-  log('[12/12] maintenance cleanup');
+  log('[13/13] maintenance cleanup');
   const uninstallRoot = path.join(os.tmpdir(), `hcc-reg-uninstall-root-${testId}`);
   const uninstallHome = path.join(os.tmpdir(), `hcc-reg-uninstall-home-${testId}`);
   fs.mkdirSync(uninstallRoot, { recursive: true });
@@ -4886,11 +5594,16 @@ function uninstallWorkflow() {
   ensureFile(path.join(uninstallHome, '.claude', 'settings.json'));
   ensureFile(path.join(uninstallHome, '.codex', 'hooks.json'));
   ensureFile(path.join(uninstallHome, '.hcc-shims', 'claude'));
+  const uninstallBashrc = path.join(uninstallHome, '.bashrc');
+  if (!fs.readFileSync(uninstallBashrc, 'utf8').includes('.hcc-shims')) {
+    fail('setup did not install shim PATH entry before uninstall workflow');
+  }
 
   const kept = run(process.execPath, [hccBin, '--root', uninstallRoot, 'uninstall'], { env: uninstallEnv });
   if (!kept.includes('project data kept')) fail(`uninstall did not keep project data by default:\n${kept}`);
   if (!fs.existsSync(path.join(uninstallRoot, '.hello-cc', 'mesh.db'))) fail('default uninstall removed project db');
   if (fs.existsSync(path.join(uninstallHome, '.hcc-shims', 'claude'))) fail('default uninstall did not remove shim');
+  if (fs.readFileSync(uninstallBashrc, 'utf8').includes('.hcc-shims')) fail('default uninstall did not remove shim PATH entry');
   if (!run(process.execPath, [hccBin, '--root', uninstallRoot, 'install-hooks', '--status'], { env: uninstallEnv }).includes('claude=no codex=no')) {
     fail('default uninstall did not remove hooks');
   }
@@ -4918,7 +5631,7 @@ async function main() {
   process.once('SIGTERM', () => { cleanup(); process.exit(143); });
 
   await setupRegression();
-  log('[2/12] runtime');
+  log('[2/13] runtime');
   startRuntime();
   await waitRuntime();
   hcc(['peer', 'list']);
@@ -4930,15 +5643,26 @@ async function main() {
   await askBroadcastWorkflow();
   await downGcPackWorkflow();
   oldNameScan();
+  identityEnforcementWorkflow();
   await syntaxAndHelp();
   uninstallWorkflow();
+  assertNoRealProjectRegistryLeak();
+  cleanup();
+  assertNoRegressionTmuxSessionLeak();
   log('FULL_REGRESSION_OK');
 }
 
 main().catch((err) => {
+  try { assertNoRealProjectRegistryLeak(); } catch (leakErr) {
+    process.stderr.write(`${leakErr.stack || leakErr.message}\n`);
+  }
   cleanup();
   process.stderr.write(`${err.stack || err.message}\n`);
   process.exit(1);
 }).finally(() => {
-  cleanup();
+  try {
+    assertNoRealProjectRegistryLeak();
+  } finally {
+    cleanup();
+  }
 });