@wipcomputer/wip-ldm-os 0.4.85-alpha.32 → 0.4.85-alpha.33

package/bin/ldm.js

@@ -24,6 +24,7 @@ import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, cpSync
 import { join, basename, resolve, dirname } from 'node:path';
 import { execSync, spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
+import { createHash } from 'node:crypto';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -409,9 +410,39 @@ function cleanStaleHooks() {
 
 // ── Boot hook sync (#49) ──
 
+// The registered SessionStart hook command is the single source of truth for
+// WHERE the boot hook actually executes from. Historically syncBootHook()
+// deployed to ~/.ldm/library/boot while the registered command pointed at
+// ~/.ldm/shared/boot (installer.mjs BOOT_DIR): new code landed in library/,
+// sessions ran the stale copy in shared/, and the install reported success.
+// Resolve the deploy target from the registered entry so the two can never
+// diverge again. Fallback is shared/boot, matching installer.mjs BOOT_DIR and
+// configureSessionStartHook() so a fresh machine stays consistent.
+// Ticket: ai/product/bugs/installer/open-tickets/2026-07-05--cc-mini--shared-library-split-brain-boot-deploy.md
+function getRegisteredBootHookTarget() {
+  const settings = readJSON(join(HOME, '.claude', 'settings.json'));
+  const entries = settings?.hooks?.SessionStart;
+  if (!Array.isArray(entries)) return null;
+  for (const entry of entries) {
+    for (const h of (entry?.hooks || [])) {
+      const cmd = h?.command || '';
+      const m = cmd.match(/(\S*boot-hook\.mjs)/);
+      if (m) return m[1].replace(/^["']|["']$/g, '');
+    }
+  }
+  return null;
+}
+
+function resolveBootExecDir() {
+  const target = getRegisteredBootHookTarget();
+  if (target) return dirname(target);
+  // Canonical default: same as src/boot/installer.mjs BOOT_DIR.
+  return join(LDM_ROOT, 'shared', 'boot');
+}
+
 function syncBootHook() {
   const srcBoot = join(__dirname, '..', 'src', 'boot', 'boot-hook.mjs');
-  const destBoot = join(LDM_ROOT, 'library', 'boot', 'boot-hook.mjs');
+  const destBoot = join(resolveBootExecDir(), 'boot-hook.mjs');
 
   if (!existsSync(srcBoot)) return false;
 
@@ -3202,6 +3233,58 @@ async function cmdDoctor() {
     }
   }
 
+  // Boot hook stale at execution path.
+  //
+  // Split-brain deploys are silent: version tracking can say the boot hook
+  // updated while the SessionStart hook still executes an older copy on disk
+  // (2026-07-05: install reported alpha.32's boot trim active, but the live
+  // payload was the untrimmed 49KB because syncBootHook wrote library/boot
+  // while the hook ran shared/boot). Hash-compare the file the registered
+  // hook actually runs against this CLI's src/boot/boot-hook.mjs (the code the
+  // installer would deploy). Divergence means the hook is running stale code.
+  // Ticket: ai/product/bugs/installer/open-tickets/2026-07-05--cc-mini--shared-library-split-brain-boot-deploy.md
+  {
+    const execTarget = getRegisteredBootHookTarget();
+    const srcBoot = join(__dirname, '..', 'src', 'boot', 'boot-hook.mjs');
+    const hashFile = (p) => {
+      try { return createHash('sha256').update(readFileSync(p)).digest('hex'); } catch { return null; }
+    };
+    if (execTarget && existsSync(srcBoot)) {
+      const srcHash = hashFile(srcBoot);
+      const execExists = existsSync(execTarget);
+      const execHash = execExists ? hashFile(execTarget) : null;
+      // Informational: which of the known deploy locations already matches src.
+      const freshCandidates = [
+        join(LDM_ROOT, 'shared', 'boot', 'boot-hook.mjs'),
+        join(LDM_ROOT, 'library', 'boot', 'boot-hook.mjs'),
+      ].filter((p) => existsSync(p) && hashFile(p) === srcHash);
+      if (!execExists || execHash !== srcHash) {
+        const short = (h) => (h ? h.slice(0, 12) : 'missing');
+        console.log(`  ! boot hook stale at execution path: ${execTarget.replace(HOME, '~')}`);
+        console.log(`    the registered SessionStart hook runs ${short(execHash)}, current is ${short(srcHash)}`);
+        if (freshCandidates.length > 0) {
+          console.log(`    a current copy exists at: ${freshCandidates[0].replace(HOME, '~')}`);
+        }
+        if (FIX_FLAG) {
+          try {
+            if (execExists) {
+              const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+              copyFileSync(execTarget, `${execTarget}.bak-${stamp}`);
+            }
+            mkdirSync(dirname(execTarget), { recursive: true });
+            copyFileSync(srcBoot, execTarget);
+            console.log('  + Redeployed the current boot hook to the execution path');
+          } catch (e) {
+            console.log(`  x Could not redeploy boot hook to execution path: ${e.message}`);
+          }
+        } else {
+          console.log('    Run: ldm doctor --fix to redeploy the current boot hook to the execution path');
+          issues++;
+        }
+      }
+    }
+  }
+
   // --fix: clean registry entries with /tmp/ sources or ldm-install- names (#54)
   if (FIX_FLAG) {
     const registry = readJSON(REGISTRY_PATH);

package/lib/deploy.mjs

@@ -19,6 +19,7 @@ import { join, basename, resolve, dirname } from 'node:path';
 import { tmpdir } from 'node:os';
 import { detectInterfaces, describeInterfaces, detectToolbox } from './detect.mjs';
 import { moveToTrash, appendToManifest } from './safe.mjs';
+import { configureSessionStartHook } from '../src/boot/installer.mjs';
 
 const HOME = process.env.HOME || '';
 const LDM_ROOT = join(HOME, '.ldm');
@@ -1117,6 +1118,40 @@ function installClaudeCodeHook(repoPath, doorOrDoors, toolName = basename(repoPa
 }
 
 function installClaudeCodeHookEvent(repoPath, door, toolName = basename(repoPath)) {
+  // Boot hook special case: single-owner delegation.
+  //
+  // The SessionStart boot hook's deployed command lives in ~/.ldm/shared/boot,
+  // NOT under ~/.ldm/extensions/<toolName>/. The extension-dir ownership match
+  // below keys on `/<toolName>/` in the command string, so it can never
+  // recognize an existing boot entry and appends a fresh duplicate on every
+  // manifest-driven install (10 copies accumulated 2026-07-04, ~450KB of boot
+  // context per session). configureSessionStartHook() in src/boot/installer.mjs
+  // is the single canonical registrar: it owns the whole boot-hook set,
+  // collapses duplicates, canonicalizes the command to BOOT_DIR, persists, and
+  // no-ops when already correct. Route boot-hook doors there so there is one
+  // writer, not two. Discriminating on the command (not the event alone) keeps
+  // other SessionStart hooks, e.g. wip-branch-guard's, on the normal path.
+  //
+  // Ticket: ai/product/bugs/installer/open-tickets/2026-07-05--cc-mini--deploy-hook-ownership-misses-boot-hook.md
+  const declaredCommand = door.command || '';
+  const isBootHookDoor =
+    (door.event || 'PreToolUse') === 'SessionStart' &&
+    (declaredCommand.includes('boot-hook') || /shared[/\\]boot/.test(declaredCommand));
+  if (isBootHookDoor) {
+    if (DRY_RUN) {
+      ok('Claude Code: would configure SessionStart boot hook (single-owner)');
+      return true;
+    }
+    try {
+      const result = configureSessionStartHook();
+      ok(`Claude Code: ${result}`);
+      return true;
+    } catch (e) {
+      fail(`Claude Code: boot hook registration failed. ${e.message}`);
+      return false;
+    }
+  }
+
   const settingsPath = join(HOME, '.claude', 'settings.json');
   let settings = readJSON(settingsPath);
 
@@ -1702,4 +1737,4 @@ export function disableExtension(name) {
 
 // ── Exports for ldm CLI ──
 
-export { loadRegistry, saveRegistry, updateRegistry, readJSON, writeJSON, runBuildIfNeeded, resolveLocalDeps, buildSourceInfo, CORE_EXTENSIONS };
+export { loadRegistry, saveRegistry, updateRegistry, readJSON, writeJSON, runBuildIfNeeded, resolveLocalDeps, buildSourceInfo, CORE_EXTENSIONS, installClaudeCodeHook };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wipcomputer/wip-ldm-os",
-  "version": "0.4.85-alpha.32",
+  "version": "0.4.85-alpha.33",
   "type": "module",
   "description": "LDM OS: identity, memory, and sovereignty infrastructure for AI agents",
   "engines": {
@@ -48,7 +48,9 @@
     "fmt": "npx prettier --write 'src/**/*.{ts,mjs}' 'lib/**/*.mjs' 'bin/**/*.js'",
     "fmt:check": "npx prettier --check 'src/**/*.{ts,mjs}' 'lib/**/*.mjs' 'bin/**/*.js'",
     "test:boot-hook-registration": "node scripts/test-boot-hook-registration.mjs",
-    "test:doctor-hook-dedupe": "node scripts/test-doctor-hook-dedupe.mjs"
+    "test:doctor-hook-dedupe": "node scripts/test-doctor-hook-dedupe.mjs",
+    "test:boot-dir-truth": "node scripts/test-boot-dir-truth.mjs",
+    "test:deploy-hook-ownership": "node scripts/test-deploy-hook-ownership.mjs"
   },
   "claudeCode": {
     "hook": {

package/scripts/test-boot-dir-truth.mjs

@@ -0,0 +1,158 @@
+#!/usr/bin/env node
+// Regression test: `ldm doctor` boot-hook stale-at-execution-path check.
+//
+// Covers:
+//   ai/product/bugs/installer/open-tickets/2026-07-05--cc-mini--shared-library-split-brain-boot-deploy.md
+//
+// The split-brain bug: syncBootHook() deployed boot-hook.mjs to
+// ~/.ldm/library/boot while the registered SessionStart hook executed
+// ~/.ldm/shared/boot. New code landed in library/, sessions ran the stale
+// copy in shared/, and the install reported success. This test drives the
+// doctor check that makes the drift visible (and the --fix that repairs the
+// execution path), plus the no-false-positive cases.
+//
+// Follows the test-doctor-hook-dedupe.mjs pattern: real bin/ldm.js doctor
+// against a temp HOME, crontab/npm shimmed on PATH so operator state and the
+// network are never touched. LDM_SELF_UPDATED=1 skips CLI self-update.
+
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+
+const repo = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const cli = join(repo, 'bin', 'ldm.js');
+const pkg = JSON.parse(readFileSync(join(repo, 'package.json'), 'utf8'));
+// The current boot hook this CLI would deploy: doctor compares against it.
+const srcBootContent = readFileSync(join(repo, 'src', 'boot', 'boot-hook.mjs'), 'utf8');
+
+let failed = 0;
+function assert(cond, label, output = '') {
+  if (cond) {
+    console.log(`  [PASS] ${label}`);
+  } else {
+    console.log(`  [FAIL] ${label}`);
+    if (output) console.log(`         --- output (last lines) ---\n         ${output.trim().split('\n').slice(-25).join('\n         ')}`);
+    failed++;
+  }
+}
+
+// Build a fixture HOME. The registered SessionStart hook points at
+// ~/.ldm/shared/boot/boot-hook.mjs (the execution path). `execContent`
+// seeds that file; `libraryContent` seeds the parallel ~/.ldm/library/boot
+// copy (null to skip).
+function setupHome({ execContent, libraryContent }) {
+  const home = mkdtempSync(join(tmpdir(), 'ldm-bootdir-'));
+  const ldmRoot = join(home, '.ldm');
+  const fakeBin = join(home, 'fakebin');
+  mkdirSync(join(ldmRoot, 'extensions'), { recursive: true });
+  mkdirSync(join(home, '.claude'), { recursive: true });
+  mkdirSync(fakeBin, { recursive: true });
+
+  writeFileSync(join(ldmRoot, 'version.json'), JSON.stringify({ version: pkg.version }, null, 2) + '\n');
+  writeFileSync(join(ldmRoot, 'extensions', 'registry.json'), JSON.stringify({ _format: 'v2', extensions: {} }, null, 2) + '\n');
+
+  const execTarget = join(ldmRoot, 'shared', 'boot', 'boot-hook.mjs');
+  mkdirSync(dirname(execTarget), { recursive: true });
+  writeFileSync(execTarget, execContent);
+  if (libraryContent !== null && libraryContent !== undefined) {
+    const lib = join(ldmRoot, 'library', 'boot', 'boot-hook.mjs');
+    mkdirSync(dirname(lib), { recursive: true });
+    writeFileSync(lib, libraryContent);
+  }
+
+  // Registered SessionStart hook runs the shared/boot (execution) copy.
+  const settings = {
+    hooks: {
+      SessionStart: [
+        { matcher: '*', hooks: [{ type: 'command', command: `node ${execTarget}`, timeout: 15 }] },
+      ],
+    },
+  };
+  const settingsPath = join(home, '.claude', 'settings.json');
+  writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + '\n');
+
+  writeFileSync(join(fakeBin, 'crontab'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'crontab'), 0o755);
+  writeFileSync(join(fakeBin, 'npm'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'npm'), 0o755);
+
+  return { home, fakeBin, execTarget };
+}
+
+function runDoctor({ home, fakeBin }, fix = false) {
+  const args = ['doctor'];
+  if (fix) args.push('--fix');
+  try {
+    return execFileSync('node', [cli, ...args], {
+      env: { ...process.env, HOME: home, PATH: `${fakeBin}:${process.env.PATH}`, LDM_SELF_UPDATED: '1' },
+      encoding: 'utf-8',
+      timeout: 30000,
+    });
+  } catch (err) {
+    return (err.stdout || '') + (err.stderr || '');
+  }
+}
+
+const STALE = '// stale boot hook code (pre-trim)\nprocess.exit(0);\n';
+
+console.log('Test 1: stale execution path is reported, not written without --fix');
+{
+  const w = setupHome({ execContent: STALE, libraryContent: srcBootContent });
+  const before = readFileSync(w.execTarget, 'utf-8');
+  const out = runDoctor(w);
+  const after = readFileSync(w.execTarget, 'utf-8');
+  assert(/boot hook stale at execution path/.test(out), 'reports stale at execution path', out);
+  assert(/a current copy exists at:.*library\/boot/.test(out), 'points at the fresh library/boot copy', out);
+  assert(before === after, 'execution-path file untouched without --fix');
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 2: --fix redeploys the current boot hook to the execution path');
+{
+  const w = setupHome({ execContent: STALE, libraryContent: srcBootContent });
+  const out = runDoctor(w, true);
+  const after = readFileSync(w.execTarget, 'utf-8');
+  const backups = readdirSync(dirname(w.execTarget)).filter((f) => f.startsWith('boot-hook.mjs.bak-'));
+  assert(/Redeployed the current boot hook to the execution path/.test(out), 'reports redeploy under --fix', out);
+  assert(after === srcBootContent, 'execution-path file now matches current src/boot/boot-hook.mjs');
+  assert(backups.length === 1, `stale copy backed up before overwrite (found ${backups.length})`);
+  const again = runDoctor(w, true);
+  assert(!/boot hook stale at execution path/.test(again), 'second --fix run finds nothing stale', again);
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 3: in-sync execution path is not flagged');
+{
+  const w = setupHome({ execContent: srcBootContent, libraryContent: null });
+  const out = runDoctor(w);
+  assert(!/boot hook stale at execution path/.test(out), 'no stale report when exec path matches src', out);
+  rmSync(w.home, { recursive: true, force: true });
+}
+
+console.log('Test 4: no registered boot hook is a no-op (no crash, no false positive)');
+{
+  const home = mkdtempSync(join(tmpdir(), 'ldm-bootdir-none-'));
+  const ldmRoot = join(home, '.ldm');
+  const fakeBin = join(home, 'fakebin');
+  mkdirSync(join(ldmRoot, 'extensions'), { recursive: true });
+  mkdirSync(join(home, '.claude'), { recursive: true });
+  mkdirSync(fakeBin, { recursive: true });
+  writeFileSync(join(ldmRoot, 'version.json'), JSON.stringify({ version: pkg.version }, null, 2) + '\n');
+  writeFileSync(join(ldmRoot, 'extensions', 'registry.json'), JSON.stringify({ _format: 'v2', extensions: {} }, null, 2) + '\n');
+  writeFileSync(join(home, '.claude', 'settings.json'), JSON.stringify({ hooks: {} }, null, 2) + '\n');
+  writeFileSync(join(fakeBin, 'crontab'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'crontab'), 0o755);
+  writeFileSync(join(fakeBin, 'npm'), '#!/bin/sh\nexit 0\n');
+  chmodSync(join(fakeBin, 'npm'), 0o755);
+  const out = runDoctor({ home, fakeBin });
+  assert(!/boot hook stale at execution path/.test(out), 'no stale report when no boot hook is registered', out);
+  rmSync(home, { recursive: true, force: true });
+}
+
+if (failed > 0) {
+  console.log(`\n${failed} assertion(s) failed`);
+  process.exit(1);
+}
+console.log('\nAll boot-dir-truth tests passed');

package/scripts/test-deploy-hook-ownership.mjs

@@ -0,0 +1,160 @@
+#!/usr/bin/env node
+// Regression test: manifest-driven boot-hook registration is single-owner.
+//
+// Covers:
+//   ai/product/bugs/installer/open-tickets/2026-07-05--cc-mini--deploy-hook-ownership-misses-boot-hook.md
+//
+// Before this fix, lib/deploy.mjs installClaudeCodeHookEvent() matched owned
+// hook entries by an extension-dir tag (`/<toolName>/`). The boot hook's
+// deployed command is `node ~/.ldm/shared/boot/boot-hook.mjs`, which contains
+// no `/wip-ldm-os/` segment, so the ownership match found nothing and appended
+// a fresh SessionStart entry on every manifest-driven `ldm install` (the real
+// mechanism behind the 10-entry accumulation on 2026-07-04).
+//
+// The fix routes boot-hook doors to configureSessionStartHook() (the single
+// canonical registrar), so the deploy path no longer appends.
+//
+// Cases:
+//   1. Fresh manifest install: exactly one boot entry, canonical command.
+//   2. Repeat manifest install: byte-identical settings.json (true no-op).
+//   3. Pre-accumulated + unrelated SessionStart hook: collapses boot entries
+//      to one, preserves the non-boot SessionStart entry (discriminates on the
+//      command, not the event).
+//   4. Dry run: reports intent, writes nothing.
+//
+// HOME must be set before importing deploy.mjs: both deploy.mjs (process.env.HOME)
+// and the transitively-imported src/boot/installer.mjs (os.homedir()) resolve
+// their HOME-based constants at module-load time.
+
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+
+// The temp prefix must not contain "boot-hook" or "shared/boot": those are the
+// ownership matchers, and the temp HOME ends up inside every fixture command.
+const tempHome = mkdtempSync(join(tmpdir(), 'ldm-deployown-'));
+process.env.HOME = tempHome;
+
+const { installClaudeCodeHook, setFlags } = await import('../lib/deploy.mjs');
+
+// Mirror detect.mjs: the wip-ldm-os package.json declares a single SessionStart
+// boot-hook door. deploy.mjs receives it as a one-element array.
+const bootDoor = {
+  event: 'SessionStart',
+  matcher: '*',
+  command: `node ${join(tempHome, '.ldm', 'shared', 'boot', 'boot-hook.mjs')}`,
+  timeout: 15,
+};
+const expectedCommand = `node ${join(tempHome, '.ldm', 'shared', 'boot', 'boot-hook.mjs')}`;
+
+let failed = 0;
+function assert(cond, label, detail = '') {
+  if (cond) {
+    console.log(`  [PASS] ${label}`);
+  } else {
+    console.log(`  [FAIL] ${label}`);
+    if (detail) console.log(`         ${detail}`);
+    failed++;
+  }
+}
+
+const settingsPath = join(tempHome, '.claude', 'settings.json');
+function seedSettings(obj) {
+  mkdirSync(join(tempHome, '.claude'), { recursive: true });
+  writeFileSync(settingsPath, JSON.stringify(obj, null, 2) + '\n');
+}
+function readSettings() {
+  return JSON.parse(readFileSync(settingsPath, 'utf-8'));
+}
+function bootEntries(settings) {
+  return (settings.hooks?.SessionStart || []).filter((entry) =>
+    (entry?.hooks || []).some((h) => h?.command?.includes('boot-hook'))
+  );
+}
+// Install through the manifest wrapper exactly as detect.mjs feeds it: an array.
+function manifestInstall() {
+  return installClaudeCodeHook(join(tempHome, 'repo'), [bootDoor], 'wip-ldm-os');
+}
+
+try {
+  console.log('Test 1: fresh manifest install adds exactly one boot entry');
+  {
+    seedSettings({ hooks: {} });
+    manifestInstall();
+    const s = readSettings();
+    assert(bootEntries(s).length === 1, 'exactly one boot-hook SessionStart entry');
+    assert(
+      s.hooks.SessionStart[0].hooks[0].command === expectedCommand,
+      'command canonicalized to BOOT_DIR boot-hook.mjs',
+      `on disk: ${s.hooks.SessionStart[0].hooks[0].command}`
+    );
+  }
+
+  console.log('Test 2: repeat manifest install is a byte-identical no-op');
+  {
+    const before = readFileSync(settingsPath, 'utf-8');
+    manifestInstall();
+    const after = readFileSync(settingsPath, 'utf-8');
+    assert(before === after, 'settings.json byte-identical after second manifest install');
+    assert(bootEntries(readSettings()).length === 1, 'still exactly one boot-hook entry (no append)');
+  }
+
+  console.log('Test 3: pre-accumulated boot entries collapse; unrelated SessionStart hook preserved');
+  {
+    // Three legacy boot appends (the pre-fix accumulation) using the old
+    // hardcoded absolute path, plus an unrelated SessionStart guard entry.
+    const legacyBoot = {
+      matcher: '*',
+      hooks: [{ type: 'command', command: 'node /Users/someone/.ldm/shared/boot/boot-hook.mjs', timeout: 15 }],
+    };
+    const guardSessionStart = {
+      matcher: 'Read|Glob',
+      hooks: [{ type: 'command', command: `node ${join(tempHome, '.ldm', 'extensions', 'wip-branch-guard', 'guard.mjs')}`, timeout: 10 }],
+    };
+    seedSettings({
+      hooks: {
+        SessionStart: [
+          structuredClone(legacyBoot),
+          structuredClone(legacyBoot),
+          guardSessionStart,
+          structuredClone(legacyBoot),
+        ],
+      },
+    });
+    manifestInstall();
+    const s = readSettings();
+    assert(bootEntries(s).length === 1, 'boot entries collapsed to one');
+    assert(
+      s.hooks.SessionStart[0].hooks[0].command === expectedCommand,
+      'surviving boot entry canonicalized to BOOT_DIR'
+    );
+    assert(
+      s.hooks.SessionStart.some((e) => e.hooks?.[0]?.command?.includes('wip-branch-guard')),
+      'unrelated SessionStart guard entry preserved (discriminates on command, not event)'
+    );
+    assert(s.hooks.SessionStart.length === 2, 'exactly boot + guard remain');
+  }
+
+  console.log('Test 4: dry run reports intent and writes nothing');
+  {
+    seedSettings({ hooks: {} });
+    const before = readFileSync(settingsPath, 'utf-8');
+    setFlags({ dryRun: true });
+    try {
+      manifestInstall();
+    } finally {
+      setFlags({ dryRun: false });
+    }
+    const after = readFileSync(settingsPath, 'utf-8');
+    assert(before === after, 'settings.json untouched under dry run');
+    assert(bootEntries(readSettings()).length === 0, 'no boot entry written under dry run');
+  }
+} finally {
+  rmSync(tempHome, { recursive: true, force: true });
+}
+
+if (failed > 0) {
+  console.log(`\n${failed} assertion(s) failed`);
+  process.exit(1);
+}
+console.log('\nAll deploy-hook ownership tests passed');