Subsession receipts with a no-change guard

[githubscum]

Closes KNOWN-LIMITS item 5. Follows the merged install-readiness and session-receipt work in #1.

The problem

Claude Code fires SessionEnd more than once for the same session (on clear, on resume, on exit). The hook deduped by session id, so the first firing won and everything after it was lost. A session that got receipted and then kept working left no record of the later work.

The fix

Each firing that carries new activity appends a NEW receipt, indexed subsession 0, 1, ... n.

Receipts stay cumulative rather than deltas. Every firing carries the whole transcript, so each receipt is a complete self-contained summary that stands on its own. Receipts are summaries (digests and counts, never file contents), so the redundancy is cheap and buys back the property that any single receipt is independently meaningful.

A no-change guard prevents inflation: if the transcript has not grown since the last receipt for that session, nothing is appended.

The race this had to avoid

The subsession decision reads the chain and then appends, which is a time-of-check-to-time-of-use race. Two firings for the same session can both observe "no receipt yet" and both append subsession 0.

appendReceiptGuarded(buildPayload) runs the whole check-then-append inside the existing chain lock. The callback receives the freshly re-read tail and returns either a payload or null to skip.

Reproduced before fixing: 4 barrier-synchronized processes ingesting the same transcript produced 4 receipts instead of 1. The test was verified to fail against an unguarded check-then-append before being accepted, because a concurrency test that passes both before and after a fix is worthless.

Changes

• src/store/index.js: new appendReceiptGuarded. Existing appendReceipt, reload, verify untouched.
• src/parser/index.js: counts.transcriptEntries is the growth marker.
• src/ingest/index.js: owns the subsession decision so the hook and the manual CLI share one implementation. Returns {entry, skipped, subsession, sessionId}.
• bin/hook-session-end.js: drops its own dedupe. Every existing guarantee kept: never writes stdout, never exits non-zero, catches all failures, bounded stdin read.
• src/views/index.js: morning-after reports total session receipts AND distinct sessions, since one session can now produce several receipts and a single number misleads. Session receipts show a subsession line when present, omitted for older receipts.
• src/mcp/server.js: query_receipts exposes subsession.
• KNOWN-LIMITS.md: item 5 rewritten for the new behavior.

Verification

• 96 tests passing (88 baseline plus 8).
• Concurrent-guard test proven to fail against the unguarded implementation and pass against the guarded one.
• Real-transcript check: first run appends subsession 0, second run reports no new activity and appends nothing.

[githubscum]

Closes KNOWN-LIMITS item 5. Follows the merged install-readiness and session-receipt work in #1.

The problem

Claude Code fires SessionEnd more than once for the same session (on clear, on resume, on exit). The hook deduped by session id, so the first firing won and everything after it was lost. A session that got receipted and then kept working left no record of the later work.

The fix

Each firing that carries new activity appends a NEW receipt, indexed subsession 0, 1, ... n.

Receipts stay cumulative rather than deltas. Every firing carries the whole transcript, so each receipt is a complete self-contained summary that stands on its own. Receipts are summaries (digests and counts, never file contents), so the redundancy is cheap and buys back the property that any single receipt is independently meaningful.

A no-change guard prevents inflation: if the transcript has not grown since the last receipt for that session, nothing is appended.

The race this had to avoid

The subsession decision reads the chain and then appends, which is a time-of-check-to-time-of-use race. Two firings for the same session can both observe "no receipt yet" and both append subsession 0.

appendReceiptGuarded(buildPayload) runs the whole check-then-append inside the existing chain lock. The callback receives the freshly re-read tail and returns either a payload or null to skip.

Reproduced before fixing: 4 barrier-synchronized processes ingesting the same transcript produced 4 receipts instead of 1. The test was verified to fail against an unguarded check-then-append before being accepted, because a concurrency test that passes both before and after a fix is worthless.

Changes

• src/store/index.js: new appendReceiptGuarded. Existing appendReceipt, reload, verify untouched.
• src/parser/index.js: counts.transcriptEntries is the growth marker.
• src/ingest/index.js: owns the subsession decision so the hook and the manual CLI share one implementation. Returns {entry, skipped, subsession, sessionId}.
• bin/hook-session-end.js: drops its own dedupe. Every existing guarantee kept: never writes stdout, never exits non-zero, catches all failures, bounded stdin read.
• src/views/index.js: morning-after reports total session receipts AND distinct sessions, since one session can now produce several receipts and a single number misleads. Session receipts show a subsession line when present, omitted for older receipts.
• src/mcp/server.js: query_receipts exposes subsession.
• KNOWN-LIMITS.md: item 5 rewritten for the new behavior.

Verification

• 96 tests passing (88 baseline plus 8).
• Concurrent-guard test proven to fail against the unguarded implementation and pass against the guarded one.
• Real-transcript check: first run appends subsession 0, second run reports no new activity and appends nothing.

[githubscum]

Closes KNOWN-LIMITS item 5. Follows the merged install-readiness and session-receipt work in #1.

The problem

Claude Code fires SessionEnd more than once for the same session (on clear, on resume, on exit). The hook deduped by session id, so the first firing won and everything after it was lost. A session that got receipted and then kept working left no record of the later work.

The fix

Each firing that carries new activity appends a NEW receipt, indexed subsession 0, 1, ... n.

Receipts stay cumulative rather than deltas. Every firing carries the whole transcript, so each receipt is a complete self-contained summary that stands on its own. Receipts are summaries (digests and counts, never file contents), so the redundancy is cheap and buys back the property that any single receipt is independently meaningful.

A no-change guard prevents inflation: if the transcript has not grown since the last receipt for that session, nothing is appended.

The race this had to avoid

The subsession decision reads the chain and then appends, which is a time-of-check-to-time-of-use race. Two firings for the same session can both observe "no receipt yet" and both append subsession 0.

appendReceiptGuarded(buildPayload) runs the whole check-then-append inside the existing chain lock. The callback receives the freshly re-read tail and returns either a payload or null to skip.

Reproduced before fixing: 4 barrier-synchronized processes ingesting the same transcript produced 4 receipts instead of 1. The test was verified to fail against an unguarded check-then-append before being accepted, because a concurrency test that passes both before and after a fix is worthless.

Changes

• src/store/index.js: new appendReceiptGuarded. Existing appendReceipt, reload, verify untouched.
• src/parser/index.js: counts.transcriptEntries is the growth marker.
• src/ingest/index.js: owns the subsession decision so the hook and the manual CLI share one implementation. Returns {entry, skipped, subsession, sessionId}.
• bin/hook-session-end.js: drops its own dedupe. Every existing guarantee kept: never writes stdout, never exits non-zero, catches all failures, bounded stdin read.
• src/views/index.js: morning-after reports total session receipts AND distinct sessions, since one session can now produce several receipts and a single number misleads. Session receipts show a subsession line when present, omitted for older receipts.
• src/mcp/server.js: query_receipts exposes subsession.
• KNOWN-LIMITS.md: item 5 rewritten for the new behavior.

Verification

• 96 tests passing (88 baseline plus 8).
• Concurrent-guard test proven to fail against the unguarded implementation and pass against the guarded one.
• Real-transcript check: first run appends subsession 0, second run reports no new activity and appends nothing.

[githubscum]

Closes KNOWN-LIMITS item 5. Follows the merged install-readiness and session-receipt work in #1.

The problem

Claude Code fires SessionEnd more than once for the same session (on clear, on resume, on exit). The hook deduped by session id, so the first firing won and everything after it was lost. A session that got receipted and then kept working left no record of the later work.

The fix

Each firing that carries new activity appends a NEW receipt, indexed subsession 0, 1, ... n.

Receipts stay cumulative rather than deltas. Every firing carries the whole transcript, so each receipt is a complete self-contained summary that stands on its own. Receipts are summaries (digests and counts, never file contents), so the redundancy is cheap and buys back the property that any single receipt is independently meaningful.

A no-change guard prevents inflation: if the transcript has not grown since the last receipt for that session, nothing is appended.

The race this had to avoid

The subsession decision reads the chain and then appends, which is a time-of-check-to-time-of-use race. Two firings for the same session can both observe "no receipt yet" and both append subsession 0.

appendReceiptGuarded(buildPayload) runs the whole check-then-append inside the existing chain lock. The callback receives the freshly re-read tail and returns either a payload or null to skip.

Reproduced before fixing: 4 barrier-synchronized processes ingesting the same transcript produced 4 receipts instead of 1. The test was verified to fail against an unguarded check-then-append before being accepted, because a concurrency test that passes both before and after a fix is worthless.

Changes

• src/store/index.js: new appendReceiptGuarded. Existing appendReceipt, reload, verify untouched.
• src/parser/index.js: counts.transcriptEntries is the growth marker.
• src/ingest/index.js: owns the subsession decision so the hook and the manual CLI share one implementation. Returns {entry, skipped, subsession, sessionId}.
• bin/hook-session-end.js: drops its own dedupe. Every existing guarantee kept: never writes stdout, never exits non-zero, catches all failures, bounded stdin read.
• src/views/index.js: morning-after reports total session receipts AND distinct sessions, since one session can now produce several receipts and a single number misleads. Session receipts show a subsession line when present, omitted for older receipts.
• src/mcp/server.js: query_receipts exposes subsession.
• KNOWN-LIMITS.md: item 5 rewritten for the new behavior.

Verification

• 96 tests passing (88 baseline plus 8).
• Concurrent-guard test proven to fail against the unguarded implementation and pass against the guarded one.
• Real-transcript check: first run appends subsession 0, second run reports no new activity and appends nothing.

[githubscum]

Closes KNOWN-LIMITS item 5. Follows the merged install-readiness and session-receipt work in #1.

The problem

Claude Code fires SessionEnd more than once for the same session (on clear, on resume, on exit). The hook deduped by session id, so the first firing won and everything after it was lost. A session that got receipted and then kept working left no record of the later work.

The fix

Each firing that carries new activity appends a NEW receipt, indexed subsession 0, 1, ... n.

Receipts stay cumulative rather than deltas. Every firing carries the whole transcript, so each receipt is a complete self-contained summary that stands on its own. Receipts are summaries (digests and counts, never file contents), so the redundancy is cheap and buys back the property that any single receipt is independently meaningful.

A no-change guard prevents inflation: if the transcript has not grown since the last receipt for that session, nothing is appended.

The race this had to avoid

The subsession decision reads the chain and then appends, which is a time-of-check-to-time-of-use race. Two firings for the same session can both observe "no receipt yet" and both append subsession 0.

appendReceiptGuarded(buildPayload) runs the whole check-then-append inside the existing chain lock. The callback receives the freshly re-read tail and returns either a payload or null to skip.

Reproduced before fixing: 4 barrier-synchronized processes ingesting the same transcript produced 4 receipts instead of 1. The test was verified to fail against an unguarded check-then-append before being accepted, because a concurrency test that passes both before and after a fix is worthless.

Changes

• src/store/index.js: new appendReceiptGuarded. Existing appendReceipt, reload, verify untouched.
• src/parser/index.js: counts.transcriptEntries is the growth marker.
• src/ingest/index.js: owns the subsession decision so the hook and the manual CLI share one implementation. Returns {entry, skipped, subsession, sessionId}.
• bin/hook-session-end.js: drops its own dedupe. Every existing guarantee kept: never writes stdout, never exits non-zero, catches all failures, bounded stdin read.
• src/views/index.js: morning-after reports total session receipts AND distinct sessions, since one session can now produce several receipts and a single number misleads. Session receipts show a subsession line when present, omitted for older receipts.
• src/mcp/server.js: query_receipts exposes subsession.
• KNOWN-LIMITS.md: item 5 rewritten for the new behavior.

Verification

• 96 tests passing (88 baseline plus 8).
• Concurrent-guard test proven to fail against the unguarded implementation and pass against the guarded one.
• Real-transcript check: first run appends subsession 0, second run reports no new activity and appends nothing.

[githubscum]

Closes KNOWN-LIMITS item 5. Follows the merged install-readiness and session-receipt work in #1.

The problem

Claude Code fires SessionEnd more than once for the same session (on clear, on resume, on exit). The hook deduped by session id, so the first firing won and everything after it was lost. A session that got receipted and then kept working left no record of the later work.

The fix

Each firing that carries new activity appends a NEW receipt, indexed subsession 0, 1, ... n.

Receipts stay cumulative rather than deltas. Every firing carries the whole transcript, so each receipt is a complete self-contained summary that stands on its own. Receipts are summaries (digests and counts, never file contents), so the redundancy is cheap and buys back the property that any single receipt is independently meaningful.

A no-change guard prevents inflation: if the transcript has not grown since the last receipt for that session, nothing is appended.

The race this had to avoid

The subsession decision reads the chain and then appends, which is a time-of-check-to-time-of-use race. Two firings for the same session can both observe "no receipt yet" and both append subsession 0.

appendReceiptGuarded(buildPayload) runs the whole check-then-append inside the existing chain lock. The callback receives the freshly re-read tail and returns either a payload or null to skip.

Reproduced before fixing: 4 barrier-synchronized processes ingesting the same transcript produced 4 receipts instead of 1. The test was verified to fail against an unguarded check-then-append before being accepted, because a concurrency test that passes both before and after a fix is worthless.

Changes

• src/store/index.js: new appendReceiptGuarded. Existing appendReceipt, reload, verify untouched.
• src/parser/index.js: counts.transcriptEntries is the growth marker.
• src/ingest/index.js: owns the subsession decision so the hook and the manual CLI share one implementation. Returns {entry, skipped, subsession, sessionId}.
• bin/hook-session-end.js: drops its own dedupe. Every existing guarantee kept: never writes stdout, never exits non-zero, catches all failures, bounded stdin read.
• src/views/index.js: morning-after reports total session receipts AND distinct sessions, since one session can now produce several receipts and a single number misleads. Session receipts show a subsession line when present, omitted for older receipts.
• src/mcp/server.js: query_receipts exposes subsession.
• KNOWN-LIMITS.md: item 5 rewritten for the new behavior.

Verification

• 96 tests passing (88 baseline plus 8).
• Concurrent-guard test proven to fail against the unguarded implementation and pass against the guarded one.
• Real-transcript check: first run appends subsession 0, second run reports no new activity and appends nothing.

[githubscum]

Closes KNOWN-LIMITS item 5. Follows the merged install-readiness and session-receipt work in #1.

The problem

Claude Code fires SessionEnd more than once for the same session (on clear, on resume, on exit). The hook deduped by session id, so the first firing won and everything after it was lost. A session that got receipted and then kept working left no record of the later work.

The fix

Each firing that carries new activity appends a NEW receipt, indexed subsession 0, 1, ... n.

Receipts stay cumulative rather than deltas. Every firing carries the whole transcript, so each receipt is a complete self-contained summary that stands on its own. Receipts are summaries (digests and counts, never file contents), so the redundancy is cheap and buys back the property that any single receipt is independently meaningful.

A no-change guard prevents inflation: if the transcript has not grown since the last receipt for that session, nothing is appended.

The race this had to avoid

The subsession decision reads the chain and then appends, which is a time-of-check-to-time-of-use race. Two firings for the same session can both observe "no receipt yet" and both append subsession 0.

appendReceiptGuarded(buildPayload) runs the whole check-then-append inside the existing chain lock. The callback receives the freshly re-read tail and returns either a payload or null to skip.

Reproduced before fixing: 4 barrier-synchronized processes ingesting the same transcript produced 4 receipts instead of 1. The test was verified to fail against an unguarded check-then-append before being accepted, because a concurrency test that passes both before and after a fix is worthless.

Changes

• src/store/index.js: new appendReceiptGuarded. Existing appendReceipt, reload, verify untouched.
• src/parser/index.js: counts.transcriptEntries is the growth marker.
• src/ingest/index.js: owns the subsession decision so the hook and the manual CLI share one implementation. Returns {entry, skipped, subsession, sessionId}.
• bin/hook-session-end.js: drops its own dedupe. Every existing guarantee kept: never writes stdout, never exits non-zero, catches all failures, bounded stdin read.
• src/views/index.js: morning-after reports total session receipts AND distinct sessions, since one session can now produce several receipts and a single number misleads. Session receipts show a subsession line when present, omitted for older receipts.
• src/mcp/server.js: query_receipts exposes subsession.
• KNOWN-LIMITS.md: item 5 rewritten for the new behavior.

Verification

• 96 tests passing (88 baseline plus 8).
• Concurrent-guard test proven to fail against the unguarded implementation and pass against the guarded one.
• Real-transcript check: first run appends subsession 0, second run reports no new activity and appends nothing.

[githubscum]

Closes KNOWN-LIMITS item 5. Follows the merged install-readiness and session-receipt work in #1.

The problem

Claude Code fires SessionEnd more than once for the same session (on clear, on resume, on exit). The hook deduped by session id, so the first firing won and everything after it was lost. A session that got receipted and then kept working left no record of the later work.

The fix

Each firing that carries new activity appends a NEW receipt, indexed subsession 0, 1, ... n.

Receipts stay cumulative rather than deltas. Every firing carries the whole transcript, so each receipt is a complete self-contained summary that stands on its own. Receipts are summaries (digests and counts, never file contents), so the redundancy is cheap and buys back the property that any single receipt is independently meaningful.

A no-change guard prevents inflation: if the transcript has not grown since the last receipt for that session, nothing is appended.

The race this had to avoid

The subsession decision reads the chain and then appends, which is a time-of-check-to-time-of-use race. Two firings for the same session can both observe "no receipt yet" and both append subsession 0.

appendReceiptGuarded(buildPayload) runs the whole check-then-append inside the existing chain lock. The callback receives the freshly re-read tail and returns either a payload or null to skip.

Reproduced before fixing: 4 barrier-synchronized processes ingesting the same transcript produced 4 receipts instead of 1. The test was verified to fail against an unguarded check-then-append before being accepted, because a concurrency test that passes both before and after a fix is worthless.

Changes

• src/store/index.js: new appendReceiptGuarded. Existing appendReceipt, reload, verify untouched.
• src/parser/index.js: counts.transcriptEntries is the growth marker.
• src/ingest/index.js: owns the subsession decision so the hook and the manual CLI share one implementation. Returns {entry, skipped, subsession, sessionId}.
• bin/hook-session-end.js: drops its own dedupe. Every existing guarantee kept: never writes stdout, never exits non-zero, catches all failures, bounded stdin read.
• src/views/index.js: morning-after reports total session receipts AND distinct sessions, since one session can now produce several receipts and a single number misleads. Session receipts show a subsession line when present, omitted for older receipts.
• src/mcp/server.js: query_receipts exposes subsession.
• KNOWN-LIMITS.md: item 5 rewritten for the new behavior.

Verification

• 96 tests passing (88 baseline plus 8).
• Concurrent-guard test proven to fail against the unguarded implementation and pass against the guarded one.
• Real-transcript check: first run appends subsession 0, second run reports no new activity and appends nothing.