Prove every ext-state write by reading the key back, so no guard is constant-true

SetProjExtState's return describes the whole extname. The persist and the instrument's publish now re-read their key; both refusals can finally fire.

src/shell/persist/CLAUDE.md

@@ -53,7 +53,7 @@ REAPER/filesystem-facing half only, and it gathers rather than decides.
 
 ## Modules
 
-- `shell/persist` (`session` / `ext_state_io` / `prune_fs`) — the persist seam, split by responsibility (Q-W5; the former `persist.cpp` god-TU and its `persist.h` compatibility umbrella are both retired — callers include `shell/persist/session.h` / `ext_state_io.h` directly). `session` owns the `ReaSamplerSession` lifecycle: the poll identity-transition detection (load / Save-As / forked sibling / recycled pointer) and the `projectconfig`-driven deferred undo/redo reload. `ext_state_io` owns project ext state (`SetProjExtState`/`GetProjExtState`, namespace `"reasampler"`) ↔ `BankBook` JSON, `ViewModeModel` JSON, `TailSetting` JSON, the tracking ledger JSON, the writing-version stamp, GUID minting, and bank-folder relocation. `session` additionally owns `recordCreated` — **the one writer of a birth record**, called at the same point the `Sample` is added, deriving lineage from that `Sample`'s own provenance. `prune_fs` hosts the prune dry-run / full-set orphan queries (gathering `referencedPaths()` plus `tracking::pruneProtection`'s two inputs for the `prune_reconcile` pure core) — and, beside them, `tiedUsageFor`, the resample's replace-vs-add input, deliberately co-located so "both answers come out of one `TrackingState`" is structural rather than a rule two files must remember. It is also **the single file-deletion authority over user files in the bank folder** (`deleteOrphanFile` via `SHFileOperationW`); nothing else in the system deletes bank-folder bytes. Dry-run / orphan-set / reclaim each independently abort (delete nothing) when the authority reports a block.
+- `shell/persist` (`session` / `ext_state_io` / `prune_fs`) — the persist seam, split by responsibility (Q-W5; the former `persist.cpp` god-TU and its `persist.h` compatibility umbrella are both retired — callers include `shell/persist/session.h` / `ext_state_io.h` directly). `session` owns the `ReaSamplerSession` lifecycle: the poll identity-transition detection (load / Save-As / forked sibling / recycled pointer) and the `projectconfig`-driven deferred undo/redo reload. `ext_state_io` owns project ext state (`SetProjExtState`/`GetProjExtState`, namespace `"reasampler"`) ↔ `BankBook` JSON, `ViewModeModel` JSON, `TailSetting` JSON, the tracking ledger JSON, the writing-version stamp, GUID minting, and bank-folder relocation. `saveToActiveProject` PROVES its `banks` write by reading that key back (`wire::extStateWriteLanded`) and returns that verdict — the sibling keys are written but not verified, so its `true` means "the bank state is in the project", never "everything persisted". `session` additionally owns `recordCreated` — **the one writer of a birth record**, called at the same point the `Sample` is added, deriving lineage from that `Sample`'s own provenance. `prune_fs` hosts the prune dry-run / full-set orphan queries (gathering `referencedPaths()` plus `tracking::pruneProtection`'s two inputs for the `prune_reconcile` pure core) — and, beside them, `tiedUsageFor`, the resample's replace-vs-add input, deliberately co-located so "both answers come out of one `TrackingState`" is structural rather than a rule two files must remember. It is also **the single file-deletion authority over user files in the bank folder** (`deleteOrphanFile` via `SHFileOperationW`); nothing else in the system deletes bank-folder bytes. Dry-run / orphan-set / reclaim each independently abort (delete nothing) when the authority reports a block.
 - `usage_scan` — extension-side prune-scan shell: enumerates every `rsusage_*` ext-state key, decodes each `sample_usage` wire record, enumerates every ReaSampler 9000 FX instance across all tracks + master / normal + record chains / containers (recursive) / take FX, and returns the pure `sample_usage::foldUsageRecords` result verbatim. One of the two inputs `tracking::pruneProtection` reads; it decides nothing itself. Read-only: writes no ext-state.
 - `persist_internal.h` — internal-only shared helpers for the persist TU family (`session` / `ext_state_io` / `prune_fs`); included only by those three TUs, never a public seam (mirror of the panel's `panel_state.h` / the editor's `editor_internal.h` precedent). Holds the former anonymous-namespace helpers more than one split TU needs (active-project + `.rpp` path lookup, project-dir derivation, growing `GetProjExtState` read, project-GUID minting, bank-folder relocation) — all definitions live in `ext_state_io.cpp`. REAPER-free header: the project handle crosses this seam as the same opaque `void*` the public `session` header already uses.
 

src/shell/persist/ext_state_io.cpp

@@ -182,7 +182,24 @@ bool ReaSamplerSession::saveToActiveProject() {
                     instrument::map::formatBankGeneration(bankGeneration_).c_str());
 
     MarkProjectDirty(static_cast<ReaProject*>(proj));
-    return true;
+
+    // Prove the ONE key a caller's answer hinges on. Each SetProjExtState above returns the
+    // size of the whole extname's state, which the six writes here keep non-zero between
+    // them, so no single one of those returns can speak for `banks`
+    // (wire::extStateWriteLanded owns the reasoning). The sibling keys stay unobserved and
+    // no caller claims otherwise; `banks` is the one whose absence would make a landed
+    // capture vanish on reload.
+    const wire::GrowingExtStateRead back = wire::readProjExtStateGrowing(
+        [&](char* buf, int cap) {
+            return GetProjExtState(static_cast<ReaProject*>(proj), projExtNamespace(),
+                                   kProjExtBanksKey, buf, cap);
+        });
+    if (back.status == wire::GrowingExtStateRead::Status::Overflow)
+        return false;  // could not check -> do not claim; never folded in as an absence
+    return wire::extStateWriteLanded(
+        banksJson, back.status == wire::GrowingExtStateRead::Status::Complete
+                       ? std::optional<std::string>(back.value)
+                       : std::nullopt);
 }
 
 bool ReaSamplerSession::writeAssignmentRequest(const std::string& wire) {

src/shell/persist/session.h

@@ -108,8 +108,16 @@ public:
     void bumpBankGeneration() { ++bankGeneration_; }
 
     // Serializes book/view/tail to ext state, clears the retired legacy
-    // `bank_index` key. No-ops with no active/saved project. Returns true iff
-    // a persist happened, so a caller can skip an undo block when nothing was written.
+    // `bank_index` key. No-ops with no active/saved project.
+    //
+    // Returns true iff the `banks` key READ BACK as exactly what this call wrote —
+    // the only per-key observation available under a shared extname
+    // (wire::extStateWriteLanded owns why SetProjExtState's own return cannot
+    // answer it). A false therefore covers four things without distinguishing
+    // them: no active project, an unsaved project, a rejected write, and a
+    // read-back that could not complete. The sibling keys (view/tail/ledger/
+    // version/generation) are written but NOT verified, so no caller may read
+    // this as "everything persisted" — only as "the bank state is in the project".
     bool saveToActiveProject();
 
     // Report-only prune dry-run: feeds the pure core with (present, referenced,