@azure-id/orc 1.2.0 → 1.4.0

package/templates/hooks/orc-statusline.js

@@ -20,10 +20,34 @@
  * `rate_limits.{five_hour,seven_day}` (Anthropic API headers, not estimated).
  * A window ≥90% folds into the DEGRADE verdict; fail-silent when absent.
  *
- * Three-tier verdict (the "ORC-ready" acceptance matrix):
- *   ✅ ORC-ready       Opus 4.8 high (the baseline)
- *   🚀 ORC-boosted     Opus 4.8 xhigh/max, or Opus 5 / Fable 5 medium…max
- *   ⛔ ORC WILL DEGRADE everything below (wrong model, sub-baseline effort, quota)
+ * Three-tier verdict (the "ORC-ready" acceptance matrix). Since v1.2.1 the
+ * ICON carries the verdict and the words carry the installed ORC version — but
+ * the degrade branch still names every reason, because a warning with no reason
+ * is an emoji:
+ *   ✅ ORC v1.2.1 - Opus 5/high          Opus 4.8 high (the baseline)
+ *   🚀 ORC v1.2.1 - Opus 5/high          Opus 4.8 xhigh/max, or Opus 5 / Fable 5 medium…max
+ *   ⛔ ORC v1.2.1 - Sonnet 5/high (why)  everything below (wrong model, sub-baseline effort, quota)
+ *
+ * The two lines, in full (v1.2.1):
+ *
+ *   {icon} ORC v{version} - {model}/{effort} · context (N%) · 5h N% (reset) ↔ wk N%
+ *          · ucs N% · wiki: … · diy:… · orc N.N.N available
+ *   {glyph} status: {lane} · {phase} · agents N (M running) · orc-extra: on|off
+ *          · Dur Nm · MTok NNNK · {branch}
+ *
+ * Line 1 answers "what tier am I on, and how full is the window". Line 2
+ * answers "what is this session DOING". Every segment on both is read from
+ * disk or from the payload; none of it costs a model call.
+ *
+ * Three segments on line 2 carry a rule worth stating here, because each is a
+ * place where the easy version would lie:
+ *   - `status:` is the ONLY segment allowed to vanish. A phase the disk cannot
+ *     prove is HIDDEN, never guessed — see the phase-rail block below for what
+ *     that costs and why it is still the right trade.
+ *   - `MTok` is MAIN TOKEN: this session's own turns. Claude Code records no
+ *     token usage for a dispatched subagent, so an hour of Opus executors adds
+ *     almost nothing. An em dash means not measured; `0` would mean free.
+ *   - `ucs` is a delta of an ACCOUNT-WIDE window, not a private meter.
  *
  * This is the ONLY place Claude Code exposes the live model id, so it also
  * writes a fail-silent session-model bridge (.claude/orc/session-model.json)
@@ -34,6 +58,12 @@
  * Also appends a "newer orc version available" hint from the 24h update cache
  * (cache-only here — never a network call in the statusline hot path; the
  * PreToolUse guard refreshes the cache when /orc is invoked).
+ *
+ * Everything on line 2 rides in ONE scan, throttled to 5s and cached in the
+ * per-session ledger, because a statusline re-renders on every keystroke and
+ * anything unthrottled here is a per-keystroke disk scan. `MTok` additionally
+ * reads only the bytes the transcript has GROWN by. There is exactly one seam
+ * over that budget — ORC_STATUSLINE_SCAN_MS — and nothing in ORC ever sets it.
  */
 
 // Opus 4.8 / Opus 5 / Fable 5 are matched by tolerant regexes below (accept
@@ -49,6 +79,383 @@ try {
   updater = null;
 }
 
+// ── The phase rail, the motifs, and the two seams (v1.2.1) ──────────────────
+// `status:` says which phase an ORC run is in. Three rules hold it up.
+//
+// 1. THE CLI COMPUTES, THIS FILE RENDERS. The phase ids, their order, their
+//    labels and their motif kind all come from `orc-lane-rails.json`, which
+//    `orc init` / `orc update` generates from the CLI's own registries. This
+//    hook holds no idea of what ORC's phases are. A second phase table here
+//    would be the Flow-stepper failure on a second surface, and no lint could
+//    see it. Frames are the exception and belong here: they are presentation,
+//    and a motif change must not need a reinstall.
+//
+// 2. A PHASE THE DISK CANNOT PROVE IS HIDDEN. Never guessed, never carried
+//    over from a minute ago. A stale phase word gets believed — the same
+//    reasoning as `unknown is not low` and `unknown is not zero`.
+//
+// 3. THE FLOOR IS HOOK-WRITTEN. `PHASE-EDGE <family>` and `SPAWN <agent>` are
+//    written by orc-trace.js with zero model cooperation. A trace verb the
+//    orchestrator narrated is allowed to REFINE that (it is more specific:
+//    `Q3 DO` rather than `execution`) but only when it is later in the file,
+//    and only when that lane's own rail publishes the verb — so it can sharpen
+//    the answer and can never invent one.
+//
+// What this cannot see, stated so nobody reads a blank as a bug:
+//   - a phase that dispatches nothing AND narrates nothing is INVISIBLE
+//     (/orc-quick Q1 LOOK and Q2 ASK, and every ask-the-user gate);
+//   - a CONTINUED agent emits no PreToolUse/SubagentStop pair, so the skeleton
+//     is a floor, never a census (orc-trace.js documents this);
+//   - `orc extra` runs a worker through Bash, so a foreign wave writes no
+//     SPAWN and resolves only through its narrated `EXTRA` verb, or hides.
+//
+// The animation is a LIVENESS TELL, not a driven animation. A statusline is a
+// pull surface — Claude Code re-renders it, ORC cannot — so the frame is picked
+// off the wall clock. It advances while you type and while turns land, and it
+// FREEZES when the session is idle, which is true and is the point.
+//
+// Two env seams, for tests and for terminals, and nothing in ORC ever sets
+// either: ORC_STATUSLINE_ASCII=1 swaps the glyph set, ORC_STATUSLINE_MOTION=0
+// REMOVES motion rather than slowing it (a frozen frame of a cycling animation
+// is a bug that looks like a hang — the web panel learned this at v0.44.0, and
+// so the still frame is designed as a still frame: frame 0 of each set).
+
+const PHASE_STALE_MS = 10 * 60 * 1000;
+
+const MOTIFS = {
+  look: { u: ["◔", "◑", "◕", "●"], a: [".", "o", "O", "0"], ms: 260 },
+  ask: { u: ["?", "¿", "?", "·"], a: ["?", "?", "?", "."], ms: 500 },
+  plan: { u: ["▁", "▃", "▅", "▇"], a: ["_", "-", "=", "#"], ms: 220 },
+  do: { u: ["▰", "▱", "▰", "▱"], a: ["=", "-", "=", "-"], ms: 180 },
+  check: { u: ["◇", "◈", "◆", "◈"], a: ["<", "=", ">", "="], ms: 240 },
+  ship: { u: ["›", "»", "≫", "»"], a: [">", ">", "=", ">"], ms: 200 },
+  wait: { u: ["·", "˙", "·", "˙"], a: [".", "'", ".", "'"], ms: 700 },
+  generic: {
+    u: ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"],
+    a: ["-", "\\", "|", "/"],
+    ms: 90,
+  },
+};
+
+function motifFrame(kind) {
+  const m = MOTIFS[kind] || MOTIFS.generic;
+  const frames = process.env.ORC_STATUSLINE_ASCII === "1" ? m.a : m.u;
+  if (process.env.ORC_STATUSLINE_MOTION === "0") return frames[0];
+  return frames[Math.floor(Date.now() / m.ms) % frames.length];
+}
+
+// The rail manifest, read once per process. Absent (a pre-1.2.1 install, or a
+// write that failed) → null → `status:` hides. Never throws.
+let RAILS = undefined;
+function rails() {
+  if (RAILS !== undefined) return RAILS;
+  RAILS = null;
+  try {
+    const j = JSON.parse(
+      require("fs").readFileSync(
+        require("path").join(__dirname, "orc-lane-rails.json"),
+        "utf8"
+      )
+    );
+    if (j && j.lanes) RAILS = j;
+  } catch (_) {}
+  return RAILS;
+}
+
+// Which phase is the run in? Called once per throttled scan, over text the scan
+// has already read, so it costs one regex pass and no extra I/O.
+//
+// `text` is the active trace, `laneToken` its filename's lane. Returns
+// {lane, label, kind} or null — and null is a real answer.
+function resolvePhase(laneToken, text) {
+  const r = rails();
+  if (!r || !laneToken) return null;
+  const row = r.lanes[laneToken];
+  if (!row) return null;
+
+  // Every line carries its own timestamp; the newest one dates the run. A trace
+  // whose last line is old is not a run in progress, whatever it says.
+  const at = (l) => {
+    const t = /^\[(\d{2})(\d{2})(\d{2}) (\d{2}):(\d{2}):(\d{2})/.exec(l);
+    if (!t) return 0;
+    return new Date(
+      2000 + Number(t[3]), Number(t[2]) - 1, Number(t[1]),
+      Number(t[4]), Number(t[5]), Number(t[6])
+    ).getTime();
+  };
+
+  const lines = text.split("\n");
+  let newest = 0;
+  let edgeIdx = -1;
+  let edgeFam = null;
+  let verbIdx = -1;
+  let verbPhase = null;
+  for (let i = 0; i < lines.length; i++) {
+    const l = lines[i];
+    if (!l) continue;
+    const ts = at(l);
+    if (ts > newest) newest = ts;
+    const e = /PHASE-EDGE ([a-z-]+)/.exec(l);
+    if (e && r.families[e[1]]) {
+      edgeIdx = i;
+      edgeFam = e[1];
+    }
+    // A verb line is the orchestrator's. It counts only when this lane's own
+    // rail published that verb — the rail is what stops a narrated word from
+    // inventing a phase the lane does not have.
+    const body = l.replace(/^\[[^\]]*\]\s*\S+\s*/, "");
+    for (const p of row.phases) {
+      for (const v of p.verbs) {
+        if (body.indexOf(v) === 0) {
+          verbIdx = i;
+          verbPhase = p;
+        }
+      }
+    }
+  }
+
+  if (!newest || Date.now() - newest > PHASE_STALE_MS) return null;
+
+  if (verbPhase && verbIdx > edgeIdx)
+    return { lane: laneToken, label: verbPhase.label, kind: verbPhase.kind };
+  if (edgeFam) {
+    const fam = r.families[edgeFam];
+    return { lane: laneToken, label: fam.label, kind: fam.kind };
+  }
+  if (verbPhase) return { lane: laneToken, label: verbPhase.label, kind: verbPhase.kind };
+  return null;
+}
+
+// The current branch, without a subprocess. A statusline re-renders on every
+// keystroke, so `git rev-parse` here would be one process per keystroke.
+// Anything unrecognised returns null and the segment is simply absent.
+function gitBranch(projectDir) {
+  const fs = require("fs");
+  const path = require("path");
+  try {
+    const dot = path.join(projectDir, ".git");
+    let gitDir = dot;
+    if (fs.statSync(dot).isFile()) {
+      // A worktree or a submodule: `.git` is a pointer file.
+      const m = /gitdir:\s*(.+)/.exec(fs.readFileSync(dot, "utf8"));
+      if (!m) return null;
+      const g = m[1].trim();
+      gitDir = path.isAbsolute(g) ? g : path.join(projectDir, g);
+    }
+    const head = fs.readFileSync(path.join(gitDir, "HEAD"), "utf8").trim();
+    const ref = /^ref:\s*refs\/heads\/(.+)$/.exec(head);
+    const name = ref
+      ? ref[1]
+      : /^[0-9a-f]{40}$/.test(head)
+        ? "@" + head.slice(0, 7)
+        : null;
+    if (!name) return null;
+    return name.length > 24 ? name.slice(0, 23) + "…" : name;
+  } catch (_) {
+    return null;
+  }
+}
+
+// MTok — MAIN TOKEN. The tokens THIS session's own turns consumed, summed from
+// the session transcript's `usage` blocks.
+//
+// Two honesty rules ship with it.
+//
+// It is the MAIN session only. Claude Code records NO token usage for a
+// dispatched subagent (v1.2.0 verified that across every transcript on two
+// machines), so a wave of three Opus executors adds almost nothing here. That
+// is why an unreadable transcript renders an em dash and NEVER `0` — a zero
+// would say the session was free.
+//
+// It is all four kinds summed. `/orc-budget`'s rule is four kinds never
+// blended, and that rule is about REPORTS; this is one cell on a status bar.
+// Any subset ORC picked would be a weighting ORC invented, which is worse. The
+// vector stays authoritative in `orc usage report`, and the ledger below keeps
+// all four kinds so it always can be.
+//
+// The read is INCREMENTAL. A transcript is append-only and reaches tens of
+// megabytes; re-reading it inside a 5-second loop is the per-keystroke disk
+// hazard the throttle exists to prevent. Only bytes past the stored offset are
+// read, and the offset resets when the file shrinks or the path changes.
+function scanTokens(led, transcriptPath) {
+  const fs = require("fs");
+  const fresh = (p) => ({
+    path: p, offset: 0, size: 0, input: 0, cache_write: 0, cache_read: 0, output: 0,
+  });
+  if (!transcriptPath) return led.tok || null;
+  let prev = led.tok && led.tok.path === transcriptPath ? led.tok : fresh(transcriptPath);
+  let st;
+  try {
+    st = fs.statSync(transcriptPath);
+  } catch (_) {
+    return prev.offset ? prev : null; // never read it → em dash, not 0
+  }
+  // Truncated or rotated under us: everything counted so far is unprovable.
+  if (st.size < prev.size) prev = fresh(transcriptPath);
+  if (st.size > prev.offset) {
+    let chunk = "";
+    try {
+      const fd = fs.openSync(transcriptPath, "r");
+      const len = st.size - prev.offset;
+      const buf = Buffer.alloc(len);
+      fs.readSync(fd, buf, 0, len, prev.offset);
+      fs.closeSync(fd);
+      chunk = buf.toString("utf8");
+    } catch (_) {
+      return prev.offset ? prev : null;
+    }
+    // The final line may be half-written. Stop at the last newline and leave
+    // the remainder for the next scan.
+    const cut = chunk.lastIndexOf("\n");
+    if (cut >= 0) {
+      const whole = chunk.slice(0, cut);
+      prev.offset += Buffer.byteLength(whole, "utf8") + 1;
+      for (const l of whole.split("\n")) {
+        if (!l || l.indexOf('"usage"') === -1) continue;
+        let u = null;
+        try {
+          const j = JSON.parse(l);
+          u = (j && j.message && j.message.usage) || (j && j.usage) || null;
+        } catch (_) {}
+        if (!u) continue;
+        prev.input += Number(u.input_tokens) || 0;
+        prev.cache_write += Number(u.cache_creation_input_tokens) || 0;
+        prev.cache_read += Number(u.cache_read_input_tokens) || 0;
+        prev.output += Number(u.output_tokens) || 0;
+      }
+    }
+  }
+  prev.size = st.size;
+  return prev;
+}
+
+function fmtTokens(tok) {
+  if (!tok) return null;
+  const n =
+    (tok.input || 0) + (tok.cache_write || 0) + (tok.cache_read || 0) + (tok.output || 0);
+  if (n <= 0) return null;
+  if (n >= 1e6) return (n / 1e6).toFixed(1).replace(/\.0$/, "") + "M";
+  if (n >= 1000) return Math.round(n / 1000) + "K";
+  return String(n);
+}
+
+// ── The per-session ledger: ONE read, ONE write, ONE throttle (v1.3.0 W0) ───
+// `.claude/orc/usage-session.json` is the per-session ledger, and three
+// separate blocks below want it: the rate-limit tracker, `ucs`, and the
+// throttled line-2 scan. Each used to open the file itself and two of them
+// wrote it, so one render cost three reads and two writes — on a surface that
+// re-renders on every keystroke. It is memoised here instead: loaded at most
+// once per process, mutated in place by whoever needs it, and flushed exactly
+// once at the end. Same rules as before — RAW numbers only, never a computed
+// word, fail-silent, and the reader decides what it means.
+//
+// The scan interval is the ONE seam over this budget, on the ORC_TEST_PROBE_MS
+// precedent: a test that proves the throttle by SLEEPING past it is a test that
+// fails on a loaded machine, and a flake is recorded and removed, never retried
+// away. Unset, this is byte-identical to a hardcoded 5000, and nothing in ORC
+// ever sets it.
+let LED = null;
+let LED_FILE = null;
+
+// The scan's own answers, in ONE shape, so a composed layout (v1.3.0) reads
+// exactly what the shipped lines read. It is populated as the blocks below
+// compute their segments — never by a second pass over the disk. A provider
+// nothing binds is simply never filled in, and every binding over it answers
+// null, which renders an em dash. UNKNOWN IS NOT ZERO.
+const SCAN = {
+  spawns: 0, running: 0, lanes: [], phase: null, slug: null,
+  branch: null, head: null, wiki: null, diy: null,
+  extra_enabled: false, update_version: null, inflight: null,
+  trace_age_min: null, trace_state: null, last_agent: null, retries: null,
+};
+
+function ledger(projectDir, sid) {
+  if (LED) return LED;
+  const fs = require("fs");
+  const path = require("path");
+  LED_FILE = path.join(projectDir, ".claude", "orc", "usage-session.json");
+  let led = null;
+  try {
+    led = JSON.parse(fs.readFileSync(LED_FILE, "utf8"));
+  } catch (_) {}
+  if (!led || led.session_id !== sid) led = { session_id: sid, started_at: Date.now() };
+  LED = led;
+  return LED;
+}
+
+function ledgerFlush() {
+  if (!LED || !LED_FILE) return;
+  try {
+    const fs = require("fs");
+    const path = require("path");
+    LED.updated_at = Date.now();
+    fs.mkdirSync(path.dirname(LED_FILE), { recursive: true });
+    fs.writeFileSync(LED_FILE, JSON.stringify(LED) + "\n");
+  } catch (_) {}
+}
+
+function scanEveryMs() {
+  const n = Number(process.env.ORC_STATUSLINE_SCAN_MS);
+  return Number.isFinite(n) && n >= 0 ? n : 5000;
+}
+
+// Per-provider TTL (v1.3.0 W2), replacing the single global throttle for
+// everything but the trace scan. A wiki tier does not move in five seconds and
+// a flow lock moves when somebody runs a command, so paying the 5-second rate
+// for either is paying for a change that cannot have happened.
+//
+// `ORC_STATUSLINE_SCAN_MS` still overrides ALL of them — it stays the ONE seam
+// over this budget, and a seam that only covered one provider would be a seam
+// tests could not use.
+const TTL = {
+  trace: 5000, // a run moves; this is the one thing that really is that fast
+  git: 5000, // .git/HEAD, no subprocess
+  wiki: 60000, // a wiki tier does not move in five seconds
+  config: 30000, // a config file is edited by hand
+  diy: 30000, // a flow lock moves when somebody runs a command
+  knowledge: 60000, // a pattern cache, a peer list, a gotcha count
+  extra: 15000, // a spend log DOES move during a wave
+  run: 10000, // RESUME.md is rewritten at every stop
+  gates: 60000, // a pact does not drift between keystrokes
+};
+
+// `at` is a ledger `scanned_at` stamp. Absent is stale — unknown is not fresh.
+function scanStale(at, now, ttl) {
+  const budget = process.env.ORC_STATUSLINE_SCAN_MS !== undefined ? scanEveryMs() : ttl == null ? scanEveryMs() : ttl;
+  return typeof at !== "number" || now - at >= budget;
+}
+
+// The read plan, from the compiled layout's lock. Returns null in EVERY state
+// but one — the feature off, no lock, an unparseable lock — and null means
+// "read everything", which is what makes `off` byte-identical.
+//
+// It deliberately does NOT re-run the gate ladder. This is a question about
+// what to READ, and the ladder is a question about what to RENDER; a layout
+// that later fails the ladder falls back to the shipped lines and simply has a
+// segment or two missing for one render. That is a far better failure than
+// reading the disk twice on a surface that re-renders on every keystroke.
+function readPlan(d) {
+  try {
+    const fs = require("fs");
+    const path = require("path");
+    const projectDir =
+      (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
+    const raw = fs.readFileSync(path.join(projectDir, ".claude", "orc.config.yaml"), "utf8");
+    if (!/^[ \t]*statusline_custom:[ \t]*["']?on["']?[ \t]*\r?$/m.test(raw)) return null;
+    const lock = JSON.parse(
+      fs.readFileSync(path.join(projectDir, ".claude", "orc", "statusline.lock.json"), "utf8")
+    );
+    if (!lock || !Array.isArray(lock.bindings)) return null;
+    return {
+      bindings: new Set(lock.bindings),
+      providers: new Set(lock.providers || []),
+      series: new Set(lock.series || []),
+    };
+  } catch (_) {
+    return null;
+  }
+}
+
 let raw = "";
 process.stdin.on("data", (c) => (raw += c));
 process.stdin.on("end", () => {
@@ -64,9 +471,26 @@ process.stdin.on("end", () => {
   const effort = String((d.effort && d.effort.level) || "").toLowerCase();
   const pct =
     d.context_window && typeof d.context_window.used_percentage === "number"
-      ? `${d.context_window.used_percentage}% ctx`
+      ? `context (${d.context_window.used_percentage}%)`
       : "";
 
+  // ── THE READ PLAN (v1.3.0 W2) ──────────────────────────────────────────────
+  // The compiler knows exactly which bindings a layout uses, therefore exactly
+  // which providers it needs, and it records both in the lock. So: A PROVIDER
+  // NOTHING BINDS IS NOT READ.
+  //
+  // That is the claim this feature has to earn — the shipped status line pays
+  // for the wiki read, the diy read and the trace scan unconditionally, and a
+  // user whose layout names none of them should pay for none of them. Composing
+  // your own line is allowed to make the bar FASTER than the hardcoded one it
+  // replaces, and here is where that happens.
+  //
+  // `null` means the feature is off, and then everything below runs exactly as
+  // it always has. That is what keeps `off` byte-identical.
+  const PLAN = readPlan(d);
+  const wants = (b) => !PLAN || PLAN.bindings.has(b);
+  const wantsProvider = (p) => !PLAN || PLAN.providers.has(p);
+
   // ── Session-model bridge (fail-silent) ─────────────────────────────────────
   // The PreToolUse effort guard cannot see the model id; it can only read
   // effort. Persist {model_id, effort, written_at} here so the guard can grant
@@ -141,9 +565,7 @@ process.stdin.on("end", () => {
       // bank what was consumed before the reset into `accumulated` and
       // re-baseline, so the running total keeps counting across the boundary.
       const sid = String(d.session_id || d.sessionId || "");
-      const sfile = path.join(orcDir, "usage-session.json");
-      let led = null;
-      try { led = JSON.parse(fs.readFileSync(sfile, "utf8")); } catch (_) {}
+      const led = ledger(projectDir, sid);
       const pctOf = (o) => (o && typeof o.used_percentage === "number" ? o.used_percentage : null);
       const track = (prev, cur) => {
         if (cur == null) return prev || null;
@@ -157,13 +579,10 @@ process.stdin.on("end", () => {
           };
         return { baseline: prev.baseline, last: cur, accumulated: prev.accumulated, resets: prev.resets };
       };
-      if (!led || led.session_id !== sid) led = { session_id: sid, started_at: Date.now() };
       led.five_hour = track(led.five_hour, pctOf(rl0 && rl0.five_hour));
       led.seven_day = track(led.seven_day, pctOf(rl0 && rl0.seven_day));
       led.context_used_percentage =
         cw0 && typeof cw0.used_percentage === "number" ? cw0.used_percentage : null;
-      led.updated_at = Date.now();
-      fs.writeFileSync(sfile, JSON.stringify(led) + "\n");
     }
 
   } catch (_) {}
@@ -262,34 +681,58 @@ process.stdin.on("end", () => {
     for (const u of usageBad) reasons.push(u);
   }
 
+  // The installed ORC version (v1.2.1). It replaces the verdict WORD, not the
+  // verdict: the icon still carries that, and the degrade branch still names
+  // every reason — dropping those would turn the loudest safety segment in ORC
+  // into an emoji. A version we cannot read renders as plain `ORC`, never
+  // `ORC vnull`: the statusline never prints a word for a thing it does not know.
+  let ver = null;
+  try {
+    ver = updater ? updater.installedVersion(__dirname) : null;
+  } catch (_) {}
+  if (!ver) {
+    try {
+      ver = JSON.parse(
+        require("fs").readFileSync(
+          require("path").join(__dirname, "orc-version.json"),
+          "utf8"
+        )
+      ).version || null;
+    } catch (_) {}
+  }
+  const brand = "ORC" + (ver ? " v" + ver : "");
+
   let line;
   if (verdict === "ready") {
-    line = `✅ ORC-ready ${tier}${pct ? " · " + pct : ""}`;
+    line = `✅ ${brand} - ${tier}${pct ? " · " + pct : ""}`;
   } else if (verdict === "boosted") {
-    line = `🚀 ORC-boosted ${tier}${pct ? " · " + pct : ""}`;
+    line = `🚀 ${brand} - ${tier}${pct ? " · " + pct : ""}`;
   } else {
-    line = `⛔ ORC WILL DEGRADE (${reasons.join(", ")}) — now: ${tier}${pct ? " · " + pct : ""}`;
+    line = `⛔ ${brand} - ${tier} (${reasons.join(", ")})${pct ? " · " + pct : ""}`;
   }
 
   // Subscription-usage segment (rendered after ctx, before wiki). Empty on
   // older Claude Code that doesn't surface `rate_limits`.
   if (rlSeg) line += " · " + rlSeg;
 
-  // How far the window moved while THIS session ran (v1.2.0). The ledger below
-  // keeps the raw numbers; this renders the delta. Never shown as "this session
-  // used X%" — the window is per ACCOUNT, and a second terminal moves it too.
+  // ucs — USAGE, CURRENT SESSION. How far the 5-hour window moved while THIS
+  // session ran (v1.2.0; renamed v1.2.1). The ledger below keeps the raw
+  // numbers; this renders the delta.
+  //
+  // It KEEPS ITS SLOT at zero. "This session has consumed nothing measurable
+  // yet" and "this build has no ucs segment" are different facts and must not
+  // look the same — the same rule as `lanes: none yet` and `used 0/20`.
+  //
+  // And it is still a delta of an ACCOUNT-WIDE window, not a private meter: a
+  // second terminal moves it too.
   try {
-    const fs = require("fs");
-    const path = require("path");
     const projectDir =
       (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
-    const led = JSON.parse(
-      fs.readFileSync(path.join(projectDir, ".claude", "orc", "usage-session.json"), "utf8")
-    );
+    const led = ledger(projectDir, String(d.session_id || d.sessionId || ""));
     const w = led && led.five_hour;
     if (w && typeof w.last === "number" && typeof w.baseline === "number") {
       const used = Math.max(0, (w.accumulated || 0) + Math.max(0, w.last - w.baseline));
-      if (used > 0) line += " · sess +" + used + "%";
+      line += " · ucs " + used + "%";
     }
   } catch (_) {}
 
@@ -298,43 +741,85 @@ process.stdin.on("end", () => {
   // wiki / no git / any error → no segment. Thresholds mirror the config
   // defaults (wiki_fresh_max 10 / wiki_aging_max 30); the hook can't read the
   // resolved config, so a user override shifts skill behavior, not this label.
+  //
+  // The git distance rides in the SAME throttled scan as everything on line 2
+  // (v1.3.0 W0). It used to be an `execSync` on every render — one child
+  // process PER KEYSTROKE in any repo with a wiki, which is the exact hazard
+  // the throttle exists to prevent. The ledger caches the RAW facts (a commit
+  // count, a boolean) and never the word: `fresh` / `AGING` / `STALE` is
+  // computed here, on read, every time.
   try {
     const fs = require("fs");
     const path = require("path");
-    const { execSync } = require("child_process");
     const projectDir =
       (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
-    const metaPath = path.join(projectDir, ".claude", "orc", "wiki-meta.json");
-    if (!fs.existsSync(metaPath)) {
-      // Docs but no manifest = UNREGISTERED: a real wiki nothing has indexed
-      // (usually a scan stopped at a 5-area pause). It is otherwise invisible —
-      // consumers and `orc crosslink` read the manifest — so surface it here,
-      // with the free fix. Never say "no wiki": these docs are already paid for.
-      const wikiDir = path.join(projectDir, "wiki");
-      const docs =
-        fs.existsSync(wikiDir) &&
-        fs.readdirSync(wikiDir).some((f) => f.startsWith("orc-") && f.endsWith(".md"));
-      if (docs) line += " · wiki: UNREGISTERED (run `orc wiki sync`)";
-    } else {
-      const meta = JSON.parse(fs.readFileSync(metaPath, "utf8"));
-      if (meta && meta.scan_commit) {
-        const distance = parseInt(
-          execSync(`git rev-list --count ${meta.scan_commit}..HEAD`, {
-            cwd: projectDir,
-            timeout: 3000,
-            stdio: ["ignore", "pipe", "ignore"],
-          })
-            .toString()
-            .trim(),
-          10
-        );
-        if (Number.isFinite(distance)) {
-          if (distance >= 10 && distance <= 30)
-            line += ` · wiki: AGING (${distance}c)`;
-          else if (distance > 30) line += ` · wiki: STALE (${distance}c)`;
-          else line += " · wiki: fresh";
+    // A layout that names no wiki component performs ZERO wiki reads — not a
+    // cheaper one, none. This is the read planner's whole point.
+    if (!wants("wiki.tier") && !wants("wiki.distance")) throw new Error("not needed");
+    const led = ledger(projectDir, String(d.session_id || d.sessionId || ""));
+    const now = Date.now();
+    // A wiki tier does not move in five seconds. Per-provider TTL replaces the
+    // single global throttle for everything but the trace scan, which is the
+    // one thing that really does move that fast.
+    if (scanStale(led.wiki && led.wiki.scanned_at, now, TTL.wiki)) {
+      const w = { unregistered: false, distance: null, scanned_at: now };
+      const metaPath = path.join(projectDir, ".claude", "orc", "wiki-meta.json");
+      if (!fs.existsSync(metaPath)) {
+        // Docs but no manifest = UNREGISTERED: a real wiki nothing has indexed
+        // (usually a scan stopped at a 5-area pause). It is otherwise invisible
+        // — consumers and `orc crosslink` read the manifest — so surface it
+        // here, with the free fix. Never say "no wiki": these docs are already
+        // paid for.
+        const wikiDir = path.join(projectDir, "wiki");
+        w.unregistered =
+          fs.existsSync(wikiDir) &&
+          fs.readdirSync(wikiDir).some((f) => f.startsWith("orc-") && f.endsWith(".md"));
+      } else {
+        const meta = JSON.parse(fs.readFileSync(metaPath, "utf8"));
+        if (meta && meta.scan_commit) {
+          // A FAILED probe is a fact, and it is cached like any other. No git,
+          // a detached commit, a timeout — without this inner catch the whole
+          // block aborts before the ledger is stamped, and the subprocess runs
+          // again on the very next keystroke. The segment stays absent either
+          // way; what changes is that it costs nothing to stay absent.
+          try {
+            const { execSync } = require("child_process");
+            const n = parseInt(
+              execSync(`git rev-list --count ${meta.scan_commit}..HEAD`, {
+                cwd: projectDir,
+                timeout: 3000,
+                stdio: ["ignore", "pipe", "ignore"],
+              })
+                .toString()
+                .trim(),
+              10
+            );
+            if (Number.isFinite(n)) w.distance = n;
+          } catch (_) {}
         }
       }
+      led.wiki = w;
+    }
+    const w = led.wiki;
+    if (w) {
+      SCAN.wiki = {
+        distance: typeof w.distance === "number" ? w.distance : null,
+        tier: w.unregistered
+          ? "unregistered"
+          : typeof w.distance !== "number"
+            ? null
+            : w.distance > 30
+              ? "stale"
+              : w.distance >= 10
+                ? "aging"
+                : "fresh",
+      };
+    }
+    if (w && w.unregistered) line += " · wiki: UNREGISTERED (run `orc wiki sync`)";
+    else if (w && typeof w.distance === "number") {
+      if (w.distance >= 10 && w.distance <= 30) line += ` · wiki: AGING (${w.distance}c)`;
+      else if (w.distance > 30) line += ` · wiki: STALE (${w.distance}c)`;
+      else line += " · wiki: fresh";
     }
   } catch (_) {}
 
@@ -347,6 +832,8 @@ process.stdin.on("end", () => {
     const crypto = require("crypto");
     const projectDir =
       (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
+    if (!wants("diy.state") && !wants("diy.name") && !wants("diy.tier_state"))
+      throw new Error("not needed");
     const lockPath = path.join(projectDir, ".claude", "orc", "diy", "flow.lock.json");
     if (fs.existsSync(lockPath)) {
       const lock = JSON.parse(
@@ -397,6 +884,23 @@ process.stdin.on("end", () => {
     } catch (_) {}
   }
 
+  // The branch is its OWN provider: `.git/HEAD` with no subprocess, on a
+  // different clock from the trace scan, and a layout that shows a branch and
+  // nothing else must not pay for a trace scan to get it.
+  if (wantsProvider("scan.git")) {
+    try {
+      const projectDir =
+        (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
+      SCAN.branch = gitBranch(projectDir) || null;
+    } catch (_) {}
+  }
+
+  // The extended scan (v1.3.0 W3). Only a composed layout can reach it, and
+  // only for the providers its own lock names.
+  extendedScan(d, wants, wantsProvider);
+  // The sparkline series, sampled during the scan that already ran.
+  sampleSeries(d, PLAN);
+
   // ── Session line (v1.2.0) ──────────────────────────────────────────────────
   // Line 1 answers "what tier am I on and how full is the window". This second
   // line answers "what has this session actually been DOING" — how many agents
@@ -416,13 +920,7 @@ process.stdin.on("end", () => {
     const path = require("path");
     const projectDir =
       (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
-    const orcDir = path.join(projectDir, ".claude", "orc");
-    const sfile = path.join(orcDir, "usage-session.json");
-    const sid = String(d.session_id || d.sessionId || "");
-
-    let led = null;
-    try { led = JSON.parse(fs.readFileSync(sfile, "utf8")); } catch (_) {}
-    if (!led || led.session_id !== sid) led = { session_id: sid, started_at: Date.now() };
+    const led = ledger(projectDir, String(d.session_id || d.sessionId || ""));
 
     // The hook cannot read the RESOLVED config — that is the lane resolver's
     // job, and a hook has no lane — so this reads the two raw keys it needs
@@ -439,32 +937,39 @@ process.stdin.on("end", () => {
     } catch (_) {}
 
     const now = Date.now();
-    // The scan interval is the ONE seam over this budget, on the
-    // ORC_TEST_PROBE_MS precedent: a test that proves the throttle by SLEEPING
-    // past it is a test that fails on a loaded machine, and a flake is recorded
-    // and removed, never retried away. Unset, this is byte-identical to a
-    // hardcoded 5000, and nothing in ORC ever sets it.
-    const scanEvery = (() => {
-      const n = Number(process.env.ORC_STATUSLINE_SCAN_MS);
-      return Number.isFinite(n) && n >= 0 ? n : 5000;
-    })();
-    const stale = !led.dispatch || typeof led.dispatch.scanned_at !== "number" ||
-      now - led.dispatch.scanned_at >= scanEvery;
-    if (stale) {
+    if (!wantsProvider("scan.trace")) throw new Error("not needed");
+    if (scanStale(led.dispatch && led.dispatch.scanned_at, now, TTL.trace)) {
       const logDir = path.isAbsolute(logRel) ? logRel : path.join(projectDir, logRel);
       const sessionFloor = Math.floor((led.started_at || 0) / 1000) * 1000;
       let spawns = 0;
       let running = 0;
       const lanes = [];
+      // The ACTIVE run, for `status:` (v1.2.1). `.current` is the pointer the
+      // lanes and the trace hook both write, so it — not "the newest file" — is
+      // what names the run in progress. A pointer naming a file that is not
+      // there answers nothing, and a pointer nobody deleted is not a run: the
+      // resolver's own staleness gate settles that from the trace's last line.
+      let activeFile = null;
+      try {
+        const cur = fs.readFileSync(path.join(logDir, ".current"), "utf8").trim();
+        if (cur) activeFile = cur;
+      } catch (_) {}
+      let phase = null;
       try {
         for (const f of fs.readdirSync(logDir)) {
           if (!f.startsWith("run-") || !f.endsWith(".txt")) continue;
           const full = path.join(logDir, f);
-          // Only traces touched since this session began. A trace from last
-          // week is not this session's spend.
           let st;
           try { st = fs.statSync(full); } catch (_) { continue; }
-          if (st.mtimeMs < (led.started_at || 0)) continue;
+          const active = f === activeFile;
+          // Only traces touched since this session began count towards the
+          // session's SPEND — a trace from last week is not this session's.
+          // The ACTIVE run is exempt from that filter: `status:` answers "what
+          // is ORC doing", which has nothing to do with who paid for it, and a
+          // run already going when this session opened would otherwise be
+          // invisible until it happened to write its next line. Its own
+          // staleness gate decides whether it is still running.
+          if (!active && st.mtimeMs < (led.started_at || 0)) continue;
           const text = fs.readFileSync(full, "utf8");
           // Count by the trace's OWN line timestamps, not the file's mtime. A
           // run that was already going when this session started shares its
@@ -486,6 +991,12 @@ process.stdin.on("end", () => {
             if (at >= sessionFloor) mine += 1;
           }
           spawns += mine;
+          // The phase comes off the text this loop already read — one more
+          // regex pass, no second file read.
+          if (active) {
+            const lm = /^run-([a-z0-9-]+?)-.+-\d{6}-\d{6}\.txt$/.exec(f);
+            if (lm) phase = resolvePhase(lm[1], text);
+          }
           let openHere = 0;
           try {
             const pend = JSON.parse(fs.readFileSync(full + ".pending.json", "utf8"));
@@ -500,32 +1011,524 @@ process.stdin.on("end", () => {
           }
         }
       } catch (_) {}
-      led.dispatch = { spawns, running, lanes, scanned_at: now };
+      led.dispatch = { spawns, running, lanes, phase, scanned_at: now };
+      // MTok rides in the same throttled pass, and reads only the bytes the
+      // transcript has grown by since the last one.
+      led.tok = scanTokens(led, d.transcript_path || null);
     }
 
-    led.updated_at = now;
-    try {
-      fs.mkdirSync(orcDir, { recursive: true });
-      fs.writeFileSync(sfile, JSON.stringify(led) + "\n");
-    } catch (_) {}
-
-    const dsp = led.dispatch || { spawns: 0, running: 0, lanes: [] };
+    const dsp = led.dispatch || { spawns: 0, running: 0, lanes: [], phase: null };
+    // The composed layout reads THESE — the same numbers the shipped line
+    // below prints, from the same scan.
+    SCAN.spawns = dsp.spawns || 0;
+    SCAN.running = dsp.running || 0;
+    SCAN.lanes = dsp.lanes || [];
+    SCAN.phase = dsp.phase || null;
+    SCAN.extra_enabled = !!extraOn;
     const parts = [];
+    // `status:` leads, because what ORC is doing right now is the one thing on
+    // this line that changes minute to minute. It is also the ONE segment
+    // allowed to vanish: a phase the disk cannot prove is hidden rather than
+    // guessed, and the glyph goes with it. It replaces v1.2.0's `lanes:` list —
+    // the running lane is its first word, and `orc stats` / `orc run list`
+    // still hold the whole session's history.
+    if (dsp.phase && dsp.phase.label)
+      parts.push(
+        motifFrame(dsp.phase.kind) + " status: " + dsp.phase.lane + " · " + dsp.phase.label
+      );
     // `running` is never hidden, because an agent still in flight is the thing
     // a user most needs to see (v1.2.0). Zero is simply not printed.
     parts.push(
       "agents " + dsp.spawns + (dsp.running ? " (" + dsp.running + " running)" : "")
     );
     parts.push("orc-extra: " + (extraOn ? "on" : "off"));
-    // An empty lane list means no ORC lane has dispatched yet this session —
-    // an ANSWER, not a gap, so it keeps its slot and says so.
-    parts.push("lanes: " + (dsp.lanes.length ? dsp.lanes.join(", ") : "none yet"));
     if (led.started_at)
-      parts.push(Math.max(0, Math.round((now - led.started_at) / 60000)) + "m");
+      parts.push("Dur " + Math.max(0, Math.round((now - led.started_at) / 60000)) + "m");
+    // MTok keeps its slot in every state. An em dash says "not measured"; a `0`
+    // would say the session was free, and that is a different claim.
+    parts.push("MTok " + (fmtTokens(led.tok) || "—"));
+    if (SCAN.branch) parts.push(SCAN.branch);
     line2 = "   " + parts.join(" · ");
   } catch (_) {
     line2 = "";
   }
 
+  // ONE write, after every block that touches the ledger has had its say. It is
+  // last on purpose: a render that throws half way through still prints, and a
+  // ledger that could not be written never takes the status line down with it.
+  ledgerFlush();
+
+  // ── THE CUSTOM LAYOUT (v1.3.0) ──────────────────────────────────────────
+  // Everything above is the SHIPPED status line, and it is what renders unless
+  // the user composed their own. `custom()` returns null in every state but
+  // one, and each of its gates is a FALLBACK rather than a throw: a hook cannot
+  // refuse, so a bad layout must degrade to something correct rather than paint
+  // garbage. The ladder is documented on the function itself.
+  const composed = custom(d, {
+    payload: d,
+    ledger: LED || {},
+    scan: SCAN,
+    derived: { verdict, reasons, version: ver },
+    now: Date.now(),
+  });
+  if (composed != null) {
+    process.stdout.write(composed);
+    return;
+  }
+
   process.stdout.write(line2 ? line + "\n" + line2 : line);
 });
+
+// ── The six-rung gate ladder ────────────────────────────────────────────────
+// In order, and EVERY RUNG IS A FALLBACK, never a throw:
+//
+//   1  statusline_custom is not `on`        the shipped lines. BYTE-IDENTICAL.
+//   2  statusline-compiled.json missing /   default + statusline-layout-unreadable
+//      unparseable / schema mismatch
+//   3  orc_version or catalog_hash moved    default + statusline-layout-stale
+//   4  an unknown op or an unknown binding  default + statusline-layout-skew
+//   5  the cheap shape guard fails          default + statusline-layout-invalid
+//   6  otherwise                            run the program
+//
+// Rungs 3 and 4 are why the lock file exists. Rung 5 is this hook RE-CHECKING
+// rather than trusting the file, because a hand-edited compiled file is a file
+// nobody validated. Every fallback RECORDS ITSELF in the ledger so `orc doctor`
+// can name it: a status line that quietly went back to the default and never
+// said why is a bug the user cannot report.
+function custom(d, ctx) {
+  try {
+    const fs = require("fs");
+    const path = require("path");
+    const projectDir =
+      (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
+    const orcDir = path.join(projectDir, ".claude", "orc");
+
+    // Rung 1. The hook cannot resolve config — that is the lane resolver's job,
+    // and a hook has no lane — so it reads the raw key off the file and takes
+    // the documented default otherwise, exactly as it already does for
+    // `log_dir` and `extra_enabled`.
+    let on = false;
+    try {
+      const raw = fs.readFileSync(path.join(projectDir, ".claude", "orc.config.yaml"), "utf8");
+      // The trailing \r is tolerated on purpose: a config file written on
+      // Windows carries CRLF, and a $-anchored match silently never fires
+      // there — which is a feature that is ON in the file and OFF on the bar.
+      on = /^[ \t]*statusline_custom:[ \t]*["']?on["']?[ \t]*\r?$/m.test(raw);
+    } catch (_) {}
+    if (!on) return null;
+
+    // Rung 2. THE HOOK NEVER READS THE AUTHORED LAYOUT — not as a fallback, not
+    // on a cache miss, not ever. One consumer per file.
+    let prog = null;
+    try {
+      prog = JSON.parse(fs.readFileSync(path.join(orcDir, "statusline-compiled.json"), "utf8"));
+    } catch (_) {}
+    if (!prog || prog.schema !== 1) return slFallback(orcDir, "statusline-layout-unreadable");
+
+    // Rung 3. An ORC upgrade that adds, removes or changes a component
+    // invalidates every compiled layout on the machine. Better the shipped
+    // lines than a program compiled against a catalogue that no longer exists.
+    let lock = null;
+    try {
+      lock = JSON.parse(fs.readFileSync(path.join(orcDir, "statusline.lock.json"), "utf8"));
+    } catch (_) {}
+    let installed = null;
+    try {
+      installed = JSON.parse(fs.readFileSync(path.join(__dirname, "orc-version.json"), "utf8")).version;
+    } catch (_) {}
+    if (!lock || (installed && lock.orc_version !== installed))
+      return slFallback(orcDir, "statusline-layout-stale");
+
+    const engine = require("./orc-statusline-render.js");
+
+    // Rung 4. A binding this build does not have is an INSTALL SKEW, not a
+    // rendering problem, and it must not be papered over one item at a time.
+    for (const b of lock.bindings || []) {
+      if (!engine.BINDINGS[b]) return slFallback(orcDir, "statusline-layout-skew");
+    }
+
+    // Rung 5. The cheap shape guard: at most three lines, at most five
+    // components on any of them, and the dense-prefix rule —
+    // A line may hold a component only if every line above it holds at least one.
+    if (!Array.isArray(prog.lines) || prog.lines.length > 3)
+      return slFallback(orcDir, "statusline-layout-invalid");
+    let seenEmpty = false;
+    for (const l of prog.lines) {
+      const n = (l.ops || []).filter((o) => o.op === "item").length;
+      if (n > 5) return slFallback(orcDir, "statusline-layout-invalid");
+      if (n === 0) seenEmpty = true;
+      else if (seenEmpty) return slFallback(orcDir, "statusline-layout-invalid");
+    }
+
+    // Rung 6. Run the program. Failure isolation lives inside the engine: one
+    // throwing item emits its unknown form and the rest of the line survives.
+    SCAN.preset = prog.preset || null;
+    const out = engine.render(prog, {
+      payload: ctx.payload,
+      ledger: ctx.ledger,
+      scan: ctx.scan,
+      derived: ctx.derived,
+      now: ctx.now,
+      cols: Number(process.env.COLUMNS) || 0,
+      env: process.env,
+    });
+    if (out.errors && out.errors.length) slNote(orcDir, "statusline-item-failed", out.errors[0]);
+    return out.text;
+  } catch (_) {
+    // Even the ladder must not throw. A status line that crashes is a status
+    // line that is simply absent, with no way to find out why.
+    return null;
+  }
+}
+
+// A fallback RECORDS ITSELF. `orc doctor` reads this file and names the finding
+// with the exact command that clears it.
+function slFallback(orcDir, finding) {
+  slNote(orcDir, finding, null);
+  return null;
+}
+function slNote(orcDir, finding, detail) {
+  try {
+    const fs = require("fs");
+    const path = require("path");
+    fs.mkdirSync(orcDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(orcDir, "statusline-state.json"),
+      JSON.stringify({ finding, detail: detail || null, at: Date.now() }) + "\n"
+    );
+  } catch (_) {}
+}
+
+// ── THE EXTENDED SCAN (v1.3.0 W3) ──────────────────────────────────────────
+// Groups D, E, F and G — knowledge, extra, flow and the health gates. Every one
+// of them is a `new read`: a read that does not exist in the shipped status
+// line and only happens when a layout asks for it.
+//
+// THE BAR IS 15 MILLISECONDS, NOT 300. W0 measured node startup at ~285 ms of a
+// 300 ms budget, so a component here has to be answerable from a small JSON
+// file, on its own clock, or it does not ship. Two are refused for that reason
+// and say so in the catalogue.
+//
+// Every read below is:
+//   - gated on a BINDING the compiled lock names (the read planner);
+//   - cached in the per-session ledger under its own key;
+//   - given its OWN TTL, because a pact ledger and a spend log do not move at
+//     the same rate.
+//
+// A read that throws leaves its slot null, and a null renders an em dash.
+// UNKNOWN IS NOT ZERO — a `0` would say the thing was measured and found empty.
+function extendedScan(d, wants, wantsProvider) {
+  if (!wantsProvider("scan.extended")) return;
+  let fs, path, projectDir, led, now;
+  try {
+    fs = require("fs");
+    path = require("path");
+    projectDir = (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
+    led = ledger(projectDir, String(d.session_id || d.sessionId || ""));
+    now = Date.now();
+  } catch (_) {
+    return;
+  }
+  const orc = path.join(projectDir, ".claude", "orc");
+  const readJson = (p) => {
+    try {
+      return JSON.parse(fs.readFileSync(p, "utf8").replace(/^/, ""));
+    } catch (_) {
+      return null;
+    }
+  };
+  // One cached sub-scan. `key` is its ledger slot, `ttl` its own clock.
+  const cached = (key, ttl, fn) => {
+    const slot = led.ext && led.ext[key];
+    if (slot && !scanStale(slot.at, now, ttl)) return slot.v;
+    let v = null;
+    try {
+      v = fn();
+    } catch (_) {
+      v = null;
+    }
+    led.ext = led.ext || {};
+    led.ext[key] = { v, at: now };
+    return v;
+  };
+
+  // ── Group D — knowledge. All of it comes out of wiki-meta.json, which is
+  //    written ONLY by `orc wiki sync` and is 100% doc-header-derived. A wiki
+  //    tier does not move in a minute, so the TTL is generous.
+  if (wants("wiki.docs")) {
+    const w = cached("wiki_meta", TTL.wiki, () => {
+      const meta = readJson(path.join(orc, "wiki-meta.json"));
+      if (!meta) return null;
+      const docs = Array.isArray(meta.docs) ? meta.docs : [];
+      return {
+        docs: docs.length,
+      };
+    });
+    SCAN.wiki_meta = w;
+  }
+  if (wants("pattern.state")) {
+    // EXISTENCE only, and by the deterministic probe's own rule: the cache
+    // lives under the hidden .claude/ dir, so a raw filesystem search
+    // false-negatives from the wrong cwd.
+    SCAN.pattern = cached("pattern", TTL.knowledge, () => {
+      const dir = path.join(orc, "patterns");
+      try {
+        return fs.readdirSync(dir).some((f) => f.endsWith("-pattern.md")) ? "cached" : "none";
+      } catch (_) {
+        return "none";
+      }
+    });
+  }
+  if (wants("crosslink.state") || wants("crosslink.peers")) {
+    const c = cached("crosslink", TTL.knowledge, () => {
+      const raw = (() => {
+        try {
+          return fs.readFileSync(path.join(projectDir, ".claude", "orc-crosslink.config.yaml"), "utf8");
+        } catch (_) {
+          return null;
+        }
+      })();
+      if (!raw) return null;
+      const n = (raw.match(/^[ \t]*-[ \t]*name:/gm) || []).length;
+      return { peers: n, state: n ? "linked" : "none" };
+    });
+    SCAN.crosslink = c;
+  }
+  if (wants("gotchas.count")) {
+    SCAN.gotchas = cached("gotchas", TTL.knowledge, () => {
+      try {
+        return fs.readdirSync(path.join(orc, "gotchas")).filter((f) => f.endsWith(".md")).length;
+      } catch (_) {
+        return null;
+      }
+    });
+  }
+
+  // ── Group E — extra. `extra.json` is small; the SPEND LOG is not, so it is
+  //    read by TAIL and on its own faster clock, because a spend log is the one
+  //    thing here that moves during a wave.
+  if (wants("extra.profile") || wants("extra.provider") || wants("extra.inflight") || wants("extra.passphrase") || wants("extra.demoted")) {
+    SCAN.extra = cached("extra", TTL.extra, () => {
+      const j = readJson(path.join(orc, "extra.json"));
+      if (!j) return null;
+      const profiles = j.profiles || {};
+      const names = Object.keys(profiles);
+      const first = names.length ? profiles[names[0]] : null;
+      return {
+        profile: names.length ? names[0] : null,
+        provider: first && first.provider ? first.provider : null,
+        profiles: names.length,
+      };
+    });
+  }
+  if (wants("extra.spend") || wants("extra.tasks")) {
+    SCAN.extra_spend = cached("extra_spend", TTL.extra, () => {
+      // The tail only. A spend log grows for the life of a project and reading
+      // all of it on a per-keystroke surface is the hazard this whole subsystem
+      // is shaped around.
+      const p = path.join(orc, "extra-spend.jsonl");
+      let st;
+      try {
+        st = fs.statSync(p);
+      } catch (_) {
+        return null;
+      }
+      const want = Math.min(st.size, 64 * 1024);
+      const buf = Buffer.alloc(want);
+      const fd = fs.openSync(p, "r");
+      try {
+        fs.readSync(fd, buf, 0, want, st.size - want);
+      } finally {
+        fs.closeSync(fd);
+      }
+      const lines = buf.toString("utf8").split("\n").slice(1).filter(Boolean);
+      let tasks = 0;
+      let usd = 0;
+      let priced = false;
+      for (const l of lines) {
+        try {
+          const r = JSON.parse(l);
+          tasks++;
+          if (typeof r.usd === "number") {
+            usd += r.usd;
+            priced = true;
+          }
+        } catch (_) {}
+      }
+      // A cost figure ORC did not price itself is never printed: `usd` stays
+      // null rather than becoming a confident 0.
+      return { tasks, usd: priced ? usd : null, partial: st.size > want };
+    });
+  }
+
+  // ── Group F — flow and lanes. The diy lock is already read for the shipped
+  //    segment; `wait` is a small run-state file.
+  if (wants("wait.state")) {
+    SCAN.wait = cached("wait", TTL.run, () => {
+      const j = readJson(path.join(orc, "wait.json"));
+      if (!j) return "none";
+      if (j.block_reason) return "blocked";
+      return j.until || j.hops ? "waiting" : "none";
+    });
+  }
+  // `preset.name` is NOT read here: it rides in the compiled program, which is
+  // the only file that crosses the wall. The hook never opens the authored
+  // layout, and a field being convenient is not an exception to that.
+
+  // ── Group C remainder — the run's own progress, from RESUME.md, which is the
+  //    ONE line `orc resume` and `orc run list` parse. Reading the same line is
+  //    how a listing never has to open a checkpoint.
+  if (wants("run.wave") || wants("run.wave_total") || wants("run.resume") || wants("run.open")) {
+    SCAN.runs = cached("runs", TTL.run, () => {
+      let logRel = ".claude/orc/logs";
+      try {
+        const raw = fs.readFileSync(path.join(projectDir, ".claude", "orc.config.yaml"), "utf8");
+        const m = /^[ \t]*run_dir:[ \t]*["']?([^"'#\r\n]+)/m.exec(raw);
+        if (m) logRel = m[1].trim();
+      } catch (_) {}
+      const runDir = path.isAbsolute(logRel) ? logRel : path.join(projectDir, ".claude", "orc", "run");
+      let open = 0;
+      let wave = null;
+      let waves = null;
+      try {
+        for (const slug of fs.readdirSync(runDir)) {
+          const rp = path.join(runDir, slug, "RESUME.md");
+          if (!fs.existsSync(rp)) continue;
+          if (fs.existsSync(path.join(runDir, slug, "closed.json"))) continue;
+          open++;
+          // The byte-stable `Where it stands:` line, at column 0. It is the one
+          // line two other commands already parse, which is exactly why this
+          // does not open a checkpoint.
+          const m = /^Where it stands:.*wave (\d+) of (\d+)/m.exec(fs.readFileSync(rp, "utf8"));
+          if (m && wave == null) {
+            wave = Number(m[1]);
+            waves = Number(m[2]);
+          }
+        }
+      } catch (_) {
+        return null;
+      }
+      return { open, wave, waves, resume: open > 0 ? "waiting" : "none" };
+    });
+  }
+
+  // ── Group G — the health gates. Each is one small ledger, each on the slow
+  //    clock: a pact does not drift between keystrokes.
+  const gate = (key, file, fn) => {
+    if (!wants(key)) return null;
+    return cached(key.replace(/\./g, "_"), TTL.gates, () => fn(readJson(path.join(orc, file))));
+  };
+  SCAN.pact = gate("pact.state", "pact.json", (j) => {
+    if (!j || !Array.isArray(j.entries)) return null;
+    const live = j.entries.filter((e) => e.state !== "retired");
+    const broken = live.filter((e) => e.state === "broken").length;
+    const drifted = live.filter((e) => e.state === "drifted").length;
+    // UNCHECKABLE is the honest state and it never reads as a failure.
+    return { state: broken ? "broken" : drifted ? "drifted" : "holding", drifted, broken, total: live.length };
+  });
+  SCAN.boundary = gate("boundary.state", "boundary.json", (j) => {
+    if (!j || !Array.isArray(j.cards)) return null;
+    const refused = j.cards.filter((c) => c.verdict === "REFUSE").length;
+    // An area with no card is UNKNOWN, never assumed safe.
+    return { state: refused ? "refused" : "clear", refused, cards: j.cards.length };
+  });
+  SCAN.challenge = gate("challenge.state", "challenge.json", (j) => {
+    if (!j) return null;
+    const open = Array.isArray(j.findings) ? j.findings.filter((f) => !f.resolved).length : 0;
+    return { state: j.state || (open ? "open" : "pass"), open, iteration: j.iteration || null };
+  });
+  SCAN.doc = gate("doc.state", "doc.json", (j) => {
+    if (!j) return null;
+    const outline = Array.isArray(j.outline) ? j.outline : [];
+    const done = outline.filter((s) => s.hash).length;
+    return { state: j.shipped ? "shipped" : "draft", done, total: outline.length };
+  });
+
+  // `usage-gate` reads the usage bridge this hook already writes — so it is the
+  // cheapest `new read` in the set, and it is the only one that can say
+  // `unknown`, which is a real answer and never a stop.
+  if (wants("usage.state")) {
+    SCAN.usage = cached("usage", TTL.trace, () => {
+      const j = readJson(path.join(orc, "usage.json"));
+      if (!j || !j.written_at) return "unknown";
+      if (now - j.written_at > 30 * 60 * 1000) return "unknown";
+      const w = [j.five_hour, j.seven_day].filter(Boolean).map((x) => x.used_percentage);
+      if (!w.length) return "unknown";
+      return Math.max(...w) >= 90 ? "low" : "ok";
+    });
+  }
+
+  // A config key as a component. The config file is edited by hand, so 30s.
+  if (wants("config.value")) {
+    SCAN.config_raw = cached("config", TTL.config, () => {
+      try {
+        return fs.readFileSync(path.join(projectDir, ".claude", "orc.config.yaml"), "utf8");
+      } catch (_) {
+        return null;
+      }
+    });
+  }
+}
+
+// ── THE SERIES LEDGER (v1.3.0 W3) ──────────────────────────────────────────
+// `spark`, `spark-braille`, `trend` and `delta` need history, and a status line
+// has none: it is a fresh process every render. So the LAST 16 SAMPLES per
+// series live in the per-session ledger, appended during the throttled scan
+// that already ran.
+//
+// NO NEW READ, NO NEW TIMER. Every value sampled here was already computed for
+// something else this render; the series is a side effect of the scan, never a
+// reason for one.
+//
+// SIXTEEN, and only for the series a compiled layout actually names — the read
+// planner again. A series nothing binds is not kept, so the ledger does not
+// grow for a user whose layout has no sparkline on it.
+const SERIES_MAX = 16;
+const SERIES_MIN_GAP_MS = 20000;
+
+function sampleSeries(d, plan) {
+  try {
+    if (!plan || !plan.series || !plan.series.size) return;
+    const led = LED;
+    if (!led) return;
+    const now = Date.now();
+    // A sample every 20 seconds, not every render. Sixteen samples at the
+    // render rate would be five seconds of history, which is not history — it
+    // is the same number sixteen times.
+    if (led.series_at && now - led.series_at < SERIES_MIN_GAP_MS) return;
+    led.series_at = now;
+    led.series = led.series || {};
+    const push = (key, v) => {
+      if (!plan.series.has(key)) return;
+      if (typeof v !== "number" || !Number.isFinite(v)) return;
+      const arr = led.series[key] || [];
+      arr.push(Math.round(v));
+      while (arr.length > SERIES_MAX) arr.shift();
+      led.series[key] = arr;
+    };
+    const rl = d.rate_limits || {};
+    const w = led.five_hour;
+    push("quota5h", rl.five_hour && rl.five_hour.used_percentage);
+    push("quotawk", rl.seven_day && rl.seven_day.used_percentage);
+    push("ucs", w && typeof w.last === "number" && typeof w.baseline === "number"
+      ? Math.max(0, (w.accumulated || 0) + Math.max(0, w.last - w.baseline))
+      : null);
+    const tok = led.tok;
+    if (tok) {
+      push("mtok", (tok.input || 0) + (tok.cache_write || 0) + (tok.cache_read || 0) + (tok.output || 0));
+      push("mtokkind", tok.cache_read || 0);
+    }
+    push("agents", SCAN.spawns);
+    push("cost", d.cost && d.cost.total_cost_usd != null ? d.cost.total_cost_usd * 100 : null);
+    push("cachehit", d.prompt_cache && d.prompt_cache.hit_ratio != null
+      ? (d.prompt_cache.hit_ratio <= 1 ? d.prompt_cache.hit_ratio * 100 : d.prompt_cache.hit_ratio)
+      : null);
+    push("cachewrite", d.prompt_cache && d.prompt_cache.cache_write_tokens);
+    push("lines", d.cost && d.cost.total_lines_added != null
+      ? (d.cost.total_lines_added || 0) - (d.cost.total_lines_removed || 0)
+      : null);
+    push("extraspend", SCAN.extra_spend && SCAN.extra_spend.usd != null ? SCAN.extra_spend.usd * 100 : null);
+  } catch (_) {
+    // A series is a nicety. It never takes the status line down with it.
+  }
+}