@azure-id/orc 1.7.0 → 1.8.1

package/templates/hooks/orc-statusline.js

@@ -1,1545 +1,1596 @@
-#!/usr/bin/env node
-"use strict";
-
-/**
- * ORC statusline — a Claude Code statusLine command.
- *
- * The statusline is the ONLY place Claude Code exposes the live model id
- * (`model.id`) together with the reasoning effort (`effort.level`). It is
- * display-only — it cannot block — so this is the "model warn" half of the
- * "run ORC on Opus 4.8 high" rule. When the session is NOT Opus 4.8 at high
- * effort, it renders a loud warning so you never launch /orc on the wrong tier.
- *
- * The deterministic hard-stop for effort lives in orc-effort-guard.js.
- *
- * Wiring (installed by `orc init` ONLY if no statusLine already exists):
- *   settings.statusLine { type:"command", command:'node "<.claude>/hooks/orc-statusline.js"' }
- *
- * On Claude Code v2.1.80+ it also renders the official subscription-usage
- * segment `5h N% (reset) ↔ wk N%`, read straight from the payload's
- * `rate_limits.{five_hour,seven_day}` (Anthropic API headers, not estimated).
- * A window ≥90% folds into the DEGRADE verdict; fail-silent when absent.
- *
- * Three-tier verdict (the "ORC-ready" acceptance matrix). Since v1.2.1 the
- * ICON carries the verdict and the words carry the installed ORC version — but
- * the degrade branch still names every reason, because a warning with no reason
- * is an emoji:
- *   ✅ ORC v1.2.1 - Opus 5/high          Opus 4.8 high (the baseline)
- *   🚀 ORC v1.2.1 - Opus 5/high          Opus 4.8 xhigh/max, or Opus 5 / Fable 5 medium…max
- *   ⛔ ORC v1.2.1 - Sonnet 5/high (why)  everything below (wrong model, sub-baseline effort, quota)
- *
- * The two lines, in full (v1.2.1):
- *
- *   {icon} ORC v{version} - {model}/{effort} · context (N%) · 5h N% (reset) ↔ wk N%
- *          · ucs N% · wiki: … · diy:… · orc N.N.N available
- *   {glyph} status: {lane} · {phase} · agents N (M running) · orc-extra: on|off
- *          · Dur Nm · MTok NNNK · {branch}
- *
- * Line 1 answers "what tier am I on, and how full is the window". Line 2
- * answers "what is this session DOING". Every segment on both is read from
- * disk or from the payload; none of it costs a model call.
- *
- * Three segments on line 2 carry a rule worth stating here, because each is a
- * place where the easy version would lie:
- *   - `status:` is the ONLY segment allowed to vanish. A phase the disk cannot
- *     prove is HIDDEN, never guessed — see the phase-rail block below for what
- *     that costs and why it is still the right trade.
- *   - `MTok` is MAIN TOKEN: this session's own turns. Claude Code records no
- *     token usage for a dispatched subagent, so an hour of Opus executors adds
- *     almost nothing. An em dash means not measured; `0` would mean free.
- *   - `ucs` is a delta of an ACCOUNT-WIDE window, not a private meter.
- *
- * This is the ONLY place Claude Code exposes the live model id, so it also
- * writes a fail-silent session-model bridge (.claude/orc/session-model.json)
- * that the PreToolUse effort guard reads — the guard can't see the model id
- * on its own, so the bridge is how the Opus 5 / Fable 5 medium-effort allowance
- * reaches it.
- *
- * Also appends a "newer orc version available" hint from the 24h update cache
- * (cache-only here — never a network call in the statusline hot path; the
- * PreToolUse guard refreshes the cache when /orc is invoked).
- *
- * Everything on line 2 rides in ONE scan, throttled to 5s and cached in the
- * per-session ledger, because a statusline re-renders on every keystroke and
- * anything unthrottled here is a per-keystroke disk scan. `MTok` additionally
- * reads only the bytes the transcript has GROWN by. There is exactly one seam
- * over that budget — ORC_STATUSLINE_SCAN_MS — and nothing in ORC ever sets it.
- */
-
-// Opus 4.8 / Opus 5 / Fable 5 are matched by tolerant regexes below (accept
-// dated/suffixed ids and the display name), not strict strings. Effort ranks give
-// the acceptance-matrix tiers (0 = unknown, never treated as a positive downgrade).
-const EFFORT_RANK = { low: 1, medium: 2, high: 3, xhigh: 4, max: 5 };
-
-// Shared update-check helper (sibling file). Degrade gracefully if absent.
-let updater = null;
-try {
-  updater = require("./orc-update-lib.js");
-} catch (_) {
-  updater = null;
-}
-
-// ── The phase rail, the motifs, and the two seams (v1.2.1) ──────────────────
-// `status:` says which phase an ORC run is in. Three rules hold it up.
-//
-// 1. THE CLI COMPUTES, THIS FILE RENDERS. The phase ids, their order, their
-//    labels and their motif kind all come from `orc-lane-rails.json`, which
-//    `orc init` / `orc update` generates from the CLI's own registries. This
-//    hook holds no idea of what ORC's phases are. A second phase table here
-//    would be the Flow-stepper failure on a second surface, and no lint could
-//    see it. Frames are the exception and belong here: they are presentation,
-//    and a motif change must not need a reinstall.
-//
-// 2. A PHASE THE DISK CANNOT PROVE IS HIDDEN. Never guessed, never carried
-//    over from a minute ago. A stale phase word gets believed — the same
-//    reasoning as `unknown is not low` and `unknown is not zero`.
-//
-// 3. THE FLOOR IS HOOK-WRITTEN. `PHASE-EDGE <family>` and `SPAWN <agent>` are
-//    written by orc-trace.js with zero model cooperation. A trace verb the
-//    orchestrator narrated is allowed to REFINE that (it is more specific:
-//    `Q3 DO` rather than `execution`) but only when it is later in the file,
-//    and only when that lane's own rail publishes the verb — so it can sharpen
-//    the answer and can never invent one.
-//
-// What this cannot see, stated so nobody reads a blank as a bug:
-//   - a phase that dispatches nothing AND narrates nothing is INVISIBLE
-//     (/orc-quick Q1 LOOK and Q2 ASK, and every ask-the-user gate);
-//   - a CONTINUED agent emits no PreToolUse/SubagentStop pair, so the skeleton
-//     is a floor, never a census (orc-trace.js documents this);
-//   - `orc extra` runs a worker through Bash, so a foreign wave writes no
-//     SPAWN and resolves only through its narrated `EXTRA` verb, or hides.
-//
-// The animation is a LIVENESS TELL, not a driven animation. A statusline is a
-// pull surface — Claude Code re-renders it, ORC cannot — so the frame is picked
-// off the wall clock. It advances while you type and while turns land, and it
-// FREEZES when the session is idle, which is true and is the point.
-//
-// Two env seams, for tests and for terminals, and nothing in ORC ever sets
-// either: ORC_STATUSLINE_ASCII=1 swaps the glyph set, ORC_STATUSLINE_MOTION=0
-// REMOVES motion rather than slowing it (a frozen frame of a cycling animation
-// is a bug that looks like a hang — the web panel learned this at v0.44.0, and
-// so the still frame is designed as a still frame: frame 0 of each set).
-
-const PHASE_STALE_MS = 10 * 60 * 1000;
-
-const MOTIFS = {
-  look: { u: ["◔", "◑", "◕", "●"], a: [".", "o", "O", "0"], ms: 260 },
-  ask: { u: ["?", "¿", "?", "·"], a: ["?", "?", "?", "."], ms: 500 },
-  plan: { u: ["▁", "▃", "▅", "▇"], a: ["_", "-", "=", "#"], ms: 220 },
-  do: { u: ["▰", "▱", "▰", "▱"], a: ["=", "-", "=", "-"], ms: 180 },
-  check: { u: ["◇", "◈", "◆", "◈"], a: ["<", "=", ">", "="], ms: 240 },
-  ship: { u: ["›", "»", "≫", "»"], a: [">", ">", "=", ">"], ms: 200 },
-  wait: { u: ["·", "˙", "·", "˙"], a: [".", "'", ".", "'"], ms: 700 },
-  generic: {
-    u: ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"],
-    a: ["-", "\\", "|", "/"],
-    ms: 90,
-  },
-};
-
-function motifFrame(kind) {
-  const m = MOTIFS[kind] || MOTIFS.generic;
-  const frames = process.env.ORC_STATUSLINE_ASCII === "1" ? m.a : m.u;
-  if (process.env.ORC_STATUSLINE_MOTION === "0") return frames[0];
-  return frames[Math.floor(Date.now() / m.ms) % frames.length];
-}
-
-// The rail manifest, read once per process. Absent (a pre-1.2.1 install, or a
-// write that failed) → null → `status:` hides. Never throws.
-let RAILS = undefined;
-function rails() {
-  if (RAILS !== undefined) return RAILS;
-  RAILS = null;
-  try {
-    const j = JSON.parse(
-      require("fs").readFileSync(
-        require("path").join(__dirname, "orc-lane-rails.json"),
-        "utf8"
-      )
-    );
-    if (j && j.lanes) RAILS = j;
-  } catch (_) {}
-  return RAILS;
-}
-
-// Which phase is the run in? Called once per throttled scan, over text the scan
-// has already read, so it costs one regex pass and no extra I/O.
-//
-// `text` is the active trace, `laneToken` its filename's lane. Returns
-// {lane, label, kind} or null — and null is a real answer.
-function resolvePhase(laneToken, text) {
-  const r = rails();
-  if (!r || !laneToken) return null;
-  const row = r.lanes[laneToken];
-  if (!row) return null;
-
-  // Every line carries its own timestamp; the newest one dates the run. A trace
-  // whose last line is old is not a run in progress, whatever it says.
-  const at = (l) => {
-    const t = /^\[(\d{2})(\d{2})(\d{2}) (\d{2}):(\d{2}):(\d{2})/.exec(l);
-    if (!t) return 0;
-    return new Date(
-      2000 + Number(t[3]), Number(t[2]) - 1, Number(t[1]),
-      Number(t[4]), Number(t[5]), Number(t[6])
-    ).getTime();
-  };
-
-  const lines = text.split("\n");
-  let newest = 0;
-  let edgeIdx = -1;
-  let edgeFam = null;
-  let verbIdx = -1;
-  let verbPhase = null;
-  for (let i = 0; i < lines.length; i++) {
-    const l = lines[i];
-    if (!l) continue;
-    const ts = at(l);
-    if (ts > newest) newest = ts;
-    const e = /PHASE-EDGE ([a-z-]+)/.exec(l);
-    if (e && r.families[e[1]]) {
-      edgeIdx = i;
-      edgeFam = e[1];
-    }
-    // A verb line is the orchestrator's. It counts only when this lane's own
-    // rail published that verb — the rail is what stops a narrated word from
-    // inventing a phase the lane does not have.
-    const body = l.replace(/^\[[^\]]*\]\s*\S+\s*/, "");
-    for (const p of row.phases) {
-      for (const v of p.verbs) {
-        if (body.indexOf(v) === 0) {
-          verbIdx = i;
-          verbPhase = p;
-        }
-      }
-    }
-  }
-
-  if (!newest || Date.now() - newest > PHASE_STALE_MS) return null;
-
-  if (verbPhase && verbIdx > edgeIdx)
-    return { lane: laneToken, label: verbPhase.label, kind: verbPhase.kind };
-  if (edgeFam) {
-    const fam = r.families[edgeFam];
-    return { lane: laneToken, label: fam.label, kind: fam.kind };
-  }
-  if (verbPhase) return { lane: laneToken, label: verbPhase.label, kind: verbPhase.kind };
-  return null;
-}
-
-// The current branch, without a subprocess. A statusline re-renders on every
-// keystroke, so `git rev-parse` here would be one process per keystroke.
-// Anything unrecognised returns null and the segment is simply absent.
-function gitBranch(projectDir) {
-  const fs = require("fs");
-  const path = require("path");
-  try {
-    const dot = path.join(projectDir, ".git");
-    let gitDir = dot;
-    if (fs.statSync(dot).isFile()) {
-      // A worktree or a submodule: `.git` is a pointer file.
-      const m = /gitdir:\s*(.+)/.exec(fs.readFileSync(dot, "utf8"));
-      if (!m) return null;
-      const g = m[1].trim();
-      gitDir = path.isAbsolute(g) ? g : path.join(projectDir, g);
-    }
-    const head = fs.readFileSync(path.join(gitDir, "HEAD"), "utf8").trim();
-    const ref = /^ref:\s*refs\/heads\/(.+)$/.exec(head);
-    const name = ref
-      ? ref[1]
-      : /^[0-9a-f]{40}$/.test(head)
-        ? "@" + head.slice(0, 7)
-        : null;
-    if (!name) return null;
-    return name.length > 24 ? name.slice(0, 23) + "…" : name;
-  } catch (_) {
-    return null;
-  }
-}
-
-// MTok — MAIN TOKEN. The tokens THIS session's own turns consumed, summed from
-// the session transcript's `usage` blocks.
-//
-// Two honesty rules ship with it.
-//
-// It is the MAIN session only. Claude Code records NO token usage for a
-// dispatched subagent (v1.2.0 verified that across every transcript on two
-// machines), so a wave of three Opus executors adds almost nothing here. That
-// is why an unreadable transcript renders an em dash and NEVER `0` — a zero
-// would say the session was free.
-//
-// It is all four kinds summed. `/orc-budget`'s rule is four kinds never
-// blended, and that rule is about REPORTS; this is one cell on a status bar.
-// Any subset ORC picked would be a weighting ORC invented, which is worse. The
-// vector stays authoritative in `orc usage report`, and the ledger below keeps
-// all four kinds so it always can be.
-//
-// The read is INCREMENTAL. A transcript is append-only and reaches tens of
-// megabytes; re-reading it inside a 5-second loop is the per-keystroke disk
-// hazard the throttle exists to prevent. Only bytes past the stored offset are
-// read, and the offset resets when the file shrinks or the path changes.
-function scanTokens(led, transcriptPath) {
-  const fs = require("fs");
-  const fresh = (p) => ({
-    path: p, offset: 0, size: 0, input: 0, cache_write: 0, cache_read: 0, output: 0,
-  });
-  if (!transcriptPath) return led.tok || null;
-  let prev = led.tok && led.tok.path === transcriptPath ? led.tok : fresh(transcriptPath);
-  let st;
-  try {
-    st = fs.statSync(transcriptPath);
-  } catch (_) {
-    return prev.offset ? prev : null; // never read it → em dash, not 0
-  }
-  // Truncated or rotated under us: everything counted so far is unprovable.
-  if (st.size < prev.size) prev = fresh(transcriptPath);
-  if (st.size > prev.offset) {
-    let chunk = "";
-    try {
-      const fd = fs.openSync(transcriptPath, "r");
-      const len = st.size - prev.offset;
-      const buf = Buffer.alloc(len);
-      fs.readSync(fd, buf, 0, len, prev.offset);
-      fs.closeSync(fd);
-      chunk = buf.toString("utf8");
-    } catch (_) {
-      return prev.offset ? prev : null;
-    }
-    // The final line may be half-written. Stop at the last newline and leave
-    // the remainder for the next scan.
-    const cut = chunk.lastIndexOf("\n");
-    if (cut >= 0) {
-      const whole = chunk.slice(0, cut);
-      prev.offset += Buffer.byteLength(whole, "utf8") + 1;
-      for (const l of whole.split("\n")) {
-        if (!l || l.indexOf('"usage"') === -1) continue;
-        let u = null;
-        try {
-          const j = JSON.parse(l);
-          u = (j && j.message && j.message.usage) || (j && j.usage) || null;
-        } catch (_) {}
-        if (!u) continue;
-        prev.input += Number(u.input_tokens) || 0;
-        prev.cache_write += Number(u.cache_creation_input_tokens) || 0;
-        prev.cache_read += Number(u.cache_read_input_tokens) || 0;
-        prev.output += Number(u.output_tokens) || 0;
-      }
-    }
-  }
-  prev.size = st.size;
-  return prev;
-}
-
-function fmtTokens(tok) {
-  if (!tok) return null;
-  const n =
-    (tok.input || 0) + (tok.cache_write || 0) + (tok.cache_read || 0) + (tok.output || 0);
-  if (n <= 0) return null;
-  if (n >= 1e6) return (n / 1e6).toFixed(1).replace(/\.0$/, "") + "M";
-  if (n >= 1000) return Math.round(n / 1000) + "K";
-  return String(n);
-}
-
-// ── The per-session ledger: ONE read, ONE write, ONE throttle (v1.3.0 W0) ───
-// `.claude/orc/usage-session.json` is the per-session ledger, and three
-// separate blocks below want it: the rate-limit tracker, `ucs`, and the
-// throttled line-2 scan. Each used to open the file itself and two of them
-// wrote it, so one render cost three reads and two writes — on a surface that
-// re-renders on every keystroke. It is memoised here instead: loaded at most
-// once per process, mutated in place by whoever needs it, and flushed exactly
-// once at the end. Same rules as before — RAW numbers only, never a computed
-// word, fail-silent, and the reader decides what it means.
-//
-// The scan interval is the ONE seam over this budget, on the ORC_TEST_PROBE_MS
-// precedent: a test that proves the throttle by SLEEPING past it is a test that
-// fails on a loaded machine, and a flake is recorded and removed, never retried
-// away. Unset, this is byte-identical to a hardcoded 5000, and nothing in ORC
-// ever sets it.
-let LED = null;
-let LED_FILE = null;
-
-// The scan's own answers, in ONE shape, so a composed layout (v1.3.0) reads
-// exactly what the shipped lines read. It is populated as the blocks below
-// compute their segments — never by a second pass over the disk. A provider
-// nothing binds is simply never filled in, and every binding over it answers
-// null, which renders an em dash. UNKNOWN IS NOT ZERO.
-const SCAN = {
-  spawns: 0, running: 0, lanes: [], phase: null, slug: null,
-  branch: null, head: null, wiki: null, diy: null,
-  extra_enabled: false, update_version: null, inflight: null,
-  trace_age_min: null, trace_state: null, last_agent: null, retries: null,
-};
-
-function ledger(projectDir, sid) {
-  if (LED) return LED;
-  const fs = require("fs");
-  const path = require("path");
-  LED_FILE = path.join(projectDir, ".claude", "orc", "usage-session.json");
-  let led = null;
-  try {
-    led = JSON.parse(fs.readFileSync(LED_FILE, "utf8"));
-  } catch (_) {}
-  if (!led || led.session_id !== sid) led = { session_id: sid, started_at: Date.now() };
-  LED = led;
-  return LED;
-}
-
-function ledgerFlush() {
-  if (!LED || !LED_FILE) return;
-  try {
-    const fs = require("fs");
-    const path = require("path");
-    LED.updated_at = Date.now();
-    fs.mkdirSync(path.dirname(LED_FILE), { recursive: true });
-    fs.writeFileSync(LED_FILE, JSON.stringify(LED) + "\n");
-  } catch (_) {}
-}
-
-function scanEveryMs() {
-  const n = Number(process.env.ORC_STATUSLINE_SCAN_MS);
-  return Number.isFinite(n) && n >= 0 ? n : 5000;
-}
-
-// Per-provider TTL (v1.3.0 W2), replacing the single global throttle for
-// everything but the trace scan. A wiki tier does not move in five seconds and
-// a flow lock moves when somebody runs a command, so paying the 5-second rate
-// for either is paying for a change that cannot have happened.
-//
-// `ORC_STATUSLINE_SCAN_MS` still overrides ALL of them — it stays the ONE seam
-// over this budget, and a seam that only covered one provider would be a seam
-// tests could not use.
-const TTL = {
-  trace: 5000, // a run moves; this is the one thing that really is that fast
-  git: 5000, // .git/HEAD, no subprocess
-  wiki: 60000, // a wiki tier does not move in five seconds
-  config: 30000, // a config file is edited by hand
-  diy: 30000, // a flow lock moves when somebody runs a command
-  knowledge: 60000, // a pattern cache, a peer list, a gotcha count
-  extra: 15000, // a spend log DOES move during a wave
-  run: 10000, // RESUME.md is rewritten at every stop
-  gates: 60000, // a pact does not drift between keystrokes
-};
-
-// `at` is a ledger `scanned_at` stamp. Absent is stale — unknown is not fresh.
-function scanStale(at, now, ttl) {
-  const budget = process.env.ORC_STATUSLINE_SCAN_MS !== undefined ? scanEveryMs() : ttl == null ? scanEveryMs() : ttl;
-  return typeof at !== "number" || now - at >= budget;
-}
-
-// The read plan, from the compiled layout's lock. Returns null in EVERY state
-// but one — the feature off, no lock, an unparseable lock — and null means
-// "read everything", which is what makes `off` byte-identical.
-//
-// It deliberately does NOT re-run the gate ladder. This is a question about
-// what to READ, and the ladder is a question about what to RENDER; a layout
-// that later fails the ladder falls back to the shipped lines and simply has a
-// segment or two missing for one render. That is a far better failure than
-// reading the disk twice on a surface that re-renders on every keystroke.
-function readPlan(d) {
-  try {
-    const fs = require("fs");
-    const path = require("path");
-    const projectDir =
-      (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
-    const raw = fs.readFileSync(path.join(projectDir, ".claude", "orc.config.yaml"), "utf8");
-    if (!/^[ \t]*statusline_custom:[ \t]*["']?on["']?[ \t]*\r?$/m.test(raw)) return null;
-    const lock = JSON.parse(
-      fs.readFileSync(path.join(projectDir, ".claude", "orc", "statusline.lock.json"), "utf8")
-    );
-    if (!lock || !Array.isArray(lock.bindings)) return null;
-    return {
-      bindings: new Set(lock.bindings),
-      providers: new Set(lock.providers || []),
-      series: new Set(lock.series || []),
-    };
-  } catch (_) {
-    return null;
-  }
-}
-
-let raw = "";
-process.stdin.on("data", (c) => (raw += c));
-process.stdin.on("end", () => {
-  let d = {};
-  try {
-    d = JSON.parse(raw || "{}");
-  } catch (_) {
-    d = {};
-  }
-
-  const model = (d.model && d.model.id) || "";
-  const display = (d.model && d.model.display_name) || model || "unknown";
-  const effort = String((d.effort && d.effort.level) || "").toLowerCase();
-  const pct =
-    d.context_window && typeof d.context_window.used_percentage === "number"
-      ? `context (${d.context_window.used_percentage}%)`
-      : "";
-
-  // ── THE READ PLAN (v1.3.0 W2) ──────────────────────────────────────────────
-  // The compiler knows exactly which bindings a layout uses, therefore exactly
-  // which providers it needs, and it records both in the lock. So: A PROVIDER
-  // NOTHING BINDS IS NOT READ.
-  //
-  // That is the claim this feature has to earn — the shipped status line pays
-  // for the wiki read, the diy read and the trace scan unconditionally, and a
-  // user whose layout names none of them should pay for none of them. Composing
-  // your own line is allowed to make the bar FASTER than the hardcoded one it
-  // replaces, and here is where that happens.
-  //
-  // `null` means the feature is off, and then everything below runs exactly as
-  // it always has. That is what keeps `off` byte-identical.
-  const PLAN = readPlan(d);
-  const wants = (b) => !PLAN || PLAN.bindings.has(b);
-  const wantsProvider = (p) => !PLAN || PLAN.providers.has(p);
-
-  // ── Session-model bridge (fail-silent) ─────────────────────────────────────
-  // The PreToolUse effort guard cannot see the model id; it can only read
-  // effort. Persist {model_id, effort, written_at} here so the guard can grant
-  // the Opus 5 / Fable 5 medium-effort allowance. The statusline re-renders constantly
-  // while a session is active, so written_at stays fresh; the guard treats a
-  // stale file (older than its freshness window) as absent and never blocks on
-  // it. Any error (no dir, read-only fs) is swallowed — this is a nicety, not a
-  // guarantee, and must never break the statusline render.
-  try {
-    if (model || effort) {
-      const fs = require("fs");
-      const path = require("path");
-      const projectDir =
-        (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
-      const orcDir = path.join(projectDir, ".claude", "orc");
-      fs.mkdirSync(orcDir, { recursive: true });
-      fs.writeFileSync(
-        path.join(orcDir, "session-model.json"),
-        JSON.stringify({ model_id: model, effort, written_at: Date.now() }) + "\n"
-      );
-    }
-  } catch (_) {}
-
-  // ── Usage bridge (v1.1.0 W4, fail-silent) ─────────────────────────────────
-  // The `rate_limits` block below reaches ONLY this process: the statusline
-  // renders a string and exits, so nothing else in ORC has ever been able to
-  // see how full the window is. A lane therefore started a wave with no idea it
-  // was about to run out, and the wave stopped in the middle.
-  //
-  // Persist the RAW numbers (never a computed word like `LOW` — a stored state
-  // is wrong one minute later; `orc usage check` computes it on read) plus
-  // `context_window`, which the wait needs to decide whether continuing
-  // in-session is cheaper than a fresh one. Same fail-silent contract as the
-  // session-model bridge above: any error is swallowed, and a reading older
-  // than its freshness window reads as `unknown`, never as `low`.
-  try {
-    const rl0 = d.rate_limits;
-    const cw0 = d.context_window;
-    if (rl0 || cw0) {
-      const fs = require("fs");
-      const path = require("path");
-      const projectDir =
-        (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
-      const orcDir = path.join(projectDir, ".claude", "orc");
-      const win = (o) =>
-        o && typeof o.used_percentage === "number"
-          ? { used_percentage: o.used_percentage, resets_at: o.resets_at == null ? null : o.resets_at }
-          : null;
-      fs.mkdirSync(orcDir, { recursive: true });
-      fs.writeFileSync(
-        path.join(orcDir, "usage.json"),
-        JSON.stringify({
-          five_hour: win(rl0 && rl0.five_hour),
-          seven_day: win(rl0 && rl0.seven_day),
-          context_used_percentage:
-            cw0 && typeof cw0.used_percentage === "number" ? cw0.used_percentage : null,
-          written_at: Date.now(),
-        }) + "\n"
-      );
-      // -- Session consumption (v1.2.0) -------------------------------------
-      // `usage.json` is a SNAPSHOT of the window. It cannot answer "how much
-      // has THIS session eaten", which is the question a user actually asks
-      // mid-run -- and the one they could otherwise only answer by remembering
-      // what the number was an hour ago.
-      //
-      // So keep a per-session ledger beside it: the reading when this session
-      // first rendered, and the reading now. Same rules as every other bridge
-      // here -- RAW numbers only, never a computed word, fail-silent, and the
-      // reader decides what it means.
-      //
-      // A window RESET mid-session (used_percentage drops) is not a refund:
-      // bank what was consumed before the reset into `accumulated` and
-      // re-baseline, so the running total keeps counting across the boundary.
-      const sid = String(d.session_id || d.sessionId || "");
-      const led = ledger(projectDir, sid);
-      const pctOf = (o) => (o && typeof o.used_percentage === "number" ? o.used_percentage : null);
-      const track = (prev, cur) => {
-        if (cur == null) return prev || null;
-        if (!prev) return { baseline: cur, last: cur, accumulated: 0, resets: 0 };
-        if (cur < prev.baseline)
-          return {
-            baseline: cur,
-            last: cur,
-            accumulated: prev.accumulated + Math.max(0, prev.last - prev.baseline),
-            resets: prev.resets + 1,
-          };
-        return { baseline: prev.baseline, last: cur, accumulated: prev.accumulated, resets: prev.resets };
-      };
-      led.five_hour = track(led.five_hour, pctOf(rl0 && rl0.five_hour));
-      led.seven_day = track(led.seven_day, pctOf(rl0 && rl0.seven_day));
-      led.context_used_percentage =
-        cw0 && typeof cw0.used_percentage === "number" ? cw0.used_percentage : null;
-    }
-
-  } catch (_) {}
-
-  // ── Subscription usage (Claude Code v2.1.80+) ──────────────────────────────
-  // Official 5-hour + 7-day usage, surfaced by Claude Code straight from
-  // Anthropic's API headers into this payload's `rate_limits`. Display-only,
-  // fail-silent: an absent block (older Claude Code / no headers) → no segment,
-  // never `undefined`. A window at/above USAGE_CRIT contributes to the DEGRADE
-  // verdict — running low on quota is a real mid-run degradation risk.
-  const USAGE_WARN = 75;
-  const USAGE_CRIT = 90;
-  const fmtReset = (v) => {
-    // resets_at may be an ISO string or an epoch (seconds or ms). "" on anything odd.
-    let t = NaN;
-    if (typeof v === "number") t = v < 1e12 ? v * 1000 : v;
-    else if (typeof v === "string") {
-      const n = Number(v);
-      t = Number.isFinite(n) ? (n < 1e12 ? n * 1000 : n) : Date.parse(v);
-    }
-    if (!Number.isFinite(t)) return "";
-    const ms = t - Date.now();
-    if (ms <= 0) return "";
-    const mins = Math.round(ms / 60000);
-    if (mins < 60) return `${mins}m`;
-    const h = Math.floor(mins / 60);
-    const m = mins % 60;
-    return m ? `${h}h${m}m` : `${h}h`;
-  };
-  let rlSeg = "";
-  const usageBad = [];
-  try {
-    const rl = d.rate_limits || {};
-    const win = (obj, label) => {
-      if (!obj || typeof obj.used_percentage !== "number") return "";
-      const p = Math.round(obj.used_percentage);
-      const reset = fmtReset(obj.resets_at);
-      const mark = p >= USAGE_CRIT ? "⛔" : p >= USAGE_WARN ? "⚠" : "";
-      if (p >= USAGE_CRIT) usageBad.push(`${label}≥${USAGE_CRIT}%`);
-      // Reset shown for the short (5h) window always; weekly only when elevated.
-      const showReset = reset && (label === "5h" || p >= USAGE_WARN);
-      return `${mark}${label} ${p}%${showReset ? ` (${reset})` : ""}`;
-    };
-    const fh = win(rl.five_hour, "5h");
-    const sd = win(rl.seven_day, "wk");
-    if (fh && sd) rlSeg = `${fh} ↔ ${sd}`;
-    else rlSeg = fh || sd || "";
-  } catch (_) {
-    rlSeg = "";
-  }
-
-  // Tolerant tier detection. A strict `model === "claude-opus-4-8"` false-fired
-  // whenever Claude Code reported a dated/suffixed id (e.g. claude-opus-4-8-
-  // YYYYMMDD) or only a display name — even on the correct tier. Match Opus 4.8
-  // and Fable 5 by normalized id OR display name, accepting any variant; the
-  // trailing \b keeps 4.7 / 4.85 / Sonnet etc. correctly warning.
-  const hay = `${model} ${display}`.toLowerCase();
-  const isOpus48 = /opus[\s._-]?4[\s._-]?8\b/.test(hay);
-  const isFable5 = /fable[\s._-]?5\b/.test(hay);
-  // Opus 5 (v0.34.0) — strictly above the baseline, so it boosts from medium up,
-  // exactly like Fable 5. The `\b` keeps opus 4.8 / 4.7 out of this branch.
-  const isOpus5 = /opus[\s._-]?5\b/.test(hay);
-  const modelKnown = model !== "" || (display !== "" && display !== "unknown");
-  // Effort rank; 0 = unknown. A missing/empty effort field is NOT proof of a
-  // downgrade — the PreToolUse guard already hard-blocks a real low-effort /orc
-  // — so an unknown effort never forces DEGRADE on effort grounds here.
-  const er = EFFORT_RANK[effort] || 0;
-
-  const tier = `${display}${effort ? "/" + effort : ""}`;
-
-  // Verdict per the acceptance matrix. Only a POSITIVELY-known bad tier degrades.
-  let verdict = "ready";
-  const reasons = [];
-  if (isOpus48) {
-    if (er >= 4) verdict = "boosted"; // xhigh / max
-    else if (er === 3 || er === 0) verdict = "ready"; // high (or unknown → lenient)
-    else {
-      verdict = "degrade"; // opus 4.8 below high
-      reasons.push("effort≠high");
-    }
-  } else if (isOpus5 || isFable5) {
-    const label = isOpus5 ? "Opus-5" : "Fable-5";
-    if (er >= 2 || er === 0) verdict = "boosted"; // medium…max (or unknown → lenient)
-    else {
-      verdict = "degrade"; // opus 5 / fable 5 below medium
-      reasons.push(`${label} effort<medium`);
-    }
-  } else if (modelKnown) {
-    verdict = "degrade";
-    reasons.push("model≠Opus5/Opus4.8/Fable5");
-  } // else model unknown → stay lenient (the guard enforces effort)
-
-  // A quota window at/above the crit threshold folds into DEGRADE regardless.
-  if (usageBad.length) {
-    verdict = "degrade";
-    for (const u of usageBad) reasons.push(u);
-  }
-
-  // The installed ORC version (v1.2.1). It replaces the verdict WORD, not the
-  // verdict: the icon still carries that, and the degrade branch still names
-  // every reason — dropping those would turn the loudest safety segment in ORC
-  // into an emoji. A version we cannot read renders as plain `ORC`, never
-  // `ORC vnull`: the statusline never prints a word for a thing it does not know.
-  let ver = null;
-  try {
-    ver = updater ? updater.installedVersion(__dirname) : null;
-  } catch (_) {}
-  if (!ver) {
-    try {
-      ver = JSON.parse(
-        require("fs").readFileSync(
-          require("path").join(__dirname, "orc-version.json"),
-          "utf8"
-        )
-      ).version || null;
-    } catch (_) {}
-  }
-  const brand = "ORC" + (ver ? " v" + ver : "");
-
-  let line;
-  if (verdict === "ready") {
-    line = `✅ ${brand} - ${tier}${pct ? " · " + pct : ""}`;
-  } else if (verdict === "boosted") {
-    line = `🚀 ${brand} - ${tier}${pct ? " · " + pct : ""}`;
-  } else {
-    line = `⛔ ${brand} - ${tier} (${reasons.join(", ")})${pct ? " · " + pct : ""}`;
-  }
-
-  // Subscription-usage segment (rendered after ctx, before wiki). Empty on
-  // older Claude Code that doesn't surface `rate_limits`.
-  if (rlSeg) line += " · " + rlSeg;
-
-  // ucs — USAGE, CURRENT SESSION. How far the 5-hour window moved while THIS
-  // session ran (v1.2.0; renamed v1.2.1). The ledger below keeps the raw
-  // numbers; this renders the delta.
-  //
-  // It KEEPS ITS SLOT at zero. "This session has consumed nothing measurable
-  // yet" and "this build has no ucs segment" are different facts and must not
-  // look the same — the same rule as `lanes: none yet` and `used 0/20`.
-  //
-  // And it is still a delta of an ACCOUNT-WIDE window, not a private meter: a
-  // second terminal moves it too.
-  try {
-    const projectDir =
-      (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
-    const led = ledger(projectDir, String(d.session_id || d.sessionId || ""));
-    const w = led && led.five_hour;
-    if (w && typeof w.last === "number" && typeof w.baseline === "number") {
-      const used = Math.max(0, (w.accumulated || 0) + Math.max(0, w.last - w.baseline));
-      line += " · ucs " + used + "%";
-    }
-  } catch (_) {}
-
-  // Wiki freshness tier (computed on read from wiki-meta.json — zero model
-  // tokens; the manifest is written only by `orc wiki sync`). Fail-silent: no
-  // wiki / no git / any error → no segment. Thresholds mirror the config
-  // defaults (wiki_fresh_max 10 / wiki_aging_max 30); the hook can't read the
-  // resolved config, so a user override shifts skill behavior, not this label.
-  //
-  // The git distance rides in the SAME throttled scan as everything on line 2
-  // (v1.3.0 W0). It used to be an `execSync` on every render — one child
-  // process PER KEYSTROKE in any repo with a wiki, which is the exact hazard
-  // the throttle exists to prevent. The ledger caches the RAW facts (a commit
-  // count, a boolean) and never the word: `fresh` / `AGING` / `STALE` is
-  // computed here, on read, every time.
-  try {
-    const fs = require("fs");
-    const path = require("path");
-    const projectDir =
-      (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
-    // A layout that names no wiki component performs ZERO wiki reads — not a
-    // cheaper one, none. This is the read planner's whole point.
-    if (!wants("wiki.tier") && !wants("wiki.distance")) throw new Error("not needed");
-    const led = ledger(projectDir, String(d.session_id || d.sessionId || ""));
-    const now = Date.now();
-    // A wiki tier does not move in five seconds. Per-provider TTL replaces the
-    // single global throttle for everything but the trace scan, which is the
-    // one thing that really does move that fast.
-    if (scanStale(led.wiki && led.wiki.scanned_at, now, TTL.wiki)) {
-      const w = { unregistered: false, distance: null, scanned_at: now };
-      const metaPath = path.join(projectDir, ".claude", "orc", "wiki-meta.json");
-      if (!fs.existsSync(metaPath)) {
-        // Docs but no manifest = UNREGISTERED: a real wiki nothing has indexed
-        // (usually a scan stopped at a 5-area pause). It is otherwise invisible
-        // — consumers and `orc crosslink` read the manifest — so surface it
-        // here, with the free fix. Never say "no wiki": these docs are already
-        // paid for.
-        const wikiDir = path.join(projectDir, "wiki");
-        w.unregistered =
-          fs.existsSync(wikiDir) &&
-          fs.readdirSync(wikiDir).some((f) => f.startsWith("orc-") && f.endsWith(".md"));
-      } else {
-        const meta = JSON.parse(fs.readFileSync(metaPath, "utf8"));
-        if (meta && meta.scan_commit) {
-          // A FAILED probe is a fact, and it is cached like any other. No git,
-          // a detached commit, a timeout — without this inner catch the whole
-          // block aborts before the ledger is stamped, and the subprocess runs
-          // again on the very next keystroke. The segment stays absent either
-          // way; what changes is that it costs nothing to stay absent.
-          try {
-            const { execSync } = require("child_process");
-            const n = parseInt(
-              execSync(`git rev-list --count ${meta.scan_commit}..HEAD`, {
-                cwd: projectDir,
-                timeout: 3000,
-                stdio: ["ignore", "pipe", "ignore"],
-              })
-                .toString()
-                .trim(),
-              10
-            );
-            if (Number.isFinite(n)) w.distance = n;
-          } catch (_) {}
-        }
-      }
-      led.wiki = w;
-    }
-    const w = led.wiki;
-    if (w) {
-      SCAN.wiki = {
-        distance: typeof w.distance === "number" ? w.distance : null,
-        tier: w.unregistered
-          ? "unregistered"
-          : typeof w.distance !== "number"
-            ? null
-            : w.distance > 30
-              ? "stale"
-              : w.distance >= 10
-                ? "aging"
-                : "fresh",
-      };
-    }
-    if (w && w.unregistered) line += " · wiki: UNREGISTERED (run `orc wiki sync`)";
-    else if (w && typeof w.distance === "number") {
-      if (w.distance >= 10 && w.distance <= 30) line += ` · wiki: AGING (${w.distance}c)`;
-      else if (w.distance > 30) line += ` · wiki: STALE (${w.distance}c)`;
-      else line += " · wiki: fresh";
-    }
-  } catch (_) {}
-
-  // orc-diy gate segment (only when a flow exists). Recomputes the same
-  // staleness checks as `orc diy status` from flow.lock.json — written only
-  // by the `orc diy` CLI. Fail-silent: any error → no segment.
-  try {
-    const fs = require("fs");
-    const path = require("path");
-    const crypto = require("crypto");
-    const projectDir =
-      (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
-    if (!wants("diy.state") && !wants("diy.name") && !wants("diy.tier_state"))
-      throw new Error("not needed");
-    const lockPath = path.join(projectDir, ".claude", "orc", "diy", "flow.lock.json");
-    if (fs.existsSync(lockPath)) {
-      const lock = JSON.parse(
-        fs.readFileSync(lockPath, "utf8").replace(/^\uFEFF/, "")
-      );
-      const sha = (p) =>
-        crypto.createHash("sha256").update(fs.readFileSync(p, "utf8")).digest("hex");
-      const cfgPath = path.join(projectDir, ".claude", "orc-diy.config.yaml");
-      const compiledPath = path.join(projectDir, ".claude", "orc", "diy", "FLOW-COMPILED.md");
-      let installedV = null;
-      try {
-        installedV = JSON.parse(
-          fs.readFileSync(path.join(__dirname, "orc-version.json"), "utf8")
-        ).version;
-      } catch (_) {}
-      const ready =
-        lock.compiled_hash &&
-        fs.existsSync(cfgPath) &&
-        lock.config_hash === sha(cfgPath) &&
-        fs.existsSync(compiledPath) &&
-        lock.compiled_hash === sha(compiledPath) &&
-        (!installedV || lock.orc_version === installedV);
-      let seg = `diy:${lock.flow_name || "flow"} ${ready ? "READY" : "STALE→recompile"}`;
-      // Model half of the compiled session_tier — warn-only (hooks can't block on
-      // model). Keyed by the slug's MODEL part, so the full tier grid (sonnet-4-6,
-      // opus-4-7, opus-4-8, fable-5 at any effort) is covered without enumerating
-      // every effort slug.
-      if (ready && modelKnown && lock.session_tier) {
-        const modelPart = String(lock.session_tier).replace(/-(med|high|xhigh|max)$/, "");
-        const want = {
-          "sonnet-4-6": /sonnet[\s._-]?4[\s._-]?6\b/,
-          "opus-4-7": /opus[\s._-]?4[\s._-]?7\b/,
-          "opus-4-8": /opus[\s._-]?4[\s._-]?8\b/,
-          "opus-5": /opus[\s._-]?5\b/,
-          "fable-5": /fable[\s._-]?5\b/,
-        }[modelPart];
-        if (want && !want.test(hay)) seg += ` ⛔model≠${lock.session_tier}`;
-      }
-      line += " · " + seg;
-    }
-  } catch (_) {}
-
-  // Append an update hint from the cache (instant, no network here).
-  if (updater) {
-    try {
-      const nudge = updater.readCachedNudge(updater.installedVersion(__dirname));
-      if (nudge) line += " · " + nudge;
-    } catch (_) {}
-  }
-
-  // The branch is its OWN provider: `.git/HEAD` with no subprocess, on a
-  // different clock from the trace scan, and a layout that shows a branch and
-  // nothing else must not pay for a trace scan to get it.
-  if (wantsProvider("scan.git")) {
-    try {
-      const projectDir =
-        (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
-      SCAN.branch = gitBranch(projectDir) || null;
-    } catch (_) {}
-  }
-
-  // The extended scan (v1.3.0 W3). Only a composed layout can reach it, and
-  // only for the providers its own lock names.
-  extendedScan(d, wants, wantsProvider);
-  // The sparkline series, sampled during the scan that already ran.
-  sampleSeries(d, PLAN);
-
-  // ── Session line (v1.2.0) ──────────────────────────────────────────────────
-  // Line 1 answers "what tier am I on and how full is the window". This second
-  // line answers "what has this session actually been DOING" — how many agents
-  // it spawned, which lanes ran, whether work can leave Claude, and how long it
-  // has been going. All of it is read from disk; none of it costs a model call.
-  //
-  // The dispatch count is the one that earns its place. v1.2.0 exists because a
-  // retry cloned a live agent three times over and nothing surfaced it. A count
-  // that says `7 (2 running)` makes that visible from the status bar.
-  //
-  // Fail-silent and THROTTLED: the statusline re-renders on every keystroke, so
-  // the trace scan runs at most every 5s and its answer is cached in the same
-  // per-session ledger. Any error → no second line, never a broken one.
-  let line2 = "";
-  try {
-    const fs = require("fs");
-    const path = require("path");
-    const projectDir =
-      (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
-    const led = ledger(projectDir, String(d.session_id || d.sessionId || ""));
-
-    // The hook cannot read the RESOLVED config — that is the lane resolver's
-    // job, and a hook has no lane — so this reads the two raw keys it needs
-    // straight from the file and takes the documented default
-    // otherwise — the same caveat the wiki segment above already carries. A
-    // user override shifts skill behaviour; this label follows the file.
-    let logRel = ".claude/orc/logs";
-    let extraOn = false;
-    try {
-      const raw = fs.readFileSync(path.join(projectDir, ".claude", "orc.config.yaml"), "utf8");
-      const ld = /^[ \t]*log_dir:[ \t]*["']?([^"'#\r\n]+)/m.exec(raw);
-      if (ld) logRel = ld[1].trim();
-      extraOn = /^[ \t]*extra_enabled:[ \t]*true[ \t]*$/m.test(raw);
-    } catch (_) {}
-
-    const now = Date.now();
-    if (!wantsProvider("scan.trace")) throw new Error("not needed");
-    if (scanStale(led.dispatch && led.dispatch.scanned_at, now, TTL.trace)) {
-      const logDir = path.isAbsolute(logRel) ? logRel : path.join(projectDir, logRel);
-      const sessionFloor = Math.floor((led.started_at || 0) / 1000) * 1000;
-      let spawns = 0;
-      let running = 0;
-      const lanes = [];
-      // The ACTIVE run, for `status:` (v1.2.1). `.current` is the pointer the
-      // lanes and the trace hook both write, so it — not "the newest file" — is
-      // what names the run in progress. A pointer naming a file that is not
-      // there answers nothing, and a pointer nobody deleted is not a run: the
-      // resolver's own staleness gate settles that from the trace's last line.
-      let activeFile = null;
-      try {
-        const cur = fs.readFileSync(path.join(logDir, ".current"), "utf8").trim();
-        if (cur) activeFile = cur;
-      } catch (_) {}
-      let phase = null;
-      try {
-        for (const f of fs.readdirSync(logDir)) {
-          if (!f.startsWith("run-") || !f.endsWith(".txt")) continue;
-          const full = path.join(logDir, f);
-          let st;
-          try { st = fs.statSync(full); } catch (_) { continue; }
-          const active = f === activeFile;
-          // Only traces touched since this session began count towards the
-          // session's SPEND — a trace from last week is not this session's.
-          // The ACTIVE run is exempt from that filter: `status:` answers "what
-          // is ORC doing", which has nothing to do with who paid for it, and a
-          // run already going when this session opened would otherwise be
-          // invisible until it happened to write its next line. Its own
-          // staleness gate decides whether it is still running.
-          if (!active && st.mtimeMs < (led.started_at || 0)) continue;
-          const text = fs.readFileSync(full, "utf8");
-          // Count by the trace's OWN line timestamps, not the file's mtime. A
-          // run that was already going when this session started shares its
-          // file with the session before it, and mtime cannot tell the two
-          // apart — it would attribute the whole file to whoever looked last.
-          let mine = 0;
-          for (const raw of text.split("\n")) {
-            const t = /^\[(\d{2})(\d{2})(\d{2}) (\d{2}):(\d{2}):(\d{2})/.exec(raw);
-            if (!t) continue;
-            if (raw.indexOf("] hook") === -1 || raw.indexOf(" SPAWN ") === -1) continue;
-            const at = new Date(
-              2000 + Number(t[3]), Number(t[2]) - 1, Number(t[1]),
-              Number(t[4]), Number(t[5]), Number(t[6])
-            ).getTime();
-            // Trace stamps have SECOND resolution and started_at has
-            // milliseconds, so a dispatch in the same second as the
-            // session start compares as earlier than it. Floor the
-            // boundary to the second the trace could actually express.
-            if (at >= sessionFloor) mine += 1;
-          }
-          spawns += mine;
-          // The phase comes off the text this loop already read — one more
-          // regex pass, no second file read.
-          if (active) {
-            const lm = /^run-([a-z0-9-]+?)-.+-\d{6}-\d{6}\.txt$/.exec(f);
-            if (lm) phase = resolvePhase(lm[1], text);
-          }
-          let openHere = 0;
-          try {
-            const pend = JSON.parse(fs.readFileSync(full + ".pending.json", "utf8"));
-            if (Array.isArray(pend)) openHere = pend.length;
-          } catch (_) {}
-          running += openHere;
-          // A lane earns its name by having actually dispatched in this
-          // session — listing a lane that contributed nothing is noise.
-          if (mine > 0 || openHere > 0) {
-            const m = /^run-([a-z0-9-]+?)-.+-\d{6}-\d{6}\.txt$/.exec(f);
-            if (m && lanes.indexOf(m[1]) === -1) lanes.push(m[1]);
-          }
-        }
-      } catch (_) {}
-      led.dispatch = { spawns, running, lanes, phase, scanned_at: now };
-      // MTok rides in the same throttled pass, and reads only the bytes the
-      // transcript has grown by since the last one.
-      led.tok = scanTokens(led, d.transcript_path || null);
-    }
-
-    const dsp = led.dispatch || { spawns: 0, running: 0, lanes: [], phase: null };
-    // The composed layout reads THESE — the same numbers the shipped line
-    // below prints, from the same scan.
-    SCAN.spawns = dsp.spawns || 0;
-    SCAN.running = dsp.running || 0;
-    SCAN.lanes = dsp.lanes || [];
-    SCAN.phase = dsp.phase || null;
-    SCAN.extra_enabled = !!extraOn;
-    const parts = [];
-    // `status:` leads, because what ORC is doing right now is the one thing on
-    // this line that changes minute to minute. It is also the ONE segment
-    // allowed to vanish: a phase the disk cannot prove is hidden rather than
-    // guessed, and the glyph goes with it. It replaces v1.2.0's `lanes:` list —
-    // the running lane is its first word, and `orc stats` / `orc run list`
-    // still hold the whole session's history.
-    if (dsp.phase && dsp.phase.label)
-      parts.push(
-        motifFrame(dsp.phase.kind) + " status: " + dsp.phase.lane + " · " + dsp.phase.label
-      );
-    // `running` is never hidden, because an agent still in flight is the thing
-    // a user most needs to see (v1.2.0). Zero is simply not printed.
-    parts.push(
-      "agents " + dsp.spawns + (dsp.running ? " (" + dsp.running + " running)" : "")
-    );
-    parts.push("orc-extra: " + (extraOn ? "on" : "off"));
-    if (led.started_at)
-      parts.push("Dur " + Math.max(0, Math.round((now - led.started_at) / 60000)) + "m");
-    // MTok keeps its slot in every state. An em dash says "not measured"; a `0`
-    // would say the session was free, and that is a different claim.
-    parts.push("MTok " + (fmtTokens(led.tok) || "—"));
-    if (SCAN.branch) parts.push(SCAN.branch);
-    line2 = "   " + parts.join(" · ");
-  } catch (_) {
-    line2 = "";
-  }
-
-  // ONE write, after every block that touches the ledger has had its say. It is
-  // last on purpose: a render that throws half way through still prints, and a
-  // ledger that could not be written never takes the status line down with it.
-  ledgerFlush();
-
-  // ── THE CUSTOM LAYOUT (v1.3.0) ──────────────────────────────────────────
-  // Everything above is the SHIPPED status line, and it is what renders unless
-  // the user composed their own. `custom()` returns null in every state but
-  // one, and each of its gates is a FALLBACK rather than a throw: a hook cannot
-  // refuse, so a bad layout must degrade to something correct rather than paint
-  // garbage. The ladder is documented on the function itself.
-  const composed = custom(d, {
-    payload: d,
-    ledger: LED || {},
-    scan: SCAN,
-    derived: { verdict, reasons, version: ver },
-    now: Date.now(),
-  });
-  if (composed != null) {
-    process.stdout.write(composed);
-    return;
-  }
-
-  process.stdout.write(line2 ? line + "\n" + line2 : line);
-});
-
-// ── The six-rung gate ladder ────────────────────────────────────────────────
-// In order, and EVERY RUNG IS A FALLBACK, never a throw:
-//
-//   1  statusline_custom is not `on`        the shipped lines. BYTE-IDENTICAL.
-//   2  statusline-compiled.json missing /   default + statusline-layout-unreadable
-//      unparseable / schema mismatch
-//   3  orc_version or catalog_hash moved    default + statusline-layout-stale
-//   4  an unknown op or an unknown binding  default + statusline-layout-skew
-//   5  the cheap shape guard fails          default + statusline-layout-invalid
-//   6  otherwise                            run the program
-//
-// Rungs 3 and 4 are why the lock file exists. Rung 5 is this hook RE-CHECKING
-// rather than trusting the file, because a hand-edited compiled file is a file
-// nobody validated. Every fallback RECORDS ITSELF in the ledger so `orc doctor`
-// can name it: a status line that quietly went back to the default and never
-// said why is a bug the user cannot report.
-function custom(d, ctx) {
-  try {
-    const fs = require("fs");
-    const path = require("path");
-    const projectDir =
-      (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
-    const orcDir = path.join(projectDir, ".claude", "orc");
-
-    // Rung 1. The hook cannot resolve config — that is the lane resolver's job,
-    // and a hook has no lane — so it reads the raw key off the file and takes
-    // the documented default otherwise, exactly as it already does for
-    // `log_dir` and `extra_enabled`.
-    let on = false;
-    try {
-      const raw = fs.readFileSync(path.join(projectDir, ".claude", "orc.config.yaml"), "utf8");
-      // The trailing \r is tolerated on purpose: a config file written on
-      // Windows carries CRLF, and a $-anchored match silently never fires
-      // there — which is a feature that is ON in the file and OFF on the bar.
-      on = /^[ \t]*statusline_custom:[ \t]*["']?on["']?[ \t]*\r?$/m.test(raw);
-    } catch (_) {}
-    if (!on) return null;
-
-    // Rung 2. THE HOOK NEVER READS THE AUTHORED LAYOUT — not as a fallback, not
-    // on a cache miss, not ever. One consumer per file.
-    let prog = null;
-    try {
-      prog = JSON.parse(fs.readFileSync(path.join(orcDir, "statusline-compiled.json"), "utf8"));
-    } catch (_) {}
-    if (!prog || prog.schema !== 1) return slFallback(orcDir, "statusline-layout-unreadable");
-
-    // Rung 3. An ORC upgrade that adds, removes or changes a component
-    // invalidates every compiled layout on the machine. Better the shipped
-    // lines than a program compiled against a catalogue that no longer exists.
-    let lock = null;
-    try {
-      lock = JSON.parse(fs.readFileSync(path.join(orcDir, "statusline.lock.json"), "utf8"));
-    } catch (_) {}
-    let installed = null;
-    try {
-      installed = JSON.parse(fs.readFileSync(path.join(__dirname, "orc-version.json"), "utf8")).version;
-    } catch (_) {}
-    if (!lock || (installed && lock.orc_version !== installed))
-      return slFallback(orcDir, "statusline-layout-stale");
-
-    const engine = require("./orc-statusline-render.js");
-
-    // Rung 4. A binding this build does not have is an INSTALL SKEW, not a
-    // rendering problem, and it must not be papered over one item at a time.
-    for (const b of lock.bindings || []) {
-      if (!engine.BINDINGS[b]) return slFallback(orcDir, "statusline-layout-skew");
-    }
-
-    // Rung 5. The cheap shape guard: at most three lines, at most `max_per_line`
-    // components on any of them, and the dense-prefix rule —
-    // A line may hold a component only if every line above it holds at least one.
-    //
-    // THE CAP AND THE COUNTING RULE ARE BOTH THE COMPILER'S (v1.4.2). This held
-    // its own `5` and counted EVERY item op, so it disagreed with the validator
-    // twice: it bounced a legal six-part line, and it bounced a legal five plus
-    // a spacer. Both fell silently back to the shipped lines with the reason
-    // only in a ledger file, which reads exactly like "my sixth part reset the
-    // bar to the default". The cap rides on the lock (already gated on
-    // `orc_version` at rung 3, so a stale copy cannot outlive its build) and
-    // the compiler marks a structural op `s` — this cannot know that on its
-    // own, because a compiled op carries an INSTANCE id and never a type.
-    if (!Array.isArray(prog.lines) || prog.lines.length > 3)
-      return slFallback(orcDir, "statusline-layout-invalid");
-    const cap = Number(lock.max_per_line) > 0 ? Number(lock.max_per_line) : 6;
-    let seenEmpty = false;
-    for (const l of prog.lines) {
-      const ops = (l.ops || []).filter((o) => o.op === "item");
-      if (ops.filter((o) => !o.s).length > cap) return slFallback(orcDir, "statusline-layout-invalid");
-      if (ops.length === 0) seenEmpty = true;
-      else if (seenEmpty) return slFallback(orcDir, "statusline-layout-invalid");
-    }
-
-    // Rung 6. Run the program. Failure isolation lives inside the engine: one
-    // throwing item emits its unknown form and the rest of the line survives.
-    SCAN.preset = prog.preset || null;
-    const out = engine.render(prog, {
-      payload: ctx.payload,
-      ledger: ctx.ledger,
-      scan: ctx.scan,
-      derived: ctx.derived,
-      now: ctx.now,
-      cols: Number(process.env.COLUMNS) || 0,
-      env: process.env,
-    });
-    if (out.errors && out.errors.length) slNote(orcDir, "statusline-item-failed", out.errors[0]);
-    return out.text;
-  } catch (_) {
-    // Even the ladder must not throw. A status line that crashes is a status
-    // line that is simply absent, with no way to find out why.
-    return null;
-  }
-}
-
-// A fallback RECORDS ITSELF. `orc doctor` reads this file and names the finding
-// with the exact command that clears it.
-function slFallback(orcDir, finding) {
-  slNote(orcDir, finding, null);
-  return null;
-}
-function slNote(orcDir, finding, detail) {
-  try {
-    const fs = require("fs");
-    const path = require("path");
-    fs.mkdirSync(orcDir, { recursive: true });
-    fs.writeFileSync(
-      path.join(orcDir, "statusline-state.json"),
-      JSON.stringify({ finding, detail: detail || null, at: Date.now() }) + "\n"
-    );
-  } catch (_) {}
-}
-
-// ── THE EXTENDED SCAN (v1.3.0 W3) ──────────────────────────────────────────
-// Groups D, E, F and G — knowledge, extra, flow and the health gates. Every one
-// of them is a `new read`: a read that does not exist in the shipped status
-// line and only happens when a layout asks for it.
-//
-// THE BAR IS 15 MILLISECONDS, NOT 300. W0 measured node startup at ~285 ms of a
-// 300 ms budget, so a component here has to be answerable from a small JSON
-// file, on its own clock, or it does not ship. Two are refused for that reason
-// and say so in the catalogue.
-//
-// Every read below is:
-//   - gated on a BINDING the compiled lock names (the read planner);
-//   - cached in the per-session ledger under its own key;
-//   - given its OWN TTL, because a pact ledger and a spend log do not move at
-//     the same rate.
-//
-// A read that throws leaves its slot null, and a null renders an em dash.
-// UNKNOWN IS NOT ZERO — a `0` would say the thing was measured and found empty.
-function extendedScan(d, wants, wantsProvider) {
-  if (!wantsProvider("scan.extended")) return;
-  let fs, path, projectDir, led, now;
-  try {
-    fs = require("fs");
-    path = require("path");
-    projectDir = (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
-    led = ledger(projectDir, String(d.session_id || d.sessionId || ""));
-    now = Date.now();
-  } catch (_) {
-    return;
-  }
-  const orc = path.join(projectDir, ".claude", "orc");
-  const readJson = (p) => {
-    try {
-      return JSON.parse(fs.readFileSync(p, "utf8").replace(/^/, ""));
-    } catch (_) {
-      return null;
-    }
-  };
-  // One cached sub-scan. `key` is its ledger slot, `ttl` its own clock.
-  const cached = (key, ttl, fn) => {
-    const slot = led.ext && led.ext[key];
-    if (slot && !scanStale(slot.at, now, ttl)) return slot.v;
-    let v = null;
-    try {
-      v = fn();
-    } catch (_) {
-      v = null;
-    }
-    led.ext = led.ext || {};
-    led.ext[key] = { v, at: now };
-    return v;
-  };
-
-  // ── Group D — knowledge. All of it comes out of wiki-meta.json, which is
-  //    written ONLY by `orc wiki sync` and is 100% doc-header-derived. A wiki
-  //    tier does not move in a minute, so the TTL is generous.
-  if (wants("wiki.docs")) {
-    const w = cached("wiki_meta", TTL.wiki, () => {
-      const meta = readJson(path.join(orc, "wiki-meta.json"));
-      if (!meta) return null;
-      const docs = Array.isArray(meta.docs) ? meta.docs : [];
-      return {
-        docs: docs.length,
-      };
-    });
-    SCAN.wiki_meta = w;
-  }
-  if (wants("pattern.state")) {
-    // EXISTENCE only, and by the deterministic probe's own rule: the cache
-    // lives under the hidden .claude/ dir, so a raw filesystem search
-    // false-negatives from the wrong cwd.
-    SCAN.pattern = cached("pattern", TTL.knowledge, () => {
-      const dir = path.join(orc, "patterns");
-      try {
-        return fs.readdirSync(dir).some((f) => f.endsWith("-pattern.md")) ? "cached" : "none";
-      } catch (_) {
-        return "none";
-      }
-    });
-  }
-  if (wants("crosslink.state") || wants("crosslink.peers")) {
-    const c = cached("crosslink", TTL.knowledge, () => {
-      const raw = (() => {
-        try {
-          return fs.readFileSync(path.join(projectDir, ".claude", "orc-crosslink.config.yaml"), "utf8");
-        } catch (_) {
-          return null;
-        }
-      })();
-      if (!raw) return null;
-      const n = (raw.match(/^[ \t]*-[ \t]*name:/gm) || []).length;
-      return { peers: n, state: n ? "linked" : "none" };
-    });
-    SCAN.crosslink = c;
-  }
-  if (wants("gotchas.count")) {
-    SCAN.gotchas = cached("gotchas", TTL.knowledge, () => {
-      try {
-        return fs.readdirSync(path.join(orc, "gotchas")).filter((f) => f.endsWith(".md")).length;
-      } catch (_) {
-        return null;
-      }
-    });
-  }
-
-  // ── Group E — extra. `extra.json` is small; the SPEND LOG is not, so it is
-  //    read by TAIL and on its own faster clock, because a spend log is the one
-  //    thing here that moves during a wave.
-  if (wants("extra.profile") || wants("extra.provider") || wants("extra.inflight") || wants("extra.passphrase") || wants("extra.demoted")) {
-    SCAN.extra = cached("extra", TTL.extra, () => {
-      const j = readJson(path.join(orc, "extra.json"));
-      if (!j) return null;
-      const profiles = j.profiles || {};
-      const names = Object.keys(profiles);
-      const first = names.length ? profiles[names[0]] : null;
-      return {
-        profile: names.length ? names[0] : null,
-        provider: first && first.provider ? first.provider : null,
-        profiles: names.length,
-      };
-    });
-  }
-  if (wants("extra.spend") || wants("extra.tasks")) {
-    SCAN.extra_spend = cached("extra_spend", TTL.extra, () => {
-      // The tail only. A spend log grows for the life of a project and reading
-      // all of it on a per-keystroke surface is the hazard this whole subsystem
-      // is shaped around.
-      const p = path.join(orc, "extra-spend.jsonl");
-      let st;
-      try {
-        st = fs.statSync(p);
-      } catch (_) {
-        return null;
-      }
-      const want = Math.min(st.size, 64 * 1024);
-      const buf = Buffer.alloc(want);
-      const fd = fs.openSync(p, "r");
-      try {
-        fs.readSync(fd, buf, 0, want, st.size - want);
-      } finally {
-        fs.closeSync(fd);
-      }
-      const lines = buf.toString("utf8").split("\n").slice(1).filter(Boolean);
-      let tasks = 0;
-      let usd = 0;
-      let priced = false;
-      for (const l of lines) {
-        try {
-          const r = JSON.parse(l);
-          tasks++;
-          if (typeof r.usd === "number") {
-            usd += r.usd;
-            priced = true;
-          }
-        } catch (_) {}
-      }
-      // A cost figure ORC did not price itself is never printed: `usd` stays
-      // null rather than becoming a confident 0.
-      return { tasks, usd: priced ? usd : null, partial: st.size > want };
-    });
-  }
-
-  // ── Group F — flow and lanes. The diy lock is already read for the shipped
-  //    segment; `wait` is a small run-state file.
-  if (wants("wait.state")) {
-    SCAN.wait = cached("wait", TTL.run, () => {
-      const j = readJson(path.join(orc, "wait.json"));
-      if (!j) return "none";
-      if (j.block_reason) return "blocked";
-      return j.until || j.hops ? "waiting" : "none";
-    });
-  }
-  // `preset.name` is NOT read here: it rides in the compiled program, which is
-  // the only file that crosses the wall. The hook never opens the authored
-  // layout, and a field being convenient is not an exception to that.
-
-  // ── Group C remainder — the run's own progress, from RESUME.md, which is the
-  //    ONE line `orc resume` and `orc run list` parse. Reading the same line is
-  //    how a listing never has to open a checkpoint.
-  if (wants("run.wave") || wants("run.wave_total") || wants("run.resume") || wants("run.open")) {
-    SCAN.runs = cached("runs", TTL.run, () => {
-      let logRel = ".claude/orc/logs";
-      try {
-        const raw = fs.readFileSync(path.join(projectDir, ".claude", "orc.config.yaml"), "utf8");
-        const m = /^[ \t]*run_dir:[ \t]*["']?([^"'#\r\n]+)/m.exec(raw);
-        if (m) logRel = m[1].trim();
-      } catch (_) {}
-      const runDir = path.isAbsolute(logRel) ? logRel : path.join(projectDir, ".claude", "orc", "run");
-      let open = 0;
-      let wave = null;
-      let waves = null;
-      try {
-        for (const slug of fs.readdirSync(runDir)) {
-          const rp = path.join(runDir, slug, "RESUME.md");
-          if (!fs.existsSync(rp)) continue;
-          if (fs.existsSync(path.join(runDir, slug, "closed.json"))) continue;
-          open++;
-          // The byte-stable `Where it stands:` line, at column 0. It is the one
-          // line two other commands already parse, which is exactly why this
-          // does not open a checkpoint.
-          const m = /^Where it stands:.*wave (\d+) of (\d+)/m.exec(fs.readFileSync(rp, "utf8"));
-          if (m && wave == null) {
-            wave = Number(m[1]);
-            waves = Number(m[2]);
-          }
-        }
-      } catch (_) {
-        return null;
-      }
-      return { open, wave, waves, resume: open > 0 ? "waiting" : "none" };
-    });
-  }
-
-  // ── Group G — the health gates. Each is one small ledger, each on the slow
-  //    clock: a pact does not drift between keystrokes.
-  const gate = (key, file, fn) => {
-    if (!wants(key)) return null;
-    return cached(key.replace(/\./g, "_"), TTL.gates, () => fn(readJson(path.join(orc, file))));
-  };
-  SCAN.pact = gate("pact.state", "pact.json", (j) => {
-    if (!j || !Array.isArray(j.entries)) return null;
-    const live = j.entries.filter((e) => e.state !== "retired");
-    const broken = live.filter((e) => e.state === "broken").length;
-    const drifted = live.filter((e) => e.state === "drifted").length;
-    // UNCHECKABLE is the honest state and it never reads as a failure.
-    return { state: broken ? "broken" : drifted ? "drifted" : "holding", drifted, broken, total: live.length };
-  });
-  SCAN.boundary = gate("boundary.state", "boundary.json", (j) => {
-    if (!j || !Array.isArray(j.cards)) return null;
-    const refused = j.cards.filter((c) => c.verdict === "REFUSE").length;
-    // An area with no card is UNKNOWN, never assumed safe.
-    return { state: refused ? "refused" : "clear", refused, cards: j.cards.length };
-  });
-  SCAN.challenge = gate("challenge.state", "challenge.json", (j) => {
-    if (!j) return null;
-    const open = Array.isArray(j.findings) ? j.findings.filter((f) => !f.resolved).length : 0;
-    return { state: j.state || (open ? "open" : "pass"), open, iteration: j.iteration || null };
-  });
-  SCAN.doc = gate("doc.state", "doc.json", (j) => {
-    if (!j) return null;
-    const outline = Array.isArray(j.outline) ? j.outline : [];
-    const done = outline.filter((s) => s.hash).length;
-    return { state: j.shipped ? "shipped" : "draft", done, total: outline.length };
-  });
-
-  // `usage-gate` reads the usage bridge this hook already writes — so it is the
-  // cheapest `new read` in the set, and it is the only one that can say
-  // `unknown`, which is a real answer and never a stop.
-  if (wants("usage.state")) {
-    SCAN.usage = cached("usage", TTL.trace, () => {
-      const j = readJson(path.join(orc, "usage.json"));
-      if (!j || !j.written_at) return "unknown";
-      if (now - j.written_at > 30 * 60 * 1000) return "unknown";
-      const w = [j.five_hour, j.seven_day].filter(Boolean).map((x) => x.used_percentage);
-      if (!w.length) return "unknown";
-      return Math.max(...w) >= 90 ? "low" : "ok";
-    });
-  }
-
-  // A config key as a component. The config file is edited by hand, so 30s.
-  if (wants("config.value")) {
-    SCAN.config_raw = cached("config", TTL.config, () => {
-      try {
-        return fs.readFileSync(path.join(projectDir, ".claude", "orc.config.yaml"), "utf8");
-      } catch (_) {
-        return null;
-      }
-    });
-  }
-}
-
-// ── THE SERIES LEDGER (v1.3.0 W3) ──────────────────────────────────────────
-// `spark`, `spark-braille`, `trend` and `delta` need history, and a status line
-// has none: it is a fresh process every render. So the LAST 16 SAMPLES per
-// series live in the per-session ledger, appended during the throttled scan
-// that already ran.
-//
-// NO NEW READ, NO NEW TIMER. Every value sampled here was already computed for
-// something else this render; the series is a side effect of the scan, never a
-// reason for one.
-//
-// SIXTEEN, and only for the series a compiled layout actually names — the read
-// planner again. A series nothing binds is not kept, so the ledger does not
-// grow for a user whose layout has no sparkline on it.
-const SERIES_MAX = 16;
-const SERIES_MIN_GAP_MS = 20000;
-
-function sampleSeries(d, plan) {
-  try {
-    if (!plan || !plan.series || !plan.series.size) return;
-    const led = LED;
-    if (!led) return;
-    const now = Date.now();
-    // A sample every 20 seconds, not every render. Sixteen samples at the
-    // render rate would be five seconds of history, which is not history — it
-    // is the same number sixteen times.
-    if (led.series_at && now - led.series_at < SERIES_MIN_GAP_MS) return;
-    led.series_at = now;
-    led.series = led.series || {};
-    const push = (key, v) => {
-      if (!plan.series.has(key)) return;
-      if (typeof v !== "number" || !Number.isFinite(v)) return;
-      const arr = led.series[key] || [];
-      arr.push(Math.round(v));
-      while (arr.length > SERIES_MAX) arr.shift();
-      led.series[key] = arr;
-    };
-    const rl = d.rate_limits || {};
-    const w = led.five_hour;
-    push("quota5h", rl.five_hour && rl.five_hour.used_percentage);
-    push("quotawk", rl.seven_day && rl.seven_day.used_percentage);
-    push("ucs", w && typeof w.last === "number" && typeof w.baseline === "number"
-      ? Math.max(0, (w.accumulated || 0) + Math.max(0, w.last - w.baseline))
-      : null);
-    const tok = led.tok;
-    if (tok) {
-      push("mtok", (tok.input || 0) + (tok.cache_write || 0) + (tok.cache_read || 0) + (tok.output || 0));
-      push("mtokkind", tok.cache_read || 0);
-    }
-    push("agents", SCAN.spawns);
-    push("cost", d.cost && d.cost.total_cost_usd != null ? d.cost.total_cost_usd * 100 : null);
-    push("cachehit", d.prompt_cache && d.prompt_cache.hit_ratio != null
-      ? (d.prompt_cache.hit_ratio <= 1 ? d.prompt_cache.hit_ratio * 100 : d.prompt_cache.hit_ratio)
-      : null);
-    push("cachewrite", d.prompt_cache && d.prompt_cache.cache_write_tokens);
-    push("lines", d.cost && d.cost.total_lines_added != null
-      ? (d.cost.total_lines_added || 0) - (d.cost.total_lines_removed || 0)
-      : null);
-    push("extraspend", SCAN.extra_spend && SCAN.extra_spend.usd != null ? SCAN.extra_spend.usd * 100 : null);
-  } catch (_) {
-    // A series is a nicety. It never takes the status line down with it.
-  }
-}
+#!/usr/bin/env node
+"use strict";
+
+/**
+ * ORC statusline — a Claude Code statusLine command.
+ *
+ * The statusline is the ONLY place Claude Code exposes the live model id
+ * (`model.id`) together with the reasoning effort (`effort.level`). It is
+ * display-only — it cannot block — so this is the "model warn" half of the
+ * "run ORC on Opus 4.8 high" rule. When the session is NOT Opus 4.8 at high
+ * effort, it renders a loud warning so you never launch /orc on the wrong tier.
+ *
+ * The deterministic hard-stop for effort lives in orc-effort-guard.js.
+ *
+ * Wiring (installed by `orc init` ONLY if no statusLine already exists):
+ *   settings.statusLine { type:"command", command:'node "<.claude>/hooks/orc-statusline.js"' }
+ *
+ * On Claude Code v2.1.80+ it also renders the official subscription-usage
+ * segment `5h N% (reset) ↔ wk N%`, read straight from the payload's
+ * `rate_limits.{five_hour,seven_day}` (Anthropic API headers, not estimated).
+ * A window ≥90% folds into the DEGRADE verdict; fail-silent when absent.
+ *
+ * Three-tier verdict (the "ORC-ready" acceptance matrix). Since v1.2.1 the
+ * ICON carries the verdict and the words carry the installed ORC version — but
+ * the degrade branch still names every reason, because a warning with no reason
+ * is an emoji:
+ *   ✅ ORC v1.2.1 - Opus 5/high          Opus 4.8 high (the baseline)
+ *   🚀 ORC v1.2.1 - Opus 5/high          Opus 4.8 xhigh/max, or Opus 5 / Fable 5 medium…max
+ *   ⛔ ORC v1.2.1 - Sonnet 5/high (why)  everything below (wrong model, sub-baseline effort, quota)
+ *
+ * The two lines, in full (v1.2.1):
+ *
+ *   {icon} ORC v{version} - {model}/{effort} · context (N%) · 5h N% (reset) ↔ wk N%
+ *          · ucs N% · wiki: … · diy:… · orc N.N.N available
+ *   {glyph} status: {lane} · {phase} · agents N (M running) · orc-extra: on|off
+ *          · Dur Nm · MTok NNNK · {branch}
+ *
+ * Line 1 answers "what tier am I on, and how full is the window". Line 2
+ * answers "what is this session DOING". Every segment on both is read from
+ * disk or from the payload; none of it costs a model call.
+ *
+ * Three segments on line 2 carry a rule worth stating here, because each is a
+ * place where the easy version would lie:
+ *   - `status:` is the ONLY segment allowed to vanish. A phase the disk cannot
+ *     prove is HIDDEN, never guessed — see the phase-rail block below for what
+ *     that costs and why it is still the right trade.
+ *   - `MTok` is MAIN TOKEN: this session's own turns. Claude Code records no
+ *     token usage for a dispatched subagent, so an hour of Opus executors adds
+ *     almost nothing. An em dash means not measured; `0` would mean free.
+ *   - `ucs` is a delta of an ACCOUNT-WIDE window, not a private meter.
+ *
+ * This is the ONLY place Claude Code exposes the live model id, so it also
+ * writes a fail-silent session-model bridge (.claude/orc/session-model.json)
+ * that the PreToolUse effort guard reads — the guard can't see the model id
+ * on its own, so the bridge is how the Opus 5 / Fable 5 medium-effort allowance
+ * reaches it.
+ *
+ * Also appends a "newer orc version available" hint from the 24h update cache
+ * (cache-only here — never a network call in the statusline hot path; the
+ * PreToolUse guard refreshes the cache when /orc is invoked).
+ *
+ * Everything on line 2 rides in ONE scan, throttled to 5s and cached in the
+ * per-session ledger, because a statusline re-renders on every keystroke and
+ * anything unthrottled here is a per-keystroke disk scan. `MTok` additionally
+ * reads only the bytes the transcript has GROWN by. There is exactly one seam
+ * over that budget — ORC_STATUSLINE_SCAN_MS — and nothing in ORC ever sets it.
+ */
+
+// Opus 4.8 / Opus 5 / Fable 5 are matched by tolerant regexes below (accept
+// dated/suffixed ids and the display name), not strict strings. Effort ranks give
+// the acceptance-matrix tiers (0 = unknown, never treated as a positive downgrade).
+const EFFORT_RANK = { low: 1, medium: 2, high: 3, xhigh: 4, max: 5 };
+
+// Shared update-check helper (sibling file). Degrade gracefully if absent.
+let updater = null;
+try {
+  updater = require("./orc-update-lib.js");
+} catch (_) {
+  updater = null;
+}
+
+// ── The phase rail, the motifs, and the two seams (v1.2.1) ──────────────────
+// `status:` says which phase an ORC run is in. Three rules hold it up.
+//
+// 1. THE CLI COMPUTES, THIS FILE RENDERS. The phase ids, their order, their
+//    labels and their motif kind all come from `orc-lane-rails.json`, which
+//    `orc init` / `orc update` generates from the CLI's own registries. This
+//    hook holds no idea of what ORC's phases are. A second phase table here
+//    would be the Flow-stepper failure on a second surface, and no lint could
+//    see it. Frames are the exception and belong here: they are presentation,
+//    and a motif change must not need a reinstall.
+//
+// 2. A PHASE THE DISK CANNOT PROVE IS HIDDEN. Never guessed, never carried
+//    over from a minute ago. A stale phase word gets believed — the same
+//    reasoning as `unknown is not low` and `unknown is not zero`.
+//
+// 3. THE FLOOR IS HOOK-WRITTEN. `PHASE-EDGE <family>` and `SPAWN <agent>` are
+//    written by orc-trace.js with zero model cooperation. A trace verb the
+//    orchestrator narrated is allowed to REFINE that (it is more specific:
+//    `Q3 DO` rather than `execution`) but only when it is later in the file,
+//    and only when that lane's own rail publishes the verb — so it can sharpen
+//    the answer and can never invent one.
+//
+// What this cannot see, stated so nobody reads a blank as a bug:
+//   - a phase that dispatches nothing AND narrates nothing is INVISIBLE
+//     (/orc-quick Q1 LOOK and Q2 ASK, and every ask-the-user gate);
+//   - a CONTINUED agent emits no PreToolUse/SubagentStop pair, so the skeleton
+//     is a floor, never a census (orc-trace.js documents this);
+//   - `orc extra` runs a worker through Bash, so a foreign wave writes no
+//     SPAWN and resolves only through its narrated `EXTRA` verb, or hides.
+//
+// The animation is a LIVENESS TELL, not a driven animation. A statusline is a
+// pull surface — Claude Code re-renders it, ORC cannot — so the frame is picked
+// off the wall clock. It advances while you type and while turns land, and it
+// FREEZES when the session is idle, which is true and is the point.
+//
+// Two env seams, for tests and for terminals, and nothing in ORC ever sets
+// either: ORC_STATUSLINE_ASCII=1 swaps the glyph set, ORC_STATUSLINE_MOTION=0
+// REMOVES motion rather than slowing it (a frozen frame of a cycling animation
+// is a bug that looks like a hang — the web panel learned this at v0.44.0, and
+// so the still frame is designed as a still frame: frame 0 of each set).
+
+const PHASE_STALE_MS = 10 * 60 * 1000;
+
+const MOTIFS = {
+  look: { u: ["◔", "◑", "◕", "●"], a: [".", "o", "O", "0"], ms: 260 },
+  ask: { u: ["?", "¿", "?", "·"], a: ["?", "?", "?", "."], ms: 500 },
+  plan: { u: ["▁", "▃", "▅", "▇"], a: ["_", "-", "=", "#"], ms: 220 },
+  do: { u: ["▰", "▱", "▰", "▱"], a: ["=", "-", "=", "-"], ms: 180 },
+  check: { u: ["◇", "◈", "◆", "◈"], a: ["<", "=", ">", "="], ms: 240 },
+  ship: { u: ["›", "»", "≫", "»"], a: [">", ">", "=", ">"], ms: 200 },
+  wait: { u: ["·", "˙", "·", "˙"], a: [".", "'", ".", "'"], ms: 700 },
+  generic: {
+    u: ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"],
+    a: ["-", "\\", "|", "/"],
+    ms: 90,
+  },
+};
+
+function motifFrame(kind) {
+  const m = MOTIFS[kind] || MOTIFS.generic;
+  const frames = process.env.ORC_STATUSLINE_ASCII === "1" ? m.a : m.u;
+  if (process.env.ORC_STATUSLINE_MOTION === "0") return frames[0];
+  return frames[Math.floor(Date.now() / m.ms) % frames.length];
+}
+
+// The rail manifest, read once per process. Absent (a pre-1.2.1 install, or a
+// write that failed) → null → `status:` hides. Never throws.
+let RAILS = undefined;
+function rails() {
+  if (RAILS !== undefined) return RAILS;
+  RAILS = null;
+  try {
+    const j = JSON.parse(
+      require("fs").readFileSync(
+        require("path").join(__dirname, "orc-lane-rails.json"),
+        "utf8"
+      )
+    );
+    if (j && j.lanes) RAILS = j;
+  } catch (_) {}
+  return RAILS;
+}
+
+// Which phase is the run in? Called once per throttled scan, over text the scan
+// has already read, so it costs one regex pass and no extra I/O.
+//
+// `text` is the active trace, `laneToken` its filename's lane. Returns
+// {lane, label, kind} or null — and null is a real answer.
+function resolvePhase(laneToken, text) {
+  const r = rails();
+  if (!r || !laneToken) return null;
+  const row = r.lanes[laneToken];
+  if (!row) return null;
+
+  // Every line carries its own timestamp; the newest one dates the run. A trace
+  // whose last line is old is not a run in progress, whatever it says.
+  const at = (l) => {
+    const t = /^\[(\d{2})(\d{2})(\d{2}) (\d{2}):(\d{2}):(\d{2})/.exec(l);
+    if (!t) return 0;
+    return new Date(
+      2000 + Number(t[3]), Number(t[2]) - 1, Number(t[1]),
+      Number(t[4]), Number(t[5]), Number(t[6])
+    ).getTime();
+  };
+
+  const lines = text.split("\n");
+  let newest = 0;
+  let edgeIdx = -1;
+  let edgeFam = null;
+  let verbIdx = -1;
+  let verbPhase = null;
+  for (let i = 0; i < lines.length; i++) {
+    const l = lines[i];
+    if (!l) continue;
+    const ts = at(l);
+    if (ts > newest) newest = ts;
+    const e = /PHASE-EDGE ([a-z-]+)/.exec(l);
+    if (e && r.families[e[1]]) {
+      edgeIdx = i;
+      edgeFam = e[1];
+    }
+    // A verb line is the orchestrator's. It counts only when this lane's own
+    // rail published that verb — the rail is what stops a narrated word from
+    // inventing a phase the lane does not have.
+    const body = l.replace(/^\[[^\]]*\]\s*\S+\s*/, "");
+    for (const p of row.phases) {
+      for (const v of p.verbs) {
+        if (body.indexOf(v) === 0) {
+          verbIdx = i;
+          verbPhase = p;
+        }
+      }
+    }
+  }
+
+  if (!newest || Date.now() - newest > PHASE_STALE_MS) return null;
+
+  if (verbPhase && verbIdx > edgeIdx)
+    return { lane: laneToken, label: verbPhase.label, kind: verbPhase.kind };
+  if (edgeFam) {
+    const fam = r.families[edgeFam];
+    return { lane: laneToken, label: fam.label, kind: fam.kind };
+  }
+  if (verbPhase) return { lane: laneToken, label: verbPhase.label, kind: verbPhase.kind };
+  return null;
+}
+
+// The current branch, without a subprocess. A statusline re-renders on every
+// keystroke, so `git rev-parse` here would be one process per keystroke.
+// Anything unrecognised returns null and the segment is simply absent.
+function gitBranch(projectDir) {
+  const fs = require("fs");
+  const path = require("path");
+  try {
+    const dot = path.join(projectDir, ".git");
+    let gitDir = dot;
+    if (fs.statSync(dot).isFile()) {
+      // A worktree or a submodule: `.git` is a pointer file.
+      const m = /gitdir:\s*(.+)/.exec(fs.readFileSync(dot, "utf8"));
+      if (!m) return null;
+      const g = m[1].trim();
+      gitDir = path.isAbsolute(g) ? g : path.join(projectDir, g);
+    }
+    const head = fs.readFileSync(path.join(gitDir, "HEAD"), "utf8").trim();
+    const ref = /^ref:\s*refs\/heads\/(.+)$/.exec(head);
+    const name = ref
+      ? ref[1]
+      : /^[0-9a-f]{40}$/.test(head)
+        ? "@" + head.slice(0, 7)
+        : null;
+    if (!name) return null;
+    return name.length > 24 ? name.slice(0, 23) + "…" : name;
+  } catch (_) {
+    return null;
+  }
+}
+
+// The commit HEAD points at, from .git alone — never a subprocess, because this
+// runs on a surface that re-renders on every keystroke. A loose ref first, then
+// packed-refs, then a detached HEAD. Anything unreadable is null, and null never
+// claims a state.
+function gitHeadCommit(projectDir) {
+  const fs = require("fs");
+  const path = require("path");
+  try {
+    const dot = path.join(projectDir, ".git");
+    let gitDir = dot;
+    if (fs.statSync(dot).isFile()) {
+      const m = /gitdir:\s*(.+)/.exec(fs.readFileSync(dot, "utf8"));
+      if (!m) return null;
+      const g = m[1].trim();
+      gitDir = path.isAbsolute(g) ? g : path.join(projectDir, g);
+    }
+    const head = fs.readFileSync(path.join(gitDir, "HEAD"), "utf8").trim();
+    if (/^[0-9a-f]{40}$/.test(head)) return head;
+    const ref = /^ref:\s*(refs\/.+)$/.exec(head);
+    if (!ref) return null;
+    try {
+      const loose = fs.readFileSync(path.join(gitDir, ...ref[1].split("/")), "utf8").trim();
+      if (/^[0-9a-f]{40}$/.test(loose)) return loose;
+    } catch (_) {}
+    const packed = fs.readFileSync(path.join(gitDir, "packed-refs"), "utf8");
+    const line = packed.split(/\r?\n/).find((l) => l.endsWith(" " + ref[1]));
+    return line ? line.slice(0, 40) : null;
+  } catch (_) {
+    return null;
+  }
+}
+
+// MTok — MAIN TOKEN. The tokens THIS session's own turns consumed, summed from
+// the session transcript's `usage` blocks.
+//
+// Two honesty rules ship with it.
+//
+// It is the MAIN session only. Claude Code records NO token usage for a
+// dispatched subagent (v1.2.0 verified that across every transcript on two
+// machines), so a wave of three Opus executors adds almost nothing here. That
+// is why an unreadable transcript renders an em dash and NEVER `0` — a zero
+// would say the session was free.
+//
+// It is all four kinds summed. `/orc-budget`'s rule is four kinds never
+// blended, and that rule is about REPORTS; this is one cell on a status bar.
+// Any subset ORC picked would be a weighting ORC invented, which is worse. The
+// vector stays authoritative in `orc usage report`, and the ledger below keeps
+// all four kinds so it always can be.
+//
+// The read is INCREMENTAL. A transcript is append-only and reaches tens of
+// megabytes; re-reading it inside a 5-second loop is the per-keystroke disk
+// hazard the throttle exists to prevent. Only bytes past the stored offset are
+// read, and the offset resets when the file shrinks or the path changes.
+function scanTokens(led, transcriptPath) {
+  const fs = require("fs");
+  const fresh = (p) => ({
+    path: p, offset: 0, size: 0, input: 0, cache_write: 0, cache_read: 0, output: 0,
+  });
+  if (!transcriptPath) return led.tok || null;
+  let prev = led.tok && led.tok.path === transcriptPath ? led.tok : fresh(transcriptPath);
+  let st;
+  try {
+    st = fs.statSync(transcriptPath);
+  } catch (_) {
+    return prev.offset ? prev : null; // never read it → em dash, not 0
+  }
+  // Truncated or rotated under us: everything counted so far is unprovable.
+  if (st.size < prev.size) prev = fresh(transcriptPath);
+  if (st.size > prev.offset) {
+    let chunk = "";
+    try {
+      const fd = fs.openSync(transcriptPath, "r");
+      const len = st.size - prev.offset;
+      const buf = Buffer.alloc(len);
+      fs.readSync(fd, buf, 0, len, prev.offset);
+      fs.closeSync(fd);
+      chunk = buf.toString("utf8");
+    } catch (_) {
+      return prev.offset ? prev : null;
+    }
+    // The final line may be half-written. Stop at the last newline and leave
+    // the remainder for the next scan.
+    const cut = chunk.lastIndexOf("\n");
+    if (cut >= 0) {
+      const whole = chunk.slice(0, cut);
+      prev.offset += Buffer.byteLength(whole, "utf8") + 1;
+      for (const l of whole.split("\n")) {
+        if (!l || l.indexOf('"usage"') === -1) continue;
+        let u = null;
+        try {
+          const j = JSON.parse(l);
+          u = (j && j.message && j.message.usage) || (j && j.usage) || null;
+        } catch (_) {}
+        if (!u) continue;
+        prev.input += Number(u.input_tokens) || 0;
+        prev.cache_write += Number(u.cache_creation_input_tokens) || 0;
+        prev.cache_read += Number(u.cache_read_input_tokens) || 0;
+        prev.output += Number(u.output_tokens) || 0;
+      }
+    }
+  }
+  prev.size = st.size;
+  return prev;
+}
+
+function fmtTokens(tok) {
+  if (!tok) return null;
+  const n =
+    (tok.input || 0) + (tok.cache_write || 0) + (tok.cache_read || 0) + (tok.output || 0);
+  if (n <= 0) return null;
+  if (n >= 1e6) return (n / 1e6).toFixed(1).replace(/\.0$/, "") + "M";
+  if (n >= 1000) return Math.round(n / 1000) + "K";
+  return String(n);
+}
+
+// ── The per-session ledger: ONE read, ONE write, ONE throttle (v1.3.0 W0) ───
+// `.claude/orc/usage-session.json` is the per-session ledger, and three
+// separate blocks below want it: the rate-limit tracker, `ucs`, and the
+// throttled line-2 scan. Each used to open the file itself and two of them
+// wrote it, so one render cost three reads and two writes — on a surface that
+// re-renders on every keystroke. It is memoised here instead: loaded at most
+// once per process, mutated in place by whoever needs it, and flushed exactly
+// once at the end. Same rules as before — RAW numbers only, never a computed
+// word, fail-silent, and the reader decides what it means.
+//
+// The scan interval is the ONE seam over this budget, on the ORC_TEST_PROBE_MS
+// precedent: a test that proves the throttle by SLEEPING past it is a test that
+// fails on a loaded machine, and a flake is recorded and removed, never retried
+// away. Unset, this is byte-identical to a hardcoded 5000, and nothing in ORC
+// ever sets it.
+let LED = null;
+let LED_FILE = null;
+
+// The scan's own answers, in ONE shape, so a composed layout (v1.3.0) reads
+// exactly what the shipped lines read. It is populated as the blocks below
+// compute their segments — never by a second pass over the disk. A provider
+// nothing binds is simply never filled in, and every binding over it answers
+// null, which renders an em dash. UNKNOWN IS NOT ZERO.
+const SCAN = {
+  spawns: 0, running: 0, lanes: [], phase: null, slug: null,
+  branch: null, head: null, wiki: null, diy: null,
+  extra_enabled: false, update_version: null, inflight: null,
+  trace_age_min: null, trace_state: null, last_agent: null, retries: null,
+};
+
+function ledger(projectDir, sid) {
+  if (LED) return LED;
+  const fs = require("fs");
+  const path = require("path");
+  LED_FILE = path.join(projectDir, ".claude", "orc", "usage-session.json");
+  let led = null;
+  try {
+    led = JSON.parse(fs.readFileSync(LED_FILE, "utf8"));
+  } catch (_) {}
+  if (!led || led.session_id !== sid) led = { session_id: sid, started_at: Date.now() };
+  LED = led;
+  return LED;
+}
+
+function ledgerFlush() {
+  if (!LED || !LED_FILE) return;
+  try {
+    const fs = require("fs");
+    const path = require("path");
+    LED.updated_at = Date.now();
+    fs.mkdirSync(path.dirname(LED_FILE), { recursive: true });
+    fs.writeFileSync(LED_FILE, JSON.stringify(LED) + "\n");
+  } catch (_) {}
+}
+
+function scanEveryMs() {
+  const n = Number(process.env.ORC_STATUSLINE_SCAN_MS);
+  return Number.isFinite(n) && n >= 0 ? n : 5000;
+}
+
+// Per-provider TTL (v1.3.0 W2), replacing the single global throttle for
+// everything but the trace scan. A wiki tier does not move in five seconds and
+// a flow lock moves when somebody runs a command, so paying the 5-second rate
+// for either is paying for a change that cannot have happened.
+//
+// `ORC_STATUSLINE_SCAN_MS` still overrides ALL of them — it stays the ONE seam
+// over this budget, and a seam that only covered one provider would be a seam
+// tests could not use.
+const TTL = {
+  trace: 5000, // a run moves; this is the one thing that really is that fast
+  git: 5000, // .git/HEAD, no subprocess
+  wiki: 60000, // a wiki tier does not move in five seconds
+  config: 30000, // a config file is edited by hand
+  diy: 30000, // a flow lock moves when somebody runs a command
+  knowledge: 60000, // a pattern cache, a peer list, a gotcha count
+  extra: 15000, // a spend log DOES move during a wave
+  run: 10000, // RESUME.md is rewritten at every stop
+  gates: 60000, // a pact does not drift between keystrokes
+};
+
+// `at` is a ledger `scanned_at` stamp. Absent is stale — unknown is not fresh.
+function scanStale(at, now, ttl) {
+  const budget = process.env.ORC_STATUSLINE_SCAN_MS !== undefined ? scanEveryMs() : ttl == null ? scanEveryMs() : ttl;
+  return typeof at !== "number" || now - at >= budget;
+}
+
+// The read plan, from the compiled layout's lock. Returns null in EVERY state
+// but one — the feature off, no lock, an unparseable lock — and null means
+// "read everything", which is what makes `off` byte-identical.
+//
+// It deliberately does NOT re-run the gate ladder. This is a question about
+// what to READ, and the ladder is a question about what to RENDER; a layout
+// that later fails the ladder falls back to the shipped lines and simply has a
+// segment or two missing for one render. That is a far better failure than
+// reading the disk twice on a surface that re-renders on every keystroke.
+function readPlan(d) {
+  try {
+    const fs = require("fs");
+    const path = require("path");
+    const projectDir =
+      (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
+    const raw = fs.readFileSync(path.join(projectDir, ".claude", "orc.config.yaml"), "utf8");
+    if (!/^[ \t]*statusline_custom:[ \t]*["']?on["']?[ \t]*\r?$/m.test(raw)) return null;
+    const lock = JSON.parse(
+      fs.readFileSync(path.join(projectDir, ".claude", "orc", "statusline.lock.json"), "utf8")
+    );
+    if (!lock || !Array.isArray(lock.bindings)) return null;
+    return {
+      bindings: new Set(lock.bindings),
+      providers: new Set(lock.providers || []),
+      series: new Set(lock.series || []),
+    };
+  } catch (_) {
+    return null;
+  }
+}
+
+let raw = "";
+process.stdin.on("data", (c) => (raw += c));
+process.stdin.on("end", () => {
+  let d = {};
+  try {
+    d = JSON.parse(raw || "{}");
+  } catch (_) {
+    d = {};
+  }
+
+  const model = (d.model && d.model.id) || "";
+  const display = (d.model && d.model.display_name) || model || "unknown";
+  const effort = String((d.effort && d.effort.level) || "").toLowerCase();
+  const pct =
+    d.context_window && typeof d.context_window.used_percentage === "number"
+      ? `context (${d.context_window.used_percentage}%)`
+      : "";
+
+  // ── THE READ PLAN (v1.3.0 W2) ──────────────────────────────────────────────
+  // The compiler knows exactly which bindings a layout uses, therefore exactly
+  // which providers it needs, and it records both in the lock. So: A PROVIDER
+  // NOTHING BINDS IS NOT READ.
+  //
+  // That is the claim this feature has to earn — the shipped status line pays
+  // for the wiki read, the diy read and the trace scan unconditionally, and a
+  // user whose layout names none of them should pay for none of them. Composing
+  // your own line is allowed to make the bar FASTER than the hardcoded one it
+  // replaces, and here is where that happens.
+  //
+  // `null` means the feature is off, and then everything below runs exactly as
+  // it always has. That is what keeps `off` byte-identical.
+  const PLAN = readPlan(d);
+  const wants = (b) => !PLAN || PLAN.bindings.has(b);
+  const wantsProvider = (p) => !PLAN || PLAN.providers.has(p);
+
+  // ── Session-model bridge (fail-silent) ─────────────────────────────────────
+  // The PreToolUse effort guard cannot see the model id; it can only read
+  // effort. Persist {model_id, effort, written_at} here so the guard can grant
+  // the Opus 5 / Fable 5 medium-effort allowance. The statusline re-renders constantly
+  // while a session is active, so written_at stays fresh; the guard treats a
+  // stale file (older than its freshness window) as absent and never blocks on
+  // it. Any error (no dir, read-only fs) is swallowed — this is a nicety, not a
+  // guarantee, and must never break the statusline render.
+  try {
+    if (model || effort) {
+      const fs = require("fs");
+      const path = require("path");
+      const projectDir =
+        (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
+      const orcDir = path.join(projectDir, ".claude", "orc");
+      fs.mkdirSync(orcDir, { recursive: true });
+      fs.writeFileSync(
+        path.join(orcDir, "session-model.json"),
+        JSON.stringify({ model_id: model, effort, written_at: Date.now() }) + "\n"
+      );
+    }
+  } catch (_) {}
+
+  // ── Usage bridge (v1.1.0 W4, fail-silent) ─────────────────────────────────
+  // The `rate_limits` block below reaches ONLY this process: the statusline
+  // renders a string and exits, so nothing else in ORC has ever been able to
+  // see how full the window is. A lane therefore started a wave with no idea it
+  // was about to run out, and the wave stopped in the middle.
+  //
+  // Persist the RAW numbers (never a computed word like `LOW` — a stored state
+  // is wrong one minute later; `orc usage check` computes it on read) plus
+  // `context_window`, which the wait needs to decide whether continuing
+  // in-session is cheaper than a fresh one. Same fail-silent contract as the
+  // session-model bridge above: any error is swallowed, and a reading older
+  // than its freshness window reads as `unknown`, never as `low`.
+  try {
+    const rl0 = d.rate_limits;
+    const cw0 = d.context_window;
+    if (rl0 || cw0) {
+      const fs = require("fs");
+      const path = require("path");
+      const projectDir =
+        (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
+      const orcDir = path.join(projectDir, ".claude", "orc");
+      const win = (o) =>
+        o && typeof o.used_percentage === "number"
+          ? { used_percentage: o.used_percentage, resets_at: o.resets_at == null ? null : o.resets_at }
+          : null;
+      fs.mkdirSync(orcDir, { recursive: true });
+      fs.writeFileSync(
+        path.join(orcDir, "usage.json"),
+        JSON.stringify({
+          five_hour: win(rl0 && rl0.five_hour),
+          seven_day: win(rl0 && rl0.seven_day),
+          context_used_percentage:
+            cw0 && typeof cw0.used_percentage === "number" ? cw0.used_percentage : null,
+          written_at: Date.now(),
+        }) + "\n"
+      );
+      // -- Session consumption (v1.2.0) -------------------------------------
+      // `usage.json` is a SNAPSHOT of the window. It cannot answer "how much
+      // has THIS session eaten", which is the question a user actually asks
+      // mid-run -- and the one they could otherwise only answer by remembering
+      // what the number was an hour ago.
+      //
+      // So keep a per-session ledger beside it: the reading when this session
+      // first rendered, and the reading now. Same rules as every other bridge
+      // here -- RAW numbers only, never a computed word, fail-silent, and the
+      // reader decides what it means.
+      //
+      // A window RESET mid-session (used_percentage drops) is not a refund:
+      // bank what was consumed before the reset into `accumulated` and
+      // re-baseline, so the running total keeps counting across the boundary.
+      const sid = String(d.session_id || d.sessionId || "");
+      const led = ledger(projectDir, sid);
+      const pctOf = (o) => (o && typeof o.used_percentage === "number" ? o.used_percentage : null);
+      const track = (prev, cur) => {
+        if (cur == null) return prev || null;
+        if (!prev) return { baseline: cur, last: cur, accumulated: 0, resets: 0 };
+        if (cur < prev.baseline)
+          return {
+            baseline: cur,
+            last: cur,
+            accumulated: prev.accumulated + Math.max(0, prev.last - prev.baseline),
+            resets: prev.resets + 1,
+          };
+        return { baseline: prev.baseline, last: cur, accumulated: prev.accumulated, resets: prev.resets };
+      };
+      led.five_hour = track(led.five_hour, pctOf(rl0 && rl0.five_hour));
+      led.seven_day = track(led.seven_day, pctOf(rl0 && rl0.seven_day));
+      led.context_used_percentage =
+        cw0 && typeof cw0.used_percentage === "number" ? cw0.used_percentage : null;
+    }
+
+  } catch (_) {}
+
+  // ── Subscription usage (Claude Code v2.1.80+) ──────────────────────────────
+  // Official 5-hour + 7-day usage, surfaced by Claude Code straight from
+  // Anthropic's API headers into this payload's `rate_limits`. Display-only,
+  // fail-silent: an absent block (older Claude Code / no headers) → no segment,
+  // never `undefined`. A window at/above USAGE_CRIT contributes to the DEGRADE
+  // verdict — running low on quota is a real mid-run degradation risk.
+  const USAGE_WARN = 75;
+  const USAGE_CRIT = 90;
+  const fmtReset = (v) => {
+    // resets_at may be an ISO string or an epoch (seconds or ms). "" on anything odd.
+    let t = NaN;
+    if (typeof v === "number") t = v < 1e12 ? v * 1000 : v;
+    else if (typeof v === "string") {
+      const n = Number(v);
+      t = Number.isFinite(n) ? (n < 1e12 ? n * 1000 : n) : Date.parse(v);
+    }
+    if (!Number.isFinite(t)) return "";
+    const ms = t - Date.now();
+    if (ms <= 0) return "";
+    const mins = Math.round(ms / 60000);
+    if (mins < 60) return `${mins}m`;
+    const h = Math.floor(mins / 60);
+    const m = mins % 60;
+    return m ? `${h}h${m}m` : `${h}h`;
+  };
+  let rlSeg = "";
+  const usageBad = [];
+  try {
+    const rl = d.rate_limits || {};
+    const win = (obj, label) => {
+      if (!obj || typeof obj.used_percentage !== "number") return "";
+      const p = Math.round(obj.used_percentage);
+      const reset = fmtReset(obj.resets_at);
+      const mark = p >= USAGE_CRIT ? "⛔" : p >= USAGE_WARN ? "⚠" : "";
+      if (p >= USAGE_CRIT) usageBad.push(`${label}≥${USAGE_CRIT}%`);
+      // Reset shown for the short (5h) window always; weekly only when elevated.
+      const showReset = reset && (label === "5h" || p >= USAGE_WARN);
+      return `${mark}${label} ${p}%${showReset ? ` (${reset})` : ""}`;
+    };
+    const fh = win(rl.five_hour, "5h");
+    const sd = win(rl.seven_day, "wk");
+    if (fh && sd) rlSeg = `${fh} ↔ ${sd}`;
+    else rlSeg = fh || sd || "";
+  } catch (_) {
+    rlSeg = "";
+  }
+
+  // Tolerant tier detection. A strict `model === "claude-opus-4-8"` false-fired
+  // whenever Claude Code reported a dated/suffixed id (e.g. claude-opus-4-8-
+  // YYYYMMDD) or only a display name — even on the correct tier. Match Opus 4.8
+  // and Fable 5 by normalized id OR display name, accepting any variant; the
+  // trailing \b keeps 4.7 / 4.85 / Sonnet etc. correctly warning.
+  const hay = `${model} ${display}`.toLowerCase();
+  const isOpus48 = /opus[\s._-]?4[\s._-]?8\b/.test(hay);
+  const isFable5 = /fable[\s._-]?5\b/.test(hay);
+  // Opus 5 (v0.34.0) — strictly above the baseline, so it boosts from medium up,
+  // exactly like Fable 5. The `\b` keeps opus 4.8 / 4.7 out of this branch.
+  const isOpus5 = /opus[\s._-]?5\b/.test(hay);
+  const modelKnown = model !== "" || (display !== "" && display !== "unknown");
+  // Effort rank; 0 = unknown. A missing/empty effort field is NOT proof of a
+  // downgrade — the PreToolUse guard already hard-blocks a real low-effort /orc
+  // — so an unknown effort never forces DEGRADE on effort grounds here.
+  const er = EFFORT_RANK[effort] || 0;
+
+  const tier = `${display}${effort ? "/" + effort : ""}`;
+
+  // Verdict per the acceptance matrix. Only a POSITIVELY-known bad tier degrades.
+  let verdict = "ready";
+  const reasons = [];
+  if (isOpus48) {
+    if (er >= 4) verdict = "boosted"; // xhigh / max
+    else if (er === 3 || er === 0) verdict = "ready"; // high (or unknown → lenient)
+    else {
+      verdict = "degrade"; // opus 4.8 below high
+      reasons.push("effort≠high");
+    }
+  } else if (isOpus5 || isFable5) {
+    const label = isOpus5 ? "Opus-5" : "Fable-5";
+    if (er >= 2 || er === 0) verdict = "boosted"; // medium…max (or unknown → lenient)
+    else {
+      verdict = "degrade"; // opus 5 / fable 5 below medium
+      reasons.push(`${label} effort<medium`);
+    }
+  } else if (modelKnown) {
+    verdict = "degrade";
+    reasons.push("model≠Opus5/Opus4.8/Fable5");
+  } // else model unknown → stay lenient (the guard enforces effort)
+
+  // A quota window at/above the crit threshold folds into DEGRADE regardless.
+  if (usageBad.length) {
+    verdict = "degrade";
+    for (const u of usageBad) reasons.push(u);
+  }
+
+  // The installed ORC version (v1.2.1). It replaces the verdict WORD, not the
+  // verdict: the icon still carries that, and the degrade branch still names
+  // every reason — dropping those would turn the loudest safety segment in ORC
+  // into an emoji. A version we cannot read renders as plain `ORC`, never
+  // `ORC vnull`: the statusline never prints a word for a thing it does not know.
+  let ver = null;
+  try {
+    ver = updater ? updater.installedVersion(__dirname) : null;
+  } catch (_) {}
+  if (!ver) {
+    try {
+      ver = JSON.parse(
+        require("fs").readFileSync(
+          require("path").join(__dirname, "orc-version.json"),
+          "utf8"
+        )
+      ).version || null;
+    } catch (_) {}
+  }
+  const brand = "ORC" + (ver ? " v" + ver : "");
+
+  let line;
+  if (verdict === "ready") {
+    line = `✅ ${brand} - ${tier}${pct ? " · " + pct : ""}`;
+  } else if (verdict === "boosted") {
+    line = `🚀 ${brand} - ${tier}${pct ? " · " + pct : ""}`;
+  } else {
+    line = `⛔ ${brand} - ${tier} (${reasons.join(", ")})${pct ? " · " + pct : ""}`;
+  }
+
+  // Subscription-usage segment (rendered after ctx, before wiki). Empty on
+  // older Claude Code that doesn't surface `rate_limits`.
+  if (rlSeg) line += " · " + rlSeg;
+
+  // ucs — USAGE, CURRENT SESSION. How far the 5-hour window moved while THIS
+  // session ran (v1.2.0; renamed v1.2.1). The ledger below keeps the raw
+  // numbers; this renders the delta.
+  //
+  // It KEEPS ITS SLOT at zero. "This session has consumed nothing measurable
+  // yet" and "this build has no ucs segment" are different facts and must not
+  // look the same — the same rule as `lanes: none yet` and `used 0/20`.
+  //
+  // And it is still a delta of an ACCOUNT-WIDE window, not a private meter: a
+  // second terminal moves it too.
+  try {
+    const projectDir =
+      (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
+    const led = ledger(projectDir, String(d.session_id || d.sessionId || ""));
+    const w = led && led.five_hour;
+    if (w && typeof w.last === "number" && typeof w.baseline === "number") {
+      const used = Math.max(0, (w.accumulated || 0) + Math.max(0, w.last - w.baseline));
+      line += " · ucs " + used + "%";
+    }
+  } catch (_) {}
+
+  // Wiki freshness tier (computed on read from wiki-meta.json — zero model
+  // tokens; the manifest is written only by `orc wiki sync`). Fail-silent: no
+  // wiki / no git / any error → no segment. Thresholds mirror the config
+  // defaults (wiki_fresh_max 10 / wiki_aging_max 30); the hook can't read the
+  // resolved config, so a user override shifts skill behavior, not this label.
+  //
+  // The git distance rides in the SAME throttled scan as everything on line 2
+  // (v1.3.0 W0). It used to be an `execSync` on every render — one child
+  // process PER KEYSTROKE in any repo with a wiki, which is the exact hazard
+  // the throttle exists to prevent. The ledger caches the RAW facts (a commit
+  // count, a boolean) and never the word: `fresh` / `AGING` / `STALE` is
+  // computed here, on read, every time.
+  try {
+    const fs = require("fs");
+    const path = require("path");
+    const projectDir =
+      (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
+    // A layout that names no wiki component performs ZERO wiki reads — not a
+    // cheaper one, none. This is the read planner's whole point.
+    if (!wants("wiki.tier") && !wants("wiki.distance")) throw new Error("not needed");
+    const led = ledger(projectDir, String(d.session_id || d.sessionId || ""));
+    const now = Date.now();
+    // A wiki tier does not move in five seconds. Per-provider TTL replaces the
+    // single global throttle for everything but the trace scan, which is the
+    // one thing that really does move that fast.
+    if (scanStale(led.wiki && led.wiki.scanned_at, now, TTL.wiki)) {
+      const w = { unregistered: false, distance: null, scanned_at: now };
+      const metaPath = path.join(projectDir, ".claude", "orc", "wiki-meta.json");
+      if (!fs.existsSync(metaPath)) {
+        // Docs but no manifest = UNREGISTERED: a real wiki nothing has indexed
+        // (usually a scan stopped at a 5-area pause). It is otherwise invisible
+        // — consumers and `orc crosslink` read the manifest — so surface it
+        // here, with the free fix. Never say "no wiki": these docs are already
+        // paid for.
+        const wikiDir = path.join(projectDir, "wiki");
+        w.unregistered =
+          fs.existsSync(wikiDir) &&
+          fs.readdirSync(wikiDir).some((f) => f.startsWith("orc-") && f.endsWith(".md"));
+      } else {
+        const meta = JSON.parse(fs.readFileSync(metaPath, "utf8"));
+        if (meta && meta.scan_commit) {
+          // A FAILED probe is a fact, and it is cached like any other. No git,
+          // a detached commit, a timeout — without this inner catch the whole
+          // block aborts before the ledger is stamped, and the subprocess runs
+          // again on the very next keystroke. The segment stays absent either
+          // way; what changes is that it costs nothing to stay absent.
+          try {
+            const { execSync } = require("child_process");
+            const n = parseInt(
+              execSync(`git rev-list --count ${meta.scan_commit}..HEAD`, {
+                cwd: projectDir,
+                timeout: 3000,
+                stdio: ["ignore", "pipe", "ignore"],
+              })
+                .toString()
+                .trim(),
+              10
+            );
+            if (Number.isFinite(n)) w.distance = n;
+          } catch (_) {}
+        }
+      }
+      led.wiki = w;
+    }
+    const w = led.wiki;
+    if (w) {
+      SCAN.wiki = {
+        distance: typeof w.distance === "number" ? w.distance : null,
+        tier: w.unregistered
+          ? "unregistered"
+          : typeof w.distance !== "number"
+            ? null
+            : w.distance > 30
+              ? "stale"
+              : w.distance >= 10
+                ? "aging"
+                : "fresh",
+      };
+    }
+    if (w && w.unregistered) line += " · wiki: UNREGISTERED (run `orc wiki sync`)";
+    else if (w && typeof w.distance === "number") {
+      if (w.distance >= 10 && w.distance <= 30) line += ` · wiki: AGING (${w.distance}c)`;
+      else if (w.distance > 30) line += ` · wiki: STALE (${w.distance}c)`;
+      else line += " · wiki: fresh";
+    }
+  } catch (_) {}
+
+  // orc-diy gate segment (only when a flow exists). Recomputes the same
+  // staleness checks as `orc diy status` from flow.lock.json — written only
+  // by the `orc diy` CLI. Fail-silent: any error → no segment.
+  try {
+    const fs = require("fs");
+    const path = require("path");
+    const crypto = require("crypto");
+    const projectDir =
+      (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
+    if (!wants("diy.state") && !wants("diy.name") && !wants("diy.tier_state"))
+      throw new Error("not needed");
+    const lockPath = path.join(projectDir, ".claude", "orc", "diy", "flow.lock.json");
+    if (fs.existsSync(lockPath)) {
+      const lock = JSON.parse(
+        fs.readFileSync(lockPath, "utf8").replace(/^\uFEFF/, "")
+      );
+      const sha = (p) =>
+        crypto.createHash("sha256").update(fs.readFileSync(p, "utf8")).digest("hex");
+      const cfgPath = path.join(projectDir, ".claude", "orc-diy.config.yaml");
+      const compiledPath = path.join(projectDir, ".claude", "orc", "diy", "FLOW-COMPILED.md");
+      let installedV = null;
+      try {
+        installedV = JSON.parse(
+          fs.readFileSync(path.join(__dirname, "orc-version.json"), "utf8")
+        ).version;
+      } catch (_) {}
+      const ready =
+        lock.compiled_hash &&
+        fs.existsSync(cfgPath) &&
+        lock.config_hash === sha(cfgPath) &&
+        fs.existsSync(compiledPath) &&
+        lock.compiled_hash === sha(compiledPath) &&
+        (!installedV || lock.orc_version === installedV);
+      let seg = `diy:${lock.flow_name || "flow"} ${ready ? "READY" : "STALE→recompile"}`;
+      // Model half of the compiled session_tier — warn-only (hooks can't block on
+      // model). Keyed by the slug's MODEL part, so the full tier grid (sonnet-4-6,
+      // opus-4-7, opus-4-8, fable-5 at any effort) is covered without enumerating
+      // every effort slug.
+      if (ready && modelKnown && lock.session_tier) {
+        const modelPart = String(lock.session_tier).replace(/-(med|high|xhigh|max)$/, "");
+        const want = {
+          "sonnet-4-6": /sonnet[\s._-]?4[\s._-]?6\b/,
+          "opus-4-7": /opus[\s._-]?4[\s._-]?7\b/,
+          "opus-4-8": /opus[\s._-]?4[\s._-]?8\b/,
+          "opus-5": /opus[\s._-]?5\b/,
+          "fable-5": /fable[\s._-]?5\b/,
+        }[modelPart];
+        if (want && !want.test(hay)) seg += ` ⛔model≠${lock.session_tier}`;
+      }
+      line += " · " + seg;
+    }
+  } catch (_) {}
+
+  // Append an update hint from the cache (instant, no network here).
+  if (updater) {
+    try {
+      const nudge = updater.readCachedNudge(updater.installedVersion(__dirname));
+      if (nudge) line += " · " + nudge;
+    } catch (_) {}
+  }
+
+  // The branch is its OWN provider: `.git/HEAD` with no subprocess, on a
+  // different clock from the trace scan, and a layout that shows a branch and
+  // nothing else must not pay for a trace scan to get it.
+  if (wantsProvider("scan.git")) {
+    try {
+      const projectDir =
+        (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
+      SCAN.branch = gitBranch(projectDir) || null;
+    } catch (_) {}
+  }
+
+  // The extended scan (v1.3.0 W3). Only a composed layout can reach it, and
+  // only for the providers its own lock names.
+  extendedScan(d, wants, wantsProvider);
+  // The sparkline series, sampled during the scan that already ran.
+  sampleSeries(d, PLAN);
+
+  // ── Session line (v1.2.0) ──────────────────────────────────────────────────
+  // Line 1 answers "what tier am I on and how full is the window". This second
+  // line answers "what has this session actually been DOING" — how many agents
+  // it spawned, which lanes ran, whether work can leave Claude, and how long it
+  // has been going. All of it is read from disk; none of it costs a model call.
+  //
+  // The dispatch count is the one that earns its place. v1.2.0 exists because a
+  // retry cloned a live agent three times over and nothing surfaced it. A count
+  // that says `7 (2 running)` makes that visible from the status bar.
+  //
+  // Fail-silent and THROTTLED: the statusline re-renders on every keystroke, so
+  // the trace scan runs at most every 5s and its answer is cached in the same
+  // per-session ledger. Any error → no second line, never a broken one.
+  let line2 = "";
+  try {
+    const fs = require("fs");
+    const path = require("path");
+    const projectDir =
+      (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
+    const led = ledger(projectDir, String(d.session_id || d.sessionId || ""));
+
+    // The hook cannot read the RESOLVED config — that is the lane resolver's
+    // job, and a hook has no lane — so this reads the two raw keys it needs
+    // straight from the file and takes the documented default
+    // otherwise — the same caveat the wiki segment above already carries. A
+    // user override shifts skill behaviour; this label follows the file.
+    let logRel = ".claude/orc/logs";
+    let extraOn = false;
+    try {
+      const raw = fs.readFileSync(path.join(projectDir, ".claude", "orc.config.yaml"), "utf8");
+      const ld = /^[ \t]*log_dir:[ \t]*["']?([^"'#\r\n]+)/m.exec(raw);
+      if (ld) logRel = ld[1].trim();
+      extraOn = /^[ \t]*extra_enabled:[ \t]*true[ \t]*$/m.test(raw);
+    } catch (_) {}
+
+    const now = Date.now();
+    if (!wantsProvider("scan.trace")) throw new Error("not needed");
+    if (scanStale(led.dispatch && led.dispatch.scanned_at, now, TTL.trace)) {
+      const logDir = path.isAbsolute(logRel) ? logRel : path.join(projectDir, logRel);
+      const sessionFloor = Math.floor((led.started_at || 0) / 1000) * 1000;
+      let spawns = 0;
+      let running = 0;
+      const lanes = [];
+      // The ACTIVE run, for `status:` (v1.2.1). `.current` is the pointer the
+      // lanes and the trace hook both write, so it — not "the newest file" — is
+      // what names the run in progress. A pointer naming a file that is not
+      // there answers nothing, and a pointer nobody deleted is not a run: the
+      // resolver's own staleness gate settles that from the trace's last line.
+      let activeFile = null;
+      try {
+        const cur = fs.readFileSync(path.join(logDir, ".current"), "utf8").trim();
+        if (cur) activeFile = cur;
+      } catch (_) {}
+      let phase = null;
+      try {
+        for (const f of fs.readdirSync(logDir)) {
+          if (!f.startsWith("run-") || !f.endsWith(".txt")) continue;
+          const full = path.join(logDir, f);
+          let st;
+          try { st = fs.statSync(full); } catch (_) { continue; }
+          const active = f === activeFile;
+          // Only traces touched since this session began count towards the
+          // session's SPEND — a trace from last week is not this session's.
+          // The ACTIVE run is exempt from that filter: `status:` answers "what
+          // is ORC doing", which has nothing to do with who paid for it, and a
+          // run already going when this session opened would otherwise be
+          // invisible until it happened to write its next line. Its own
+          // staleness gate decides whether it is still running.
+          if (!active && st.mtimeMs < (led.started_at || 0)) continue;
+          const text = fs.readFileSync(full, "utf8");
+          // Count by the trace's OWN line timestamps, not the file's mtime. A
+          // run that was already going when this session started shares its
+          // file with the session before it, and mtime cannot tell the two
+          // apart — it would attribute the whole file to whoever looked last.
+          let mine = 0;
+          for (const raw of text.split("\n")) {
+            const t = /^\[(\d{2})(\d{2})(\d{2}) (\d{2}):(\d{2}):(\d{2})/.exec(raw);
+            if (!t) continue;
+            if (raw.indexOf("] hook") === -1 || raw.indexOf(" SPAWN ") === -1) continue;
+            const at = new Date(
+              2000 + Number(t[3]), Number(t[2]) - 1, Number(t[1]),
+              Number(t[4]), Number(t[5]), Number(t[6])
+            ).getTime();
+            // Trace stamps have SECOND resolution and started_at has
+            // milliseconds, so a dispatch in the same second as the
+            // session start compares as earlier than it. Floor the
+            // boundary to the second the trace could actually express.
+            if (at >= sessionFloor) mine += 1;
+          }
+          spawns += mine;
+          // The phase comes off the text this loop already read — one more
+          // regex pass, no second file read.
+          if (active) {
+            const lm = /^run-([a-z0-9-]+?)-.+-\d{6}-\d{6}\.txt$/.exec(f);
+            if (lm) phase = resolvePhase(lm[1], text);
+          }
+          let openHere = 0;
+          try {
+            const pend = JSON.parse(fs.readFileSync(full + ".pending.json", "utf8"));
+            if (Array.isArray(pend)) openHere = pend.length;
+          } catch (_) {}
+          running += openHere;
+          // A lane earns its name by having actually dispatched in this
+          // session — listing a lane that contributed nothing is noise.
+          if (mine > 0 || openHere > 0) {
+            const m = /^run-([a-z0-9-]+?)-.+-\d{6}-\d{6}\.txt$/.exec(f);
+            if (m && lanes.indexOf(m[1]) === -1) lanes.push(m[1]);
+          }
+        }
+      } catch (_) {}
+      led.dispatch = { spawns, running, lanes, phase, scanned_at: now };
+      // MTok rides in the same throttled pass, and reads only the bytes the
+      // transcript has grown by since the last one.
+      led.tok = scanTokens(led, d.transcript_path || null);
+    }
+
+    const dsp = led.dispatch || { spawns: 0, running: 0, lanes: [], phase: null };
+    // The composed layout reads THESE — the same numbers the shipped line
+    // below prints, from the same scan.
+    SCAN.spawns = dsp.spawns || 0;
+    SCAN.running = dsp.running || 0;
+    SCAN.lanes = dsp.lanes || [];
+    SCAN.phase = dsp.phase || null;
+    SCAN.extra_enabled = !!extraOn;
+    const parts = [];
+    // `status:` leads, because what ORC is doing right now is the one thing on
+    // this line that changes minute to minute. It is also the ONE segment
+    // allowed to vanish: a phase the disk cannot prove is hidden rather than
+    // guessed, and the glyph goes with it. It replaces v1.2.0's `lanes:` list —
+    // the running lane is its first word, and `orc stats` / `orc run list`
+    // still hold the whole session's history.
+    if (dsp.phase && dsp.phase.label)
+      parts.push(
+        motifFrame(dsp.phase.kind) + " status: " + dsp.phase.lane + " · " + dsp.phase.label
+      );
+    // `running` is never hidden, because an agent still in flight is the thing
+    // a user most needs to see (v1.2.0). Zero is simply not printed.
+    parts.push(
+      "agents " + dsp.spawns + (dsp.running ? " (" + dsp.running + " running)" : "")
+    );
+    parts.push("orc-extra: " + (extraOn ? "on" : "off"));
+    if (led.started_at)
+      parts.push("Dur " + Math.max(0, Math.round((now - led.started_at) / 60000)) + "m");
+    // MTok keeps its slot in every state. An em dash says "not measured"; a `0`
+    // would say the session was free, and that is a different claim.
+    parts.push("MTok " + (fmtTokens(led.tok) || "—"));
+    if (SCAN.branch) parts.push(SCAN.branch);
+    line2 = "   " + parts.join(" · ");
+  } catch (_) {
+    line2 = "";
+  }
+
+  // ONE write, after every block that touches the ledger has had its say. It is
+  // last on purpose: a render that throws half way through still prints, and a
+  // ledger that could not be written never takes the status line down with it.
+  ledgerFlush();
+
+  // ── THE CUSTOM LAYOUT (v1.3.0) ──────────────────────────────────────────
+  // Everything above is the SHIPPED status line, and it is what renders unless
+  // the user composed their own. `custom()` returns null in every state but
+  // one, and each of its gates is a FALLBACK rather than a throw: a hook cannot
+  // refuse, so a bad layout must degrade to something correct rather than paint
+  // garbage. The ladder is documented on the function itself.
+  const composed = custom(d, {
+    payload: d,
+    ledger: LED || {},
+    scan: SCAN,
+    derived: { verdict, reasons, version: ver },
+    now: Date.now(),
+  });
+  if (composed != null) {
+    process.stdout.write(composed);
+    return;
+  }
+
+  process.stdout.write(line2 ? line + "\n" + line2 : line);
+});
+
+// ── The six-rung gate ladder ────────────────────────────────────────────────
+// In order, and EVERY RUNG IS A FALLBACK, never a throw:
+//
+//   1  statusline_custom is not `on`        the shipped lines. BYTE-IDENTICAL.
+//   2  statusline-compiled.json missing /   default + statusline-layout-unreadable
+//      unparseable / schema mismatch
+//   3  orc_version or catalog_hash moved    default + statusline-layout-stale
+//   4  an unknown op or an unknown binding  default + statusline-layout-skew
+//   5  the cheap shape guard fails          default + statusline-layout-invalid
+//   6  otherwise                            run the program
+//
+// Rungs 3 and 4 are why the lock file exists. Rung 5 is this hook RE-CHECKING
+// rather than trusting the file, because a hand-edited compiled file is a file
+// nobody validated. Every fallback RECORDS ITSELF in the ledger so `orc doctor`
+// can name it: a status line that quietly went back to the default and never
+// said why is a bug the user cannot report.
+function custom(d, ctx) {
+  try {
+    const fs = require("fs");
+    const path = require("path");
+    const projectDir =
+      (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
+    const orcDir = path.join(projectDir, ".claude", "orc");
+
+    // Rung 1. The hook cannot resolve config — that is the lane resolver's job,
+    // and a hook has no lane — so it reads the raw key off the file and takes
+    // the documented default otherwise, exactly as it already does for
+    // `log_dir` and `extra_enabled`.
+    let on = false;
+    try {
+      const raw = fs.readFileSync(path.join(projectDir, ".claude", "orc.config.yaml"), "utf8");
+      // The trailing \r is tolerated on purpose: a config file written on
+      // Windows carries CRLF, and a $-anchored match silently never fires
+      // there — which is a feature that is ON in the file and OFF on the bar.
+      on = /^[ \t]*statusline_custom:[ \t]*["']?on["']?[ \t]*\r?$/m.test(raw);
+    } catch (_) {}
+    if (!on) return null;
+
+    // Rung 2. THE HOOK NEVER READS THE AUTHORED LAYOUT — not as a fallback, not
+    // on a cache miss, not ever. One consumer per file.
+    let prog = null;
+    try {
+      prog = JSON.parse(fs.readFileSync(path.join(orcDir, "statusline-compiled.json"), "utf8"));
+    } catch (_) {}
+    if (!prog || prog.schema !== 1) return slFallback(orcDir, "statusline-layout-unreadable");
+
+    // Rung 3. An ORC upgrade that adds, removes or changes a component
+    // invalidates every compiled layout on the machine. Better the shipped
+    // lines than a program compiled against a catalogue that no longer exists.
+    let lock = null;
+    try {
+      lock = JSON.parse(fs.readFileSync(path.join(orcDir, "statusline.lock.json"), "utf8"));
+    } catch (_) {}
+    let installed = null;
+    try {
+      installed = JSON.parse(fs.readFileSync(path.join(__dirname, "orc-version.json"), "utf8")).version;
+    } catch (_) {}
+    if (!lock || (installed && lock.orc_version !== installed))
+      return slFallback(orcDir, "statusline-layout-stale");
+
+    const engine = require("./orc-statusline-render.js");
+
+    // Rung 4. A binding this build does not have is an INSTALL SKEW, not a
+    // rendering problem, and it must not be papered over one item at a time.
+    for (const b of lock.bindings || []) {
+      if (!engine.BINDINGS[b]) return slFallback(orcDir, "statusline-layout-skew");
+    }
+
+    // Rung 5. The cheap shape guard: at most three lines, at most `max_per_line`
+    // components on any of them, and the dense-prefix rule —
+    // A line may hold a component only if every line above it holds at least one.
+    //
+    // THE CAP AND THE COUNTING RULE ARE BOTH THE COMPILER'S (v1.4.2). This held
+    // its own `5` and counted EVERY item op, so it disagreed with the validator
+    // twice: it bounced a legal six-part line, and it bounced a legal five plus
+    // a spacer. Both fell silently back to the shipped lines with the reason
+    // only in a ledger file, which reads exactly like "my sixth part reset the
+    // bar to the default". The cap rides on the lock (already gated on
+    // `orc_version` at rung 3, so a stale copy cannot outlive its build) and
+    // the compiler marks a structural op `s` — this cannot know that on its
+    // own, because a compiled op carries an INSTANCE id and never a type.
+    if (!Array.isArray(prog.lines) || prog.lines.length > 3)
+      return slFallback(orcDir, "statusline-layout-invalid");
+    const cap = Number(lock.max_per_line) > 0 ? Number(lock.max_per_line) : 6;
+    let seenEmpty = false;
+    for (const l of prog.lines) {
+      const ops = (l.ops || []).filter((o) => o.op === "item");
+      if (ops.filter((o) => !o.s).length > cap) return slFallback(orcDir, "statusline-layout-invalid");
+      if (ops.length === 0) seenEmpty = true;
+      else if (seenEmpty) return slFallback(orcDir, "statusline-layout-invalid");
+    }
+
+    // Rung 6. Run the program. Failure isolation lives inside the engine: one
+    // throwing item emits its unknown form and the rest of the line survives.
+    SCAN.preset = prog.preset || null;
+    const out = engine.render(prog, {
+      payload: ctx.payload,
+      ledger: ctx.ledger,
+      scan: ctx.scan,
+      derived: ctx.derived,
+      now: ctx.now,
+      cols: Number(process.env.COLUMNS) || 0,
+      env: process.env,
+    });
+    if (out.errors && out.errors.length) slNote(orcDir, "statusline-item-failed", out.errors[0]);
+    return out.text;
+  } catch (_) {
+    // Even the ladder must not throw. A status line that crashes is a status
+    // line that is simply absent, with no way to find out why.
+    return null;
+  }
+}
+
+// A fallback RECORDS ITSELF. `orc doctor` reads this file and names the finding
+// with the exact command that clears it.
+function slFallback(orcDir, finding) {
+  slNote(orcDir, finding, null);
+  return null;
+}
+function slNote(orcDir, finding, detail) {
+  try {
+    const fs = require("fs");
+    const path = require("path");
+    fs.mkdirSync(orcDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(orcDir, "statusline-state.json"),
+      JSON.stringify({ finding, detail: detail || null, at: Date.now() }) + "\n"
+    );
+  } catch (_) {}
+}
+
+// ── THE EXTENDED SCAN (v1.3.0 W3) ──────────────────────────────────────────
+// Groups D, E, F and G — knowledge, extra, flow and the health gates. Every one
+// of them is a `new read`: a read that does not exist in the shipped status
+// line and only happens when a layout asks for it.
+//
+// THE BAR IS 15 MILLISECONDS, NOT 300. W0 measured node startup at ~285 ms of a
+// 300 ms budget, so a component here has to be answerable from a small JSON
+// file, on its own clock, or it does not ship. Two are refused for that reason
+// and say so in the catalogue.
+//
+// Every read below is:
+//   - gated on a BINDING the compiled lock names (the read planner);
+//   - cached in the per-session ledger under its own key;
+//   - given its OWN TTL, because a pact ledger and a spend log do not move at
+//     the same rate.
+//
+// A read that throws leaves its slot null, and a null renders an em dash.
+// UNKNOWN IS NOT ZERO — a `0` would say the thing was measured and found empty.
+function extendedScan(d, wants, wantsProvider) {
+  if (!wantsProvider("scan.extended")) return;
+  let fs, path, projectDir, led, now;
+  try {
+    fs = require("fs");
+    path = require("path");
+    projectDir = (d.workspace && d.workspace.project_dir) || d.cwd || process.cwd();
+    led = ledger(projectDir, String(d.session_id || d.sessionId || ""));
+    now = Date.now();
+  } catch (_) {
+    return;
+  }
+  const orc = path.join(projectDir, ".claude", "orc");
+  const readJson = (p) => {
+    try {
+      return JSON.parse(fs.readFileSync(p, "utf8").replace(/^/, ""));
+    } catch (_) {
+      return null;
+    }
+  };
+  // One cached sub-scan. `key` is its ledger slot, `ttl` its own clock.
+  const cached = (key, ttl, fn) => {
+    const slot = led.ext && led.ext[key];
+    if (slot && !scanStale(slot.at, now, ttl)) return slot.v;
+    let v = null;
+    try {
+      v = fn();
+    } catch (_) {
+      v = null;
+    }
+    led.ext = led.ext || {};
+    led.ext[key] = { v, at: now };
+    return v;
+  };
+
+  // ── Group D — knowledge. All of it comes out of wiki-meta.json, which is
+  //    written ONLY by `orc wiki sync` and is 100% doc-header-derived. A wiki
+  //    tier does not move in a minute, so the TTL is generous.
+  if (wants("wiki.docs")) {
+    const w = cached("wiki_meta", TTL.wiki, () => {
+      const meta = readJson(path.join(orc, "wiki-meta.json"));
+      if (!meta) return null;
+      const docs = Array.isArray(meta.docs) ? meta.docs : [];
+      return {
+        docs: docs.length,
+      };
+    });
+    SCAN.wiki_meta = w;
+  }
+  if (wants("pattern.state")) {
+    // EXISTENCE only, and by the deterministic probe's own rule: the cache
+    // lives under the hidden .claude/ dir, so a raw filesystem search
+    // false-negatives from the wrong cwd.
+    SCAN.pattern = cached("pattern", TTL.knowledge, () => {
+      const dir = path.join(orc, "patterns");
+      try {
+        return fs.readdirSync(dir).some((f) => f.endsWith("-pattern.md")) ? "cached" : "none";
+      } catch (_) {
+        return "none";
+      }
+    });
+  }
+  if (wants("crosslink.state") || wants("crosslink.peers")) {
+    const c = cached("crosslink", TTL.knowledge, () => {
+      const raw = (() => {
+        try {
+          return fs.readFileSync(path.join(projectDir, ".claude", "orc-crosslink.config.yaml"), "utf8");
+        } catch (_) {
+          return null;
+        }
+      })();
+      if (!raw) return null;
+      const n = (raw.match(/^[ \t]*-[ \t]*name:/gm) || []).length;
+      return { peers: n, state: n ? "linked" : "none" };
+    });
+    SCAN.crosslink = c;
+  }
+  if (wants("gotchas.count")) {
+    SCAN.gotchas = cached("gotchas", TTL.knowledge, () => {
+      try {
+        return fs.readdirSync(path.join(orc, "gotchas")).filter((f) => f.endsWith(".md")).length;
+      } catch (_) {
+        return null;
+      }
+    });
+  }
+  // The code graph (v1.8.0). A FLOOR, exactly like the wiki row: the commit the
+  // index was built at against HEAD, both read from disk with no subprocess.
+  // `behind` means HEAD moved — never that files changed, which only
+  // `orc graph status` can see. The key is read off the raw file, because a hook
+  // has no lane and cannot resolve config (the `statusline_custom` answer).
+  if (wants("graph.state")) {
+    SCAN.graph = cached("graph", TTL.knowledge, () => {
+      let raw = "";
+      try {
+        raw = fs.readFileSync(path.join(projectDir, ".claude", "orc.config.yaml"), "utf8");
+      } catch (_) {}
+      if (!/^[ \t]*code_graph:[ \t]*["']?on["']?[ \t]*\r?$/m.test(raw)) return { state: "off" };
+      const meta = readJson(path.join(orc, "graph", "meta.json"));
+      if (!meta) return { state: "none" };
+      const head = gitHeadCommit(projectDir);
+      if (!head || !meta.head_commit) return null;
+      return { state: head === meta.head_commit ? "fresh" : "behind" };
+    });
+  }
+
+  // ── Group E — extra. `extra.json` is small; the SPEND LOG is not, so it is
+  //    read by TAIL and on its own faster clock, because a spend log is the one
+  //    thing here that moves during a wave.
+  if (wants("extra.profile") || wants("extra.provider") || wants("extra.inflight") || wants("extra.passphrase") || wants("extra.demoted")) {
+    SCAN.extra = cached("extra", TTL.extra, () => {
+      const j = readJson(path.join(orc, "extra.json"));
+      if (!j) return null;
+      const profiles = j.profiles || {};
+      const names = Object.keys(profiles);
+      const first = names.length ? profiles[names[0]] : null;
+      return {
+        profile: names.length ? names[0] : null,
+        provider: first && first.provider ? first.provider : null,
+        profiles: names.length,
+      };
+    });
+  }
+  if (wants("extra.spend") || wants("extra.tasks")) {
+    SCAN.extra_spend = cached("extra_spend", TTL.extra, () => {
+      // The tail only. A spend log grows for the life of a project and reading
+      // all of it on a per-keystroke surface is the hazard this whole subsystem
+      // is shaped around.
+      const p = path.join(orc, "extra-spend.jsonl");
+      let st;
+      try {
+        st = fs.statSync(p);
+      } catch (_) {
+        return null;
+      }
+      const want = Math.min(st.size, 64 * 1024);
+      const buf = Buffer.alloc(want);
+      const fd = fs.openSync(p, "r");
+      try {
+        fs.readSync(fd, buf, 0, want, st.size - want);
+      } finally {
+        fs.closeSync(fd);
+      }
+      const lines = buf.toString("utf8").split("\n").slice(1).filter(Boolean);
+      let tasks = 0;
+      let usd = 0;
+      let priced = false;
+      for (const l of lines) {
+        try {
+          const r = JSON.parse(l);
+          tasks++;
+          if (typeof r.usd === "number") {
+            usd += r.usd;
+            priced = true;
+          }
+        } catch (_) {}
+      }
+      // A cost figure ORC did not price itself is never printed: `usd` stays
+      // null rather than becoming a confident 0.
+      return { tasks, usd: priced ? usd : null, partial: st.size > want };
+    });
+  }
+
+  // ── Group F — flow and lanes. The diy lock is already read for the shipped
+  //    segment; `wait` is a small run-state file.
+  if (wants("wait.state")) {
+    SCAN.wait = cached("wait", TTL.run, () => {
+      const j = readJson(path.join(orc, "wait.json"));
+      if (!j) return "none";
+      if (j.block_reason) return "blocked";
+      return j.until || j.hops ? "waiting" : "none";
+    });
+  }
+  // `preset.name` is NOT read here: it rides in the compiled program, which is
+  // the only file that crosses the wall. The hook never opens the authored
+  // layout, and a field being convenient is not an exception to that.
+
+  // ── Group C remainder — the run's own progress, from RESUME.md, which is the
+  //    ONE line `orc resume` and `orc run list` parse. Reading the same line is
+  //    how a listing never has to open a checkpoint.
+  if (wants("run.wave") || wants("run.wave_total") || wants("run.resume") || wants("run.open")) {
+    SCAN.runs = cached("runs", TTL.run, () => {
+      let logRel = ".claude/orc/logs";
+      try {
+        const raw = fs.readFileSync(path.join(projectDir, ".claude", "orc.config.yaml"), "utf8");
+        const m = /^[ \t]*run_dir:[ \t]*["']?([^"'#\r\n]+)/m.exec(raw);
+        if (m) logRel = m[1].trim();
+      } catch (_) {}
+      const runDir = path.isAbsolute(logRel) ? logRel : path.join(projectDir, ".claude", "orc", "run");
+      let open = 0;
+      let wave = null;
+      let waves = null;
+      try {
+        for (const slug of fs.readdirSync(runDir)) {
+          const rp = path.join(runDir, slug, "RESUME.md");
+          if (!fs.existsSync(rp)) continue;
+          if (fs.existsSync(path.join(runDir, slug, "closed.json"))) continue;
+          open++;
+          // The byte-stable `Where it stands:` line, at column 0. It is the one
+          // line two other commands already parse, which is exactly why this
+          // does not open a checkpoint.
+          const m = /^Where it stands:.*wave (\d+) of (\d+)/m.exec(fs.readFileSync(rp, "utf8"));
+          if (m && wave == null) {
+            wave = Number(m[1]);
+            waves = Number(m[2]);
+          }
+        }
+      } catch (_) {
+        return null;
+      }
+      return { open, wave, waves, resume: open > 0 ? "waiting" : "none" };
+    });
+  }
+
+  // ── Group G — the health gates. Each is one small ledger, each on the slow
+  //    clock: a pact does not drift between keystrokes.
+  const gate = (key, file, fn) => {
+    if (!wants(key)) return null;
+    return cached(key.replace(/\./g, "_"), TTL.gates, () => fn(readJson(path.join(orc, file))));
+  };
+  SCAN.pact = gate("pact.state", "pact.json", (j) => {
+    if (!j || !Array.isArray(j.entries)) return null;
+    const live = j.entries.filter((e) => e.state !== "retired");
+    const broken = live.filter((e) => e.state === "broken").length;
+    const drifted = live.filter((e) => e.state === "drifted").length;
+    // UNCHECKABLE is the honest state and it never reads as a failure.
+    return { state: broken ? "broken" : drifted ? "drifted" : "holding", drifted, broken, total: live.length };
+  });
+  SCAN.boundary = gate("boundary.state", "boundary.json", (j) => {
+    if (!j || !Array.isArray(j.cards)) return null;
+    const refused = j.cards.filter((c) => c.verdict === "REFUSE").length;
+    // An area with no card is UNKNOWN, never assumed safe.
+    return { state: refused ? "refused" : "clear", refused, cards: j.cards.length };
+  });
+  SCAN.challenge = gate("challenge.state", "challenge.json", (j) => {
+    if (!j) return null;
+    const open = Array.isArray(j.findings) ? j.findings.filter((f) => !f.resolved).length : 0;
+    return { state: j.state || (open ? "open" : "pass"), open, iteration: j.iteration || null };
+  });
+  SCAN.doc = gate("doc.state", "doc.json", (j) => {
+    if (!j) return null;
+    const outline = Array.isArray(j.outline) ? j.outline : [];
+    const done = outline.filter((s) => s.hash).length;
+    return { state: j.shipped ? "shipped" : "draft", done, total: outline.length };
+  });
+
+  // `usage-gate` reads the usage bridge this hook already writes — so it is the
+  // cheapest `new read` in the set, and it is the only one that can say
+  // `unknown`, which is a real answer and never a stop.
+  if (wants("usage.state")) {
+    SCAN.usage = cached("usage", TTL.trace, () => {
+      const j = readJson(path.join(orc, "usage.json"));
+      if (!j || !j.written_at) return "unknown";
+      if (now - j.written_at > 30 * 60 * 1000) return "unknown";
+      const w = [j.five_hour, j.seven_day].filter(Boolean).map((x) => x.used_percentage);
+      if (!w.length) return "unknown";
+      return Math.max(...w) >= 90 ? "low" : "ok";
+    });
+  }
+
+  // A config key as a component. The config file is edited by hand, so 30s.
+  if (wants("config.value")) {
+    SCAN.config_raw = cached("config", TTL.config, () => {
+      try {
+        return fs.readFileSync(path.join(projectDir, ".claude", "orc.config.yaml"), "utf8");
+      } catch (_) {
+        return null;
+      }
+    });
+  }
+}
+
+// ── THE SERIES LEDGER (v1.3.0 W3) ──────────────────────────────────────────
+// `spark`, `spark-braille`, `trend` and `delta` need history, and a status line
+// has none: it is a fresh process every render. So the LAST 16 SAMPLES per
+// series live in the per-session ledger, appended during the throttled scan
+// that already ran.
+//
+// NO NEW READ, NO NEW TIMER. Every value sampled here was already computed for
+// something else this render; the series is a side effect of the scan, never a
+// reason for one.
+//
+// SIXTEEN, and only for the series a compiled layout actually names — the read
+// planner again. A series nothing binds is not kept, so the ledger does not
+// grow for a user whose layout has no sparkline on it.
+const SERIES_MAX = 16;
+const SERIES_MIN_GAP_MS = 20000;
+
+function sampleSeries(d, plan) {
+  try {
+    if (!plan || !plan.series || !plan.series.size) return;
+    const led = LED;
+    if (!led) return;
+    const now = Date.now();
+    // A sample every 20 seconds, not every render. Sixteen samples at the
+    // render rate would be five seconds of history, which is not history — it
+    // is the same number sixteen times.
+    if (led.series_at && now - led.series_at < SERIES_MIN_GAP_MS) return;
+    led.series_at = now;
+    led.series = led.series || {};
+    const push = (key, v) => {
+      if (!plan.series.has(key)) return;
+      if (typeof v !== "number" || !Number.isFinite(v)) return;
+      const arr = led.series[key] || [];
+      arr.push(Math.round(v));
+      while (arr.length > SERIES_MAX) arr.shift();
+      led.series[key] = arr;
+    };
+    const rl = d.rate_limits || {};
+    const w = led.five_hour;
+    push("quota5h", rl.five_hour && rl.five_hour.used_percentage);
+    push("quotawk", rl.seven_day && rl.seven_day.used_percentage);
+    push("ucs", w && typeof w.last === "number" && typeof w.baseline === "number"
+      ? Math.max(0, (w.accumulated || 0) + Math.max(0, w.last - w.baseline))
+      : null);
+    const tok = led.tok;
+    if (tok) {
+      push("mtok", (tok.input || 0) + (tok.cache_write || 0) + (tok.cache_read || 0) + (tok.output || 0));
+      push("mtokkind", tok.cache_read || 0);
+    }
+    push("agents", SCAN.spawns);
+    push("cost", d.cost && d.cost.total_cost_usd != null ? d.cost.total_cost_usd * 100 : null);
+    push("cachehit", d.prompt_cache && d.prompt_cache.hit_ratio != null
+      ? (d.prompt_cache.hit_ratio <= 1 ? d.prompt_cache.hit_ratio * 100 : d.prompt_cache.hit_ratio)
+      : null);
+    push("cachewrite", d.prompt_cache && d.prompt_cache.cache_write_tokens);
+    push("lines", d.cost && d.cost.total_lines_added != null
+      ? (d.cost.total_lines_added || 0) - (d.cost.total_lines_removed || 0)
+      : null);
+    push("extraspend", SCAN.extra_spend && SCAN.extra_spend.usd != null ? SCAN.extra_spend.usd * 100 : null);
+  } catch (_) {
+    // A series is a nicety. It never takes the status line down with it.
+  }
+}