@deftai/directive-core 0.104.0 → 0.105.0

package/dist/session/session-ready.js

@@ -15,6 +15,7 @@ import { execFileSync } from "node:child_process";
 import { join } from "node:path";
 import { cacheFetchAll } from "../cache/fetch.js";
 import { formatFrameworkCommand } from "../render/framework-commands.js";
+import { applyWorktreeOccupancy, } from "./occupancy.js";
 import { runSessionStart, } from "./session-start.js";
 import { inspectSessionRitual, verifySessionRitual, } from "./verify-session-ritual.js";
 export const SESSION_READY_FAST_PATH = "fast";
@@ -95,6 +96,54 @@ export function runSessionReady(projectRoot, options = {}) {
     const start = options.runStart ?? runSessionStart;
     const fetchAll = options.fetchAll ?? cacheFetchAll;
     const inferRepo = options.inferRepo ?? ((root) => inferSessionReadyRepo(root, env));
+    const applyOccupancy = options.applyOccupancy ?? applyWorktreeOccupancy;
+    const occupancyInput = (write) => ({
+        env,
+        now,
+        steal: options.sessionStartOptions?.steal,
+        confirm: options.sessionStartOptions?.confirm,
+        occupant: options.sessionStartOptions?.occupant,
+        newSessionId: options.sessionStartOptions?.newSessionId,
+        intent: options.sessionStartOptions?.occupancyIntent ?? "mutation",
+        write,
+    });
+    const previewOccupancy = applyOccupancy(projectRoot, occupancyInput(false));
+    if (previewOccupancy.code !== 0) {
+        const message = previewOccupancy.message;
+        lines.push(message);
+        return {
+            code: previewOccupancy.code,
+            message,
+            path: SESSION_READY_FAILED,
+            lines,
+            steps,
+            duration_ms: elapsedMs(started),
+        };
+    }
+    const claimOnSuccess = () => applyOccupancy(projectRoot, occupancyInput(true));
+    const finishReady = (path, message) => {
+        const claimed = claimOnSuccess();
+        if (claimed.code !== 0) {
+            lines.push(claimed.message);
+            return {
+                code: claimed.code,
+                message: claimed.message,
+                path: SESSION_READY_FAILED,
+                lines,
+                steps,
+                duration_ms: elapsedMs(started),
+            };
+        }
+        lines.push(message);
+        return {
+            code: 0,
+            message,
+            path,
+            lines,
+            steps,
+            duration_ms: elapsedMs(started),
+        };
+    };
     const verifyOpts = {
         tier: "gated",
         posture: "mutation",
@@ -127,16 +176,7 @@ export function runSessionReady(projectRoot, options = {}) {
                 duration_ms: elapsedMs(started),
             };
         }
-        const message = "OK session ready (gated ritual already fresh).";
-        lines.push(message);
-        return {
-            code: 0,
-            message,
-            path: SESSION_READY_FAST_PATH,
-            lines,
-            steps,
-            duration_ms: elapsedMs(started),
-        };
+        return finishReady(SESSION_READY_FAST_PATH, "OK session ready (gated ritual already fresh).");
     }
     // --- Ensure quick-tier ritual state when missing / stale / drifted ---
     const quickInspect = inspect(projectRoot, {
@@ -175,16 +215,7 @@ export function runSessionReady(projectRoot, options = {}) {
     steps.push("verify:session-ritual:gated");
     let verifyResult = verify(projectRoot, verifyOpts);
     if (isGatedVerifyActuallyReady(verifyResult)) {
-        const message = "OK session ready (gated ritual verified).";
-        lines.push(message);
-        return {
-            code: 0,
-            message,
-            path: SESSION_READY_VERIFIED,
-            lines,
-            steps,
-            duration_ms: elapsedMs(started),
-        };
+        return finishReady(SESSION_READY_VERIFIED, "OK session ready (gated ritual verified).");
     }
     if (verifyResult.code === 0 && verifyResult.bypassed) {
         const message = bypassedReadyFailure(verifyResult);
@@ -241,16 +272,7 @@ export function runSessionReady(projectRoot, options = {}) {
         steps.push("verify:session-ritual:gated:retry");
         verifyResult = verify(projectRoot, { ...verifyOpts, forceGatedSteps: [] });
         if (isGatedVerifyActuallyReady(verifyResult)) {
-            const message = "OK session ready (recovered via cache refresh).";
-            lines.push(message);
-            return {
-                code: 0,
-                message,
-                path: SESSION_READY_RECOVERED,
-                lines,
-                steps,
-                duration_ms: elapsedMs(started),
-            };
+            return finishReady(SESSION_READY_RECOVERED, "OK session ready (recovered via cache refresh).");
         }
         if (verifyResult.code === 0 && verifyResult.bypassed) {
             const message = bypassedReadyFailure(verifyResult);

package/dist/session/session-start.d.ts

@@ -6,6 +6,7 @@ import { type ProbeScmReadinessOptions, type ScmReadinessReport } from "../scm/r
 import { type ResolveUserMdResult } from "../user-config/resolve-user-md.js";
 import { type DetectHardEffortBudgetInput } from "./effort-budget.js";
 import type { GitRunner } from "./git.js";
+import { type ApplyOccupancyInput, type OccupancyDecision } from "./occupancy.js";
 import { type OrientationBundle, type RunOrientationOptions } from "./orientation-compression.js";
 import { type ReleaseAvailabilityProbeOptions } from "./release-availability.js";
 import { type RitualState, ritualStatePath } from "./ritual-sentinel.js";
@@ -63,6 +64,12 @@ export interface SessionStartOptions {
     readonly writeHistory?: boolean;
     readonly runGit?: GitRunner;
     readonly newSessionId?: () => string;
+    /** #3433: steal the worktree occupancy lease. Requires confirm + occupant. */
+    readonly steal?: boolean;
+    readonly confirm?: boolean;
+    readonly occupant?: string;
+    readonly occupancyIntent?: ApplyOccupancyInput["intent"];
+    readonly applyOccupancy?: (projectRoot: string, input: ApplyOccupancyInput) => OccupancyDecision;
     readonly runTriageWelcome?: (projectRoot: string, options: {
         writeHistory: boolean;
         now: Date;

package/dist/session/session-start.js

@@ -1,4 +1,3 @@
-import { randomUUID } from "node:crypto";
 import { runningInsideDeftRepo } from "../doctor/paths.js";
 import { emitSessionEvalReadback } from "../eval/readback.js";
 import { bindSessionGeneration } from "../freshness/bind.js";
@@ -26,6 +25,7 @@ import { verifyRequiredTools } from "../verify-env/verify-tools.js";
 import { ceremonyDialEvidenceToDict, collectCeremonyDialConsumerEvidence, formatCeremonyDialEvidenceLine, mergeCeremonyDialInputsWithConsumerEvidence, } from "./ceremony-dial-evidence.js";
 import { effortBudgetToDict, maybeFormatEffortBudgetLines, resolveProductionHostEffortDescriptor, } from "./effort-budget.js";
 import { defaultGitRunner, gitHead, gitIsAncestor, worktreePath } from "./git.js";
+import { applyWorktreeOccupancy, } from "./occupancy.js";
 import { runOrientationCompression, } from "./orientation-compression.js";
 import { emitSessionStartProcessCost } from "./process-cost.js";
 import { probeSessionReleaseAvailability, } from "./release-availability.js";
@@ -433,6 +433,46 @@ function resolveEffortBudget(options) {
         };
     }
 }
+function occupancyInput(options, now, write) {
+    return {
+        env: options.env,
+        now,
+        newSessionId: options.newSessionId,
+        steal: options.steal,
+        confirm: options.confirm,
+        occupant: options.occupant,
+        intent: options.occupancyIntent ?? "mutation",
+        write,
+    };
+}
+function runOccupancy(projectRoot, options, now, write) {
+    const apply = options.applyOccupancy ?? applyWorktreeOccupancy;
+    return apply(projectRoot, occupancyInput(options, now, write));
+}
+function occupancyDeniedResult(occupancy, environment) {
+    return {
+        code: occupancy.code,
+        payload: {
+            ready: false,
+            exit_code: occupancy.code,
+            posture: MUTATION_POSTURE,
+            occupancy: {
+                action: occupancy.action,
+                session_id: occupancy.sessionId,
+                occupant_id: occupancy.record?.sessionId ?? null,
+            },
+            environment: environmentContextToDict(environment),
+            message: occupancy.message,
+        },
+        lines: occupancy.message.split("\n"),
+    };
+}
+function persistOccupancyOrDeny(projectRoot, options, now, environment) {
+    const occupancy = runOccupancy(projectRoot, options, now, true);
+    if (occupancy.code !== 0)
+        return occupancyDeniedResult(occupancy, environment);
+    return occupancy;
+}
 function runReadOnlySessionStart(projectRoot, options, instant, environment) {
     const lines = [];
     const resolveUserMd = options.resolveUserMd ?? ((root) => resolveUserMdPath({ projectRoot: root }));
@@ -509,6 +549,10 @@ function runSessionRearm(projectRoot, options, instant, environment) {
             lines: [formatEnvironmentContext(environment), message],
         };
     }
+    const plannedOccupancy = runOccupancy(projectRoot, options, instant, options.steal === true);
+    if (plannedOccupancy.code !== 0) {
+        return occupancyDeniedResult(plannedOccupancy, environment);
+    }
     const resolveUserMd = options.resolveUserMd ?? ((root) => resolveUserMdPath({ projectRoot: root }));
     const userMd = resolveUserMd(projectRoot);
     const safePath = userMd.path.replace(/\r?\n/g, " ");
@@ -606,7 +650,12 @@ function runSessionRearm(projectRoot, options, instant, environment) {
     };
     const gatedSteps = restampSteps(eligibility.state.gatedSteps, instant);
     const writeStarted = performance.now();
-    const rearmSessionId = (options.newSessionId ?? randomUUID)();
+    const persistedOccupancy = persistOccupancyOrDeny(projectRoot, options, instant, environment);
+    if ("payload" in persistedOccupancy) {
+        return persistedOccupancy;
+    }
+    // #3433: keep DEFT_SESSION_ID / occupant id. Do not mint a new UUID on re-arm.
+    const rearmSessionId = persistedOccupancy.sessionId;
     // Fresh payload (no rearm_needed / compact_resume_at) clears compact markers (#2992).
     const writePayload = {
         ...newRitualStatePayload({
@@ -714,6 +763,10 @@ function runSessionRearm(projectRoot, options, instant, environment) {
             scm: scmReadinessToDict(scm),
             host_content_surface: hostContentSurfaceToDict(hostSurface.report),
             effort_budget: effortBudgetToDict(effortBudget.budget),
+            occupancy: {
+                action: persistedOccupancy.action,
+                session_id: rearmSessionId,
+            },
             message: code === 0 ? "session ritual re-armed" : "session ritual re-arm failed",
         },
         lines,
@@ -847,6 +900,10 @@ export function runSessionStart(projectRoot, options = {}) {
             lines: [formatEnvironmentContext(environment), payload.message],
         };
     }
+    const plannedOccupancy = runOccupancy(projectRoot, options, instant, options.steal === true);
+    if (plannedOccupancy.code !== 0) {
+        return occupancyDeniedResult(plannedOccupancy, environment);
+    }
     const quickSteps = recordDeferredSteps(QUICK_STEPS, effectiveDeferrals, instant);
     const gatedSteps = recordDeferredSteps(GATED_STEPS, effectiveDeferrals, instant);
     const lines = [];
@@ -1214,7 +1271,11 @@ export function runSessionStart(projectRoot, options = {}) {
         lines.push(consentPrompt.trimEnd());
     }
     const writeStarted = performance.now();
-    const coldSessionId = (options.newSessionId ?? randomUUID)();
+    const persistedOccupancy = persistOccupancyOrDeny(projectRoot, options, instant, environment);
+    if ("payload" in persistedOccupancy) {
+        return persistedOccupancy;
+    }
+    const coldSessionId = persistedOccupancy.sessionId;
     const dialDict = {
         ...ceremonyDialToDict(ceremonyDialSelection),
         start_tier: ceremonyDialSelection.depth,
@@ -1298,10 +1359,9 @@ export function runSessionStart(projectRoot, options = {}) {
                     }
                     : {}),
             });
-            // #3356: always emit a denominator when the destination is live so
-            // share = ritual_events / denominator is computable from the stream.
-            // Prefer DEFT_TOTAL_TOOL_TURNS, then DEFT_MAX_TURNS / host maxTurns,
-            // else this session:start CLI invocation (1).
+            // #3399: emit a denominator only when a host/harness value is known.
+            // Prefer DEFT_TOTAL_TOOL_TURNS (harness_actual), then DEFT_MAX_TURNS /
+            // host maxTurns (host_planned). Unset → no event; share is unevaluable.
             emitter.emitSessionToolTurnDenominator(effortBudget.budget.maxTurns);
             // #3319: evaluate escalate-on-evidence only when #3274 is live. A pin
             // emits nothing so never-evaluated stays distinguishable from declined.
@@ -1386,6 +1446,10 @@ export function runSessionStart(projectRoot, options = {}) {
         scm: scmReadinessToDict(scm),
         host_content_surface: hostContentSurfaceToDict(hostSurface.report),
         effort_budget: effortBudgetToDict(effortBudget.budget),
+        occupancy: {
+            action: persistedOccupancy.action,
+            session_id: coldSessionId,
+        },
         message: code === 0 ? "session ritual recorded" : "session ritual failed",
     };
     // #2994: local process-cost event (best-effort; never blocks ceremony).

package/dist/session/verify-ac-session-cache.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Same-session verify:ac result cache (#3387).
+ *
+ * Disk-backed so check composition (spawned verify:ac) can serve from_cache
+ * after a green run in the same session when plan + product hash still match.
+ */
+export declare const VERIFY_AC_SESSION_CACHE_DIR = ".deft/verify-ac-session-cache";
+export declare const AC_SERVED_FROM: readonly ["bank", "cache", "executed"];
+export type AcServedFrom = (typeof AC_SERVED_FROM)[number];
+export interface CachedVerifyAcSnapshot {
+    readonly ok: boolean;
+    readonly code: 0 | 1 | 2;
+    readonly message: string;
+    readonly commands: readonly unknown[];
+    readonly runs: readonly unknown[];
+    readonly rejected?: readonly unknown[];
+    readonly sourceRung: string;
+    readonly noneStated: boolean;
+    readonly acceptance: unknown;
+    readonly resolution: string;
+    readonly resolvedCommandCount: number;
+}
+export interface VerifyAcSessionCacheRecord {
+    readonly sessionId: string;
+    readonly scopeId: string;
+    readonly productStateHash: string;
+    readonly cachedAt: string;
+    readonly snapshot: CachedVerifyAcSnapshot;
+}
+export declare function verifyAcSessionCacheDir(projectRoot: string): string;
+export declare function verifyAcSessionCachePath(projectRoot: string, sessionId: string, scopeId: string): string;
+export declare function resolveVerifyAcSessionId(env?: Readonly<Record<string, string | undefined>>, explicit?: string | null): string | null;
+export declare function readVerifyAcSessionCache(projectRoot: string, sessionId: string, scopeId: string): VerifyAcSessionCacheRecord | null;
+export declare function writeVerifyAcSessionCache(input: {
+    readonly projectRoot: string;
+    readonly sessionId: string;
+    readonly scopeId: string;
+    readonly productStateHash: string;
+    readonly snapshot: CachedVerifyAcSnapshot;
+    readonly now?: string;
+}): VerifyAcSessionCacheRecord;
+//# sourceMappingURL=verify-ac-session-cache.d.ts.map

package/dist/session/verify-ac-session-cache.js

@@ -0,0 +1,126 @@
+/**
+ * Same-session verify:ac result cache (#3387).
+ *
+ * Disk-backed so check composition (spawned verify:ac) can serve from_cache
+ * after a green run in the same session when plan + product hash still match.
+ */
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
+import { sanitizeScopeIdForFilename } from "./ac-pass-banking.js";
+export const VERIFY_AC_SESSION_CACHE_DIR = ".deft/verify-ac-session-cache";
+export const AC_SERVED_FROM = ["bank", "cache", "executed"];
+function asRecord(value) {
+    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+        return value;
+    }
+    return null;
+}
+export function verifyAcSessionCacheDir(projectRoot) {
+    return join(resolve(projectRoot), ...VERIFY_AC_SESSION_CACHE_DIR.split("/"));
+}
+export function verifyAcSessionCachePath(projectRoot, sessionId, scopeId) {
+    const safeSession = sanitizeScopeIdForFilename(sessionId);
+    const safeScope = sanitizeScopeIdForFilename(scopeId);
+    return join(verifyAcSessionCacheDir(projectRoot), `${safeSession}-${safeScope}.json`);
+}
+export function resolveVerifyAcSessionId(env, explicit) {
+    const injected = explicit?.trim() ?? "";
+    if (injected.length > 0)
+        return injected;
+    const fromEnv = typeof env?.DEFT_SESSION_ID === "string" ? env.DEFT_SESSION_ID.trim() : "";
+    return fromEnv.length > 0 ? fromEnv : null;
+}
+function parseSnapshot(raw) {
+    const rec = asRecord(raw);
+    if (rec === null)
+        return null;
+    if (typeof rec.ok !== "boolean")
+        return null;
+    if (rec.code !== 0 && rec.code !== 1 && rec.code !== 2)
+        return null;
+    if (typeof rec.message !== "string")
+        return null;
+    if (!Array.isArray(rec.commands) || !Array.isArray(rec.runs))
+        return null;
+    if (typeof rec.sourceRung !== "string")
+        return null;
+    if (typeof rec.noneStated !== "boolean")
+        return null;
+    if (typeof rec.resolution !== "string")
+        return null;
+    if (typeof rec.resolvedCommandCount !== "number")
+        return null;
+    return {
+        ok: rec.ok,
+        code: rec.code,
+        message: rec.message,
+        commands: rec.commands,
+        runs: rec.runs,
+        rejected: Array.isArray(rec.rejected) ? rec.rejected : undefined,
+        sourceRung: rec.sourceRung,
+        noneStated: rec.noneStated,
+        acceptance: rec.acceptance,
+        resolution: rec.resolution,
+        resolvedCommandCount: rec.resolvedCommandCount,
+    };
+}
+export function readVerifyAcSessionCache(projectRoot, sessionId, scopeId) {
+    const path = verifyAcSessionCachePath(projectRoot, sessionId, scopeId);
+    if (!existsSync(path))
+        return null;
+    let text;
+    try {
+        text = readFileSync(path, { encoding: "utf8" });
+    }
+    catch {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(text);
+        const rec = asRecord(parsed);
+        if (rec === null)
+            return null;
+        if (rec.sessionId !== sessionId || rec.scopeId !== scopeId)
+            return null;
+        if (typeof rec.productStateHash !== "string" || rec.productStateHash.length === 0) {
+            return null;
+        }
+        const snapshot = parseSnapshot(rec.snapshot);
+        if (snapshot === null || snapshot.ok !== true)
+            return null;
+        return {
+            sessionId,
+            scopeId,
+            productStateHash: rec.productStateHash,
+            cachedAt: typeof rec.cachedAt === "string" ? rec.cachedAt : "",
+            snapshot,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function writeVerifyAcSessionCache(input) {
+    const root = resolve(input.projectRoot);
+    const path = verifyAcSessionCachePath(root, input.sessionId, input.scopeId);
+    const dir = verifyAcSessionCacheDir(root);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    const record = {
+        sessionId: input.sessionId,
+        scopeId: input.scopeId,
+        productStateHash: input.productStateHash,
+        cachedAt: input.now ?? new Date().toISOString().replace(/\.\d{3}Z$/, "Z"),
+        snapshot: input.snapshot,
+    };
+    containedWrite({
+        root,
+        target: path,
+        data: `${JSON.stringify(record, null, 2)}\n`,
+        mode: "replace",
+        mkdir: true,
+    });
+    return record;
+}
+//# sourceMappingURL=verify-ac-session-cache.js.map

package/dist/session/verify-session-ritual.d.ts

@@ -28,6 +28,11 @@ export type RitualRunner = (command: readonly string[], projectRoot: string) =>
 };
 /** Human recovery line after a failed ritual probe (#2992 / #2993). */
 export declare function formatRitualRecoveryInstruction(tier?: SessionCeremonyTier): string;
+/**
+ * Sanctioned audited defer copy for gated `cache_fresh` failure (#3506 / #3507).
+ * The gated argv is always `["verify:cache-fresh"]`, so this is unconditional.
+ */
+export declare function formatCacheFreshDeferSoftPath(): string;
 export interface VerifySessionRitualOptions {
     readonly tier?: "quick" | "gated";
     readonly now?: Date;

package/dist/session/verify-session-ritual.js

@@ -50,6 +50,14 @@ export function formatRitualRecoveryInstruction(tier = "cold") {
     return (`Recovery: run ${ready} ` +
         `(one-shot: session:start + gated ritual + cache recovery as needed).`);
 }
+/**
+ * Sanctioned audited defer copy for gated `cache_fresh` failure (#3506 / #3507).
+ * The gated argv is always `["verify:cache-fresh"]`, so this is unconditional.
+ */
+export function formatCacheFreshDeferSoftPath() {
+    const cmd = formatFrameworkCommand(["session:start", "--", "--defer", "cache_fresh=<reason>"]);
+    return `Soft path (audited): \`${cmd}\`.`;
+}
 function runGatedStep(projectRoot, payload, stepName, runner, now) {
     const command = [...GATED_ENTRYPOINT_COMMANDS[stepName]];
     const { code, stdout, stderr } = runner(command, projectRoot);
@@ -465,6 +473,7 @@ export function emitVerifyJson(result) {
         would_fail_code: result.wouldFailCode,
         posture: result.posture,
         ritual_state_required: result.ritualStateRequired,
+        recovery_tier: result.recoveryTier ?? null,
     });
 }
 export function emitBypassWarning(result) {

package/dist/slash/openclaw-deposit.js

@@ -10,11 +10,12 @@
  *
  * ⊗ Fake project `.openclaw/commands/` file emitter.
  */
-import { existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readFileSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { detectOpenClaw, isEscapingSkillSymlink, listInScopeSkillsDirs, } from "../doctor/openclaw-skills.js";
-import { containedWrite } from "../fs/contained-write.js";
+import { containedMkdir, containedRemove, containedRename, containedWrite, } from "../fs/contained-write.js";
+import { isPortRecordMode } from "../fs/mutation-ledger.js";
 import { readPlanPolicy } from "../policy/plan-extensions.js";
 import { loadProjectDefinition } from "../policy/resolve.js";
 import { generateOpenClawSkillArtifacts, isManagedOpenClawL2Skill, listOpenClawManagedSkillSlugs, } from "./openclaw-adapter.js";
@@ -122,7 +123,7 @@ function writeSkillArtifact(skillsDir, artifact) {
             return "preserved";
         }
     }
-    mkdirSync(skillDir, { recursive: true });
+    containedMkdir({ root: skillsDir, target: skillDir });
     // Re-check after mkdir: concurrent symlink plant is fail-closed.
     if (skillDirLstatKind(skillDir) === "symlink" && isEscapingSkillSymlink(skillsDir, skillDir)) {
         return "preserved";
@@ -137,11 +138,11 @@ function writeSkillArtifact(skillsDir, artifact) {
             data: artifact.skillMarkdown,
             mode: "replace",
         });
-        renameSync(tmp, skillFile);
+        containedRename({ root: skillsDir, from: tmp, to: skillFile, mutation: false });
     }
     catch (err) {
         try {
-            rmSync(tmp, { force: true });
+            containedRemove({ root: skillsDir, target: tmp, mutation: false });
         }
         catch {
             /* best-effort */
@@ -172,8 +173,9 @@ function stripManagedSkills(skillsDir) {
         if (!isManagedOpenClawL2Skill(raw))
             continue;
         try {
-            rmSync(skillDir, { recursive: true, force: true });
-            removed.push(skillDir);
+            if (containedRemove({ root: skillsDir, target: skillDir, recursive: true }).removed) {
+                removed.push(skillDir);
+            }
         }
         catch {
             /* best-effort */
@@ -221,7 +223,8 @@ export function depositOpenClawL2ProductCommands(options = {}) {
     const preservedCustomPaths = [];
     if (!policy) {
         for (const skillsDir of skillsDirs) {
-            mkdirSync(skillsDir, { recursive: true });
+            if (!isPortRecordMode())
+                mkdirSync(skillsDir, { recursive: true });
             removedPaths.push(...stripManagedSkills(skillsDir));
         }
         if (removedPaths.length > 0) {
@@ -242,7 +245,8 @@ export function depositOpenClawL2ProductCommands(options = {}) {
     }
     const artifacts = generateOpenClawSkillArtifacts();
     for (const skillsDir of skillsDirs) {
-        mkdirSync(skillsDir, { recursive: true });
+        if (!isPortRecordMode())
+            mkdirSync(skillsDir, { recursive: true });
         for (const artifact of artifacts) {
             const outcome = writeSkillArtifact(skillsDir, artifact);
             const abs = join(skillsDir, artifact.slug);

package/dist/slice/constants.d.ts

@@ -1,5 +1,5 @@
-/** Default slices log path relative to project root. */
-export declare const DEFAULT_SLICES_LOG_REL_PATH = "vbrief/.eval/slices.jsonl";
+/** Default slices log path relative to an xbrief-layout project root (#1703). */
+export declare const DEFAULT_SLICES_LOG_REL_PATH = "xbrief/.triage-cache/slices.jsonl";
 export declare const ENV_PROJECT_ROOT = "DEFT_PROJECT_ROOT";
 export declare const ENV_PROJECT_REPO = "DEFT_PROJECT_REPO";
 export declare const DEFAULT_ACTOR = "manual:operator";

package/dist/slice/constants.js

@@ -1,5 +1,5 @@
-/** Default slices log path relative to project root. */
-export const DEFAULT_SLICES_LOG_REL_PATH = "vbrief/.eval/slices.jsonl";
+/** Default slices log path relative to an xbrief-layout project root (#1703). */
+export const DEFAULT_SLICES_LOG_REL_PATH = "xbrief/.triage-cache/slices.jsonl";
 export const ENV_PROJECT_ROOT = "DEFT_PROJECT_ROOT";
 export const ENV_PROJECT_REPO = "DEFT_PROJECT_REPO";
 export const DEFAULT_ACTOR = "manual:operator";

package/dist/slice/existing.js

@@ -1,6 +1,7 @@
 import { ContainedWriteError } from "../fs/contained-write.js";
 import { call as scmCall } from "../scm/call.js";
 import { pyRepr } from "../scm/py-format.js";
+import { triageCacheRelPath } from "../triage/cache-path.js";
 import { DEFAULT_ACTOR, DEFAULT_EXPECTED_CLOSE_SIGNAL, DEFAULT_ROLE, WAVE_FLAG_RE, } from "./constants.js";
 import { IssueValidationError, SliceRecordError } from "./errors.js";
 import { pythonJsonPretty } from "./json.js";
@@ -171,6 +172,10 @@ export function summariseWaves(waveMap, totalChildren) {
         .map((waveN) => `wave-${waveN}=${placedByWave.get(waveN)}`);
     return `${parts.length} wave(s): ${parts.join(", ")}`;
 }
+/** Layout-aware display path for the slices log actually read or written (#3386). */
+function slicesLogDisplayPath(projectRoot) {
+    return triageCacheRelPath(projectRoot, "slices.jsonl");
+}
 function duplicateMessage(umbrella, duplicate) {
     return (`slice:record-existing: umbrella #${umbrella} already has a matching record (slice_id=${String(duplicate.slice_id)}, ` +
         `actor=${String(duplicate.actor)}). Re-run with --force to write a second record.`);
@@ -295,7 +300,7 @@ export function runRecordExisting(args, waveMap, deps = {}) {
         const waveSummary = summariseWaves(waveMap, children.length);
         return {
             exitCode: 0,
-            stdout: `Wrote vbrief/.eval/slices.jsonl entry for umbrella ` +
+            stdout: `Wrote ${slicesLogDisplayPath(resolved.projectRoot)} entry for umbrella ` +
                 `#${args.umbrella} (${children.length} children, ${waveSummary}). ` +
                 `slice_id=${outcome.sliceId}\n`,
             stderr: "",
@@ -320,6 +325,7 @@ export function runList(args) {
     if (resolved.exitCode !== 0) {
         return { exitCode: 2, stdout: "", stderr: `${formatMissingRootError()}\n` };
     }
+    const logDisplay = slicesLogDisplayPath(resolved.projectRoot);
     const records = readAll({ path: slicesPath(resolved.projectRoot) });
     if (args.asJson) {
         return { exitCode: 0, stdout: `${pythonJsonPretty(records)}\n`, stderr: "" };
@@ -327,11 +333,11 @@ export function runList(args) {
     if (records.length === 0) {
         return {
             exitCode: 0,
-            stdout: "slice:list: no records found in vbrief/.eval/slices.jsonl (file absent or empty).\n",
+            stdout: `slice:list: no records found in ${logDisplay} (file absent or empty).\n`,
             stderr: "",
         };
     }
-    const lines = [`slice:list: ${records.length} record(s) in vbrief/.eval/slices.jsonl`];
+    const lines = [`slice:list: ${records.length} record(s) in ${logDisplay}`];
     for (const record of records) {
         const umbrella = record.umbrella ?? "?";
         const actor = record.actor ?? "?";

package/dist/slice/lock.d.ts

@@ -1,9 +1,24 @@
+/** 10× occupancy heartbeat TTL. Off-Linux PID reuse / stalled holder reclaim. */
+export declare const STALE_LOCK_HARD_CAP_MS: number;
 export interface LockDeps {
     readonly sleepMs?: (ms: number) => void;
     readonly now?: () => number;
 }
+export interface HeldLock {
+    readonly lockPath: string;
+    readonly pid: number;
+    readonly token: string;
+    readonly acquiredAt: number;
+}
+export interface LockRecord {
+    readonly pid: number | null;
+    readonly token: string;
+    readonly acquiredAt: number | null;
+}
+export declare function parseLockRecord(lockPath: string): LockRecord;
+export declare function assertAppendLockOwned(held: HeldLock): void;
 /** Serialise appenders across threads AND processes (sidecar lock file). */
-export declare function withAppendLock<T>(logPath: string, fn: () => T, deps?: LockDeps): T;
+export declare function withAppendLock<T>(logPath: string, fn: (held: HeldLock) => T, deps?: LockDeps): T;
 /** Public alias mirroring Python append_lock. */
 export declare const appendLock: typeof withAppendLock;
 //# sourceMappingURL=lock.d.ts.map