harnery 0.35.0 → 0.36.0

package/src/core/hooks/cli.ts

@@ -17,19 +17,21 @@
  * adapter flow.
  */
 
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { coordEnv } from "../../lib/env.ts";
 import { buildInstructionBundle } from "../../lib/instructions/bundle.ts";
 import type { Adapter } from "../adapter.ts";
 import { coordBinPath } from "../agents/coord-bin.ts";
+import { resolveCoordRoot } from "../agents/coord-client.ts";
 import {
   type ClaimFinalizationDecision,
   type ClaimFinalizationDescriptor,
   classifyWriteClaimFinalization,
   formatWriteClaimFinalizationDenial,
 } from "../agents/finalization.ts";
+import { restoreLiveCoordinationStateAfterEpochV3 } from "../agents/live-authority-v3.ts";
 import { evaluateStopHook, STOP_REMEDIATION_MARKER } from "../agents/rules/stop-hook.ts";
 import {
   assistantTextStartsWithSessionNameBlock,
@@ -39,11 +41,10 @@ import {
   sessionNameDisplayRecoveryInstruction,
   toolResponseMintedSessionName,
 } from "../agents/session-name-display.ts";
-import { stampSessionNameSeen } from "../agents/state/heartbeat-writer.ts";
-import {
-  ensureLiveCoordinationHeartbeat,
-  readLiveCoordinationRow,
-} from "../agents/state/live-coordination-view.ts";
+import type { Heartbeat } from "../agents/state/heartbeat-reader.ts";
+import { readHeartbeat, stampSessionNameSeen } from "../agents/state/heartbeat-writer.ts";
+import { readLiveCoordinationRow } from "../agents/state/live-coordination-view.ts";
+import { ensureLiveCoordinationHeartbeat } from "../agents/state/live-coordination-writer.ts";
 import { writePidmapRow } from "../agents/state/pidmap.ts";
 import { agentsRequireGitFinalization, resolveBinName } from "../config.ts";
 import {
@@ -59,12 +60,14 @@ import {
 import { tryWriteLiveDisplayV3 } from "../events/v3/live-feed.ts";
 import {
   liveHookSignalDefersDrainV3,
+  reconcileLivePendingRuntimeContextV3,
   recordLiveDelegatedChildSessionV3,
   recordLiveHookSignalV3,
   resolveLiveEventLedgerRouteV3,
 } from "../events/v3/live-routing.ts";
 import { captureSpanClockV3 } from "../events/v3/span-state.ts";
-import { fetchPresence } from "../presence/index.ts";
+import { ensureRelayDaemon, fetchPresence, publishPresence } from "../presence/index.ts";
+import { closeProcessLoggers, legacyLogFields, processLogger } from "../storage/logger.ts";
 import { stableScopeId } from "../workflow/scope-id.ts";
 import { detectAdapter, shouldSkipHookAdapter } from "./adapter/detect.ts";
 import {
@@ -98,12 +101,11 @@ import {
 import { toolInputHash, toolTargetHash } from "./events/input-hash.ts";
 import { canonicalize } from "./guard-path.ts";
 import { adapterPidFromEnv, parsePsChainLine, selectAnchorPid } from "./resolve/anchor.ts";
-import { findCoordRoot } from "./resolve/coord-root.ts";
 import { extractIntentComment, resolveIntent } from "./resolve/intent.ts";
 import { resolveOwner } from "./resolve/owner.ts";
 import {
   inspectSessionNameDisplayImmediately,
-  scanAssistantTextIncludes,
+  scanAssistantStatusBoxPresent,
   scanSessionNameDisplayedImmediately,
   scanStatusBoxPresent,
   scanTranscriptRuntime,
@@ -134,6 +136,11 @@ function parseArgv(argv: string[]): Argv {
   return out;
 }
 
+function extraArg(extra: string[], name: string): string | undefined {
+  const index = extra.indexOf(name);
+  return index >= 0 ? extra[index + 1] : undefined;
+}
+
 async function readStdin(): Promise<string> {
   if (process.stdin.isTTY) return "";
   try {
@@ -159,6 +166,14 @@ function childEnv(coordRoot: string): NodeJS.ProcessEnv {
 }
 
 function appendDebug(coordRoot: string, entry: Record<string, unknown>): void {
+  if (coordEnv("SHARED_LOGS") !== "0") {
+    try {
+      processLogger(coordRoot, "agent-hook").debug("agent_hook.diagnostic", legacyLogFields(entry));
+      return;
+    } catch {
+      /* fall through to the rollback writer */
+    }
+  }
   const path = join(coordRoot, ".harnery", "debug", "agent-hook.ndjson");
   try {
     mkdirSync(dirname(path), { recursive: true });
@@ -170,6 +185,18 @@ function appendDebug(coordRoot: string, entry: Record<string, unknown>): void {
 
 function logError(coordRoot: string | null, err: unknown, context: Record<string, unknown>): void {
   if (!coordRoot) return;
+  if (coordEnv("SHARED_LOGS") !== "0") {
+    try {
+      processLogger(coordRoot, "agent-hook").error(
+        "agent_hook.error",
+        legacyLogFields(context),
+        err,
+      );
+      return;
+    } catch {
+      /* fall through to the rollback writer */
+    }
+  }
   const path = join(coordRoot, ".harnery", "debug", "agent-hook.errors.ndjson");
   try {
     mkdirSync(dirname(path), { recursive: true });
@@ -408,9 +435,10 @@ function buildEventData(
         // assistant text only (same window, same scanner as the session-name
         // detection). The Stop verdict enforces this field; the loose field is
         // retained as diagnostic telemetry for the measured detector divergence.
-        status_box_present_strict:
-          scanAssistantTextIncludes(p?.transcript_path, "┌─ agent-") ||
-          lastAssistantMessage.includes("┌─ agent-"),
+        status_box_present_strict: scanAssistantStatusBoxPresent(
+          p?.transcript_path,
+          lastAssistantMessage,
+        ),
         // Whether the session's suggested name is satisfied as of this turn,
         // and which name that refers to. Reported on every stop while a name
         // exists (the stop-hook.session_name verdict reads it per turn); the
@@ -582,7 +610,7 @@ async function main(): Promise<number> {
   // `--adapter cursor` dispatch of the same payload carries the session.
   if (shouldSkipHookAdapter(adapter, raw)) {
     if (coordEnv("AGENT_COORD_OFF") !== "1") {
-      const coordRoot = findCoordRoot(process.cwd());
+      const coordRoot = resolveCoordRoot(process.cwd());
       if (coordRoot) {
         appendDebug(coordRoot, {
           ts: new Date().toISOString(),
@@ -607,7 +635,7 @@ async function main(): Promise<number> {
   if (adapter === "claude-code" && eventName) {
     const s = soundForEvent(eventName);
     if (s) {
-      const repoRoot = findCoordRoot(process.cwd());
+      const repoRoot = resolveCoordRoot(process.cwd());
       if (repoRoot) {
         let sid = "";
         let stopContinuation = false;
@@ -638,8 +666,11 @@ async function main(): Promise<number> {
   // bypass during incident triage.
   if (coordEnv("AGENT_COORD_OFF") === "1") return 0;
 
-  const coordRoot = findCoordRoot(process.cwd());
+  const coordRoot = resolveCoordRoot(process.cwd());
   if (!coordRoot) return 0;
+  if (eventName === "runtime-context-retry") {
+    return runRuntimeContextRetryWorker(coordRoot, adapter, extra);
+  }
   const ledgerRoute = resolveLiveEventLedgerRouteV3(coordRoot);
 
   // Always log a breadcrumb, useful when an event_type maps to null or owner
@@ -661,6 +692,30 @@ async function main(): Promise<number> {
     return 0;
   }
 
+  // Cursor's preToolUse `agent_message` is only the current narration before
+  // that tool. It is not a transcript and therefore cannot prove that an
+  // earlier assistant response omitted the required session-name block.
+  // afterAgentResponse is the one native boundary that carries the completed
+  // assistant text, so stamp a positive sighting here without retaining or
+  // emitting the response body into V3.
+  if (adapter === "cursor" && eventName === "after-agent-response") {
+    const payload = parsePayload(raw, adapter);
+    const owner = resolveOwner({ payload: payload?.raw ?? null, coordRoot });
+    if (!owner) {
+      appendDebug(coordRoot, { ...debugBase, skipped: "no-owner-resolved" });
+      return 0;
+    }
+    const name = sessionNameDisplayPending(readLiveCoordinationRow(coordRoot, owner.instance_id));
+    const text = typeof payload?.raw.text === "string" ? payload.raw.text : "";
+    if (name && assistantTextStartsWithSessionNameBlock(text, name)) {
+      stampSessionNameSeen(coordRoot, owner.instance_id, name);
+      appendDebug(coordRoot, { ...debugBase, effect: "session-name-display-stamped" });
+    } else {
+      appendDebug(coordRoot, { ...debugBase, skipped: "no-session-name-sighting" });
+    }
+    return 0;
+  }
+
   const norm = normalizeEventName(eventName);
   if (!norm) {
     appendDebug(coordRoot, { ...debugBase, skipped: "non-canonical-event" });
@@ -682,6 +737,7 @@ async function main(): Promise<number> {
   }
 
   const sessionId = payload?.session_id ?? payload?.conversation_id ?? owner.instance_id;
+  const priorCoordination = readHeartbeat(coordRoot, owner.instance_id);
 
   const data = buildEventData(norm.event_type, {
     coordRoot,
@@ -756,6 +812,24 @@ async function main(): Promise<number> {
     ...(turnRitual ? { turn_ritual: turnRitual } : {}),
     ...(deferV3Drain ? { defer_drain: true } : {}),
   });
+  const recordedGenerationId =
+    v3Result && "event" in v3Result && "generation_id" in v3Result.event.scope
+      ? (v3Result.event.scope.generation_id as `gen_${string}`)
+      : undefined;
+  if (v3Result?.state === "recorded" || v3Result?.state === "already_started") {
+    try {
+      restoreLiveCoordinationStateAfterEpochV3({
+        coordRoot,
+        owner: owner.instance_id,
+        nativeSessionId: sessionId,
+        adapter,
+        prior: priorCoordination,
+        currentGenerationId: recordedGenerationId,
+      });
+    } catch (error) {
+      logError(coordRoot, error, { phase: "epoch-coordination-restore" });
+    }
+  }
   const v3EventId =
     v3Result && "event" in v3Result
       ? v3Result.event.event_id
@@ -795,7 +869,7 @@ async function main(): Promise<number> {
 
   if (v3Result?.state === "recorded" && capturedImages.length > 0) {
     try {
-      recordImageArtifactsV3(coordRoot, v3Result.event, capturedImages);
+      recordImageArtifactsV3(coordRoot, v3Result.event, capturedImages, ledgerRoute.genesis_id);
     } catch (err) {
       logError(coordRoot, err, { phase: "image-artifact-observation" });
     }
@@ -889,6 +963,36 @@ async function main(): Promise<number> {
     // session-start additionalContext inside emitSessionStartSystemMessage.
     if (adapter === "claude-code") journalJanitor(coordRoot);
     imageJanitor(coordRoot);
+    // Session start is the only caller of the artifact janitor and the storage
+    // maintenance pass, so both load here instead of on every tool call.
+    const { autoCleanArtifacts } = await import("../artifacts/index.ts");
+    const { createAutomaticMaintenanceComposition, runAutomaticMaintenancePass } = await import(
+      "../storage/maintenance-providers.ts"
+    );
+    // Effect: throttled daily sweep of expired artifact workspaces (guarded,
+    // managed-expired only; see autoCleanArtifacts). Best-effort like every
+    // janitor here: a failure logs and never blocks session start.
+    try {
+      autoCleanArtifacts(coordRoot);
+    } catch (err) {
+      logError(coordRoot, err, { phase: "artifact-auto-clean" });
+    }
+    // Plan one bounded, claim-first global slice from cached pressure only.
+    // Existing owner janitors above remain the only active executors until
+    // each provider receives a separate production activation.
+    try {
+      await runAutomaticMaintenancePass(
+        createAutomaticMaintenanceComposition(coordRoot, {
+          journal: () => {
+            if (adapter === "claude-code") journalJanitor(coordRoot);
+          },
+          images: () => imageJanitor(coordRoot),
+          artifacts: () => autoCleanArtifacts(coordRoot),
+        }),
+      );
+    } catch (err) {
+      logError(coordRoot, err, { phase: "storage-maintenance-auto" });
+    }
     let recovery: PreparedContextRecovery | null = null;
     if (payload?.source === "compact") {
       try {
@@ -920,10 +1024,13 @@ async function main(): Promise<number> {
     } catch (err) {
       logError(coordRoot, err, { phase: "session-start-systemMessage" });
     }
-    // Pull advisory cross-machine presence. V3 never publishes from the
-    // disposable heartbeat cache.
+    // Cross-machine presence is derived from the authority-safe V3 projection,
+    // not the disposable heartbeat cache. Announce this session, pull peers,
+    // and keep the optional live relay connected.
     try {
+      publishPresence(coordRoot);
       fetchPresence(coordRoot);
+      ensureRelayDaemon(coordRoot);
     } catch (err) {
       logError(coordRoot, err, { phase: "session-start-presence" });
     }
@@ -943,6 +1050,13 @@ async function main(): Promise<number> {
       journalArchive(coordRoot, owner.instance_id);
       runSessionSyncExtension(coordRoot, true);
     }
+    // Publish the post-cleanup V3 projection so remote machines see this
+    // session disappear without waiting for the stale window.
+    try {
+      publishPresence(coordRoot);
+    } catch (err) {
+      logError(coordRoot, err, { phase: "session-end-presence" });
+    }
   }
 
   // Phase 8: SubagentStart: the child generation was opened above from the
@@ -1061,6 +1175,16 @@ async function main(): Promise<number> {
       runSessionSyncExtension(coordRoot, false);
     }
 
+    // Publish after the canonical turn event has landed so the blob carries
+    // current task, activity, and claim state. Re-ensure the relay here because
+    // its daemon intentionally exits when a machine has no live sessions.
+    try {
+      publishPresence(coordRoot);
+      ensureRelayDaemon(coordRoot);
+    } catch (err) {
+      logError(coordRoot, err, { phase: "stop-presence" });
+    }
+
     // Stop verdict (V3 ritual + task/status gate). Direct in-process call: the
     // rule lives in Harnery. agent-hook already emitted this turn.completed
     // with privacy-safe ritual observations, so the evidence is in the stream.
@@ -1069,6 +1193,8 @@ async function main(): Promise<number> {
       instance_id: owner.instance_id,
       session_id: sessionId,
       adapter,
+      stop_hook_active: payload?.stop_hook_active === true,
+      status_box_present_strict: data.status_box_present_strict === true,
       bypass: coordEnv("AGENT_COORD_BYPASS_STOP") === "1",
       workflow_child: coordEnv("WORKFLOW_CHILD") === "1",
     });
@@ -1078,13 +1204,16 @@ async function main(): Promise<number> {
       // `cap` consecutive blocked stops in one cycle, allow the stop instead
       // of bouncing the model forever. Cycle boundaries come from the
       // adapter's continuation flag, so adapters without one are unaffected.
-      const { remediationCapExceeded } = await import("./remediation-cap.ts");
-      if (remediationCapExceeded(sessionId, payload?.stop_hook_active === true)) {
+      const { recordRemediationBlock } = await import("./remediation-cap.ts");
+      const remediation = recordRemediationBlock(sessionId, payload?.stop_hook_active === true);
+      if (remediation.exceeded) {
         appendDebug(coordRoot, {
           ...debugBase,
           skipped: "stop-remediation-cap-exhausted",
           blocked_rule: verdict.rule,
+          blocked_count: remediation.count,
           session_id: sessionId,
+          remediation_cycle_anchor: verdict.remediation_cycle_anchor,
         });
       } else {
         // Adapter-aware enforcement channel: Claude Code honors exit-2 + stderr
@@ -1113,6 +1242,7 @@ async function main(): Promise<number> {
     } catch (err) {
       logError(coordRoot, err, { phase: "stop-explicit-session-finalization" });
     }
+    if (adapter === "codex") scheduleCodexRuntimeContextRetry(coordRoot, sessionId);
   }
 
   // Phase 7: PreToolUse: heartbeat + pid-map self-heal on every tool call.
@@ -1141,14 +1271,18 @@ async function main(): Promise<number> {
     // runs before a name exists; every later tool waits until the exact block
     // is the first assistant text after the mint result. Cursor supplies
     // agent_message directly; Claude Code and Codex are resolved from their
-    // JSONL transcripts. Later commentary must not erase an already-correct
-    // display, and an unreadable transcript must not deadlock every tool.
+    // JSONL transcripts. Cursor's current narration can provide positive
+    // evidence, but cannot disprove an earlier response; afterAgentResponse
+    // stamps that durable sighting. Later commentary must not erase an
+    // already-correct display, and unavailable evidence must not deadlock
+    // every tool.
     try {
       const displayAllowed = await enforcePendingSessionNameDisplay(
         coordRoot,
         owner.instance_id,
         adapter,
         payload,
+        generationBoundHeartbeat(readHeartbeat(coordRoot, owner.instance_id), recordedGenerationId),
       );
       if (!displayAllowed) return 0;
     } catch (err) {
@@ -1225,13 +1359,56 @@ async function main(): Promise<number> {
   return 0;
 }
 
+function scheduleCodexRuntimeContextRetry(coordRoot: string, nativeSessionId: string): void {
+  const modulePath = process.argv[1];
+  if (!modulePath) return;
+  try {
+    const child = spawn(
+      process.execPath,
+      [modulePath, "runtime-context-retry", "--adapter", "codex", "--session-id", nativeSessionId],
+      {
+        cwd: coordRoot,
+        detached: true,
+        stdio: "ignore",
+        env: childEnv(coordRoot),
+      },
+    );
+    child.unref();
+  } catch (err) {
+    logError(coordRoot, err, { phase: "runtime-context-retry-spawn" });
+  }
+}
+
+async function runRuntimeContextRetryWorker(
+  coordRoot: string,
+  adapter: Adapter | null,
+  extra: string[],
+): Promise<number> {
+  const nativeSessionId = extraArg(extra, "--session-id");
+  if (adapter !== "codex" || !nativeSessionId) return 0;
+  for (const [index, delayMs] of [400, 1_000].entries()) {
+    await new Promise((resolve) => setTimeout(resolve, delayMs));
+    const route = resolveLiveEventLedgerRouteV3(coordRoot);
+    if (route.state !== "v3") return 0;
+    const result = reconcileLivePendingRuntimeContextV3({
+      coordRoot,
+      route,
+      nativeSessionId,
+      finalAttempt: index === 1,
+    });
+    if (result.state !== "pending" && result.state !== "busy") return 0;
+  }
+  return 0;
+}
+
 async function enforcePendingSessionNameDisplay(
   coordRoot: string,
   instanceId: string,
   adapter: Adapter,
   payload: ParsedPayload | null,
+  coordination: Heartbeat | null,
 ): Promise<boolean> {
-  const name = sessionNameDisplayPending(readLiveCoordinationRow(coordRoot, instanceId));
+  const name = sessionNameDisplayPending(coordination);
   if (!name) return true;
 
   const command = extractBashCommand(payload?.tool_name, payload?.tool_input);
@@ -1242,7 +1419,7 @@ async function enforcePendingSessionNameDisplay(
       ? {
           state: assistantTextStartsWithSessionNameBlock(payload.agent_message, name)
             ? ("present" as const)
-            : ("absent" as const),
+            : ("unavailable" as const),
         }
       : inspectSessionNameDisplayImmediately(
           // Codex hook payloads omit transcript_path on every event, which
@@ -1275,6 +1452,13 @@ async function enforcePendingSessionNameDisplay(
   return false;
 }
 
+function generationBoundHeartbeat(
+  heartbeat: Heartbeat | null,
+  generationId: `gen_${string}` | undefined,
+): Heartbeat | null {
+  return generationId && heartbeat?.v3_generation_id === generationId ? heartbeat : null;
+}
+
 async function runPreToolUseGuard(
   coordRoot: string,
   instanceId: string,
@@ -1622,16 +1806,22 @@ async function emitUserPromptSubmitSystemMessage(
     // Every human-facing adapter gets the first-session naming reminder from
     // the shared hook path. Cursor + Codex additionally get ongoing set-task
     // staleness nudges; Claude Code enforces those via its Stop transcript.
+    // Codex also gets the optional project-owned prompt reminder. Claude Code
+    // already has native output-style reminders, so duplicating it would add
+    // noise. Cursor's current beforeSubmitPrompt output can allow or block but
+    // cannot inject model context; an Always Apply rule is its durable carrier.
+    // Only the boolean route travels through argv, never the host's text.
+    if (adapter === "codex") args.push("--host-prompt-reminder");
     // Codex gets a fresh status-footer reminder on every prompt. Its Stop hook
     // stays observe-only, so missing the footer never replaces the answer.
-    // Claude Code + Cursor (the Stop-ENFORCING adapters) get a fresh per-turn
-    // ritual reminder: satisfying the contract up front is far cheaper than
-    // the bounce-and-retry the Stop hook otherwise forces.
+    // Claude Code gets a fresh per-turn ritual reminder: satisfying the
+    // contract up front is far cheaper than the bounce-and-retry the Stop hook
+    // otherwise forces. Cursor's beforeSubmitPrompt cannot inject context, so
+    // its Stop follow-up remains the supported enforcement channel.
     args.push("--session-name-nudge");
     if (adapter === "cursor" || adapter === "codex") args.push("--task-nudge");
     if (adapter === "codex") args.push("--status-footer-nudge");
-    if (adapter === "claude-code" || adapter === "cursor")
-      args.push("--turn-ritual-nudge", adapter);
+    if (adapter === "claude-code") args.push("--turn-ritual-nudge", adapter);
     const result = spawnSync(agentCoordBin, args, { encoding: "utf8", timeout: 3000 });
     if (result.status === 0 && result.stdout) additionalContext = result.stdout.trim();
   }
@@ -1796,11 +1986,15 @@ function completeRecoveryInjection(
 }
 
 main()
-  .then((code) => process.exit(code))
-  .catch((err) => {
-    logError(findCoordRoot(process.cwd()), err, {
+  .then(async (code) => {
+    await closeProcessLoggers();
+    process.exit(code);
+  })
+  .catch(async (err) => {
+    logError(resolveCoordRoot(process.cwd()), err, {
       argv: process.argv.slice(2),
       pid: process.pid,
     });
+    await closeProcessLoggers();
     process.exit(0);
   });

package/src/core/hooks/effects/image-capture.ts

@@ -94,10 +94,13 @@ export function recordImageArtifactsV3(
   coordRoot: string,
   sourceEvent: EventV3,
   artifacts: readonly CapturedImageArtifact[],
+  expectedGenesisId?: `gex_${string}`,
 ): void {
   if (!("generation_id" in sourceEvent.scope) || !sourceEvent.attestation_id) return;
   for (const artifact of artifacts) {
-    writeEventV3(coordRoot, buildImageArtifactEventV3(sourceEvent, artifact));
+    writeEventV3(coordRoot, buildImageArtifactEventV3(sourceEvent, artifact), {
+      ...(expectedGenesisId ? { expectedGenesisId } : {}),
+    });
   }
 }
 

package/src/core/hooks/remediation-cap.ts

@@ -36,14 +36,20 @@ function counterPath(sessionId: string): string {
  *
  * Call only when the Stop verdict blocked. `continuation` is the adapter's
  * "this stop follows a stop-hook block" flag; false starts a fresh cycle.
- * Returns true when this cycle has already been blocked `cap` times, meaning
- * the caller should allow the stop instead of blocking again.
+ * Returns the retained block count and whether this cycle has already been
+ * blocked `cap` times, meaning the caller should allow the stop instead of
+ * blocking again.
  */
-export function remediationCapExceeded(
+export interface RemediationBlockRecord {
+  count: number;
+  exceeded: boolean;
+}
+
+export function recordRemediationBlock(
   sessionId: string,
   continuation: boolean,
   cap = DEFAULT_STOP_REMEDIATION_CAP,
-): boolean {
+): RemediationBlockRecord {
   const path = counterPath(sessionId);
   let count = 1;
   if (continuation) {
@@ -62,9 +68,9 @@ export function remediationCapExceeded(
     writeFileSync(path, String(count), "utf8");
   } catch {
     // Counter IO must never turn into a block or a crash; fail open (no cap).
-    return false;
+    return { count, exceeded: false };
   }
-  return count > cap;
+  return { count, exceeded: count > cap };
 }
 
 /** Clear the cycle counter after an allowed stop. */

package/src/core/hooks/resolve/coord-root.ts

@@ -1,14 +1,16 @@
-import { resolveCoordRoot } from "../../agents/coord-client.ts";
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
 
 /**
- * The hooks-side name for THE coordination-root resolution.
+ * Resolve the coordination root from path evidence only.
  *
- * Delegates to `resolveCoordRoot()` so the hooks and the CLI cannot resolve
- * different roots. They used to: this walked up from `CLAUDE_PROJECT_DIR` or
- * cwd while the CLI's `monorepoRoot()` asked git for the superproject first, so
- * with a shell inside a submodule that carries its own `.harnery/`, the CLI's
- * `coord.status_observed` landed in a stream this side never read and rule 1/3
- * blocked every turn.
+ * This path-only resolver deliberately does not inspect live producer state.
+ * Code that reads or writes coordination authority must use
+ * `resolveCoordRoot()` from `agents/coord-client.ts`, which disambiguates
+ * nested coordination roots through the registered session. Keeping the two
+ * responsibilities separate lets configuration and other path-only consumers
+ * avoid loading the event recorder and its contract graph.
  *
  * Resolution precedence (see `resolveCoordRoot` for the full rationale):
  *   1. HARNERY_COORD_ROOT_OVERRIDE — explicit pin (tests, git hooks).
@@ -17,9 +19,87 @@ import { resolveCoordRoot } from "../../agents/coord-client.ts";
  *      submodules that may carry a `.harnery/` of their own (or none at all,
  *      e.g. a journal dir under /tmp). The session's coordination home is the
  *      project the adapter opened, not wherever the shell happens to sit.
- *   3. The root that already holds this session's heartbeat.
- *   4. The nearest enclosing `.harnery/`, then a git-derived root.
+ *   3. The nearest enclosing `.harnery/`.
+ *   4. A git-derived root when no `.harnery/` exists yet.
  */
 export function findCoordRoot(start: string = process.cwd()): string | null {
-  return resolveCoordRoot(start);
+  const rootOverride = process.env.HARNERY_COORD_ROOT_OVERRIDE;
+  if (rootOverride) return rootOverride;
+
+  const projectDir = process.env.CLAUDE_PROJECT_DIR;
+  if (projectDir) {
+    const fromProject = nearestCoordRoot(projectDir);
+    if (fromProject) return fromProject;
+  }
+
+  const nearest = nearestCoordRoot(start);
+  if (nearest) return nearest;
+  return gitCoordRoots(start)[0] ?? gitToplevel(start);
 }
+
+/** Nearest enclosing directory carrying `.harnery/`, or null. */
+export function nearestCoordRoot(start: string): string | null {
+  return ancestorCoordRoots(start)[0] ?? null;
+}
+
+/** Every enclosing directory carrying `.harnery/`, nearest first. */
+export function ancestorCoordRoots(start: string): string[] {
+  const found: string[] = [];
+  let dir = resolve(start);
+  while (true) {
+    if (existsSync(join(dir, ".harnery"))) found.push(dir);
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return found;
+}
+
+/**
+ * Git-derived roots carrying `.harnery/`, in superproject-first order.
+ *
+ * Spawns use `start` as cwd so a call about another checkout cannot inherit
+ * this process's repository. The common-dir fallback recovers a superproject
+ * from a submodule worktree, where Git reports no direct superproject path.
+ */
+export function gitCoordRoots(start: string): string[] {
+  const roots: string[] = [];
+  const push = (value: string | null) => {
+    if (value && existsSync(join(value, ".harnery")) && !roots.includes(value)) roots.push(value);
+  };
+
+  push(gitRevParse(start, "--show-superproject-working-tree"));
+  const common = gitRevParse(start, "--git-common-dir");
+  if (common) {
+    const index = common.indexOf("/.git/modules/");
+    if (index !== -1) push(common.substring(0, index));
+  }
+  push(gitToplevel(start));
+  return roots;
+}
+
+export function gitToplevel(start: string): string | null {
+  return gitRevParse(start, "--show-toplevel");
+}
+
+function gitRevParse(start: string, flag: string): string | null {
+  const key = `${start}\0${flag}`;
+  const cached = gitRevParseCache.get(key);
+  if (cached !== undefined) return cached;
+  let value: string | null = null;
+  try {
+    // A stale adapter project directory may no longer exist. Treat spawn
+    // failure as no path evidence instead of turning discovery into an error.
+    const result = spawnSync("git", ["rev-parse", flag], {
+      cwd: start,
+      encoding: "utf8",
+    });
+    if (result.status === 0) value = result.stdout.trim() || null;
+  } catch {
+    value = null;
+  }
+  gitRevParseCache.set(key, value);
+  return value;
+}
+
+const gitRevParseCache = new Map<string, string | null>();

package/src/core/hooks/resolve/owner.ts

@@ -45,6 +45,10 @@ export function resolveOwner(opts: {
     };
     const childId = value("subagent_id") ?? value("agent_id");
     const sessionId = value("session_id") ?? value("conversation_id");
+    // A payload with one unambiguous session identity needs no projection
+    // lookup. Live-authority tie-breaking matters only when the adapter also
+    // supplies a child candidate that could be stale or belong to the parent.
+    if (sessionId && !childId) return { instance_id: sessionId, source: "payload" };
     const child = childId ? readLiveCoordinationRow(opts.coordRoot, childId) : null;
     const session = sessionId ? readLiveCoordinationRow(opts.coordRoot, sessionId) : null;