kenaz 0.0.0-stage → 0.3.2

package/core/.specialist/tools/__tests__/task-1863-boot-lease-reuse.test.js

@@ -0,0 +1,99 @@
+// TASK_1863 — boot ghost-lease fix: re-running ansuz-boot-fast.js within the SAME
+// conversation must reuse the existing stream lease (via stream-lease register's
+// findLeaseByConversationId reuse path), not mint a new boot-<ts>-<pid> ghost.
+// Isolated sandbox via CLAUDE_PROJECT_DIR (stream-lease resolveBase honors it);
+// never touches the real repo's leases.
+//
+// Arms:
+//   1  (AC#2): 3 consecutive boots, same conversation id -> readAllLeases must hold
+//      exactly ONE lease for that conversation; boots 2/3 must not print a
+//      [Multi-Ansuz] banner (no self-ghost).
+//   2  (control): a boot under a DIFFERENT conversation id still creates its own
+//      new lease (reuse is conversation-scoped, not a global singleton).
+//
+// Usage: node .specialist/tools/__tests__/task-1863-boot-lease-reuse.test.js
+// Exit 0=all pass, non-zero=at least one failure.
+
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+function resolveRoot() {
+  var d = path.resolve(__dirname);
+  for (var i = 0; i < 10; i++) {
+    if (fs.existsSync(path.join(d, '.kenaz')) && fs.existsSync(path.join(d, '.specialist'))) return d;
+    var parent = path.dirname(d); if (parent === d) break; d = parent;
+  }
+  if (process.env.CLAUDE_PROJECT_DIR) return process.env.CLAUDE_PROJECT_DIR;
+  throw new Error('Cannot resolve repo root from ' + __dirname);
+}
+const WT = resolveRoot();
+const SB = path.join(os.tmpdir(), 't1863_boot_' + process.pid);
+const BOOT = path.join(WT, '.specialist/tools/ansuz-boot-fast.js');
+const STREAM_LEASE = path.join(WT, '.specialist/tools/stream-lease.js');
+const CONV1 = 'conv-t1863-boot';
+const CONV2 = 'conv-t1863-other';
+
+for (const d of [
+  '.kenaz/tasks/backlog', '.kenaz/tasks/active', '.kenaz/tasks/done',
+  '.kenaz/tasks/blocked', '.kenaz/tasks/cancel',
+  '.kenaz/specialist/sessions/leases',
+]) fs.mkdirSync(path.join(SB, d), { recursive: true });
+
+const env = { ...process.env, CLAUDE_PROJECT_DIR: SB };
+
+const boot = (convId) => spawnSync(process.execPath, [
+  BOOT,
+  '--project-path=' + SB,
+  '--conversation-id=' + convId,
+  '--mcp-base-url=http://127.0.0.1:1', // dead port: preamble arm fails instantly, offline-safe
+], { encoding: 'utf8', env, windowsHide: true, cwd: SB, timeout: 30000 });
+
+// Count via the exported readAllLeases (card: do NOT re-implement lease scanning).
+// Child process so resolveBase picks up CLAUDE_PROJECT_DIR=SB at module load.
+const readLeases = () => {
+  const r = spawnSync(process.execPath, ['-e',
+    'const sl=require(' + JSON.stringify(STREAM_LEASE) + ');process.stdout.write(JSON.stringify(sl.readAllLeases()));',
+  ], { encoding: 'utf8', env, windowsHide: true });
+  return JSON.parse(r.stdout || '[]');
+};
+
+let pass = 0, fail = 0;
+const check = (name, cond, detail) => {
+  console.log((cond ? 'PASS' : 'FAIL') + ' | ' + name + (cond ? '' : ' | ' + detail));
+  cond ? pass++ : fail++;
+};
+
+// ── Arm 1: 3 boots, same conversation ──
+const outs = [];
+for (let i = 0; i < 3; i++) {
+  const r = boot(CONV1);
+  outs.push((r.stdout || '') + (r.stderr || ''));
+  check('boot#' + (i + 1) + ' runs (banner printed)', (r.stdout || '').includes('Ansuz'),
+    'status=' + r.status + ' | ' + ((r.stdout || '') + (r.stderr || '')).slice(0, 300));
+}
+const all = readLeases();
+const mine = all.filter((l) => l.conversation_id === CONV1);
+check('AC#2: exactly ONE lease for the conversation after 3 boots', mine.length === 1,
+  'count=' + mine.length + ' sids=' + all.map((l) => l.session_id).join(','));
+check('boots 2+3 show no [Multi-Ansuz] self-ghost',
+  !outs[1].includes('[Multi-Ansuz]') && !outs[2].includes('[Multi-Ansuz]'),
+  'boot2/3 banner: ' + (outs[1] + outs[2]).split(String.fromCharCode(10)).filter((l) => l.includes('Multi-Ansuz') || l.includes('[live]') || l.includes('[stale]')).join(' / '));
+
+// ── Arm 2 (control): different conversation still gets its OWN new lease ──
+const r2 = boot(CONV2);
+const all2 = readLeases();
+const mine2 = all2.filter((l) => l.conversation_id === CONV2);
+const mine1 = all2.filter((l) => l.conversation_id === CONV1);
+check('control: new conversation creates a NEW lease (reuse is conversation-scoped)',
+  mine2.length === 1 && mine1.length === 1 && all2.length === 2,
+  'conv2=' + mine2.length + ' conv1=' + mine1.length + ' total=' + all2.length);
+check('control: second conversation SEES the first as a live peer (banner intact)',
+  ((r2.stdout || '')).includes('[Multi-Ansuz]'),
+  'no peer banner: ' + (r2.stdout || '').slice(0, 400));
+
+fs.rmSync(SB, { recursive: true, force: true });
+console.log('---');
+console.log('RESULT: ' + pass + ' pass, ' + fail + ' fail');
+process.exit(fail ? 1 : 0);

package/core/.specialist/tools/__tests__/task-1917-orphan-detection.test.js

@@ -0,0 +1,175 @@
+// TASK_1917 — cleanOrphanedClaude ownership-based orphan detection.
+//
+// Pins classifyOrphanCandidates() — the pure decision function production
+// (cleanOrphanedClaude in ../session.js) calls after gathering real process
+// and registry data. This test calls the SAME exported function with a
+// synthetic process/registry snapshot; it does not reimplement the judgment
+// logic, so a regression in the real function fails here too.
+//
+// Background: the pre-fix code taskkilled every claude.exe older than
+// staleHours (default 2h) regardless of who spawned it, silently killing the
+// user's own interactive sessions whenever Formation dispatch ran (see
+// TASK_1915 root-cause chain). The fix flips the criterion to ownership:
+// only a claude.exe positively matched to a live .active-dispatches.json
+// registry entry, whose own spawning process has since died, is a kill
+// candidate. Case 2 below is the regression guard for the original bug —
+// a 3-hour-old claude.exe that was never registered by Formation must be
+// skipped no matter its age.
+//
+// Also pins a review-round-2 fix: an earlier draft's fail-closed comment on
+// "supervisor liveness cannot be determined" was not implemented — the code
+// fell through to would_kill. Case 6 exercises exactly that branch.
+//
+// Usage: node .specialist/tools/__tests__/task-1917-orphan-detection.test.js
+// Exit 0=all pass, non-zero=at least one failure.
+
+const fs = require('fs');
+const path = require('path');
+
+function resolveRoot() {
+  var d = path.resolve(__dirname);
+  for (var i = 0; i < 10; i++) {
+    if (fs.existsSync(path.join(d, '.kenaz')) && fs.existsSync(path.join(d, '.specialist'))) return d;
+    var parent = path.dirname(d); if (parent === d) break; d = parent;
+  }
+  if (process.env.CLAUDE_PROJECT_DIR) return process.env.CLAUDE_PROJECT_DIR;
+  throw new Error('Cannot resolve repo root from ' + __dirname);
+}
+const WT = resolveRoot();
+const { classifyOrphanCandidates } = require(path.join(WT, '.specialist/tools/session.js'));
+
+let pass = 0, fail = 0;
+const check = (name, cond, detail) => {
+  console.log((cond ? 'PASS' : 'FAIL') + ' | ' + name + (cond ? '' : ' | ' + detail));
+  cond ? pass++ : fail++;
+};
+
+const now = Date.now();
+const THREE_HOURS_AGO = now - 3 * 60 * 60 * 1000; // > staleHours(2), the exact age
+                                                    // that used to trigger the bug
+
+// ── Synthetic process snapshot ──────────────────────────────────────────
+// Case 1: direct registration, supervisor dead -> would_kill (positive control)
+//   20001 claude.exe, ppid 20002 (its supervisor node.exe). 20002 is present
+//   in the snapshot but reported dead by isProcessAlive.
+//
+// Case 2: 3h-old claude.exe, never registered -> skipped/not_dispatch_owned
+//   (THE regression guard: this is exactly what the pre-fix age-only code
+//   would have killed.)
+//
+// Case 3: registered via cmd.exe wrapper (indirect match), supervisor alive
+//   -> skipped/supervisor_alive
+//   20005 claude.exe, ppid 20007 (cmd.exe wrapper, registered pid). 20007's
+//   own ppid 20008 (node.exe) is alive.
+//
+// Case 4: self/ancestor -> skipped/self_or_ancestor
+//
+// Case 5: VSCode extension host, 3h-old, never registered
+//   -> skipped/vscode_extension
+//
+// Case 6: registered via indirect match, but the registered wrapper pid has
+//   NO process record in the snapshot at all (already fully exited/reaped)
+//   -> skipped/supervisor_unknown (fail-closed; Windows PID recycling means
+//   "no record" must never be treated as "confirmed dead supervisor")
+//   20016 claude.exe, ppid 20017 (registered), but 20017 itself does not
+//   appear anywhere in allProcs.
+//
+// Bystander: unregistered claude.exe with ppid === null (top-of-tree), to
+// confirm the registry's `{pid: null}` early-registration-window entry
+// cannot accidentally "match" a process whose OWN ppid is null (the naive
+// bug would be `registryPids.has(proc.ppid)` true-ing on two nullish values).
+const allProcs = [
+  { pid: 20001, ppid: 20002, name: 'claude.exe', cmdline: 'claude --model opus "/dispatch-real"', createdAt: THREE_HOURS_AGO },
+  { pid: 20002, ppid: 20099, name: 'node.exe', cmdline: 'node headless.js (dead supervisor)', createdAt: THREE_HOURS_AGO },
+
+  { pid: 20003, ppid: 20004, name: 'claude.exe', cmdline: 'claude --model opus "interactive session"', createdAt: THREE_HOURS_AGO },
+  { pid: 20004, ppid: 1, name: 'WindowsTerminal.exe', cmdline: 'WindowsTerminal.exe', createdAt: THREE_HOURS_AGO },
+
+  { pid: 20005, ppid: 20007, name: 'claude.exe', cmdline: 'claude --model opus "/dispatch-wrapped"', createdAt: THREE_HOURS_AGO },
+  { pid: 20007, ppid: 20008, name: 'cmd.exe', cmdline: 'cmd.exe /d /s /c claude ...', createdAt: THREE_HOURS_AGO },
+  { pid: 20008, ppid: 1, name: 'node.exe', cmdline: 'node headless.js (ALIVE supervisor)', createdAt: THREE_HOURS_AGO },
+
+  { pid: 20010, ppid: 20011, name: 'claude.exe', cmdline: 'claude (self, the running dispatcher)', createdAt: now },
+
+  { pid: 20012, ppid: 20013, name: 'claude.exe', cmdline: 'claude --permission-prompt-tool ide-mcp', createdAt: THREE_HOURS_AGO },
+  { pid: 20013, ppid: 1, name: 'Code.exe', cmdline: 'Code.exe', createdAt: THREE_HOURS_AGO },
+
+  { pid: 20016, ppid: 20017, name: 'claude.exe', cmdline: 'claude --model opus "/dispatch-orphaned-wrapper"', createdAt: THREE_HOURS_AGO },
+  // NOTE: pid 20017 deliberately has NO entry in allProcs — simulates a
+  // cmd.exe wrapper that has already fully exited and been reaped.
+
+  { pid: 20019, ppid: null, name: 'claude.exe', cmdline: 'claude --model opus "top-of-tree, unregistered"', createdAt: THREE_HOURS_AGO },
+];
+
+const registryEntries = [
+  { pid: 20001 },       // direct match (case 1)
+  { pid: 20007 },       // indirect match via ppid (case 3)
+  { pid: null },        // early-registration window (headless.js:708-738) — must
+                         // never be treated as "registered pid 0/undefined matches
+                         // everything"; must not affect any other case's outcome.
+  { pid: 20017 },       // indirect match target with no process record (case 6)
+];
+
+const selfPids = new Set([20010, 20011]);
+
+function isProcessAlive(pid) {
+  // Ground truth for this fixture: 20002 (case 1's supervisor) is dead;
+  // 20008 (case 3's supervisor) is alive. Nothing else should ever be queried.
+  const aliveSet = new Set([20008]);
+  return aliveSet.has(pid);
+}
+
+const results = classifyOrphanCandidates({ allProcs, registryEntries, selfPids, isProcessAlive });
+const byPid = Object.fromEntries(results.map(r => [r.pid, r]));
+
+check(
+  'case 1 — direct registration, supervisor dead -> would_kill (positive control)',
+  byPid[20001] && byPid[20001].action === 'would_kill' && byPid[20001].reason === 'orphaned_dispatch_child',
+  JSON.stringify(byPid[20001])
+);
+
+check(
+  'case 2 — 3h-old unregistered interactive claude.exe -> skipped/not_dispatch_owned (REGRESSION GUARD)',
+  byPid[20003] && byPid[20003].action === 'skipped' && byPid[20003].reason === 'not_dispatch_owned',
+  JSON.stringify(byPid[20003])
+);
+
+check(
+  'case 3 — cmd.exe-wrapper indirect registration, supervisor alive -> skipped/supervisor_alive',
+  byPid[20005] && byPid[20005].action === 'skipped' && byPid[20005].reason === 'supervisor_alive',
+  JSON.stringify(byPid[20005])
+);
+
+check(
+  'case 4 — self/ancestor -> skipped/self_or_ancestor',
+  byPid[20010] && byPid[20010].action === 'skipped' && byPid[20010].reason === 'self_or_ancestor',
+  JSON.stringify(byPid[20010])
+);
+
+check(
+  'case 5 — VSCode extension host, 3h-old, unregistered -> skipped/vscode_extension',
+  byPid[20012] && byPid[20012].action === 'skipped' && byPid[20012].reason === 'vscode_extension',
+  JSON.stringify(byPid[20012])
+);
+
+check(
+  'case 6 — registered wrapper pid has no process record -> skipped/supervisor_unknown (fail-closed)',
+  byPid[20016] && byPid[20016].action === 'skipped' && byPid[20016].reason === 'supervisor_unknown',
+  JSON.stringify(byPid[20016])
+);
+
+check(
+  'bystander — registry {pid:null} entry does not match a claude.exe with ppid:null -> skipped/not_dispatch_owned',
+  byPid[20019] && byPid[20019].action === 'skipped' && byPid[20019].reason === 'not_dispatch_owned',
+  JSON.stringify(byPid[20019])
+);
+
+check(
+  'exactly 7 claude.exe processes classified (no extras, none dropped)',
+  results.length === 7,
+  'got ' + results.length + ': ' + JSON.stringify(results.map(r => r.pid))
+);
+
+console.log('---');
+console.log('RESULT: ' + pass + ' pass, ' + fail + ' fail');
+process.exit(fail ? 1 : 0);

package/core/.specialist/tools/__tests__/task-1977-banner-cap.test.js

@@ -0,0 +1,129 @@
+// TASK_1977 R3/R4(d) — ansuz-boot-fast.js handoff banner fan-out cap.
+//
+// MEASURED 2026-09-20: a run of 19 accumulated handoff slots printed 33.8 KB
+// into the fast-boot banner, most repeating the same pending_decisions text.
+// Fix: sort newest-first, print at most 3 full slots (deduped by topic
+// prefix), fold the rest into one summary line. Archiving must still touch
+// EVERY slot regardless of what gets rendered.
+//
+// Arms:
+//   1. 5 distinct-topic fixture slots -> 3 printed in full + 1 summary line
+//      naming the other 2 topics; all 5 archived.
+//   2. dedup case: several slots share a topic prefix -> duplicates fold
+//      into the summary instead of eating a "printed" slot.
+//
+// Usage: node .specialist/tools/__tests__/task-1977-banner-cap.test.js
+// Exit 0=all pass, non-zero=at least one failure.
+
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+function resolveRoot() {
+  let d = path.resolve(__dirname);
+  for (let i = 0; i < 10; i++) {
+    if (fs.existsSync(path.join(d, '.kenaz')) && fs.existsSync(path.join(d, '.specialist'))) return d;
+    const parent = path.dirname(d);
+    if (parent === d) break;
+    d = parent;
+  }
+  if (process.env.CLAUDE_PROJECT_DIR) return process.env.CLAUDE_PROJECT_DIR;
+  throw new Error('Cannot resolve repo root from ' + __dirname);
+}
+const WT = resolveRoot();
+const BOOT = path.join(WT, '.specialist/tools/ansuz-boot-fast.js');
+
+let pass = 0, fail = 0;
+function check(name, cond, detail) {
+  console.log((cond ? 'PASS' : 'FAIL') + ' | ' + name + (cond ? '' : ' | ' + detail));
+  cond ? pass++ : fail++;
+}
+
+function makeSandbox(prefix) {
+  const sb = path.join(os.tmpdir(), prefix + '_' + process.pid + '_' + Date.now());
+  for (const d of [
+    '.kenaz/tasks/backlog', '.kenaz/tasks/active', '.kenaz/tasks/done',
+    '.kenaz/tasks/blocked', '.kenaz/tasks/cancel',
+    '.kenaz/specialist/sessions/leases',
+    '.kenaz/specialist/handoffs',
+  ]) fs.mkdirSync(path.join(sb, d), { recursive: true });
+  return sb;
+}
+
+function writeSlot(sb, name, topic, generatedAt) {
+  const p = path.join(sb, '.kenaz/specialist/handoffs', name);
+  fs.writeFileSync(p, JSON.stringify({
+    generated_at: generatedAt,
+    isbar: {
+      situation: { current_topic: topic, pending_decisions: 'pending for ' + topic },
+      recommendation: { first_action: 'continue ' + topic },
+      assessment: { unfinished: 'unfinished ' + topic },
+    },
+  }));
+}
+
+function boot(sb) {
+  return spawnSync(process.execPath, [
+    BOOT,
+    '--project-path=' + sb,
+    '--conversation-id=t1977-banner-' + path.basename(sb),
+    '--mcp-base-url=http://127.0.0.1:1', // dead port: preamble arm fails instantly, offline-safe
+  ], { encoding: 'utf8', env: { ...process.env, CLAUDE_PROJECT_DIR: sb }, windowsHide: true, cwd: sb, timeout: 30000 });
+}
+
+// ── Arm 1: 5 distinct-topic slots, oldest to newest ──
+const sb1 = makeSandbox('t1977_banner_distinct');
+writeSlot(sb1, 'slot-1.json', 'Topic ONE',   '2026-09-15T00:00:00.000Z');
+writeSlot(sb1, 'slot-2.json', 'Topic TWO',   '2026-09-16T00:00:00.000Z');
+writeSlot(sb1, 'slot-3.json', 'Topic THREE', '2026-09-17T00:00:00.000Z');
+writeSlot(sb1, 'slot-4.json', 'Topic FOUR',  '2026-09-18T00:00:00.000Z');
+writeSlot(sb1, 'slot-5.json', 'Topic FIVE',  '2026-09-19T00:00:00.000Z'); // newest
+const r1 = boot(sb1);
+const out1 = (r1.stdout || '') + (r1.stderr || '');
+check('arm1: boot runs (banner printed)', out1.includes('Ansuz'), 'status=' + r1.status + ' | ' + out1.slice(0, 300));
+// TASK_2280: the banner prints String(slot_file).slice(0, 8) (TASK_1988 diet),
+// so "slot-5.json" shows as "[slot-5.j]" -- match the 8-char prefix, not the filename.
+const fullBlocks1 =(out1.match(/📜 Handoff \[slot-\d\.j\]:/g) || []).length;
+check('arm1: exactly 3 full slots printed', fullBlocks1 === 3, 'count=' + fullBlocks1 + '\n' + out1);
+check('arm1: newest 3 topics printed in full (FIVE, FOUR, THREE)',
+  out1.includes('Topic FIVE') && out1.includes('Topic FOUR') && out1.includes('Topic THREE'),
+  out1);
+check('arm1: one summary line for the remaining 2, naming their topics',
+  /2 more handoff slots archived \(topics: Topic TWO; Topic ONE\)/.test(out1),
+  out1);
+const archiveDir1 = path.join(sb1, '.kenaz/specialist/handoff_archive');
+const archived1 = fs.existsSync(archiveDir1) ? fs.readdirSync(archiveDir1) : [];
+check('arm1: ALL 5 slots archived regardless of banner selection', archived1.length === 5, 'archived=' + JSON.stringify(archived1));
+const remaining1 = fs.readdirSync(path.join(sb1, '.kenaz/specialist/handoffs'));
+check('arm1: handoffs dir drained after archiving', remaining1.length === 0, 'remaining=' + JSON.stringify(remaining1));
+
+// ── Arm 2: dedup -- 4 slots share a topic prefix, 1 is distinct ──
+const sb2 = makeSandbox('t1977_banner_dedup');
+const REPEATED_TOPIC = 'Repeated handoff topic used verbatim across several stale Codex sessions that keeps recurring';
+writeSlot(sb2, 'dup-1.json', REPEATED_TOPIC, '2026-09-16T00:00:00.000Z');
+writeSlot(sb2, 'dup-2.json', REPEATED_TOPIC, '2026-09-17T00:00:00.000Z');
+writeSlot(sb2, 'dup-3.json', REPEATED_TOPIC, '2026-09-18T00:00:00.000Z'); // newest of the dupes
+writeSlot(sb2, 'unique.json', 'A distinct one-off topic', '2026-09-15T00:00:00.000Z'); // oldest overall
+const r2 = boot(sb2);
+const out2 = (r2.stdout || '') + (r2.stderr || '');
+check('arm2: boot runs (banner printed)', out2.includes('Ansuz'), 'status=' + r2.status + ' | ' + out2.slice(0, 300));
+const fullBlocks2 = (out2.match(/📜 Handoff \[(dup-\d\.js|unique\.j)\]:/g) || []).length;
+check('arm2: only 2 full slots printed (one per distinct topic prefix, dupes folded)', fullBlocks2 === 2, 'count=' + fullBlocks2 + '\n' + out2);
+check('arm2: newest dupe (dup-3) is the one printed in full, not dup-1/dup-2',
+  out2.includes('📜 Handoff [dup-3.js]:') && !out2.includes('📜 Handoff [dup-1.js]:') && !out2.includes('📜 Handoff [dup-2.js]:'),
+  out2);
+check('arm2: the distinct topic is also printed in full', out2.includes('📜 Handoff [unique.j]:'), out2);
+check('arm2: summary line folds the 2 duplicate slots', /2 more handoff slots archived/.test(out2), out2);
+const archiveDir2 = path.join(sb2, '.kenaz/specialist/handoff_archive');
+const archived2 = fs.existsSync(archiveDir2) ? fs.readdirSync(archiveDir2) : [];
+check('arm2: ALL 4 slots archived regardless of dedup folding', archived2.length === 4, 'archived=' + JSON.stringify(archived2));
+
+// ── cleanup ──
+for (const sb of [sb1, sb2]) {
+  try { fs.rmSync(sb, { recursive: true, force: true }); } catch { /* best-effort */ }
+}
+
+console.log('---');
+console.log('RESULT: ' + pass + ' pass, ' + fail + ' fail');
+process.exit(fail > 0 ? 1 : 0);

package/core/.specialist/tools/__tests__/task-1983-lease-project-path.test.js

@@ -0,0 +1,96 @@
+// TASK_1983 (R1/R5) — stream-lease.js lease files must carry a stable project_path
+// field so the Rust-side active_project_paths() (features/session/active_projects.rs)
+// can map a live lease to a project without any JS<->Rust bridge at read time.
+//
+// Contract under test (documented in both stream-lease.js and active_projects.rs):
+//   - `register --project-path=<p>` writes lease.project_path = <p>.
+//   - `register` on an EXISTING conversation (reuse path) refreshes project_path
+//     to whatever --project-path is passed on the reuse call.
+//   - `register` without --project-path leaves project_path absent (back-compat;
+//     older callers / a lease pre-dating this task must not crash JS or Rust readers).
+//   - `touch --project-path=<p>` self-heals project_path on an existing lease
+//     (mirrors lease-touch.js passing CLAUDE_PROJECT_DIR on every prompt).
+//
+// Isolated sandbox via CLAUDE_PROJECT_DIR (stream-lease resolveBase honors it);
+// never touches the real repo's leases.
+//
+// Usage: node .specialist/tools/__tests__/task-1983-lease-project-path.test.js
+// Exit 0=all pass, non-zero=at least one failure.
+
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+function resolveRoot() {
+  var d = path.resolve(__dirname);
+  for (var i = 0; i < 10; i++) {
+    if (fs.existsSync(path.join(d, '.kenaz')) && fs.existsSync(path.join(d, '.specialist'))) return d;
+    var parent = path.dirname(d); if (parent === d) break; d = parent;
+  }
+  if (process.env.CLAUDE_PROJECT_DIR) return process.env.CLAUDE_PROJECT_DIR;
+  throw new Error('Cannot resolve repo root from ' + __dirname);
+}
+const WT = resolveRoot();
+const SB = path.join(os.tmpdir(), 't1983_lease_' + process.pid);
+const STREAM_LEASE = path.join(WT, '.specialist/tools/stream-lease.js');
+
+fs.mkdirSync(path.join(SB, '.kenaz', 'specialist', 'sessions', 'leases'), { recursive: true });
+const env = { ...process.env, CLAUDE_PROJECT_DIR: SB };
+
+const run = (args) => spawnSync(process.execPath, [STREAM_LEASE, ...args], {
+  encoding: 'utf8', env, windowsHide: true, cwd: SB, timeout: 10000,
+});
+
+const readLease = (sid) => {
+  const r = spawnSync(process.execPath, ['-e',
+    'const sl=require(' + JSON.stringify(STREAM_LEASE) + ');process.stdout.write(JSON.stringify(sl.readLease(' + JSON.stringify(sid) + ')));',
+  ], { encoding: 'utf8', env, windowsHide: true });
+  return JSON.parse(r.stdout || 'null');
+};
+
+let pass = 0, fail = 0;
+const check = (name, cond, detail) => {
+  console.log((cond ? 'PASS' : 'FAIL') + ' | ' + name + (cond ? '' : ' | ' + detail));
+  cond ? pass++ : fail++;
+};
+
+// ── Arm 1: register --project-path writes project_path ──
+const PROJ_A = path.join(SB, 'proj-a');
+run(['register', '--session-id=s1', '--project-path=' + PROJ_A, '--conversation-id=conv1']);
+const l1 = readLease('s1');
+check('register --project-path writes lease.project_path', l1 && l1.project_path === PROJ_A,
+  'lease=' + JSON.stringify(l1));
+
+// ── Arm 2: re-register on the SAME conversation (reuse path) refreshes project_path ──
+const PROJ_B = path.join(SB, 'proj-b');
+run(['register', '--session-id=s1-ignored', '--project-path=' + PROJ_B, '--conversation-id=conv1']);
+const l1b = readLease('s1'); // reuse keeps the original session_id
+check('register reuse path refreshes project_path to the new value', l1b && l1b.project_path === PROJ_B,
+  'lease=' + JSON.stringify(l1b));
+check('register reuse path keeps the original session_id (no ghost)', l1b && l1b.session_id === 's1',
+  'lease=' + JSON.stringify(l1b));
+
+// ── Arm 3 (back-compat control): register WITHOUT --project-path leaves it absent ──
+run(['register', '--session-id=s2']);
+const l2 = readLease('s2');
+check('register without --project-path does not crash and yields no project_path',
+  l2 && l2.project_path == null, 'lease=' + JSON.stringify(l2));
+
+// ── Arm 4: touch --project-path self-heals an existing lease ──
+const PROJ_C = path.join(SB, 'proj-c');
+run(['touch', '--session-id=s2', '--project-path=' + PROJ_C]);
+const l2b = readLease('s2');
+check('touch --project-path self-heals lease.project_path', l2b && l2b.project_path === PROJ_C,
+  'lease=' + JSON.stringify(l2b));
+
+// ── Arm 5: touch WITHOUT --project-path leaves an existing value untouched ──
+run(['touch', '--session-id=s2']);
+const l2c = readLease('s2');
+check('touch without --project-path preserves the existing value', l2c && l2c.project_path === PROJ_C,
+  'lease=' + JSON.stringify(l2c));
+
+fs.rmSync(SB, { recursive: true, force: true });
+console.log('---');
+console.log('RESULT: ' + pass + ' pass, ' + fail + ' fail');
+process.exit(fail ? 1 : 0);

package/core/.specialist/tools/__tests__/task-2218-boot-session-id.test.js

@@ -0,0 +1,118 @@
+// TASK_2218 — ansuz-boot-fast.js must derive _convId from the REAL
+// hook-provided session id (last_prompt_session.json, written by
+// .claude/hooks/ansuz-session-pin.js every UserPromptSubmit turn) instead of
+// guessing "the newest *.jsonl mtime in the cwd's transcript dir" -- that
+// guess silently resolves to ANOTHER session's transcript whenever two
+// sessions share a cwd (field report: installed user, every session's cwd =
+// kenaz-core; boot derived the wrong conversation_id, so
+// ansuz_handoff_snapshot wrote to the OTHER session's slot).
+//
+// Arms:
+//   1  A fresh, real hint -> _convId comes from it verbatim (banner line).
+//   2  Two DIFFERENT hints in the SAME cwd (sandbox dir), one boot each ->
+//      each boot resolves to its OWN id -- never the same, never a guess.
+//   3  Negative control: a STALE hint (older than the 5-minute freshness
+//      window) must NOT be used -- falls through to the pre-existing guess
+//      (which finds nothing in this sandbox -> no conversation_id line at
+//      all, proving the hint path, not the guess path, produced arms 1/2).
+//
+// Usage: node .specialist/tools/__tests__/task-2218-boot-session-id.test.js
+// Exit 0=all pass, non-zero=at least one failure.
+
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+
+function resolveRoot() {
+  let d = path.resolve(__dirname);
+  for (let i = 0; i < 10; i++) {
+    if (fs.existsSync(path.join(d, '.kenaz')) && fs.existsSync(path.join(d, '.specialist'))) return d;
+    const parent = path.dirname(d); if (parent === d) break; d = parent;
+  }
+  if (process.env.CLAUDE_PROJECT_DIR) return process.env.CLAUDE_PROJECT_DIR;
+  throw new Error('Cannot resolve repo root from ' + __dirname);
+}
+const WT = resolveRoot();
+const BOOT = path.join(WT, '.specialist/tools/ansuz-boot-fast.js');
+
+let pass = 0, fail = 0;
+const check = (name, cond, detail) => {
+  console.log((cond ? 'PASS' : 'FAIL') + ' | ' + name + (cond ? '' : ' | ' + detail));
+  cond ? pass++ : fail++;
+};
+
+function freshSandbox(tag) {
+  const dir = path.join(os.tmpdir(), 'kenaz_t2218_boot_' + tag + '_' + process.pid);
+  for (const d of [
+    '.kenaz/tasks/backlog', '.kenaz/tasks/active', '.kenaz/tasks/done',
+    '.kenaz/tasks/blocked', '.kenaz/tasks/cancel',
+    '.kenaz/specialist/sessions/leases',
+  ]) fs.mkdirSync(path.join(dir, d), { recursive: true });
+  return dir;
+}
+
+function writeHint(sandbox, sessionId, writtenAt) {
+  fs.writeFileSync(
+    path.join(sandbox, '.kenaz', 'specialist', 'last_prompt_session.json'),
+    JSON.stringify({ session_id: sessionId, transcript_path: null, written_at: writtenAt }),
+    'utf8',
+  );
+}
+
+function boot(sandbox) {
+  const env = { ...process.env, CLAUDE_PROJECT_DIR: sandbox };
+  return spawnSync(process.execPath, [
+    BOOT,
+    '--project-path=' + sandbox,
+    '--mcp-base-url=http://127.0.0.1:1', // dead port: preamble arm fails instantly, offline-safe
+  ], { encoding: 'utf8', env, windowsHide: true, cwd: sandbox, timeout: 30000 });
+}
+
+function convIdFromBanner(stdout) {
+  const m = /\[session\] conversation_id=(\S+)/.exec(stdout || '');
+  return m ? m[1] : null;
+}
+
+// ── Arm 1: a fresh hook-written hint is used verbatim ──
+{
+  const sb = freshSandbox('arm1');
+  writeHint(sb, 'hook-sess-A', Date.now());
+  const r = boot(sb);
+  check('arm1: boot runs (banner printed)', (r.stdout || '').includes('Ansuz'), 'status=' + r.status + ' | ' + (r.stderr || '').slice(0, 300));
+  check('arm1: _convId comes from the hint, not a guess', convIdFromBanner(r.stdout) === 'hook-sess-A', 'got=' + convIdFromBanner(r.stdout));
+  fs.rmSync(sb, { recursive: true, force: true });
+}
+
+// ── Arm 2: two DIFFERENT hints in the SAME cwd -> two DIFFERENT conversation_ids ──
+{
+  const sb = freshSandbox('arm2');
+  writeHint(sb, 'hook-sess-FIRST', Date.now());
+  const r1 = boot(sb);
+  const conv1 = convIdFromBanner(r1.stdout);
+  writeHint(sb, 'hook-sess-SECOND', Date.now());
+  const r2 = boot(sb);
+  const conv2 = convIdFromBanner(r2.stdout);
+  check('arm2: first boot resolves to its own hint', conv1 === 'hook-sess-FIRST', 'got=' + conv1);
+  check('arm2: second boot (same cwd) resolves to ITS OWN hint, not the first', conv2 === 'hook-sess-SECOND', 'got=' + conv2);
+  check('arm2: the two concurrent-looking boots never collide on one id', conv1 !== conv2, conv1 + ' vs ' + conv2);
+  fs.rmSync(sb, { recursive: true, force: true });
+}
+
+// ── Arm 3 (negative control): a STALE hint must be ignored ──
+{
+  const sb = freshSandbox('arm3');
+  writeHint(sb, 'hook-sess-STALE', Date.now() - 10 * 60 * 1000); // 10 min old > 5 min freshness window
+  const r = boot(sb);
+  check('arm3: boot runs (banner printed)', (r.stdout || '').includes('Ansuz'), 'status=' + r.status);
+  check(
+    'arm3: a stale hint is never used (falls through to the guess, which finds nothing here)',
+    convIdFromBanner(r.stdout) !== 'hook-sess-STALE',
+    'got=' + convIdFromBanner(r.stdout) + ' (must not be the stale id)',
+  );
+  fs.rmSync(sb, { recursive: true, force: true });
+}
+
+console.log('---');
+console.log('RESULT: ' + pass + ' pass, ' + fail + ' fail');
+process.exit(fail ? 1 : 0);