ruvnet-brain 4.5.2 → 4.5.4

package/plugin/scripts/session-snapshot-hook.mjs

@@ -1,6 +1,9 @@
+import { DETACHED_REPLAY_BUDGET_MS, REPLAY_LOCK_STALE_MS, REPLAY_LOCK_ABANDON_MS, pidAlive, queueCapture, queuedCaptures, queuedWork, processStart, reclaimOrphans, takeReplayLock, refreshReplayLock, adoptReplayLock, releaseReplayLock, replayOutboxDetached, runOutboxReplay, drainCaptureQueue } from './project-capture-queue.mjs';
+export { DETACHED_REPLAY_BUDGET_MS, REPLAY_LOCK_STALE_MS, REPLAY_LOCK_ABANDON_MS, pidAlive, queueCapture, queuedCaptures, queuedWork, processStart, reclaimOrphans, takeReplayLock, refreshReplayLock, adoptReplayLock, releaseReplayLock, replayOutboxDetached, runOutboxReplay, drainCaptureQueue } from './project-capture-queue.mjs';
 import fs from 'node:fs';
 import path from 'node:path';
-import { spawn, spawnSync } from 'node:child_process';
+import os from 'node:os';
+import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { ProgressionOutbox } from './project-progression-outbox.mjs';
 import {
@@ -12,7 +15,7 @@ import { projectDirectory } from './project-identity.mjs';
 import { buildProjectProgression } from './project-progression-producer.mjs';
 import { ProjectProgressionStore } from './project-progression-store.mjs';
 import { resolveProjectStore } from './project-store-resolver.mjs';
-import { captureTurnOutcome } from './turn-outcome-capture.mjs';
+import { resolveTurnDb, captureTurnOutcome } from './turn-outcome-capture.mjs';
 import { captureContinuityEvents, stopNotice } from './continuity-journal.mjs';
 
 /**
@@ -79,7 +82,7 @@ export function writeSessionSnapshot(projectDir, event) {
  * A deadline-bounded `ruflo` runner. The store's own 120s per-call timeout is right for a deliberate
  * CLI invocation and far too generous for a lifecycle hook, so the remaining budget caps every call.
  */
-function boundedStoreFactory(deadlineAt) {
+export function boundedStoreFactory(deadlineAt) {
   return (options) => new ProjectProgressionStore({
     ...options,
     runner: (binary, args, runOptions) => {
@@ -113,6 +116,7 @@ function boundedStoreFactory(deadlineAt) {
  */
 export function runSessionSnapshotHook(projectDir, event, {
   rawInput = '',
+  env = process.env,
   host = process.env.RUVNET_HOOK_HOST || 'claude',
   captureProgression = captureProjectTransition,
   produce = buildProjectProgression,
@@ -125,22 +129,32 @@ export function runSessionSnapshotHook(projectDir, event, {
   ordered = null,
   captureEvents = captureContinuityEvents,
 } = {}) {
+  const suspended = (reason) => ({ metadataWritten: false, progressionCaptured: false, receipt: null, skipped: reason,
+    turn: { event, recorded: false, skipped: reason }, continuity: { event, recorded: 0, launched: false, skipped: reason } });
+  // Consent is checked before metadata, transcript inspection or any durable capture queue.
+  try {
+    const consent = resolveTurnDb({ projectDir, brainHome: env.RUVNET_BRAIN_HOME || path.join(env.HOME || os.homedir(), '.cache', 'ruvnet-brain'),
+      gitTimeoutMs: Math.max(1, Math.min(500, budgetMs)) });
+    if (consent.skipped) return suspended(consent.skipped);
+  } catch (error) {
+    return suspended(`capture consent unavailable: ${error.message}`);
+  }
   // The detached worker re-runs a QUEUED boundary; its session receipt was already written then.
   const metadataWritten = writeMetadata ? writeSessionSnapshot(projectDir, event) : false;
   let payload;
   try { payload = rawInput ? JSON.parse(rawInput) : {}; } catch { payload = {}; }
-  // TURN OUTCOMES FIRST, and independent of `.swarm`: every turn in every repository is recorded
-  // (a project without `.swarm` records to the machine-wide db outside it — turn-outcome-capture.mjs).
+  // TURN OUTCOMES FIRST: consent and canonical store availability govern whether a turn is queued
+  // (a project without a store requires persisted opt-in — turn-outcome-capture.mjs).
   // It only reads and spawns a detached writer, so it costs the progression budget below nothing.
   let turn;
-  try { turn = captureTurn({ projectDir, event, payload, host }); } catch (error) {
+  try { turn = captureTurn({ projectDir, event, payload, host, env }); } catch (error) {
     turn = { recorded: false, skipped: `turn capture failed: ${error.message}` };
   }
   // MATERIAL EVENTS (continuity-journal.mjs): commits, releases, gates, findings, decisions, lessons —
   // journalled to the durable outbox with one fsync and committed by a detached drainer. Like turn
   // capture it is independent of the progression lock below and costs this boundary only a read.
   let continuity;
-  try { continuity = captureEvents({ projectDir, event, payload, host }); } catch (error) {
+  try { continuity = captureEvents({ projectDir, event, payload, host, env }); } catch (error) {
     continuity = { recorded: 0, skipped: `continuity capture failed: ${error.message}` };
   }
   const idle = { metadataWritten, progressionCaptured: false, receipt: null, turn, continuity };
@@ -149,7 +163,7 @@ export function runSessionSnapshotHook(projectDir, event, {
     if (payload.hook_event_name !== event) {
       throw new Error(`progression boundary mismatch: expected ${event}, received ${payload.hook_event_name}`);
     }
-    const result = captureProgression({ host, payload, projectDir });
+    const result = captureProgression({ host, payload, projectDir, storeFactory: (options) => makeStoreFactory(now() + budgetMs)({ ...options, env }) });
     return { ...idle, progressionCaptured: true, receipt: result.receipt };
   }
 
@@ -187,7 +201,10 @@ export function runSessionSnapshotHook(projectDir, event, {
   // `ordered` is the worker's own re-entry: it already holds the lock and is draining in order.
   let token = ordered;
   const handOff = (why) => {
-    const queued = queueCapture({ projectDir: root, event, host, payload });
+    let frozen;
+    try { frozen = produce({ resolution, projectDir, payload, host, trigger: event }); } catch { frozen = null; }
+    const queued = frozen?.projectProgression ? queueCapture({ projectDir: root, originProjectDir: projectDir, env, event, host,
+      payload: { session_id: payload.session_id, hook_event_name: event, projectProgression: frozen.projectProgression } }) : null;
     const handed = queued ? spawnReplay({ projectDir: root, token }) : false;
     if (!handed && token && token !== ordered) releaseReplayLock(root, token);
     return { ...idle, replayed: 0, progressionCaptured: false, deferredToReplayer: Boolean(queued),
@@ -208,7 +225,7 @@ export function runSessionSnapshotHook(projectDir, event, {
   let handedLock = false;
   try {
     const deadlineAt = now() + budgetMs;
-    const storeFactory = makeStoreFactory(deadlineAt);
+    const storeFactory = (options) => makeStoreFactory(deadlineAt)({ ...options, env });
     let replayed = 0;
     if (budgetMs >= REPLAY_MIN_BUDGET_MS) {
       try {
@@ -226,7 +243,7 @@ export function runSessionSnapshotHook(projectDir, event, {
 
     let produced;
     try {
-      produced = produce({ resolution, payload, host, trigger: event });
+      produced = produce({ resolution, projectDir, payload, host, trigger: event });
     } catch (error) {
       return { ...idle, replayed, skipped: `producer failed: ${error.message}` };
     }
@@ -271,276 +288,31 @@ export function runSessionSnapshotHook(projectDir, event, {
   }
 }
 
-/**
- * How long the detached worker may spend per step. The lock is refreshed between steps and goes stale
- * after REPLAY_LOCK_STALE_MS, which is more than twice a step, so a live worker never looks dead.
- */
-export const DETACHED_REPLAY_BUDGET_MS = 45_000;
-export const REPLAY_LOCK_STALE_MS = 120_000;
-const REPLAY_LOCK = '.progression-replay.lock';
-const QUEUE_PREFIX = '.progression-capture-queue-';
-const lockPath = (projectDir) => path.join(projectDir, '.swarm', REPLAY_LOCK);
-// The lock's FIRST line is the owner token; a second `pid <n>` line names the process holding it.
-const readLock = (projectDir) => { try { return fs.readFileSync(lockPath(projectDir), 'utf8').split('\n')[0].trim(); } catch { return null; } };
-const CLAIM_PREFIX = '.progression-capture-claimed-';
-/** After this long a stale lock is taken over even if its holder pid looks alive (pid reuse, a wedged process). */
-export const REPLAY_LOCK_ABANDON_MS = 30 * 60_000;
-
-/** Is a process with this pid alive? EPERM means alive but not ours. Never throws. */
-export function pidAlive(pid) {
-  if (!Number.isSafeInteger(pid) || pid <= 0) return false;
-  try { process.kill(pid, 0); return true; } catch (error) { return error?.code === 'EPERM'; }
-}
-const seqOf = (name) => Number((/(\d{12})\.json$/.exec(name) || [])[1] ?? 0);
-const swarmEntries = (projectDir) => { try { return fs.readdirSync(path.join(projectDir, '.swarm')); } catch { return []; } };
-// 4.4.0 named queue files by wall clock: `<prefix><15-digit ms>-<hrtime>-<pid>-<n>.json`. Open 4.4.0
-// sessions keep queuing in that format after the update, so the two formats coexist for a while.
-const LEGACY_QUEUE = /^\d{15}-/;
-const queueTail = (name) => (name.startsWith(QUEUE_PREFIX) ? name.slice(QUEUE_PREFIX.length) : name.slice(CLAIM_PREFIX.length).replace(/^\d+-[A-Za-z0-9]*-\d+-/, ''));   // <pid>-<start>-<queuedAt>-
-const mtimeOf = (projectDir, name) => { try { return fs.statSync(path.join(projectDir, '.swarm', name)).mtimeMs; } catch { return Infinity; } };
-
-/**
- * Queue one boundary's capture for the worker (0600, inside the project's own .swarm). ORDER IS THE
- * ORDER OF EXCLUSIVE CREATION: the name is the next sequence number after every queued or claimed one,
- * created with O_EXCL and retried on collision — never a clock, which can step backwards or wrap.
- */
-export function queueCapture({ projectDir, event, host, payload }) {
-  const body = JSON.stringify({ event, host, payload });
-  for (let attempt = 0; attempt < 64; attempt += 1) {
-    const seq = Math.max(0, ...swarmEntries(projectDir).filter((n) => n.startsWith(QUEUE_PREFIX) || n.startsWith(CLAIM_PREFIX)).map(seqOf)) + 1;
-    const file = path.join(projectDir, '.swarm', `${QUEUE_PREFIX}${String(seq).padStart(12, '0')}.json`);
-    try { fs.writeFileSync(file, body, { flag: 'wx', mode: 0o600 }); return file; } catch (error) {
-      if (error?.code !== 'EEXIST') return null;
-    }
-  }
-  return null;
-}
-
-/**
- * Unclaimed queued captures, in queue order. While any 4.4.0 (timestamp-named) entry is present the
- * order is creation time (mtime, then name) — by NAME every 4.4.1 sequence file would sort before every
- * 4.4.0 one, replaying newer captures before older ones across the upgrade window. Once the legacy
- * entries are gone the order is the sequence alone, independent of any clock.
- */
-export function queuedCaptures(projectDir) {
-  const all = swarmEntries(projectDir).filter((n) => (n.startsWith(QUEUE_PREFIX) || n.startsWith(CLAIM_PREFIX)) && n.endsWith('.json'));
-  const queued = all.filter((n) => n.startsWith(QUEUE_PREFIX));
-  const mixed = all.some((n) => LEGACY_QUEUE.test(queueTail(n)));
-  const ordered = mixed
-    ? queued.map((n) => [mtimeOf(projectDir, n), n]).sort((a, b) => a[0] - b[0] || (a[1] < b[1] ? -1 : a[1] > b[1] ? 1 : 0)).map(([, n]) => n)
-    : queued.sort();
-  return ordered.map((n) => path.join(projectDir, '.swarm', n));
-}
-
-/** All older work a boundary must wait behind: unclaimed captures plus captures a worker has claimed. */
-export function queuedWork(projectDir) {
-  return swarmEntries(projectDir).filter((n) => (n.startsWith(QUEUE_PREFIX) || n.startsWith(CLAIM_PREFIX)) && n.endsWith('.json')).length;
-}
-
-/**
- * A process's START TIME, as a filename-safe token, or null where it cannot be read (no `ps`, e.g.
- * Windows). With the pid it identifies the process: a reused pid has a different start time.
- */
-export function processStart(pid) {
-  try {
-    // TZ and locale PINNED: `lstart` prints local time in the locale's format, so two workers with
-    // different settings would record the same live process differently and read it as pid reuse.
-    const r = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8', timeout: 2000, windowsHide: true,
-      env: { ...process.env, TZ: 'UTC', LC_ALL: 'C', LANG: 'C' } });
-    const s = String(r.stdout || '').replace(/[^A-Za-z0-9]/g, '');
-    return r.status === 0 && s ? s : null;
-  } catch { return null; }
-}
-let selfStart;
-const ownStart = () => (selfStart === undefined ? (selfStart = processStart(process.pid)) : selfStart);
-
-/**
- * Claim a queued capture by atomic rename; null if taken. The claim's name records pid, start time and
- * the queue file's ORIGINAL mtime (its creation order, which the mixed upgrade window sorts by); the
- * claim file's own mtime is then set to the claim time, from which the orphan ceiling counts.
- */
-function claimQueued(file) {
-  let queuedAt = 0;
-  try { queuedAt = Math.floor(fs.statSync(file).mtimeMs); } catch { return null; }
-  const claimed = path.join(path.dirname(file), `${CLAIM_PREFIX}${process.pid}-${ownStart() || 'na'}-${queuedAt}-${path.basename(file).slice(QUEUE_PREFIX.length)}`);
-  try { fs.renameSync(file, claimed); } catch { return null; }
-  try { const t = new Date(); fs.utimesSync(claimed, t, t); } catch { /* the ceiling then counts from queue time: earlier, never later */ }
-  return claimed;
-}
-const unclaimedName = (claimed) => path.join(path.dirname(claimed), `${QUEUE_PREFIX}${queueTail(path.basename(claimed))}`);
-/** Put a claim back in the queue: rename (atomic, needs no hard links), restoring its creation order. */
-const returnClaim = (claimed) => {
-  const queuedAt = Number(path.basename(claimed).slice(CLAIM_PREFIX.length).split('-')[2]);
-  const back = unclaimedName(claimed);
-  try { fs.renameSync(claimed, back); } catch { return false; }
-  if (Number.isFinite(queuedAt) && queuedAt > 0) { try { const t = new Date(queuedAt); fs.utimesSync(back, t, t); } catch { /* best effort */ } }
-  return true;
-};
-
-/**
- * Return to the queue every claim whose worker is gone: its pid is dead, OR the pid now belongs to a
- * different process (start time differs — pid reuse), OR the claim is older than REPLAY_LOCK_ABANDON_MS
- * whatever the pid says (a reused pid where no start time can be read, a wedged worker). Without the
- * last two a reused pid stranded a claim forever and every Stop spawned a worker that could not run it.
- */
-export function reclaimOrphans(projectDir, { isAlive = pidAlive, startOf = processStart, now = Date.now() } = {}) {
-  let n = 0;
-  for (const name of swarmEntries(projectDir).filter((x) => x.startsWith(CLAIM_PREFIX))) {
-    const [pidText, start] = name.slice(CLAIM_PREFIX.length).split('-');
-    const pid = Number(pidText);
-    const claimed = path.join(projectDir, '.swarm', name);
-    const abandoned = now - mtimeOf(projectDir, name) > REPLAY_LOCK_ABANDON_MS;
-    let gone = abandoned || !isAlive(pid);
-    if (!gone && start && start !== 'na') {
-      const current = startOf(pid);
-      gone = Boolean(current) && current !== start;
-    }
-    if (gone && returnClaim(claimed)) n += 1;
-  }
-  return n;
-}
-
-const lockFacts = (file) => { const st = fs.statSync(file); return { content: fs.readFileSync(file, 'utf8'), mtimeMs: st.mtimeMs, ino: st.ino }; };
-const sameFacts = (a, b) => a.content === b.content && a.mtimeMs === b.mtimeMs && a.ino === b.ino;
-/** The pid ACTUALLY holding a lock: the `pid <n>` line a worker writes for itself, else the token's pid. */
-const holderPid = (content) => {
-  const line = /^pid (\d+)$/m.exec(String(content));
-  return Number(line ? line[1] : String(content).trim().split('-')[0]);
-};
-
-/**
- * Take the lock. Returns this holder's TOKEN (`<pid>-<time>-<random>`), or null.
- *  • Free → exclusive create.
- *  • Fresh (refreshed within REPLAY_LOCK_STALE_MS) → null.
- *  • Stale but its holder pid is ALIVE → null until REPLAY_LOCK_ABANDON_MS: a laptop asleep mid-step,
- *    or a long step, is not a dead worker, and taking over would put two workers on one job. The holder
- *    pid is the WORKER's own (it rewrites the lock on start), not the hook that spawned it and exited.
- *  • Otherwise taken over: the stale file is renamed aside and VERIFIED to be the very file judged
- *    stale (content, mtime, inode). If a successor's fresh lock was moved instead (it took over between
- *    our check and our rename), it is put back — never over a third lock — and we back off. One winner.
- */
-export function takeReplayLock(projectDir, now = Date.now(), { isAlive = pidAlive, beforeRename = null } = {}) {
-  const lock = lockPath(projectDir);
-  const token = `${process.pid}-${now}-${Math.random().toString(36).slice(2, 10)}`;
-  const create = () => { fs.writeFileSync(lock, `${token}\npid ${process.pid}\n`, { flag: 'wx', mode: 0o600 }); return token; };
-  try { return create(); } catch { /* held, or stale */ }
-  let seen;
-  try { seen = lockFacts(lock); } catch { try { return create(); } catch { return null; } }
-  const age = now - seen.mtimeMs;
-  if (age <= REPLAY_LOCK_STALE_MS) return null;
-  if (age <= REPLAY_LOCK_ABANDON_MS && isAlive(holderPid(seen.content))) return null;
-  beforeRename?.();
-  const aside = `${lock}.stale-${token}`;
-  try { fs.renameSync(lock, aside); } catch { return null; }
-  let moved = null;
-  try { moved = lockFacts(aside); } catch { /* vanished */ }
-  if (!moved || !sameFacts(moved, seen)) {
-    // Put the successor's lock back without ever overwriting a third holder's: a hard link where the
-    // filesystem has them, else an exclusive copy.
-    try { fs.linkSync(aside, lock); } catch {
-      try { fs.copyFileSync(aside, lock, fs.constants.COPYFILE_EXCL); } catch { /* a third holder exists; the successor sees it lost the lock and stops */ }
-    }
-    try { fs.rmSync(aside, { force: true }); } catch { /* best effort */ }
-    return null;
-  }
-  try { fs.rmSync(aside, { force: true }); } catch { /* best effort */ }
-  try { return create(); } catch { return null; }
-}
-
-/** Heartbeat: refresh the lock's mtime if (and only if) this holder still owns it. */
-export function refreshReplayLock(projectDir, token) {
-  if (!token || readLock(projectDir) !== token) return false;
-  try { const t = new Date(); fs.utimesSync(lockPath(projectDir), t, t); return true; } catch { return false; }
-}
-
-/** A worker that inherited the lock records ITS OWN pid on it, keeping the owner token. */
-export function adoptReplayLock(projectDir, token) {
-  if (!token || readLock(projectDir) !== token) return false;
-  try { fs.writeFileSync(lockPath(projectDir), `${token}\npid ${process.pid}\n`, { mode: 0o600 }); return true; } catch { return false; }
-}
-
-/** Release ONLY a lock this holder owns; a successor's lock is never deleted. */
-export function releaseReplayLock(projectDir, token) {
-  if (!token || readLock(projectDir) !== token) return false;
-  try { fs.rmSync(lockPath(projectDir), { force: true }); return true; } catch { return false; }
-}
-
-/** Hand the lock (or take it, if free) to a detached worker. Returns whether one was started. Never throws. */
-export function replayOutboxDetached({ projectDir, token = null, spawnFn = spawn } = {}) {
-  const held = token || takeReplayLock(projectDir);
-  if (!held) return false;
-  try {
-    const child = spawnFn(process.execPath, [fileURLToPath(import.meta.url), '--replay-outbox'], {
-      cwd: projectDir, detached: true, stdio: 'ignore', windowsHide: true,
-      env: { ...process.env, RUVNET_REPLAY_LOCK_TOKEN: held },
-    });
-    child.unref?.();
-    return true;
-  } catch {
-    releaseReplayLock(projectDir, held);
-    return false;
-  }
-}
-
-/**
- * The detached worker's body, holding the lock `token`: record its own pid on the lock, return orphaned
- * claims to the queue, replay the outbox, then run every queued capture IN ORDER — each CLAIMED by
- * atomic rename first, so no other worker can run it too, and each re-entering the boundary as
- * `ordered`, so it replays before it produces. Ownership is re-checked before every step and right
- * after each claim; a worker that lost the lock puts an unstarted claim back and stops. A finished
- * claim is the claimer's own and is deleted. Releases only its own lock, then re-checks for captures
- * queued while it held it.
- */
-export function runOutboxReplay({ projectDir, token = process.env.RUVNET_REPLAY_LOCK_TOKEN || null, budgetMs = DETACHED_REPLAY_BUDGET_MS,
-  makeStoreFactory = boundedStoreFactory, now = Date.now, runCapture = runSessionSnapshotHook, onClaim = null } = {}) {
-  let held = token || takeReplayLock(projectDir);
-  let replayed = 0;
-  for (let round = 0; held && round < 8; round += 1) {
-    try {
-      if (!adoptReplayLock(projectDir, held)) return replayed;
-      reclaimOrphans(projectDir);
-      const resolution = resolveProjectStore({ projectDir });
-      const store = makeStoreFactory(now() + budgetMs)({ projectDir, requestedStorePath: resolution.canonicalAgentDbPath });
-      for (const snapshot of store.outbox.pendingSnapshots()) {
-        if (!refreshReplayLock(projectDir, held)) return replayed;
-        store.outbox.markCommitted(store.appendExact(snapshot));
-        replayed += 1;
-      }
-      for (const file of queuedCaptures(projectDir)) {
-        if (!refreshReplayLock(projectDir, held)) return replayed;
-        const claimed = claimQueued(file);
-        if (!claimed) continue;
-        onClaim?.(claimed);
-        if (!refreshReplayLock(projectDir, held)) {
-          returnClaim(claimed);
-          return replayed;
-        }
-        let job = null;
-        try { job = JSON.parse(fs.readFileSync(claimed, 'utf8')); } catch { /* torn: dropped below */ }
-        try {
-          if (job) runCapture(projectDir, job.event, { rawInput: JSON.stringify(job.payload), host: job.host,
-            budgetMs, makeStoreFactory, now, ordered: held, writeMetadata: false,
-            captureTurn: () => ({ recorded: false, skipped: 'detached replay' }),
-            captureEvents: () => ({ recorded: 0, skipped: 'detached replay' }) });
-        } catch { /* a failed capture leaves its own snapshot durable in the outbox */ }
-        try { fs.rmSync(claimed, { force: true }); } catch { /* best effort */ }
-      }
-    } catch { /* the debt stays durable; the next boundary hands it on again */ } finally {
-      releaseReplayLock(projectDir, held);
-    }
-    held = queuedWork(projectDir) ? takeReplayLock(projectDir) : null;
-  }
-  return replayed;
-}
-
 if (process.argv[1] && path.resolve(process.argv[1]).endsWith('session-snapshot-hook.mjs') && process.argv[2] === '--replay-outbox') {
   try { runOutboxReplay({ projectDir: process.cwd() }); } catch { /* the debt stays durable in the outbox */ }
+} else if (process.argv[1] && path.resolve(process.argv[1]).endsWith('session-snapshot-hook.mjs')
+  && ['UserPromptSubmit', 'PreToolUse', 'PostToolUse', 'PostToolUseFailure', 'SubagentStop'].includes(process.argv[2])) {
+  // Compatibility entrypoint uses the same minimized transition producer as direct registrations.
+  // Finish evaluating this module before importing its transition consumer.
+  void (async () => {
+  try {
+    const { runProjectTransitionHook } = await import('./project-transition-hook.mjs');
+    const payload = JSON.parse(fs.readFileSync(0, 'utf8') || '{}');
+    const result = runProjectTransitionHook(payload.cwd || projectDirectory(), process.argv[2], { payload });
+    if (result.state === 'pending') process.stdout.write(JSON.stringify({ systemMessage: 'Project memory transition remains pending; exact readback was not verified.' }));
+  } catch { process.stdout.write(JSON.stringify({ systemMessage: 'Project memory transition capture degraded; exact readback was not verified.' })); }
+  })();
 } else if (process.argv[1] && path.resolve(process.argv[1]).endsWith('session-snapshot-hook.mjs')) {
   // projectDirectory() is the SAME derivation the Console's detector uses. Deriving it here
   // independently is what let this hook write a receipt the Console then reported as missing (#85).
   const rawInput = fs.readFileSync(0, 'utf8');
   try {
-    const result = runSessionSnapshotHook(projectDirectory(), process.argv[2] || 'SessionEnd', { rawInput });
+    let originProjectDir = projectDirectory();
+    try {
+      const cwd = JSON.parse(rawInput || '{}').cwd;
+      if (typeof cwd === 'string' && path.isAbsolute(cwd)) originProjectDir = cwd;
+    } catch { /* malformed input keeps the host's project fallback */ }
+    const result = runSessionSnapshotHook(originProjectDir, process.argv[2] || 'SessionEnd', { rawInput });
     // FAIL LOUDLY, NEVER SILENTLY — AND ONCE. When recording is stuck (events pending past STUCK_AFTER_MS,
     // a quarantined conflict, a corrupt outbox line, a cap drop) Claude Code shows this systemMessage, at
     // most once per session per condition (stopNotice; it used to repeat at every turn). "Not applicable"

package/plugin/scripts/session-start-budget.mjs

@@ -31,9 +31,9 @@ export function sessionStartTimeoutMs(hooksJsonPath = HOOKS_JSON_PATH) {
 }
 
 // Per-stage budgets, ms. Every stage session-start-core.mjs (or continuity's restore) can run
-// appears here exactly once. Reviewer-mandated ceilings: restore <= 1000, banner <= 200.
+// appears here exactly once. Restore includes bounded durable replay; banner remains <= 200.
 export const STAGE_BUDGETS_MS = {
-  restore: 1000,          // continuity lane's project-progression restore — NOT this lane's code
+  restore: 3500,          // measured turn replay (1.5–2s) + progression write/readback + bounded restore
   misc: 250,              // settings/nightly/health/console-offer/auto-pref/star — small fs reads
   // The cache read itself is budgeted at 100ms internally (session-start-issue-alert.mjs's own
   // ISSUE_POINTER_BUDGET_MS, per correction #2's exact wording); this stage's total also carries

package/plugin/scripts/session-start-core.mjs

@@ -27,6 +27,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { restoreWithBrief } from './continuity-brief.mjs';
+import { turnRecordingStatus } from './turn-outcome-capture.mjs';
 import {
   read, json, exists, mkdir, write, runNode,
 } from './session-start-fsutil.mjs';
@@ -120,6 +121,7 @@ export async function runSessionStart({
       || s.startsWith('[RuvNet Brain v')
       || s.startsWith('USER-LEVEL:')
       || s.startsWith('[ASCII→SVG]')
+      || s.startsWith('[RuvNet Brain — TURN RECORDING]')
       || s.startsWith('[RuvNet Brain — PROJECT CONTINUITY UNKNOWN]')
       || s.startsWith('[RuvNet Brain — PROJECT CONTINUITY RESTORED]')
       || s.startsWith('[RuvNet Brain — COME UP TO SPEED')
@@ -183,6 +185,9 @@ export async function runSessionStart({
     emit('[RuvNet Brain — PROJECT CONTINUITY UNKNOWN]');
     emit('The SessionStart restore boundary failed unexpectedly. Do not claim project state was restored; verify the canonical store before relying on remembered state.');
   }
+  // Turn health remains visible even when the separate progression restore fails.
+  const turnStatus = turnRecordingStatus({ projectDir: cwd, env, home });
+  if (turnStatus.state === 'warn') emit(`[RuvNet Brain — TURN RECORDING] ${turnStatus.line}`);
   // Opt-in, matching the pre-existing `trace()` convention below: several other tests assert
   // SessionStart's stderr is EMPTY in the clean case (hook-battery.test.mjs, hook-hardening.test.mjs
   // — a real contract, not incidental), so this must never write unconditionally. `restore` shares