session-orchestrator 3.21.0 → 3.23.0

package/scripts/lib/vault-backfill/glab.mjs

@@ -7,6 +7,9 @@
 
 import { spawnSync } from 'node:child_process';
 
+import { redactUrlCredentials } from '../vcs-repo-spec.mjs';
+import { isValidRepoPath } from './manifest.mjs';
+
 let _verbose = false;
 
 /** Enable verbose stderr logging. */
@@ -38,7 +41,7 @@ export function assertGlabExists(dieFn) {
  * Run a glab command, return { ok, stdout, stderr }.
  *
  * Host-pinning (#872): deliberately ambient — this module runs instance-wide
- * queries (e.g. `glab repo list -g <group>`) that are not scoped to a single
+ * queries (`glab api groups/<group>/projects`) that are not scoped to a single
  * repo/project, so there is no single `-R`/`--repo` spec to pin. If a
  * caller ever needs single-repo host-pinning here, use `--hostname` (the
  * flag `glab api` and instance-wide subcommands accept), NOT `-R`/`--repo` —
@@ -46,79 +49,129 @@ export function assertGlabExists(dieFn) {
  * `resolveRepoHost` (`--hostname`) contract this repo already established.
  */
 export function glabRun(glabArgs) {
-  vlog(`glab ${glabArgs.join(' ')}`);
+  vlog(`glab ${redactUrlCredentials(glabArgs.join(' '))}`);
   const result = spawnSync('glab', glabArgs, {
     encoding: 'utf8',
     maxBuffer: 10 * 1024 * 1024,
   });
 
   if (result.error) {
-    return { ok: false, stdout: '', stderr: result.error.message };
+    return { ok: false, stdout: '', stderr: redactUrlCredentials(result.error.message) };
   }
   return {
     ok: result.status === 0,
     stdout: result.stdout || '',
-    stderr: result.stderr || '',
+    stderr: redactUrlCredentials(result.stderr || ''),
+  };
+}
+
+const PROJECT_VISIBILITIES = new Set(['private', 'internal', 'public']);
+const ISO_TIMESTAMP = /^(?<year>[1-9]\d{3})-(?<month>\d{2})-(?<day>\d{2})T(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/;
+
+/**
+ * GitLab returns `created_at` as an ISO-8601 timestamp. Validate the calendar
+ * components separately because Date normalizes impossible dates such as Feb 30.
+ */
+function isValidCreatedAt(value) {
+  if (typeof value !== 'string') return false;
+
+  const match = ISO_TIMESTAMP.exec(value);
+  if (!match?.groups) return false;
+
+  const { year, month, day } = match.groups;
+  const calendarDate = new Date(Date.UTC(Number(year), Number(month) - 1, Number(day)));
+  return (
+    calendarDate.getUTCFullYear() === Number(year) &&
+    calendarDate.getUTCMonth() === Number(month) - 1 &&
+    calendarDate.getUTCDate() === Number(day)
+  );
+}
+
+/**
+ * Reduce a GitLab project response to the fields vault-backfill consumes.
+ *
+ * The group API with `simple=true` still includes presentation and URL fields.
+ * Keeping only this projection prevents those opaque project objects from
+ * flowing into logs or downstream actions.
+ */
+function normalizeRepo(project) {
+  return {
+    id: project.id,
+    path: project.path_with_namespace ?? project.path,
+    visibility: project.visibility === undefined ? 'private' : project.visibility,
+    createdAt: project.created_at === undefined ? '' : project.created_at.slice(0, 10),
   };
 }
 
+function isSimpleProject(project) {
+  const path = project?.path_with_namespace ?? project?.path;
+  return (
+    project !== null &&
+    typeof project === 'object' &&
+    !Array.isArray(project) &&
+    Number.isInteger(project.id) &&
+    project.id > 0 &&
+    isValidRepoPath(path) &&
+    (project.visibility === undefined || PROJECT_VISIBILITIES.has(project.visibility)) &&
+    (project.created_at === undefined || isValidCreatedAt(project.created_at))
+  );
+}
+
 /**
- * Parse `glab repo list --output json` output (JSON array or JSONL).
- * Returns array of { id, path, name, visibility, createdAt }.
+ * Parse `glab api --paginate --slurp` output (a project array or page arrays).
+ *
+ * Returns an array of { id, path, visibility, createdAt }, or null when an
+ * exit-zero response does not fully match the simple-project list contract.
  */
 export function parseRepoList(stdout) {
   const trimmed = stdout.trim();
-  if (!trimmed) return [];
+  if (!trimmed) return null;
 
+  let data;
   try {
-    const data = JSON.parse(trimmed);
-    if (!Array.isArray(data)) return [];
-    return data.map((r) => ({
-      id: r.id ?? 0,
-      path: r.path_with_namespace ?? r.path ?? '',
-      name: r.name ?? '',
-      visibility: r.visibility ?? 'private',
-      createdAt: (r.created_at ?? '').slice(0, 10),
-    }));
+    data = JSON.parse(trimmed);
   } catch {
-    // Try line-by-line JSONL
-    const repos = [];
-    for (const line of trimmed.split('\n')) {
-      const l = line.trim();
-      if (!l) continue;
-      try {
-        const r = JSON.parse(l);
-        repos.push({
-          id: r.id ?? 0,
-          path: r.path_with_namespace ?? r.path ?? '',
-          name: r.name ?? '',
-          visibility: r.visibility ?? 'private',
-          createdAt: (r.created_at ?? '').slice(0, 10),
-        });
-      } catch {
-        // skip malformed line
-      }
-    }
-    return repos;
+    return null;
   }
+
+  if (!Array.isArray(data)) return null;
+  if (data.length === 0) return [];
+
+  const projects = data.every(isSimpleProject)
+    ? data
+    : data.every(Array.isArray)
+      ? data.flat()
+      : null;
+
+  if (!projects || !projects.every(isSimpleProject)) return null;
+  return projects.map(normalizeRepo);
 }
 
 /**
  * List all repos in a GitLab group. Returns repo array or null on API error.
  */
 export function listGroupRepos(group) {
+  const encodedGroup = encodeURIComponent(group);
   const { ok, stdout, stderr } = glabRun([
-    'repo', 'list', '-g', group, '--output', 'json', '--per-page', '100',
+    'api', `groups/${encodedGroup}/projects?simple=true&per_page=100`, '--paginate', '--slurp',
   ]);
 
   if (!ok) {
     process.stderr.write(
-      `[vault-backfill] WARN: glab repo list failed for group '${group}': ${stderr.trim()}\n`,
+      `[vault-backfill] WARN: glab api groups/<group>/projects failed for group '${group}': ${stderr.trim()}\n`,
+    );
+    return null;
+  }
+
+  const repos = parseRepoList(stdout);
+  if (repos === null) {
+    process.stderr.write(
+      `[vault-backfill] WARN: glab api groups/<group>/projects returned an unexpected project-list response shape for group '${group}'\n`,
     );
     return null;
   }
 
-  return parseRepoList(stdout);
+  return repos;
 }
 
 /**
@@ -150,23 +203,3 @@ export function checkVaultYaml(repoPath) {
   );
   return 'error';
 }
-
-/**
- * Fetch repo owner via glab API. Returns username or 'unknown' on failure.
- */
-export function fetchRepoOwner(repoId) {
-  const { ok, stdout } = glabRun(['api', `projects/${repoId}`]);
-  if (!ok) return 'unknown';
-
-  try {
-    const data = JSON.parse(stdout);
-    return (
-      data?.namespace?.path ||
-      data?.owner?.username ||
-      data?.namespace?.name ||
-      'unknown'
-    );
-  } catch {
-    return 'unknown';
-  }
-}

package/scripts/lib/vault-backfill/manifest.mjs

@@ -7,8 +7,34 @@
 
 const VALID_TIERS = new Set(['top', 'active', 'archived']);
 const VALID_VISIBILITIES = new Set(['public', 'internal', 'private']);
+const GITLAB_PATH_SEGMENT_RE = /^[A-Za-z0-9_.-]+$/;
 export const SLUG_RE = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 
+/**
+ * Return whether a value is a canonical GitLab namespace/project path.
+ *
+ * GitLab project paths have at least one namespace and one project segment.
+ * Each segment uses the slug character set; dot segments remain excluded so
+ * the result is safe to use as a path below a controlled staging directory.
+ *
+ * @param {unknown} value
+ * @returns {value is string}
+ */
+export function isValidRepoPath(value) {
+  if (typeof value !== 'string') return false;
+
+  const segments = value.split('/');
+  return (
+    segments.length >= 2 &&
+    segments.every(
+      (segment) =>
+        segment !== '.' &&
+        segment !== '..' &&
+        GITLAB_PATH_SEGMENT_RE.test(segment),
+    )
+  );
+}
+
 /**
  * Validate and normalise a manifest object.
  * Calls dieFn(1, ...) on any schema violation.
@@ -34,14 +60,8 @@ export function validateManifest(raw, dieFn) {
     const prefix = `manifest.repos[${i}]`;
 
     if (typeof entry.id !== 'number') dieFn(1, `${prefix}.id must be a number`);
-    if (typeof entry.path !== 'string' || !entry.path) {
-      dieFn(1, `${prefix}.path must be a non-empty string`);
-    }
-    if (entry.path.startsWith('/') || entry.path.split('/').includes('..')) {
-      dieFn(
-        1,
-        `${prefix}.path '${entry.path}' is invalid — must be a relative repo path (no leading '/' or '..' segments)`,
-      );
+    if (!isValidRepoPath(entry.path)) {
+      dieFn(1, `${prefix}.path must be a valid GitLab namespace/project path`);
     }
     if (typeof entry.slug !== 'string') dieFn(1, `${prefix}.slug must be a string`);
     if (!SLUG_RE.test(entry.slug)) {

package/scripts/lib/vault-mirror/process.mjs

@@ -14,6 +14,7 @@ import { isRealSession } from '../session-schema/filters.mjs';
 import { resolveRepoNamespace } from './namespace.mjs';
 import { detectLearningSchema, normalizeLearningEntry, generateLearningNote, generateLearningNoteV2 } from './render-learnings.mjs';
 import { detectSessionSchema, normalizeSessionEntry, generateSessionNote, generateSessionNoteV2, generateSessionNoteV3 } from './render-sessions.mjs';
+import { emitMirrorEvent } from './telemetry.mjs';
 
 const GENERATOR_MARKER = 'session-orchestrator-vault-mirror@1';
 
@@ -256,8 +257,33 @@ export { deriveRepo } from './namespace.mjs';
  * @param {object} [opts.meta] — optional extra fields merged into the emitted JSON
  *   (used for quality-gate skips to carry a `reason` field). Callers that omit
  *   `meta` get the base JSON shape unchanged.
+ * @param {number} [opts.line] — 1-based JSONL line number. When FINITE, this
+ *   entry also gets one `orchestrator.vault.mirror_completed` ledger record
+ *   (#1147) — UNLESS `action` is `skipped-noop`, whose per-entry record is
+ *   suppressed as ledger flood and reported only in the run-level roll-up
+ *   (#1151; see the gate below). Omitting `line` keeps the stdout-only
+ *   behaviour, which is what the direct unit tests of this function exercise.
+ * @param {boolean} [opts.dryRun] — the run's dry-run flag, for telemetry only.
+ * @param {string} [opts.skipClass] — `validation` | `mapper-crash`; telemetry only.
+ * @param {string} [opts.reason] — explicit telemetry reason. Defaults to
+ *   `meta.reason` when that exists, so the quality-gate strings
+ *   (`confidence:X < min:Y` / `narrative:N < min:M` / `status:…`) are REUSED
+ *   rather than recomputed — recomputing is how one fact becomes two copies.
+ * @returns {Promise<string>} the `action` string, so the CLI's main loop can
+ *   tally a run-level denominator without a second census of these call sites.
  */
-export function emitAction({ action, path, kind, id, vaultDir, meta }) {
+export async function emitAction({
+  action,
+  path,
+  kind,
+  id,
+  vaultDir,
+  meta,
+  line,
+  dryRun,
+  skipClass,
+  reason,
+}) {
   let rel;
   if (path === null || path === undefined) {
     rel = null;
@@ -271,7 +297,59 @@ export function emitAction({ action, path, kind, id, vaultDir, meta }) {
   if (meta && typeof meta === 'object') {
     Object.assign(payload, meta);
   }
+  // The stdout JSON-per-entry protocol is the CONTRACT other callers parse —
+  // it stays byte-identical; the ledger record below is purely additive.
   process.stdout.write(JSON.stringify(payload) + '\n');
+
+  // Per-entry ledger record for every action EXCEPT `skipped-noop` (#1151).
+  //
+  // `skipped-noop` is the STEADY STATE, not an event: on a populated vault
+  // nearly every record is already mirrored, so one `--kind session` run over
+  // this repo's ~276-record sessions ledger wrote ~276 per-entry records that
+  // between them said "nothing happened" — burying every other event class in
+  // the same file. No information is lost by dropping them: `finishRun()` in
+  // `scripts/vault-mirror.mjs` counts this class into the run event's `skipped`
+  // total AND names it in `action_breakdown['skipped-noop']`, so the noop COUNT
+  // stays measured per run and the gate stays falsifiable (HR-105).
+  //
+  // BV-004 ceiling: what this drops is the per-LINE locator for noops — the
+  // ledger can still say HOW MANY records were unchanged, never WHICH. Revisit
+  // if a consumer ever needs to name them (a staleness audit over unchanged
+  // notes would); reinstate it behind an opt-in flag then, not unconditionally.
+  if (Number.isFinite(line) && action !== 'skipped-noop') {
+    const telemetryReason =
+      reason ?? (meta && typeof meta.reason === 'string' ? meta.reason : undefined);
+    await emitMirrorEvent({
+      action,
+      kind,
+      line,
+      recordId: id,
+      // The VAULT-RELATIVE path (`rel`), never the absolute one: the ledger
+      // record can travel over the optional Clank webhook unredacted.
+      path: rel,
+      skipClass,
+      reason: telemetryReason,
+      dryRun,
+    });
+  }
+
+  return action;
+}
+
+/**
+ * Per-entry stdout + telemetry wrapper used by {@link processLearning} and
+ * {@link processSession}. Threads the line number, kind, vaultDir and dry-run
+ * flag out of the processor `ctx` so the 18 call sites do not repeat them.
+ *
+ * @param {number} lineNum — 1-based JSONL line number of the entry.
+ * @param {object} ctx — processor context (`vaultDir`, `dryRun`, `kind`).
+ * @param {object} opts — the remaining {@link emitAction} fields (`action`,
+ *   `path`, `id`, and optionally `meta`).
+ * @returns {Promise<string>} the `action` string.
+ */
+function emitEntryAction(lineNum, ctx, opts) {
+  const { vaultDir, dryRun, kind } = ctx;
+  return emitAction({ ...opts, vaultDir, kind, line: lineNum, dryRun });
 }
 
 // ── Secret masking (#974) — THE choke-point ───────────────────────────────────
@@ -447,7 +525,7 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
   const {
     vaultDir,
     dryRun,
-    kind,
+    kind: _kind, // threaded to emitAction via ctx by emitEntryAction (#1147); kept for ctx symmetry
     force = false,
     qualityMinConfidence = 0.5,
     qualityMinNarrativeChars: _qualityMinNarrativeChars = 400, // unused for learnings; kept for ctx symmetry
@@ -531,15 +609,12 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
   // Missing/non-numeric confidence is treated as 1.0 (legacy entries pass).
   const learningConfidence = typeof entry.confidence === 'number' ? entry.confidence : 1.0;
   if (learningConfidence < qualityMinConfidence) {
-    emitAction({
+    return emitEntryAction(_lineNum, ctx, {
       action: 'skipped-quality-low',
       path: null,
-      kind,
       id: entryId,
-      vaultDir,
       meta: { reason: `confidence:${learningConfidence} < min:${qualityMinConfidence}` },
     });
-    return;
   }
 
   // #660: namespace new writes under a per-repo subdirectory.
@@ -572,8 +647,7 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
         // Render the candidate and compare canonical fields before deciding to skip.
         const candidateContent = generator(entry, slug, generatorOpts);
         if (learningContentMatches(legacyContent, candidateContent)) {
-          emitAction({ action: 'skipped-noop', path: legacyFlatPath, kind, id: slug, vaultDir });
-          return;
+          return emitEntryAction(_lineNum, ctx, { action: 'skipped-noop', path: legacyFlatPath, id: slug });
         }
         // Content differs — fall through to write into the namespaced path.
       }
@@ -588,15 +662,13 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
     if (!fm || !fm['_generator']) {
       // Hand-written: skip
       process.stderr.write(`SKIP hand-written: ${targetPath}\n`);
-      emitAction({ action: 'skipped-handwritten', path: targetPath, kind, id: entryId, vaultDir });
-      return;
+      return emitEntryAction(_lineNum, ctx, { action: 'skipped-handwritten', path: targetPath, id: entryId });
     }
 
     if (fm['_generator'] !== GENERATOR_MARKER) {
       // Different generator — treat as hand-written to be safe
       process.stderr.write(`SKIP unknown generator: ${targetPath}\n`);
-      emitAction({ action: 'skipped-handwritten', path: targetPath, kind, id: entryId, vaultDir });
-      return;
+      return emitEntryAction(_lineNum, ctx, { action: 'skipped-handwritten', path: targetPath, id: entryId });
     }
 
     if (fm['id'] !== slug) {
@@ -611,16 +683,14 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
         const disambigFm = parseFrontmatter(disambigContent);
         if (!disambigFm || !disambigFm['_generator']) {
           process.stderr.write(`SKIP hand-written (disambig): ${targetPath}\n`);
-          emitAction({ action: 'skipped-handwritten', path: targetPath, kind, id: entryId, vaultDir });
-          return;
+          return emitEntryAction(_lineNum, ctx, { action: 'skipped-handwritten', path: targetPath, id: entryId });
         }
         // Check updated advancement; if date has not advanced, also diff content.
         const entryUpdated = toDate(dateSource);
         if (disambigFm['updated'] && disambigFm['updated'] >= entryUpdated) {
           const candidateContent = generator(entry, slug, generatorOpts);
           if (learningContentMatches(disambigContent, candidateContent)) {
-            emitAction({ action: 'skipped-noop', path: targetPath, kind, id: disambigSlug, vaultDir });
-            return;
+            return emitEntryAction(_lineNum, ctx, { action: 'skipped-noop', path: targetPath, id: disambigSlug });
           }
           // Content differs — fall through to write.
         }
@@ -628,8 +698,7 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
 
       const content = generator(entry, slug, generatorOpts);
       if (!dryRun) writeFileSync(targetPath, content, 'utf8');
-      emitAction({ action: 'skipped-collision-resolved', path: targetPath, kind, id: slug, vaultDir });
-      return;
+      return emitEntryAction(_lineNum, ctx, { action: 'skipped-collision-resolved', path: targetPath, id: slug });
     }
 
     // Same id: check if updated would advance (unless --force overrides).
@@ -639,8 +708,7 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
     if (!force && fm['updated'] && fm['updated'] >= entryUpdated) {
       const candidateContent = generator(entry, slug, generatorOpts);
       if (learningContentMatches(existingContent, candidateContent)) {
-        emitAction({ action: 'skipped-noop', path: targetPath, kind, id: slug, vaultDir });
-        return;
+        return emitEntryAction(_lineNum, ctx, { action: 'skipped-noop', path: targetPath, id: slug });
       }
       // Content differs — fall through to overwrite (same path as date-advance branch).
     }
@@ -648,21 +716,20 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
     // Overwrite with advanced updated date (or forced re-render)
     const content = generator(entry, slug, generatorOpts);
     if (!dryRun) writeFileSync(targetPath, content, 'utf8');
-    emitAction({ action: 'updated', path: targetPath, kind, id: slug, vaultDir });
-    return;
+    return emitEntryAction(_lineNum, ctx, { action: 'updated', path: targetPath, id: slug });
   }
 
   // File does not exist — create
   const content = generator(entry, slug, generatorOpts);
   if (!dryRun) writeFileSync(targetPath, content, 'utf8');
-  emitAction({ action: 'created', path: targetPath, kind, id: slug, vaultDir });
+  return emitEntryAction(_lineNum, ctx, { action: 'created', path: targetPath, id: slug });
 }
 
 export async function processSession(rawEntry, _lineNum, ctx) {
   const {
     vaultDir,
     dryRun,
-    kind,
+    kind: _kind, // threaded to emitAction via ctx by emitEntryAction (#1147); kept for ctx symmetry
     force = false,
     qualityMinNarrativeChars = 400,
     qualityMinConfidence: _qualityMinConfidence = 0.5, // unused for sessions; kept for ctx symmetry
@@ -716,15 +783,12 @@ export async function processSession(rawEntry, _lineNum, ctx) {
   // status from the vault; the mapping keeps every OTHER status honest, and
   // guards the generators' other entry point (the render.mjs barrel).
   if (!isRealSession(entry)) {
-    emitAction({
+    return emitEntryAction(_lineNum, ctx, {
       action: 'skipped-abandoned',
       path: null,
-      kind,
       id: session_id,
-      vaultDir,
       meta: { reason: `status:${entry?.status}` },
     });
-    return;
   }
 
   // #732: resolve the leak-guarded repo namespace ONCE per session, BEFORE the
@@ -752,15 +816,12 @@ export async function processSession(rawEntry, _lineNum, ctx) {
   const narrativeBody = renderedBody.replace(/^---[\s\S]*?---/m, '').trim();
   const narrativeChars = narrativeBody.length;
   if (narrativeChars < qualityMinNarrativeChars) {
-    emitAction({
+    return emitEntryAction(_lineNum, ctx, {
       action: 'skipped-quality-low',
       path: null,
-      kind,
       id: session_id,
-      vaultDir,
       meta: { reason: `narrative:${narrativeChars} < min:${qualityMinNarrativeChars}` },
     });
-    return;
   }
 
   // #660: namespace new writes under a per-repo subdirectory. repoNs was
@@ -786,8 +847,7 @@ export async function processSession(rawEntry, _lineNum, ctx) {
     if (legacyFm && legacyFm['_generator'] === GENERATOR_MARKER && legacyFm['id'] === session_id) {
       const entryUpdated = toDate(entry.completed_at);
       if (!force && legacyFm['updated'] && legacyFm['updated'] >= entryUpdated) {
-        emitAction({ action: 'skipped-noop', path: legacyFlatPath, kind, id: session_id, vaultDir });
-        return;
+        return emitEntryAction(_lineNum, ctx, { action: 'skipped-noop', path: legacyFlatPath, id: session_id });
       }
       // Updated date would advance — fall through to write into the namespaced path.
     }
@@ -800,31 +860,27 @@ export async function processSession(rawEntry, _lineNum, ctx) {
     if (!fm || !fm['_generator']) {
       // Hand-written: skip
       process.stderr.write(`SKIP hand-written: ${targetPath}\n`);
-      emitAction({ action: 'skipped-handwritten', path: targetPath, kind, id: session_id, vaultDir });
-      return;
+      return emitEntryAction(_lineNum, ctx, { action: 'skipped-handwritten', path: targetPath, id: session_id });
     }
 
     if (fm['_generator'] !== GENERATOR_MARKER) {
       process.stderr.write(`SKIP unknown generator: ${targetPath}\n`);
-      emitAction({ action: 'skipped-handwritten', path: targetPath, kind, id: session_id, vaultDir });
-      return;
+      return emitEntryAction(_lineNum, ctx, { action: 'skipped-handwritten', path: targetPath, id: session_id });
     }
 
     // Same generator: check id and updated
     if (fm['id'] === session_id) {
       const entryUpdated = toDate(entry.completed_at);
       if (!force && fm['updated'] && fm['updated'] >= entryUpdated) {
-        emitAction({ action: 'skipped-noop', path: targetPath, kind, id: session_id, vaultDir });
-        return;
+        return emitEntryAction(_lineNum, ctx, { action: 'skipped-noop', path: targetPath, id: session_id });
       }
       if (!dryRun) writeFileSync(targetPath, renderedBody, 'utf8');
-      emitAction({ action: 'updated', path: targetPath, kind, id: session_id, vaultDir });
-      return;
+      return emitEntryAction(_lineNum, ctx, { action: 'updated', path: targetPath, id: session_id });
     }
   }
 
   // File does not exist — create. Reuse the rendered body computed during the
   // quality-gate check (avoids a second generator invocation).
   if (!dryRun) writeFileSync(targetPath, renderedBody, 'utf8');
-  emitAction({ action: 'created', path: targetPath, kind, id: session_id, vaultDir });
+  return emitEntryAction(_lineNum, ctx, { action: 'created', path: targetPath, id: session_id });
 }