session-orchestrator 3.23.0 → 4.0.0

package/scripts/lib/reconcile/idempotency.mjs

@@ -391,7 +391,14 @@ export function mergeCandidates({ candidates, repoRoot, storePath } = {}) {
  * @param {number} [params.fallbackConfidence] - used only when no existing record is found.
  * @param {string} [params.repoRoot]
  * @param {string} [params.storePath]
- * @returns {{ written: boolean, stamped: ReconcileCandidate|null }}
+ * @returns {{ written: boolean, stamped: ReconcileCandidate|null, alreadyProcessed?: boolean }}
+ *   `stamped` is the record as PERSISTED (read back out of `mergeCandidates`'s
+ *   merged array), never the one this call merely proposed — when a prior
+ *   terminal verdict wins the dedupe, the two differ and only the former is
+ *   true. `alreadyProcessed: true` marks exactly that case; `written` stays
+ *   `true` there, because the store holds the intended terminal state and
+ *   `written: false` means a WRITE FAILURE to the one production caller
+ *   (`writer.mjs`, which turns it into an operator-visible error).
  */
 export function markCandidateProcessed({
   learningKey,
@@ -419,6 +426,7 @@ export function markCandidateProcessed({
     stamped = { ...found, processed_at: stampAt, outcome: typeof outcome === 'string' ? outcome : (found.outcome ?? null) };
   } else {
     const slug = typeof fallbackSlug === 'string' ? fallbackSlug : '';
+    const finalOutcome = typeof outcome === 'string' ? outcome : null;
     stamped = buildCandidate({
       id:
         typeof fallbackCandidateId === 'string' && fallbackCandidateId.length > 0
@@ -426,15 +434,40 @@ export function markCandidateProcessed({
           : makeCandidateId(learningKey, slug),
       learningKey,
       slug,
-      status: 'proposed',
+      // A minted record is TERMINAL from birth (`processed_at` is set two lines
+      // below), so `status` must agree with `outcome` instead of always saying
+      // `'proposed'` — a record reading `status:'proposed'` while carrying
+      // `outcome:'rejected'` is self-contradictory and misreads as a live
+      // proposal to anything that renders `status`. The vocabulary is exactly
+      // the two members of the ReconcileCandidate typedef; nothing new is
+      // invented here: `'rejected'` for the operator-rejection outcome
+      // (writer.mjs, issue #1042), `'proposed'` for the accepted outcomes
+      // (`'written'` / `'already-on-disk'`), where the proposal stood.
+      status: finalOutcome === 'rejected' ? 'rejected' : 'proposed',
       reason: 'stamped without a prior sidecar record',
       confidence: typeof fallbackConfidence === 'number' ? fallbackConfidence : 0,
       createdAt: stampAt,
     });
     stamped.processed_at = stampAt;
-    stamped.outcome = typeof outcome === 'string' ? outcome : null;
+    stamped.outcome = finalOutcome;
   }
 
   const result = mergeCandidates({ candidates: [stamped], repoRoot, storePath });
-  return { written: result.written === true, stamped };
+
+  // Report what is PERSISTED, not what we asked for. `mergeCandidates`'s dedupe
+  // rule keeps an already-terminal existing record and DROPS the incoming one,
+  // so when `found` was already processed the store still holds the OLD
+  // `processed_at`/`outcome` — returning our freshly-built `stamped` would tell
+  // the caller a verdict that is nowhere on disk. `merged` IS the array that was
+  // just written, so reading the record back out of it is the honest answer.
+  const persisted = result.merged.find((rec) => rec && rec.learning_key === learningKey);
+  return {
+    written: result.written === true,
+    stamped: persisted ?? stamped,
+    // `true` iff a prior terminal verdict won and this call changed nothing on
+    // disk. `written` deliberately stays `true` in that case: the store IS in
+    // the intended terminal state, and writer.mjs treats `written:false` as a
+    // stamp FAILURE worth an operator-visible error.
+    alreadyProcessed: isTerminal(found),
+  };
 }

package/scripts/lib/reconcile/writer.mjs

@@ -457,26 +457,37 @@ function frontmatterRefusalReason(content) {
  * not yet mature enough — silently, and with no way back short of editing the
  * sidecar by hand.
  *
- * The discriminator is the rendered `content`: `engine.mjs` pushes its own
- * rejections as `{learningKey, type, reason, status:'rejected'}` — they never
- * reach the renderer, so they never carry `content`/`slug`/`path` — while the
- * proposals the operator declines are full `ReconcileProposal` records whose
- * `content` is the very rule text the AUQ showed him.
- *
- * CEILING (BV-004): this reads an implicit signal, not an explicit marker,
- * because the one production caller (`skills/session-end/phase-3-6-tail.md`
- * step 6/7) concatenates engine rejections and operator-declined proposals into
- * ONE `rejected` array and marks neither. Revisit if that caller starts passing
- * rendered content on engine-side rejections, or if it gains an explicit
- * operator-rejection flag — then key on the flag instead.
- *
- * @param {WriterRejectedItem & {content?: unknown, learningKey?: unknown}} item
+ * PRIMARY discriminator (#1153 P15): the explicit `operatorRejected: true`
+ * flag that `skills/session-end/phase-3-6-tail.md` step 6 stamps on every
+ * proposal the operator left unselected before concatenating it into the one
+ * `rejected` array. `engine.mjs` pushes its own rejections as
+ * `{learningKey, type, reason, status:'rejected'}` and never sets the flag, so
+ * the two shapes are now distinguishable by a marker rather than by inference.
+ *
+ * FALLBACK (@deprecated — remove once no supported skill body predates the P15
+ * stamp): when the flag is absent, fall back to the old implicit signal — the
+ * rendered `content`. Engine rejections never reach the renderer, so they never
+ * carry `content`/`slug`/`path`, while an operator-declined proposal is a full
+ * `ReconcileProposal` whose `content` is the rule text the AUQ showed him. The
+ * fallback exists because the skill prose and this module ship together but
+ * consumer repos may pin an OLDER `phase-3-6-tail.md` that emits no flag;
+ * dropping it immediately would silently stop stamping their operator
+ * rejections terminal (the exact #1042 bug). REMOVAL TRIGGER: the next major
+ * release in which no supported consumer ships a pre-P15 skill body.
+ *
+ * Either way the decision stays conservative in the same direction: a false
+ * negative costs nothing (the learning is re-proposed next run); a false
+ * positive would permanently suppress a learning that was only capped.
+ *
+ * @param {WriterRejectedItem & {content?: unknown, learningKey?: unknown, operatorRejected?: unknown}} item
  * @returns {boolean}
  */
 function isOperatorRejection(item) {
   if (!item || typeof item !== 'object') return false;
-  if (typeof item.content !== 'string' || item.content.length === 0) return false;
-  return typeof item.learningKey === 'string' && item.learningKey.length > 0;
+  if (typeof item.learningKey !== 'string' || item.learningKey.length === 0) return false;
+  if (item.operatorRejected === true) return true;
+  // @deprecated fallback — pre-P15 skill bodies emit no flag; see above.
+  return typeof item.content === 'string' && item.content.length > 0;
 }
 
 // ---------------------------------------------------------------------------
@@ -663,8 +674,12 @@ export async function writeApprovedRules({
             repoRoot,
           });
           if (!stampResult.written) {
+            // Same discrimination as the rejected path below (identical shape,
+            // identical reader): an already-terminal record is not a lost stamp.
             errors.push(
-              `sidecar-stamp failed for "${item.path ?? item.slug}" (learningKey=${item.learningKey}) — rule file was written but the idempotency sidecar was not updated`,
+              stampResult.alreadyProcessed
+                ? `sidecar-stamp for "${item.path ?? item.slug}" (learningKey=${item.learningKey}) wrote nothing — a prior terminal verdict is already on disk, so the rule file landed and the candidate stays terminal`
+                : `sidecar-stamp failed for "${item.path ?? item.slug}" (learningKey=${item.learningKey}) — rule file was written but the idempotency sidecar was not updated`,
             );
           }
         }
@@ -724,8 +739,15 @@ export async function writeApprovedRules({
                   repoRoot,
                 });
                 if (!stampResult.written) {
+                  // `alreadyProcessed` distinguishes the two failures that look
+                  // identical from `written:false` alone. When a PRIOR terminal
+                  // verdict is already on disk, the re-proposal warning is
+                  // simply false — the sidecar holds the state we wanted — and
+                  // telling the operator otherwise sends him after a non-bug.
                   errors.push(
-                    `sidecar-stamp failed for rejected "${item.learningKey}" — the rejection was archived but the idempotency sidecar was not updated, so a later run may re-propose it`,
+                    stampResult.alreadyProcessed
+                      ? `sidecar-stamp for rejected "${item.learningKey}" wrote nothing — a prior terminal verdict is already on disk, so the rejection is recorded and it will NOT be re-proposed`
+                      : `sidecar-stamp failed for rejected "${item.learningKey}" — the rejection was archived but the idempotency sidecar was not updated, so a later run may re-propose it`,
                   );
                 }
               }

package/scripts/lib/scope-gate.mjs

@@ -918,6 +918,28 @@ export function suggestForScopeViolation(relPath, allowedCsv) {
   );
 }
 
+/**
+ * Prefix that marks an aggregate-sidecar record as a PEER SESSION's declared
+ * scope rather than one of this wave's own agents (#1195).
+ *
+ * SSOT: this constant lives here — in the module both the `--union` helper and
+ * `hooks/post-bash-write-verify.mjs` already import — so the union exclusion
+ * below and the hook's peer-write notice can never disagree about what a peer
+ * record IS.
+ */
+export const PEER_RECORD_PREFIX = 'peer-session-';
+
+/**
+ * Is this record id a PEER SESSION's record (see {@link PEER_RECORD_PREFIX})?
+ * Fail-closed: a non-string id is not a peer record.
+ *
+ * @param {unknown} id
+ * @returns {boolean}
+ */
+export function isPeerRecordId(id) {
+  return typeof id === 'string' && id.startsWith(PEER_RECORD_PREFIX);
+}
+
 /**
  * Merge many agents' declared file scopes into ONE deduplicated, order-stable
  * list — the mechanical form of "allowedPaths is the UNION of all agent file
@@ -943,6 +965,19 @@ export function suggestForScopeViolation(relPath, allowedCsv) {
  * non-array / non-object members and non-string, empty entries are skipped.
  * Pure, sync, no I/O — hook-safe per the module header.
  *
+ * PEER RECORDS ARE EXCLUDED (#1195 follow-through). A record whose id starts
+ * with `peer-session-` declares a territory NO agent of this wave may write —
+ * it exists so a peer's paths take part in the DISJOINTNESS check and so
+ * `hooks/post-bash-write-verify.mjs` can name a peer write instead of alarming
+ * about it. Unioning it into `allowedPaths` would do the exact inverse: Gate 7
+ * (`hooks/enforce-scope.mjs`) would GRANT every agent of the wave write access
+ * to the peer's files, and the hook's peer branch would become dead code (a
+ * peer path can only reach it while it is OUTSIDE `allowedPaths`). The
+ * exclusion lives HERE — the one helper `--union` runs — rather than in the
+ * CLI, so every consumer of the union inherits it.
+ * `findScopeCollisions` deliberately does NOT filter: a peer/agent path
+ * collision is a real collision and must surface.
+ *
  * @param {Array<string[]|{id?: string, files?: string[]}>} scopes
  * @returns {string[]} deduplicated union in first-seen order
  */
@@ -954,6 +989,7 @@ export function unionFileScopes(scopes) {
     let files = null;
     if (Array.isArray(scope)) files = scope;
     else if (scope !== null && typeof scope === 'object' && Array.isArray(scope.files)) {
+      if (isPeerRecordId(scope.id)) continue;
       files = scope.files;
     }
     if (files === null) continue;

package/scripts/lib/session-close-backfill.mjs

@@ -67,12 +67,31 @@ import { parseStateMd as defaultParseStateMd } from './state-md/yaml-parser.mjs'
 // Constants
 // ---------------------------------------------------------------------------
 
-/** session_type enum accepted by the schema — lock.mode is coerced against it. */
-const VALID_SESSION_TYPES = new Set(['feature', 'deep', 'housekeeping']);
+/**
+ * The three real session MODES — deliberately NOT the schema's VALID_SESSION_TYPES,
+ * which since GitLab #1234 also carries `unknown`. This set answers a narrower
+ * question: "is `gathered.mode` a MEASUREMENT?". `unknown` must never pass it, or
+ * an events record carrying `mode: 'unknown'` would be recorded as a measured type
+ * (`_session_type_inferred` absent) when it is the opposite.
+ */
+const MEASURED_SESSION_MODES = new Set(['feature', 'deep', 'housekeeping']);
+
+/**
+ * session_type written when nothing in events.jsonl measured the mode
+ * (GitLab #1234). Always paired with `_session_type_inferred` + `_synthetic`.
+ */
+const UNMEASURED_SESSION_TYPE = 'unknown';
 
 const EVENT_STARTED = 'orchestrator.session.started';
 const EVENT_LOCK_ACQUIRED = 'orchestrator.session.lock.acquired';
+// Both names for one generation (GitLab #1234): `hooks/on-stop.mjs` now emits
+// `orchestrator.turn.stopped` as the canonical name and keeps the legacy
+// `orchestrator.session.stopped` (with `deprecated: true`) beside it until
+// 2027-03-06. A terminal-event probe must accept EITHER, or every session that
+// closes after the legacy name is dropped silently loses its attested end and
+// falls back to the flagged `lastEventMs` estimate.
 const EVENT_STOPPED = 'orchestrator.session.stopped';
+const EVENT_TURN_STOPPED = 'orchestrator.turn.stopped';
 const EVENT_ENDED = 'orchestrator.session.ended';
 
 const EVENTS_REL = ['.orchestrator', 'metrics', 'events.jsonl'];
@@ -108,14 +127,24 @@ function markerName(id) {
 }
 
 /**
- * Read a JSONL file into an array of parsed objects. Missing file → []; each
- * malformed line is skipped rather than aborting the whole read. Never throws.
+ * Read a JSONL file into an array of parsed objects. Missing file (ENOENT) →
+ * [] silently; an unreadable one (EACCES/EISDIR/…) → [] with a stderr WARN
+ * (#1210 — ENOENT and other read failures are different facts, same split as
+ * `sessions-canonical.mjs` `readCanonicalSessions`). Each malformed line is
+ * skipped rather than aborting the whole read. Never throws.
  */
 function readJsonlSafe(readFileSync, filePath) {
   let raw;
   try {
     raw = readFileSync(filePath, 'utf8');
-  } catch {
+  } catch (err) {
+    if (!err || err.code !== 'ENOENT') {
+      process.stderr.write(
+        `⚠ readJsonlSafe: cannot read ${filePath} ` +
+          `(${err?.code ?? '?'}: ${err?.message ?? String(err)}) — ` +
+          'treating as EMPTY, counts below are floors\n',
+      );
+    }
     return [];
   }
   const out = [];
@@ -153,18 +182,33 @@ function collectSessionEvents(events, { sessionId, semanticSessionId }) {
 
   let mode = null;
   let semanticFromLock = null;
+  // #1167 — the SECOND semantic bridge. `orchestrator.session.ended` carries
+  // `semantic_session_id` alongside the raw UUID since #1068 AC1, but nothing
+  // read it: a session that LOST the lock-acquire race emits no lock.acquired,
+  // so the lock bridge above resolved null and the caller fell through to the
+  // synthetic-id mint — writing a SECOND `abandoned` stub for a session the
+  // SessionEnd hook had already recorded under its semantic id. Measured
+  // 2026-09-02 @ c3ab480: 8 such duplicate pairs in sessions.jsonl.
+  let semanticFromEvents = null;
 
-  // First pass — lock.acquired bridges the UUID set + carries mode + semantic.
+  // First pass — bridge the UUID set + carry mode + semantic id. lock.acquired
+  // is the original bridge; session.ended is the #1167 addition.
   for (const ev of events) {
-    if (ev.event !== EVENT_LOCK_ACQUIRED) continue;
+    const isLock = ev.event === EVENT_LOCK_ACQUIRED;
+    const isEnded = ev.event === EVENT_ENDED && typeof ev.semantic_session_id === 'string';
+    if (!isLock && !isEnded) continue;
     const matchesUuid = isUuid(sessionId) && ev.session_id === sessionId;
     const matchesSemantic =
       (semanticSessionId && ev.semantic_session_id === semanticSessionId) ||
       (!isUuid(sessionId) && sessionId && ev.semantic_session_id === sessionId);
     if (!matchesUuid && !matchesSemantic) continue;
     if (typeof ev.session_id === 'string') uuids.add(ev.session_id);
-    if (typeof ev.mode === 'string') mode = ev.mode;
-    if (typeof ev.semantic_session_id === 'string') semanticFromLock = ev.semantic_session_id;
+    if (isLock) {
+      if (typeof ev.mode === 'string') mode = ev.mode;
+      if (typeof ev.semantic_session_id === 'string') semanticFromLock = ev.semantic_session_id;
+    } else {
+      semanticFromEvents = ev.semantic_session_id;
+    }
   }
 
   // Second pass — started + terminal timestamps from every matched UUID.
@@ -192,7 +236,7 @@ function collectSessionEvents(events, { sessionId, semanticSessionId }) {
       if (typeof ev.timestamp === 'string') startedAt = ev.timestamp;
       if (typeof ev.branch === 'string' && ev.branch.length > 0) branch = ev.branch;
       if (typeof ev.project === 'string') project = ev.project;
-    } else if (ev.event === EVENT_STOPPED || ev.event === EVENT_ENDED) {
+    } else if (ev.event === EVENT_STOPPED || ev.event === EVENT_TURN_STOPPED || ev.event === EVENT_ENDED) {
       if (!Number.isNaN(ts)) {
         lastTerminalMs = lastTerminalMs === null ? ts : Math.max(lastTerminalMs, ts);
       }
@@ -200,7 +244,18 @@ function collectSessionEvents(events, { sessionId, semanticSessionId }) {
     }
   }
 
-  return { uuids, mode, semanticFromLock, startedAt, branch, project, lastTerminalMs, earliestMs, lastEventMs };
+  return {
+    uuids,
+    mode,
+    semanticFromLock,
+    semanticFromEvents,
+    startedAt,
+    branch,
+    project,
+    lastTerminalMs,
+    earliestMs,
+    lastEventMs,
+  };
 }
 
 /**
@@ -256,7 +311,7 @@ function isCandidateDeadByAge({ relaxDeadByAge, assumeDeadBeforeMs, lastEventMs,
  * this record replaces. It is emitted only when non-null, so every existing
  * record shape is byte-identical to before.
  */
-function synthesizeRecord({ recordId, synthetic, gathered, nowMs, status = 'abandoned', backfillSource = 'events-jsonl', supersedes = null }) {
+function synthesizeRecord({ recordId, synthetic, gathered, nowMs, status = 'abandoned', backfillSource = 'events-jsonl', supersedes = null, rawSessionId = null }) {
   const startedIso = canonicalIso(gathered.startedAt, gathered.earliestMs ?? nowMs);
   const startedMs = Date.parse(startedIso);
   // completed_at is events-attested, never the backfill-run wall-clock (#914 R1).
@@ -281,9 +336,9 @@ function synthesizeRecord({ recordId, synthetic, gathered, nowMs, status = 'aban
   // Guard the same monotonic invariant as before: never earlier than started_at.
   const completedIso = new Date(Math.max(startedMs, completedMs)).toISOString();
 
-  let sessionType = 'housekeeping';
+  let sessionType = UNMEASURED_SESSION_TYPE;
   let inferred = true;
-  if (gathered.mode && VALID_SESSION_TYPES.has(gathered.mode)) {
+  if (gathered.mode && MEASURED_SESSION_MODES.has(gathered.mode)) {
     sessionType = gathered.mode;
     inferred = false;
   }
@@ -320,7 +375,36 @@ function synthesizeRecord({ recordId, synthetic, gathered, nowMs, status = 'aban
     _backfill_incomplete_fields: incomplete,
   };
   if (branchFound) record.branch = gathered.branch;
-  if (inferred) record._session_type_inferred = true;
+  if (inferred) {
+    record._session_type_inferred = true;
+    // GitLab #1234 — BACKFILLER HONESTY, half landed 2026-09-06.
+    //
+    // `session_type` above is now `'unknown'`, not the old `'housekeeping'`
+    // DEFAULT that nothing in events.jsonl ever said. Measured 2026-09-06, all
+    // 1.656 `abandoned` records in the 90-day fleet window carry
+    // `_session_type_inferred: true` + `total_waves: 0`, and NO organically
+    // written `abandoned` record exists anywhere — that `housekeeping` guess is
+    // what produced the "27 % close rate" figure that turned out to be an
+    // artefact (the real rate is 21,3 %). VALID_SESSION_TYPES was widened with
+    // `unknown` in `scripts/lib/session-schema/constants.mjs` to make this
+    // sayable; historical records keep their `housekeeping` label verbatim
+    // (sessions.jsonl is append-only), so a reader wanting the honest
+    // population still filters on `_synthetic !== true` rather than on the type.
+    //
+    // The OTHER half is deliberately NOT landed: `status` stays `'abandoned'`
+    // even though `'unresolved'` is the honest word and the schema now accepts
+    // it. Six executable phantom-stub filters key on the literal `abandoned`
+    // (census + revisit trigger in `scripts/lib/session-schema/validator.mjs`
+    // § SESSION_STATUS) and none of them is in this change's file scope —
+    // flipping the emitter first would make every new stub invisible to all six
+    // and re-open the #834 phantom-in-signal class fleet-wide. Repoint those
+    // filters onto one both-accepting predicate, then flip this one line.
+    //
+    // `_synthetic: true` still carries the claim no enum can: this record was
+    // COMPOSED. A consumer that filters on `_synthetic !== true` gets only
+    // measured records without needing to know either enum.
+    record._synthetic = true;
+  }
   if (synthetic) record._synthetic_session_id = true;
   if (completedEstimated) record._completed_at_estimated = true;
   // #1068 AC3/AC4 — forensic supersede marker. sessions.jsonl is append-only,
@@ -329,6 +413,13 @@ function synthesizeRecord({ recordId, synthetic, gathered, nowMs, status = 'aban
   // "historische Stub-Provenance bleibt erhalten"). Readers resolve one
   // canonical state per id by taking the NEWEST record for that id.
   if (typeof supersedes === 'string' && supersedes.length > 0) record.supersedes = supersedes;
+  // #1167 — the harness UUID this record was reconstructed from, when known.
+  // Additive and optional (the schema validates unknown keys pass-through, see
+  // session-schema/validator.mjs `_validateOptionalFields`): it is the ONLY key
+  // that lets a reader join a semantic record back to its raw uuid. Measured
+  // 2026-09-02 @ c3ab480: 0 of 286 existing records carry it, which is exactly
+  // why the two backfill writers could not see each other's work.
+  if (typeof rawSessionId === 'string' && rawSessionId.length > 0) record.raw_session_id = rawSessionId;
   return record;
 }
 
@@ -535,8 +626,11 @@ export async function backfillAbandonedSession({
 
       // -- Resolve a deferred id from the lock bridge or a synthetic mint ------
       if (recordId === null) {
-        if (gathered.semanticFromLock) {
-          recordId = gathered.semanticFromLock;
+        // Prefer the lock bridge (it also carries `mode`), then the #1167
+        // session.ended bridge. Only when NEITHER attests a semantic id do we
+        // mint a synthetic one — that fallback was the duplicate-stub source.
+        if (gathered.semanticFromLock || gathered.semanticFromEvents) {
+          recordId = gathered.semanticFromLock || gathered.semanticFromEvents;
         } else {
           // No semantic bridge — mint a synthetic id. Both components are STABLE
           // across re-runs so dedupe/marker suppress a double write (idempotency
@@ -619,7 +713,13 @@ export async function backfillAbandonedSession({
       }
 
       // -- Synthesize + validate (round-trip gate) BEFORE any disk mutation ---
-      const record = synthesizeRecord({ recordId, synthetic, gathered, nowMs });
+      const record = synthesizeRecord({
+        recordId,
+        synthetic,
+        gathered,
+        nowMs,
+        rawSessionId: isUuid(sessionId) ? sessionId : null,
+      });
       let validated;
       try {
         validated = validateSession(record);
@@ -845,6 +945,13 @@ export async function backfillCompletedFromStateMd({
         status: 'completed',
         backfillSource: 'state-md-completed',
         supersedes,
+        // #1167 — the abandoned path stamps this; so must the authoritative
+        // one, or the join key exists on exactly the weaker half of the pair.
+        // `gathered.uuids` is bridged from lock.acquired / session.ended, so it
+        // normally holds EXACTLY the one uuid this semantic id ran under. Two
+        // (or zero) means the bridge is ambiguous — omit rather than guess, the
+        // same fail-quiet posture as `isUuid(sessionId) ? sessionId : null`.
+        rawSessionId: gathered.uuids?.size === 1 ? [...gathered.uuids][0] : null,
       });
       let validated;
       try {

package/scripts/lib/session-discovery.mjs

@@ -32,6 +32,28 @@
  *   - Lock takes precedence over registry (more detail per session); registry
  *     supplements missing per-worktree entries (e.g., when the hook ran but
  *     the prose Phase 1.2 acquire was skipped).
+ *   - A live local session.lock does NOT supersede same-repo registry entries
+ *     with a different raw session_id (GH#67 candidate fix, measured 2026-09-02
+ *     and NOT adopted): the session lock is advisory, so a second session can
+ *     and demonstrably does run in the same working copy without holding it.
+ *     Filtering those entries out hides genuine same-working-copy peers — the
+ *     #1085 semantic-alias boundary (tests/integration/session-identity-
+ *     boundaries.test.mjs) and 7 peer-discovery cases pin exactly that
+ *     visibility. Any GH#67 fix must discriminate finished-but-fresh entries
+ *     some other way; do not re-attempt lock-ownership supersession here.
+ *     See ADR-0014 (docs/adr/0014-peer-visibility-under-advisory-lock.md) for
+ *     the annotate-never-filter decision and the 9-test refutation of the
+ *     filtering alternative.
+ *   - The adopted GH#67 shape is therefore ADDITIVE ANNOTATION, never a filter.
+ *     Registry-sourced sessions carry `registryOnly: true` plus
+ *     `lockSuperseded` / `lockOwnerId`. `lockSuperseded: true` means: a LIVE
+ *     lock at this repoRoot is owned by a different raw session_id than this
+ *     registry entry. It is a HINT, not a verdict — the lock is advisory, so
+ *     the entry may still be a live session that lost the acquire race (#1085
+ *     contract). Consumers deciding a worktree-PROMOTION_OFFER downgrade such
+ *     a peer to an advisory line (GH#67); consumers counting or displaying
+ *     peers keep it. Lock-sourced sessions carry none of the three fields, so
+ *     their objects stay byte-identical to the pre-GH#67 shape.
  *
  * Timeout + A1 fallback:
  *   - listWorktrees() is raced against DEFAULT_DISCOVERY_TIMEOUT_MS (2 s).
@@ -93,10 +115,24 @@ function sessionFromLock(lock, worktreePath, branch = '') {
  * does not record per-worktree paths — only repo-path-hashes. Branch is
  * passed through from the registry entry when available.
  *
+ * GH#67 annotation (additive, never a filter — see the module header): every
+ * registry-sourced session carries `registryOnly: true` and the pair
+ * `lockSuperseded` / `lockOwnerId`. `lockSuperseded: true` says a LIVE lock at
+ * this repoRoot is owned by a DIFFERENT raw session_id than this entry — a
+ * HINT that the entry may be a finished-but-still-fresh task (the GH#67 case:
+ * Codex emits no SessionEnd, so the registry entry outlives the task by up to
+ * `freshnessMin`). It is not a verdict: the lock is advisory, so the entry may
+ * equally be a live session that never acquired it (#1085). Consumers deciding
+ * a worktree PROMOTION_OFFER downgrade such a peer to an advisory line;
+ * consumers counting or displaying peers keep it unchanged.
+ *
  * @param {object} entry    Registry entry.
  * @param {string} repoRoot Discovery repoRoot (used as worktreePath fallback).
+ * @param {object} [ctx]
+ * @param {string|null} [ctx.lockOwnerId] Raw session_id owning a LIVE lock at
+ *   repoRoot, or null when there is no live local lock.
  */
-function sessionFromRegistryEntry(entry, repoRoot) {
+function sessionFromRegistryEntry(entry, repoRoot, { lockOwnerId = null } = {}) {
   return {
     worktreePath: repoRoot,
     sessionId:    entry.session_id,
@@ -111,6 +147,11 @@ function sessionFromRegistryEntry(entry, repoRoot) {
     // single machine, so consumers comparing hosts need the normalised form.
     host_id:      stableHostname(),
     branch:       typeof entry.branch === 'string' ? entry.branch : '',
+    // GH#67 additive annotation (see the JSDoc above). Lock-sourced sessions
+    // deliberately carry none of these three fields.
+    registryOnly: true,
+    lockSuperseded: lockOwnerId !== null && entry.session_id !== lockOwnerId,
+    lockOwnerId,
   };
 }
 
@@ -177,7 +218,10 @@ function dedupeBySessionId(sessions) {
  * @param {Function} [opts.registryReader]      DI hook replacing readRegistry() for tests.
  * @param {number}   [opts.freshnessMin=15]     Registry-entry freshness threshold in minutes.
  * @param {number}   [opts.now]                 ms-since-epoch (test seam for heartbeat freshness).
- * @returns {Promise<Array<{worktreePath:string,sessionId:string,mode:string,startedAt:string,pid:number,host:string,host_id:string,branch:string}>>}
+ * @returns {Promise<Array<{worktreePath:string,sessionId:string,mode:string,startedAt:string,pid:number,host:string,host_id:string,branch:string,registryOnly?:boolean,lockSuperseded?:boolean,lockOwnerId?:string|null}>>}
+ *   The last three fields appear ONLY on registry-sourced sessions (GH#67
+ *   annotation — see `sessionFromRegistryEntry`); lock-sourced sessions omit
+ *   them entirely.
  */
 export async function discoverActiveSessions(repoRoot, opts = {}) {
   const listWorktreesFn = opts.listWorktreesImpl ?? listWorktrees;
@@ -232,10 +276,20 @@ export async function discoverActiveSessions(repoRoot, opts = {}) {
   try {
     const allEntries = await registryReaderFn();
     const myRepoHash = repoPathHash(repoRoot);
+    // GH#67: who (if anyone) holds a LIVE lock at this repoRoot right now.
+    // Read once, outside the map — it is a property of the repo, not of an
+    // entry. A stale lock proves nothing, so it yields null.
+    const localLock = readLock({ repoRoot });
+    const lockOwnerId = (
+      localLock
+      && isLockLive(localLock, nowMs)
+      && typeof localLock.session_id === 'string'
+      && localLock.session_id
+    ) ? localLock.session_id : null;
     registrySessions = allEntries
       .filter((e) => e && e.repo_path_hash === myRepoHash)
       .filter((e) => isRegistryEntryFresh(e, { freshnessMin, now: nowMs }))
-      .map((e) => sessionFromRegistryEntry(e, repoRoot));
+      .map((e) => sessionFromRegistryEntry(e, repoRoot, { lockOwnerId }));
   } catch {
     // Registry read failure → keep going with lock-only results.
     registrySessions = [];

package/scripts/lib/session-end/phase-skip.mjs

@@ -55,7 +55,7 @@ import { sweepExpiredLearnings } from '../learnings/expiry-sweep.mjs';
 import { shouldDispatchAutoDream } from '../auto-dream.mjs';
 import { shouldDispatchAutoDialectic } from '../auto-dialectic.mjs';
 import { readSkillInvocations } from '../skill-invocations-schema.mjs';
-import { runReconcile, resolveEffectiveTargets } from '../reconcile/engine.mjs';
+import { runReconcileFromPhaseSkip, resolveEffectiveTargets } from '../reconcile/engine.mjs';
 import { resolveMemoryDir } from '../memory-paths.mjs';
 
 // ---------------------------------------------------------------------------
@@ -285,7 +285,7 @@ async function decideReconcile({ repoRoot, cfg }) {
     if (!existsSync(learningsPath)) {
       return mkSkip(phase, 'learnings.jsonl absent', 'learnings.jsonl');
     }
-    const { proposals, summary, error } = await runReconcile({
+    const { proposals, summary, error } = await runReconcileFromPhaseSkip({
       repoRoot,
       ruleExpiryDays: cfg?.reconcile?.['rule-expiry-days'] ?? undefined,
       minRuleDays: cfg?.reconcile?.['min-rule-days'] ?? undefined,

package/scripts/lib/session-id.mjs

@@ -42,6 +42,7 @@
 import { open, readFile } from 'node:fs/promises';
 import path from 'node:path';
 
+import { readCanonicalSessions } from './sessions-canonical.mjs';
 import { withStateMdLock } from './session-lock.mjs';
 import { resolveStateMdPath } from './state-md/frontmatter-mutators.mjs';
 import { parseStateMd } from './state-md/yaml-parser.mjs';
@@ -127,34 +128,22 @@ function isValidMode(mode) {
  *  - Malformed JSONL line → silently skipped (per-line try/catch).
  *  - Lines without a string `session_id` field → filtered out.
  *
- * Performance note: sessions.jsonl is line-oriented but typically <100 KB.
- * A single readFile is faster than line-streaming at this size. Should the
- * file grow past ~5 MB a future change can swap to a `readline` stream with
- * early-exit; not a launch blocker.
+ * #1209: migrated to `readCanonicalSessions` (dedup per `session_id`, drop
+ * id-less lines — same three rules `sessions-canonical.mjs` documents).
+ * Number-neutral for THIS reader: the only consumer of its output
+ * (`resolveSemanticSessionId`) folds `candidateIds` through `Math.max` over
+ * the parsed `n` — "Duplicates are fine — Math.max handles them" (see that
+ * function's body) — so collapsing a duplicate `session_id` line to one
+ * record changes nothing observable here. Migrated anyway for one collapse
+ * implementation across all `sessions.jsonl` raw-line-scan readers (#1209).
  *
  * @param {string} repoRoot
- * @returns {Promise<string[]>}  Array of session_id strings (may include duplicates).
+ * @returns {Promise<string[]>}  Array of session_id strings (may include duplicates
+ *   only across DIFFERENT ids — never the same id twice, see above).
  */
 async function readSessionIdsFromHistory(repoRoot) {
   const filePath = path.join(repoRoot, '.orchestrator', 'metrics', 'sessions.jsonl');
-  let raw;
-  try {
-    raw = await readFile(filePath, 'utf8');
-  } catch {
-    return [];
-  }
-  const ids = [];
-  for (const line of raw.split(/\r?\n/)) {
-    const trimmed = line.trim();
-    if (trimmed === '') continue;
-    try {
-      const parsed = JSON.parse(trimmed);
-      if (typeof parsed?.session_id === 'string') ids.push(parsed.session_id);
-    } catch {
-      // Malformed line — skip silently (audit §3.1 robustness contract).
-    }
-  }
-  return ids;
+  return readCanonicalSessions({ filePath }).map((rec) => rec.session_id);
 }
 
 /**