session-orchestrator 3.24.0 → 4.0.0

package/CHANGELOG.md

@@ -7,10 +7,1063 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [4.0.0] - 2026-09-06
+
+> **A MAJOR, because public surfaces are REMOVED** (see *Removed (BREAKING)* below).
+> This entry was folded out of `[Unreleased]` by hand at cut time. That is a manual
+> editorial act and not an automated one: `scripts/release.mjs` carries no writer for it —
+> `checkChangelogEntry()` (`release.mjs:283`) only REQUIRES a dated `## [4.0.0]` heading as
+> the topmost release with `[Unreleased]` emptied (`release.mjs:296`), and `--check`
+> separately requires HEAD to be present on BOTH remotes (`evaluateRemoteHeadParity`,
+> `release.mjs:556`) before it will tag. An earlier draft of this note asserted that the
+> script renames the heading; it does not, and a release trusting that would have failed
+> its own preflight. The reason the heading is written no earlier than the cut is the
+> `3.22.1` failure this repo already paid for once — a release section for a release that
+> never completed, unnoticed for 12 days (`e4674109`).
+
+**Predecessor commits (v3.24.0 → `e4674109`).** Three commits (`ee8ea425` Wave 2,
+`e22a702e` Wave 3, `37169158` Wave 4; 71 files, +3,505/−678, measured
+`git diff --stat 2cb8708b..37169158`), no `BREAKING CHANGE:` footer and no `!` subject.
+Twelve Wave-2 follow-up issues land as mechanism: identity resolution folds onto the
+process-local reader on a third surface, seven ledger readers move onto one canonical
+`sessions.jsonl` collapse, and a `secret_masker.applied` guard closes its last two gaps.
+Wave 3 arms the schema-drift CI gate; Wave 4 is a 3-Opus-reviewer panel plus fixpass that
+closed 2 HIGH findings inside the panel's own Wave-2/3 diff.
+
+**The 360° audit session (`main-2026-09-06-deep-1`) — what makes this a major.** Everything
+below marked *4.0.0 — audit session* is that session's own change set, which lands as this
+release's commit: 277 working-tree entries at fold time (`git status --short | wc -l`,
+2026-09-06), on top of 13 already-committed predecessors measuring 256 files, +13,537/−1,669
+(`git diff --stat v3.24.0..HEAD | tail -1`, same day). Fourteen read-only Discovery agents measured the plugin against its own
+telemetry, the 90-day fleet ledger and the vendor docs; the synthesis is
+[`docs/audits/2026-09-06-360-audit.md`](docs/audits/2026-09-06-360-audit.md), per-agent
+evidence under `docs/audits/2026-09-06-360-audit/w1/`. Nothing was removed on judgement: the
+rule was 0 telemetry ∧ 0 fleet invocation in 90 days ∧ no runtime consumer, and
+prose-invoked skills (0 by construction) were exempt. Upgrade guide:
+[`docs/migration-v4.md`](docs/migration-v4.md).
+
+### Added
+
+#### 4.0.0 — audit session
+
+- **Root `AGENTS.md`, root `plugin.json`, and a portable `.agents/skills/` mirror — this repo
+  was previously invisible to Copilot CLI and to agent-plugins.org clients.** The root
+  `AGENTS.md` is byte-identical to `CLAUDE.md` (`diff -q AGENTS.md CLAUDE.md` → no
+  difference), so a harness that resolves project instructions from `AGENTS.md` now finds
+  this repo's own Session Config instead of nothing — before this there was no root
+  `AGENTS.md` at all, meaning the plugin's own repository could not read its own config on a
+  harness that looks for that filename. `plugin.json` declares
+  `$schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json`, the cross-vendor
+  manifest shape Cursor, Amazon, Microsoft, OpenAI and Vercel converged on.
+  `.agents/skills/<name>/SKILL.md` mirrors all 43 skills (`ls .agents/skills | wc -l` → 43)
+  for harnesses that read that convention rather than a plugin manifest.
+- **`ultradeep` — a session PROFILE over `deep`, deliberately NOT a fourth session type.**
+  `/session ultradeep` resolves to `session-type: deep` + `session-profile: ultradeep` in
+  STATE.md frontmatter (`commands/session.md` § Argument alias). `session-type` never becomes
+  `ultradeep`: `VALID_SESSION_TYPES` is a closed set in
+  `scripts/lib/session-schema/constants.mjs`, and a fourth member would degrade silently in
+  two places (`telemetry/schema.mjs` maps an unknown type to `"other"`,
+  `session-close-backfill.mjs` labels it `housekeeping`). The profile changes only the wave
+  SHAPE — 7 waves with a coordinator-direct Synthesis-Gate at W2 (`agents: 0`, the one wave
+  whose whole job is to stop and ask before any code is written), per the new row at
+  `skills/session-plan/SKILL.md:336`. `SESSION_PROFILE_FIELD` in `scripts/lib/state-md.mjs`
+  is the reader; absent is not empty. Budgets (`ultradeep.max-*`) are deliberately NOT
+  implemented — the PRD defers thresholds until three runs have been measured. Spec:
+  [`docs/prd/2026-09-06-ultradeep-session-profile.md`](docs/prd/2026-09-06-ultradeep-session-profile.md).
+- **A plugin-update banner at session-start — the first code in this repo that compares
+  INSTALLED against AVAILABLE.** `scripts/lib/plugin-update-banner.mjs` (`checkPluginUpdate`,
+  imported lazily from `hooks/on-session-start.mjs:976`) reads the RUNNING package's own
+  `package.json` — resolved as `../..` from `scripts/lib/`, i.e. the loaded bytes, never
+  `$CLAUDE_PLUGIN_ROOT`, which is precisely what resolved to the checkout while a stale cache
+  copy was executing — and compares it against the npm `dist-tags.latest`. The measured gap:
+  this host ran the marketplace cache at **3.19.0** (installed 2026-08-09) while repo and npm
+  were at **3.24.0** — five minors, four weeks, no warning, because the freshness probe
+  shells out to `git -C <plugin-dir> log -1` against a FILE COPY and
+  `classifyVersionMismatch()` downgrades anything below a major jump to `info`. Contract:
+  fail SILENT, never optimistic — offline, non-2xx, malformed JSON, timeout and unusable
+  cache each return `null` ("no statement"), never "you are up to date" (the #1031 collapse
+  class).
+- **A telemetry sandbox guard — `detectSandbox()` in `scripts/lib/telemetry/sync.mjs`.**
+  This session's own read-only Wave-1 benches sent 6 production pings from agent sandboxes:
+  `hooks/on-session-end.mjs` ran from the repo checkout with `SO_CONFIG_HOME` redirected
+  while `owner.yaml` was unreachable inside the sandbox. The sender now refuses when
+  `SO_TELEMETRY_DISABLED=1` (`sandbox:telemetry-disabled`), `DO_NOT_TRACK` is set
+  (`sandbox:do-not-track`), the config home is split from the state dir
+  (`sandbox:config-home-split`), or the state dir resolves under a temp root
+  (`sandbox:temp-root` — matched after realpath, because macOS's `/var` → `/private/var`
+  symlink defeats a raw string prefix). Every refusal is reported with its `sandbox:*` reason
+  rather than as a silent no-op.
+- **[`docs/baseline.md`](docs/baseline.md) — the `projects-baseline` relationship written
+  down.** One line: the baseline is a **private, optional** companion repository, read when
+  present, degraded to a documented fallback when absent, required by nothing in this plugin
+  and needed by no public consumer. The measurement behind it: of 49 baseline-touching files,
+  17 are docs-only, 15 test-only, 13 soft, and only 4 hard-runtime — **2 of those 4 pointed
+  at a hardcoded `$HOME/Projects/projects-baseline` that does not exist**.
+
+#### Predecessor commits (v3.24.0 → `e4674109`)
+
+- **`scripts/lib/wave-executor/dispatch-common.mjs` (#1204).** Six symbols
+  (`NEVER_FOREIGN_ROLES`, `DEFAULT_TIMEOUT_SEC`, `DEFAULT_KILL_GRACE_MS`, `isSafeRunId`,
+  `isNeverForeignRole`, `runChild`) extracted out of `foreign-dispatch.mjs` into one shared
+  module, imported by both dispatch call sites (`foreign-dispatch.mjs`, `remote-dispatch.mjs`)
+  and their two test files. A redundant `isNeverForeignRole` check that had never lived in
+  `wave-resource-gate.mjs`'s own invariant is now a documented non-check there instead of a
+  silent gap.
+- **`scripts/lib/learnings/evolve-telemetry.mjs` (#1206).** Mechanical
+  `orchestrator.evolve.completed` / `orchestrator.dialectic.completed` emitters replace
+  hand-written prose emit sites in `skills/evolve/SKILL.md`: `recordEvolveCompletion()` is
+  called from `scripts/sweep-expired-learnings.mjs`'s `--prune` exit path (the one store
+  write `/evolve analyze` already performs), and `recordDialecticRun()` from
+  `scripts/dialectic-deriver.mjs`. Both skip the emit with a stderr note when no `repoRoot`
+  is given, so test runs never write the fleet ledger. `docs/events-schema.md` gained both
+  event's producer lines.
+- **`hooks/post-edit-import-probe.mjs` — a PostToolUse hook that catches a broken
+  hook-reachable module at save time, not at the next tool call (#1224).** On every
+  Edit/Write/MultiEdit to a `.mjs`/`.js`/`.cjs` file that is a member of the new committed
+  allowlist `hooks/_lib/hook-import-set.json` (149 modules at generation time — every module
+  transitively reachable from the four hook manifests' entry files), it runs ESLint's
+  `no-undef` on that single file (primary check) plus an `import()` probe scoped to
+  `scripts/lib/**` only (secondary — `hooks/*.mjs` is excluded because half of them run
+  `main()` at module bottom). Reports via `additionalContext` + the new
+  `orchestrator.hook.import_probe_failed` event (payload: `file`, `check`, `error`,
+  `reachable_from`, `duration_ms` — documented in `docs/events-schema.md`); never blocks
+  (exit 0 always); kill switch `SO_DISABLED_HOOKS=post-edit-import-probe`. The allowlist is
+  built by the new `scripts/generate-hook-import-set.mjs` (`--check` re-crawls and diffs) and
+  is guarded three ways: a new blocking `validate-plugin.mjs` check
+  (`runHookImportSetCheck`), a new `.husky/pre-commit` stage scoped to commits touching
+  `hooks/` or `scripts/lib/`, and — deliberately absent — no Codex wiring
+  (`hooks-codex.json`), documented as an intentional asymmetry in
+  `check-hooks-symmetry.mjs`'s `DOCUMENTED_ASYMMETRIES` (same missing Edit/Write-payload
+  adapter gap as `post-edit-validate.mjs`). Wired into `hooks.json`, `hooks-cursor.json`, and
+  `hooks-pi.json`. Rationale: the 2026-09-04 host-wide hook-block incident documented
+  elsewhere in this section (a `SyntaxError`/`ReferenceError` in an intermediate save of
+  `own-session.mjs` blocked every Bash/Edit call on the host for ~8 minutes) was a
+  **call-time** defect neither `node --check` (syntactically valid) nor a bare `await
+  import()` (module-level evaluation succeeds) catches — ESLint's `no-undef` does. The
+  allowlist has since been regenerated to include `scripts/lib/config/private-config-dir.mjs`
+  (new, #1223 below), which became hook-reachable via `host-identity.mjs`: measured
+  2026-09-05, `node scripts/generate-hook-import-set.mjs --check` → `✓ hook-import-set: 150
+  modules, in sync`.
+
+### Changed
+
+#### 4.0.0 — audit session
+
+- **43 generated rule files consolidated into 8 thematic ones; `.claude/rules/` goes 61 → 26
+  files.** Measured now: `ls .claude/rules/*.md | wc -l` → 26, of which **zero** still match
+  the generated-rule naming (`anti-pattern-*`, `proven-pattern-*`, `recurring-issue-*`,
+  `convention-*`, `fragile-*`); at `HEAD` (`e4674109`) the same directory held 61 files
+  (`git ls-tree -r --name-only HEAD .claude/rules/ | grep -c '\.md$'`). The eight
+  replacements are `identity-and-locks`, `guard-design`, `measurement-discipline`,
+  `test-hygiene`, `process-contracts`, `toolchain-and-build`, `git-and-worktrees`,
+  `review-and-adapter-contracts`. Grounds: the 43 files were delivered TWICE per dispatched
+  agent (natively plus via rule injection) — 112 kB, 46 % overhead — and 10 of them restated
+  an always-on rule's insight verbatim.
+- **The three largest instruction files are SPLIT into `references/`, not shortened.**
+  `skills/session-start/SKILL.md` 1,275 → 388 lines (9 reference files);
+  `skills/session-end/SKILL.md` 1,203 → 316 (6 reference files);
+  `skills/wave-executor/wave-loop.md` 1,337 → a 39-line index over 3 references
+  (`wave-loop-dispatch.md`, `wave-loop-review.md`, `wave-loop-scope-manifest.md`). Baselines
+  measured `git show HEAD:<path> | wc -l`, current `wc -l`. Content moved rather than
+  vanished: a phase you need is one hop away, a phase you do not need is no longer in every
+  agent's context.
+- **`orchestrator.session.stopped` → `orchestrator.turn.stopped` (GitLab #1234).** The
+  emitter fires per assistant TURN, not per session: measured over the 90-day fleet window,
+  **15,538 records against 2,016 distinct `orchestrator.session.started` ids = 7.7 per
+  session**, with 184 for one id — so six consumers reading it as a session-lifecycle signal
+  were wrong by that factor. `hooks/on-stop.mjs:489`/`:493` emits BOTH names from the same
+  payload object for one deprecation generation (so they cannot disagree); the legacy name
+  additionally carries `deprecated: true`, letting a reader tell at a glance that it matched
+  the old name. **Removal of `orchestrator.session.stopped`: 2027-03-06.** Readers switch the
+  name they match on and change nothing else. NOT affected: the SubagentStop branch keeps
+  emitting `orchestrator.agent.stopped`, whose per-agent cardinality is correct. Contract:
+  `docs/events-schema.md:92-93`.
+- **The telemetry `fleet` field becomes `fleet_self_declared`, and attribution moves
+  server-side.** The old name asserted something the client cannot know: 394 of 490 pings
+  were the operator's own second Mac, mis-attributed as "external", because the flag hung off
+  an `owner.yaml` line rather than off a person. The client field now says what it is —
+  self-declared, derived from the RESOLVED consent state (`enabled-fleet` / `enabled-env`)
+  rather than from a raw `owner.yaml` read (`scripts/lib/telemetry/schema.mjs:552-555`) — and
+  the authoritative classification is an anon-id allowlist in the ingest server
+  (`server/ingest/config.mjs`, `server/ingest/validate.mjs:190-196`). `fleet` remains in the
+  payload, identical in value for the whole generation so the server's existing column stays
+  comparable: **DEPRECATED 2026-09-06, removal 2027-03-06** (`docs/telemetry.md:42-43`).
+
+- **`zod` and `yaml` hoisted from a nested skill's own `package.json` to this repo's
+  root `dependencies`.** `skills/vault-sync/package.json` resolved them as its own
+  transitive install; a fresh top-level `npm ci` without that nested install step
+  left `vault-sync`'s schema validation unable to resolve either package. Root
+  `package.json` now pins `yaml@^2.9.0` and `zod@^3.25.76` directly (the nested
+  `package.json` still carries its own copies — redundant, harmless, left as a
+  cleanup candidate).
+- **`scripts/release.mjs`'s preflight gains a GitHub-mirror CI row and two
+  publish-time hardenings.** `evaluateGithubCiRow()` adds `ci-green-on-head-github`
+  as its own preflight check (26 rows total) via `checkCiStatus({ vcs: 'github' })`
+  — `--skip-ci` marks it skipped, and a repo with no configured GitHub remote also
+  skips it rather than failing; `publishInvocation()` now pins
+  `npm_config_loglevel=notice` on the publish spawn (an inherited silent level from
+  an outer gate run suppressed output the packlist gate depends on); and
+  `describeTagProgress()` is printed on a post-receipt tag/push failure, so a
+  publish that succeeds but fails to tag no longer leaves the operator guessing
+  what state the release is in. `commands/release.md` step 7 documents the ≥600s
+  Bash wrapper this needs; `skills/npm-publish/SKILL.md` is updated to match.
+- **The release drift sweep moves off `git grep` onto `enumerateRepoFiles()`
+  (#1248) — the same gitignore/untracked blind spot the two checkers below were
+  fixed for, closed once.** `collectDriftHits()` in `scripts/release.mjs` now
+  enumerates via `git ls-files --cached --others --exclude-standard` instead of
+  shelling out to `git grep` for the previous release tag, so an untracked file is
+  swept for a leftover version literal exactly as a tracked one is.
+- **The Full Gate now names which test FILES failed, not just the pass/fail
+  count.** `extractFailedTestFiles()` (`scripts/lib/gates/gate-helpers.mjs`) parses
+  vitest's own failure output; `gate-full.mjs` carries the result as a new
+  `failed_files[]` field alongside the existing counts, on both the returned
+  object and the `orchestrator.quality_gate.*` event payload. Separately,
+  `.husky/pre-push` now passes the real repo root to the gate as an **argv flag**,
+  `--ledger-root <path>` (`npm run --silent quality-gate -- --ledger-root
+  "$repo_root"`), so a gate run against a materialised temp worktree writes its
+  event into the REAL repo ledger instead of a tree an `EXIT` trap deletes seconds
+  later — the root cause of several `quality_gate.passed` records the test suite
+  itself had polluted into `.orchestrator/metrics/events.jsonl`.
+  `resolveLedgerRoot()` (`scripts/run-quality-gate.mjs`) validates the flag as an
+  existing directory that itself contains `.orchestrator/`; anything else is one
+  stderr WARN and a fallback to the pre-existing resolution, never a crash. **This
+  shipped first as an exported `SO_GATE_LEDGER_ROOT` env var and was replaced
+  before release, inside the same session**: the Wave-4 architect-panel review
+  measured that an exported env var is inherited by every descendant process,
+  including the gate's OWN vitest children three levels down (`npm run
+  quality-gate` → `gate-full.mjs` → `npm test`), where `run-quality-gate.test.mjs`'s
+  telemetry tests spread `...process.env` and so wrote their fixture events to the
+  pinned root instead of their own tmp fixture — measured **8 of 9 telemetry tests
+  red** under the hook's own environment. An argv flag reaches only the one
+  process meant to read it. `run-quality-gate.test.mjs` still sandboxes
+  `CLAUDE_PROJECT_DIR` per test and additionally scrubs any ambient
+  `SO_GATE_LEDGER_ROOT` before each run (belt-and-braces against a leftover from
+  the removed env-var form); a new `tests/husky/pre-push-gate.test.mjs` case
+  ("hands the real repo root to the gate as --ledger-root") pins the hook's own
+  argv, and 0 production readers of `SO_GATE_LEDGER_ROOT` remain repo-wide
+  (`grep -rn SO_GATE_LEDGER_ROOT` outside test files and history comments → no
+  match, measured 2026-09-06).
+- **The session-start plugin-update banner is now English and platform-aware.**
+  `checkPluginUpdate()` (`scripts/lib/plugin-update-banner.mjs`) accepts an
+  optional `platform` and picks the matching upgrade command from
+  `PLATFORM_UPDATE_INSTRUCTIONS` (`claude`/`codex`/`cursor`/`pi`), falling back to
+  a generic `npm update`-shaped instruction when the platform is unset or
+  unknown — previously every consumer saw the same `claude plugin update` line
+  regardless of harness.
+- **Six documentation corrections following the 4.0.0 removals above.** The
+  `autopilot` SKILL's Configuration section is now a 4-line pointer to
+  `docs/migration-v4.md` instead of describing the removed `bg-isolation` field in
+  full; `NOTICE`'s attribution table is repointed at
+  `skills/architecture/references/{domain-model,ADR-FORMAT,CONTEXT-FORMAT}.md` and
+  notes `ubiquitous-language`'s removal while keeping its MIT attribution history;
+  `check-agents.mjs`'s warn-string citations of `agents/AGENTS.md` now cite
+  `docs/agent-authoring.md`; `templates/_shared/journey-manifest.md` gained a
+  retirement notice (kept as an optional per-repo template — no command consumes
+  it anymore); `skills/architecture/SKILL.md` documents when to load
+  `references/domain-model.md`; and `README.md` picked up matching corrections
+  (Windows is untested rather than "runs natively"; the update banner is
+  patch-silent; nothing is sent without consent EXCEPT the update check's own
+  anonymous `GET`, opt-out via `SO_DISABLE_UPDATE_CHECK`/`DO_NOT_TRACK`).
+
+#### Predecessor commits (v3.24.0 → `e4674109`)
+
+- **Quality-gate ownership check now folds onto the process-local reader (#1205).**
+  `quality-gate.mjs`'s private copy of `readOwnSessionIds()` is gone; the ownership check now
+  calls `readProcessLocalSessionIds()` directly (removing the STATE.md-lock fallback), with
+  the first test of the ownership path itself.
+- **Wave-scope manifest binding writes `attributionForRecord()`, not a hand-rolled call
+  (#1207).** `skills/wave-executor/wave-loop.md`'s manifest-binding step now sources
+  `session`/`wave` from the same `attributionForRecord()` used by `emitEvent()`'s own
+  correlation fill, instead of a raw `sessionAttribution()` call; the STATE.md prose
+  comparison the previous step asked for is removed as a redundant, sometimes-wrong check
+  (a peer-owned lock and STATE.md agree with each other, not with this process).
+- **Seven readers now go through `readCanonicalSessions()` instead of their own duplicate
+  parse (#1209).** `session-id.mjs`, `auto-dream.mjs`, `dispatcher/rank.mjs`,
+  `eval/engine.mjs` (+ new `eval/session-resolve.mjs`), `harness-audit/categories/category4.mjs`
+  (via `canonicalizeSessions({ keepUnidentified: true })`, since a bare wrapper broke 3
+  id-less fixtures), `skill-health/join.mjs`, `sessions-staleness-banner.mjs`, and
+  `dialectic-deriver.mjs` each had a red-on-HEAD fake-regression proof before the fix
+  (auto-dream 3→2 sessions, rank 50→<6 candidates, eval 2→1 peers). `category9` is
+  deliberately untouched.
+- **Four modules now distinguish silent `ENOENT` from a loud read failure (#1210).**
+  `session-close-backfill.mjs`, `reconcile/engine.mjs`, `memory-proposals/store.mjs` (via a
+  new shared helper — a decorative `err.code` branch there is now real), and
+  `agent-status.mjs` all warn on stderr for `EACCES`/`EISDIR`/other, and stay silent only on
+  a genuinely missing file.
+- **German distributional-claim patterns join the English set (#1211).** Six German
+  quantifier-triggered patterns (`N von M`, `100% von/der/aller`, `alle N`, `keine
+  verbleibenden`, `jeder/jede/jedes`, `keiner/keine/keins von/der`) plus a narrow German
+  `CARDINAL_NOUN` extension (`zeilen?|dateien?|datei|aufrufer|eintr(?:ag|(?:ä|ae)ge)`) land
+  in `hooks/post-subagent-discovery-validator.mjs`. Measured against a 41-line German claim
+  corpus pulled from this repo's own `events.jsonl`: the quantifier patterns flag 7/41
+  (same order of magnitude as the English baseline); a wider bare-cardinal noun set
+  (`Sessions`/`Repos`/`Treffer`/`Stellen`/`Module`/`Tests`) was tried and rejected after it
+  flagged 39/41 (~57% false-positive rate) — those six nouns stay reachable only through the
+  lexically-anchored quantifier patterns. German `GATE_SUMMARY` recap forms are also
+  recognised and skipped, matching the existing English recap-skip.
+- **`skills/vault-sync/validator.mjs`'s vendored schema catches up with upstream (#531).**
+  `peer-card` (#503), `board` (#738), and the optional `source-repo` field (#725) were
+  vendor-ahead of `projects-baseline` until this session; upstream-lifted in
+  `projects-baseline@cb9ec97`. `sync-vault-schema.mjs` now strips a bare `//` line (with a
+  regression test), and the provenance notes documenting the vendoring history moved outside
+  the generated-block sentinels so a `--write` regeneration can no longer drop them (measured:
+  it did, once).
+- **The schema-drift CI gate is armed (#1175, follow-up to #531).** `SCHEMA_DRIFT_OPTIONAL`
+  is `"false"` in both `.gitlab-ci.yml` jobs that read it — `schema-drift-check` (line 636)
+  and `pipeline-gate` (line 723) — so a missing `SCHEMA_DRIFT_TOKEN` now hard-fails (exit 4)
+  instead of degrading to an amber "not verified" pass. A test pins the armed state (a half
+  revert of either flag turns 2 tests red). Proof: pipelines 8355–8357 @ `bca78dae` (bogus
+  enum) failed with `schema-drift-check` reporting "drift detected"; pipeline 8358 @
+  `dc9522dd` (branch `proof/1175-schema-drift-green`) passed with the check running WITH the
+  token, in sync. `docs/ci-setup.md` documents the Project-Access-Token recipe and the
+  now-current state (was previously the follow-up gap this same doc named).
+- **`#1203` — the `enforce-scope.mjs` peer-manifest fix confirmed already SHIPPED via
+  #1194.** `tests/hooks/enforce-scope.test.mjs:1219/:1245/:1302` (56/56) prove the behaviour
+  landed with #1194; no further code change was needed.
+- **`scripts/lib/platform.mjs`'s five module-constant exports become lazy, memoized
+  accessors; the five constants are REMOVED (#1153 P5).** They were internal accessor
+  constants of this plugin, never a documented public API, and every in-repo importer is
+  migrated — an external importer of these five names (none known) switches to the
+  getters; no `BREAKING CHANGE:` footer is carried for that reason. `SO_PLATFORM`, `SO_PLUGIN_ROOT`,
+  `SO_PROJECT_DIR`, `SO_STATE_DIR`, `SO_CONFIG_FILE` used to be `export const … =
+  detect…()` evaluated at module load, so every one of ~31 static importers — including
+  the hottest deny-capable hooks, which run on every tool call — paid a filesystem
+  walk-up (`statSync`/`existsSync` per ancestor directory) merely for importing the
+  module, whether or not the value was ever read. They are replaced by
+  `getPlatform()`/`getPluginRoot()`/`getProjectDir()`/`getStateDir()`/`getConfigFile()`,
+  computed on first call and memoized for the process (plus a test-only
+  `_resetPlatformCache()`); the deprecated names are fully REMOVED, not kept as
+  deprecated live bindings — a re-introduction is caught by the named-export assertion in
+  `tests/lib/platform.test.mjs`. 23 non-test call sites across `scripts/` and `hooks/` now
+  call a getter (re-measured 2026-09-05: `grep -rlE "getPlatform\(\)|getPluginRoot\(\)|getProjectDir\(\)|getStateDir\(\)|getConfigFile\(\)" scripts/ hooks/ --include="*.mjs" | grep -v /tests/ | grep -v platform.mjs | wc -l` → 23; it was 22 on 2026-09-04, before this session's own new modules landed).
+- **Wave-scope manifest session keys renamed to `session_id`/`semantic_session_id`,
+  canonical since #1153 P2.** The pre-#1153 spellings `session`/`semantic_session` are
+  still ACCEPTED on the read side for one release (`MANIFEST_SESSION_KEYS` in
+  `scripts/lib/session-identity/own-session.mjs` is the shared SSOT list every writer and
+  reader now imports); `scripts/validate-wave-scope.mjs` flags a manifest that carries
+  BOTH spellings with conflicting values as an error rather than silently preferring one
+  and dropping the other. `scripts/wave-scope-binding.mjs` (new — #1153 P4) replaces the
+  inline `node --input-type=module -e` block `skills/wave-executor/wave-loop.md` § Scope
+  Manifest previously asked the coordinator to retype once per wave; an unbound `{}`
+  manifest now emits `orchestrator.scope.unbound_manifest` (0 hits repo-wide before this
+  file existed), making the previously-silent fail-closed case countable. `--merge` folds
+  the binding into an existing manifest in place.
+- **`_privateDir()` (host-identity.mjs) now honours `SO_CONFIG_HOME` (#1153 P6).** Two
+  overrides, most specific first: `SO_CONFIG_HOME` names the private config directory
+  itself; `XDG_CONFIG_HOME` (same variable `owner-config-loader.mjs` already reads) names
+  its parent. Both read via `.trim() || fallback`, not a bare `||` (the whitespace-only
+  env-var trap). Without either, the homedir default `~/.config/session-orchestrator` is
+  unchanged.
+- **`scripts/lib/session-identity/own-session.mjs`'s static import closure cut from 3,567
+  to 269 lines (#1153 P7).** It no longer imports `../session-lock.mjs` — which drags
+  `session-lock` → `exclusivity-matrix` → `file-lock` → `io` → `host-identity` behind it —
+  and instead shares the shape predicate `isLockShape()` via a new zero-import module,
+  `scripts/lib/session-lock-shape.mjs`, with `session-lock.mjs`'s own `parseLock()`. This
+  matters because `hooks/enforce-scope.mjs` loads `own-session.mjs` on every Edit/Write;
+  anything it imports joins that hook's static closure.
+- **codex-cli 0.144.4 fixes the `plugin add` failure documented against 0.141.0
+  (#1163, FIXED-UPSTREAM — no code change here).** Re-verified end-to-end 2026-09-04
+  against this repo's unchanged flat layout: `codex plugin add session-orchestrator@kanevry
+  --json` now exits 0 where it previously failed with `plugin session-orchestrator was
+  not found in marketplace kanevry`. `docs/codex-setup.md`'s "Short-Form Marketplace Add"
+  section is promoted to the recommended install path and the prior failure kept as a
+  historical note; a new "Switching Marketplace Sources" section documents that
+  `marketplace add` silently REPLACES an already-registered marketplace of the same
+  declared name.
+- **`#1152` closed — the reported defect was a false premise (two separate writers, not
+  one drifting one).** No code change; investigation confirmed the two paths write
+  independently and neither needed reconciling.
+- **`#1214` — the suspected `maskerWouldChange` gap in the vault narrative-mirror sink was
+  a false premise, refuted by measurement.** Unlike the two `vault-mirror/process.mjs`
+  sinks fixed under #1028 (five-field comparisons that can match while a raw needle
+  survives on disk), `scripts/lib/vault-status/narrative-mirror.mjs` compares the WHOLE
+  rendered document, and the candidate always passes through the CURRENT `maskNarrative` —
+  so a value that masker would redact can never appear in it, and a false
+  `matchesModuloRedaction` match cannot occur. Measured 2026-09-04 at HEAD `cd785003` in
+  both directions (no marker on disk; marker on disk plus a second needle entering the
+  env): both returned `written` with the raw value gone. No probe added; two invariant
+  tests in `tests/lib/vault-status/narrative-mirror.test.mjs` pin it. Named ceiling: the
+  invariant depends on `maskNarrative` walking every rendered string, and `repo` is fed to
+  `renderNarrative` OUTSIDE that walk (a directory basename, not STATE.md content) — a
+  future rendered field added the same way would reopen this.
+- **Three host-private-config-dir resolvers collapse into one (#1223).** New zero-import
+  leaf `scripts/lib/config/private-config-dir.mjs` (`node:os` + `node:path` only) exports
+  `resolvePrivateConfigDir({env}?)` — precedence `SO_CONFIG_HOME` (the dir itself) >
+  `XDG_CONFIG_HOME` (its parent) > `~/.config/session-orchestrator`, each `.trim()`ed. Before
+  this, `owner-yaml.mjs`'s import-time `OWNER_YAML_PATH` (homedir-only, no overrides at all),
+  `owner-config-loader.mjs`'s `resolveOwnerConfigPath()` (XDG-only, untrimmed), and
+  `host-identity.mjs`'s `_privateDir()` each had a different precedence — so
+  `SO_CONFIG_HOME=<sandbox>` moved the self-alias ledger but not `owner.yaml`, which kept
+  reading the operator's real home (the CLAUDE.md "vault-dir resolves HOST-LOCALLY" hazard
+  class). `host-identity.mjs` now delegates `_privateDir()` to the leaf directly (it is
+  reachable from live hooks via `session-lock.mjs`, so the leaf must stay import-free);
+  `owner-yaml.mjs` re-exports `resolvePrivateConfigDir` and adds a call-time
+  `resolveOwnerYamlPath(env?)`; the old `OWNER_YAML_PATH` constant is fully REMOVED (verified
+  0 remaining consumers repo-wide), not kept as a deprecated back-compat export.
+  `owner-config-loader.mjs` and `owner-interview.mjs` now call through
+  `resolveOwnerYamlPath()` instead of their own copies. `tests/husky/pre-commit-owner-leakage.test.mjs`'s
+  file-by-file copied import chain (the CP11 scanner's dynamic-import fixture) gained the new
+  leaf as a required copy.
+- **`skills/wave-executor/wave-loop.md` gains a "Shell variables used in this section"
+  preamble (#1225).** `$PLUGIN_ROOT`, `$WAVE`, `$ROLE`, `$STATE_DIR` are defined once ahead
+  of the Scope Manifest steps instead of being re-explained inline (the `$PLUGIN_ROOT`
+  per-platform expansion parenthetical is now a single cross-reference instead of a repeated
+  clause).
+- **`scripts/lib/ci-status-banner.mjs` gains a three-state contract instead of two (#1031).**
+  A frozen `DEGRADED_REASONS` enum (`cli-missing`, `timeout`, `parse-error`, `query-failed`,
+  `git-error`) now distinguishes "state could not be read" from "no CI here" — before this,
+  4 return sites collapsed every CLI-missing / timeout / unparseable-output / VCS-probe-error
+  case onto the same `null` an absent remote returns, which the banner reads as all-clear
+  (the same collapse class documented for `mirror-issues-banner.mjs` in
+  `skills/session-start/SKILL.md`, now fixed on this probe too). Consumers updated to the new
+  shape: the probe registry in `scripts/lib/session-start-probes.mjs` (`ci-status` entry's
+  `render`/`severityOf` now treat a `degraded` result as `warn`, not `ok`);
+  `scripts/lib/dispatcher/rank.mjs` (new exported `normalizeCiSignal()` reduces every shape —
+  bare string, `{status}`, `{degraded}`, `null` — to `{ciStatus, ciDegraded}`, mapping
+  `degraded` to `'unknown'` for scoring parity with the old behaviour while surfacing the
+  reason into `signals.readiness.ciDegraded` and a `warnings` entry); `scripts/release.mjs`'s
+  `evaluateCiRow()` treats `ci.degraded` as "CI status unknown (\<reason\>)", never as green.
+  `skills/session-start/SKILL.md`'s CI-status paragraph documents the new degraded banner
+  line. `scripts/lib/qg-command-drift-banner.mjs` is converted too (W3-P1): it mints its own
+  `degradedBanner(reason)` and passes a nested `detailed.degraded` straight through
+  (`:59`/`:99`/`:102-103`), so a config that could not be READ is reported as `warn` rather
+  than read as "no drift".
+- **`hooks/post-tool-batch-wave-signal.mjs` starts emitting the `files_changed` measurement
+  `scripts/lib/convergence-monitor.mjs`'s `shrinking_diff` signal has always read but no
+  producer ever wrote (#980).** At an N→N+1 wave-open transition, the `orchestrator.wave.completed`
+  emitted for wave N now carries `files_changed` (the deduped union of
+  `git diff --name-only <wave_start_sha>` and `git ls-files --others --exclude-standard`,
+  measured against the working tree because the coordinator commits at session close, not per
+  wave) and `files_changed_source: 'worktree-vs-wave-start-sha'`; `wave_start_sha` (`git
+  rev-parse HEAD`) is persisted into `.orchestrator/current-session.json` under the same
+  ownership gate as the other wave keys when a wave opens. Both keys are optional and
+  absent-is-not-zero — any git failure, a 1.5s timeout, or a missing `wave_start_sha` omits
+  them, and the monitor reads the absence as `null` rather than firing on a fabricated 0.
+  `skills/convergence-monitoring/SIGNALS.md` gained a "Live monitor input" subsection under
+  all three signals (shrinking_diff, pass_rate_plateau, velocity_drop), each quoting a fresh
+  measurement of `.orchestrator/metrics/events.jsonl` (2026-09-05): 144 pre-existing
+  `wave.completed` records carried no `files_changed` key at all before this fix; 33
+  `orchestrator.quality_gate.*` records carry both `wave_number` and a well-formed `counts`
+  object (making `pass_rate_plateau` fireable, `_evaluateSignals` now a test-only export);
+  11,754 `orchestrator.agent.stopped` records make `velocity_drop` fireable, versus 0 for the
+  `agent.dispatched` type the reader also accepts. `monitors/monitors.json`'s
+  `convergence-monitor` description corrected — it never opened `sessions.jsonl` (a stale
+  claim from an earlier draft of the monitor).
+- **`scripts/validate-wave-scope.mjs`'s internal `validateSession()` renamed to
+  `validateSessionBinding()` (#1153 P11).** Rename only, no behaviour change — the old name
+  read as "validate the session" when it validates the wave-scope manifest's session-BINDING
+  fields specifically; a previously-considered `skipped[]` return addition was dropped as a
+  false premise (the function already reports via `errors`/`warnings`).
+- **`docs/rule-authoring.md`'s `LEARNING_TYPE_REGISTRY` table gains its fourth axis,
+  `hostScoped` (#1153 P12, follow-up to #1090).** The table previously transcribed only
+  `ttlDays`/`agentProposable`/`ruleConvertible`, so a drifted `host_class`-gating cell was
+  structurally invisible to `tests/docs/rule-authoring-registry-parity.test.mjs`; the parser
+  regex and parity-diff logic there now check all four axes bijectively.
+  `hardware-pattern` is the only `hostScoped: true` type today.
+- **`docs/README.md` gains a "Superseded design notes" section (#1153 P14).** Because
+  `docs/specs/` is gitignored, a correction written INTO a spec can never be committed — the
+  correction for `docs/specs/2026-05-26-parallel-aware-sessions-design.md` (which still
+  specifies PID-based lock liveness) lives here instead: liveness has been heartbeat-age
+  based since #1137, and the recorded PID has been consulted nowhere since #1151.
+  `skills/_shared/parallel-aware-preamble.md` cross-references it.
+
+### Removed (BREAKING)
+
+Every entry under *4.0.0 — audit session* below is a REMOVED PUBLIC SURFACE and the reason
+this release is a major. Each names its replacement or states explicitly that there is none.
+Upgrade guide: [`docs/migration-v4.md`](docs/migration-v4.md).
+
+**Deviation from the deprecate-then-remove norm** (`.claude/rules/development.md` § Package
+Lifecycle: stub + first-call `console.warn` for ≥1 minor cycle). The 5 skills and 3 commands
+below are HARD-deleted, not stubbed — an explicit operator decision made 2026-09-06. The
+removal test was **0 telemetry ∧ 0 fleet invocation over 90 days ∧ no runtime consumer**, and
+that 90-day window is honestly a *search* window, not 90 days of shipped exposure: `journey-audit`
+itself had existed for only 9 days (added 2026-08-28) before this cut. Full rationale and the
+manual cleanup steps: [`docs/migration-v4.md`](docs/migration-v4.md).
+
+#### 4.0.0 — audit session
+
+- **5 skills removed** — `find skills -name SKILL.md | wc -l` → 43, against
+  `git ls-tree -r --name-only HEAD skills/ | grep -c 'SKILL.md$'` → 49 (the sixth delta is
+  the `domain-model` merge below):
+  - **`skills/daily/`** (plus `generate.sh`, its template and 2 test files) — **no
+    replacement.** 0 telemetry, 0 fleet invocations in 90 days, no runtime consumer; only its
+    own test and documentation referenced it. Recurring daily notes are a Routine / scheduled
+    task, not a session skill (`.claude/rules/loop-and-monitor.md` § LM-004).
+  - **`skills/skill-creator/`** — **replaced by Anthropic's official `skill-creator` plugin**
+    plus `claude plugin init`. 0/0/0 with 0 in-repo references.
+  - **`skills/ubiquitous-language/`** — **no replacement.** 0/0/0.
+  - **`skills/contract-version-bump/`** — **no replacement.** 0/0/0; one comment referenced
+    it.
+  - **`skills/journey-audit/`** — **no replacement.** 0 journey manifests exist fleet-wide,
+    so the skill was never runnable in the first place.
+- **3 commands removed** — `commands/*.md` 28 → 25, mirrored in `.cursor/commands/` and
+  `pi/prompts/` (both also 25): **`/contract-version-bump`**, **`/journey-audit`** (with
+  their skills above) and **`/autopilot-multi`**. **No replacement** for any of the three.
+  `/autopilot` is a different command, unaffected, and stays.
+- **Session Config `autopilot.bg-isolation` removed** — the `autopilot:` block's only field,
+  retired together with `/autopilot-multi` above (`scripts/parse-config.mjs` never parsed an
+  `autopilot` key at all, so removing it changes no runtime behaviour). **No replacement** —
+  delete the block from your `CLAUDE.md`/`AGENTS.md`; single-story `/autopilot` takes no
+  Session Config block and is unaffected.
+- **8 top-level scripts removed** (`scripts/*.mjs`, 0 runtime callers each, with their test
+  files): `autopilot-multi.mjs`, `backfill-learnings.mjs`, `backfill-learnings-expires.mjs`,
+  `fleet-instruction-scan.mjs`, `lifecycle-sim-v6.mjs`, `migrate-learnings-jsonl.mjs`,
+  `migrate-subagents-jsonl.mjs`, `upload-social-preview.mjs` — **no replacement.** The two
+  `migrate-*` scripts were one-shot format migrations whose target format has been canonical
+  for several releases; the two `backfill-learnings*` scripts were one-shot ledger repairs.
+- **`skills/_shared/model-selection.md` removed — no replacement, 0 consumers.**
+- **`skills/domain-model/` removed and MERGED into `skills/architecture/references/`** — its
+  three files now live as `references/domain-model.md`, `references/ADR-FORMAT.md` and
+  `references/CONTEXT-FORMAT.md`. It was reference-only material with 4 inbound links, never
+  a dispatchable skill; `/architecture` is the entry point.
+- **Two non-agents moved OUT of `agents/`** — `agents/*.md` 16 → 14. The agent loader
+  registers every `.md` file in that directory as a dispatchable agent, and
+  `agents/AGENTS.md` — the authoring SPEC — was measurably dispatched as an agent 5 times. It
+  is now [`docs/agent-authoring.md`](docs/agent-authoring.md), and
+  `agents/memory-proposal-collector.md` is now
+  [`docs/memory-proposal-flow.md`](docs/memory-proposal-flow.md). Same content, no longer a
+  dispatch target. **Anything dispatching either by name must stop** — they are
+  documentation, and were only ever documentation.
+
+- **`scripts/lib/autopilot/multi-killswitch.mjs` and
+  `scripts/lib/autopilot/dep-graph.mjs` deleted, with their test files** —
+  orphaned by the `/autopilot-multi` removal above, with only their own tests as
+  consumers. **No replacement**; single-story `/autopilot` never imported either
+  module.
+
+#### Predecessor commits (v3.24.0 → `e4674109`)
+
+- **`scripts/lib/webhook-url.mjs` deleted — zero callers repo-wide (#1168).** `resolveWebhookUrl`/
+  `WebhookConfigError` and their test file (`tests/lib/webhook-url.test.mjs`, 192 lines) are gone,
+  −364 lines total; the `## Webhooks (#228)` section in `docs/session-config-reference.md`
+  (the `webhooks.<kind>.url` Session Config surface it backed) is removed with it. The still-live
+  Clank Event Bus webhook (`scripts/lib/events.mjs`, `CLANK_EVENT_SECRET`/`CLANK_EVENT_URL`) is
+  unrelated and unaffected — its doc section is promoted from `### Clank Event Bus` to
+  `## Clank Event Bus` in the same edit, since it is no longer a subsection of the now-removed one.
+
+### Fixed
+
+#### 4.0.0 — audit session
+- **`tests/telemetry/sync.test.mjs`: the two `detectSandbox` "real operator shape" cases no longer use `process.cwd()`** — the husky pre-push gate runs the suite in a tracked-tree copy under `$TMPDIR`, where cwd IS a temp root and the guard correctly answers `sandbox:temp-root`; both cases were red on every push attempt while green in the checkout (measured 2026-09-06 — the first push of the 4.0.0 review session failed on exactly this file, unnamed until the gate learned to name `failed_files`). They now probe a path under `os.homedir()`.
+
+- **`js-yaml` out of the eager hook import graph — 4 of 27 hooks crashed on every turn
+  without `node_modules`; now 0 (GH#62 / GH#63 / GitLab #1230).**
+  `scripts/lib/owner-yaml.mjs` carried a static `import yaml from 'js-yaml'` and sits on the
+  import graph of `on-session-start`, `on-session-end`, `post-edit-validate` and
+  `skill-invocation-telemetry` — so a skipped or interrupted `npm install`, a half-synced
+  plugin cache, or an EPERM sandbox killed all four at MODULE-LOAD time with
+  `ERR_MODULE_NOT_FOUND` and exit 1, on every single turn. `js-yaml` now resolves lazily
+  inside `loadOwnerConfig`/`writeOwnerConfig`. Measured 2026-09-06 @ `e4674109` with `hooks/`
+  and `scripts/` copied to a tmp dir carrying no `node_modules` anywhere up the tree:
+  **23/27 hooks exited 0 before the fix, 27/27 after.** Pinned by the new
+  `tests/hooks/hooks-run-without-node-modules.test.mjs`, which EXECUTES every hook instead of
+  reading source text — the pre-existing static-import guard would have accepted a lazy
+  `require()` of a package that does not exist. The `zx` half of #1230 is stale and now says
+  so: `scripts/lib/worktree/listing.mjs`'s `zx` imports are already lazy and caught, verified
+  by installing a `js-yaml` stub alone and watching all four hooks reach rc=0 with `zx` still
+  absent.
+- **`picomatch` declared in `package.json` dependencies.** It is imported by four runtime
+  modules (`rule-loader.mjs`, `command-blocker.mjs`, `validate-vendored-rules.mjs`,
+  `reconcile/emitter.mjs`) and was absent from the manifest at `HEAD`
+  (`git show HEAD:package.json | grep picomatch` → no match) — reachable only as somebody
+  else's transitive dependency, the GH#62 class exactly.
+- **The Cursor adapter generator wrote a malformed `argument-hint` into 24 of 28 command
+  files (GH#54).** `scripts/generate-cursor-adapter.mjs` now renders every frontmatter value
+  through `yamlQuote()`, which JSON-quotes anything failing `YAML_PLAIN_SAFE` (and anything
+  that looks like a YAML scalar, or starts with a digit). Measured after the fix:
+  `grep -c "argument-hint: \[" .cursor/commands/*.md` reports zero files carrying the array
+  shape. The regression survived for as long as it did because the generator was tested
+  against itself; it is now pinned against the spec.
+- **`generateFrontmatterSnippet()` THREW when the baseline was absent.**
+  `scripts/lib/frontmatter-guard.mjs` resolves the schema through
+  `resolveHostPath('baseline-path')` and treats a missing schema as `null` — the honest
+  outcome, with the documented fallback enum set — instead of raising inside a pre-dispatch
+  guard. `scripts/lib/vault-backfill/template.mjs` uses the same resolver.
+- **The session registry wrote into the operator's REAL host-private config from a
+  sandbox.** `scripts/lib/session-registry.mjs` now derives its `sessions/` directory from
+  `resolvePrivateConfigDir()` (`SO_CONFIG_HOME` > `XDG_CONFIG_HOME` >
+  `~/.config/session-orchestrator`) instead of its own homedir-only path, so a redirected
+  config home actually redirects it.
+- **`node scripts/parse-config.mjs --json` failed with `File not found: --json`.** The flag
+  is now an explicit NO-OP alias for the default (stdout has always been JSON), because the
+  bootstrap documentation names that exact command as THE validation command and
+  `cli-design.md` § JSON-First Output requires every CLI to accept `--json`.
+- **The vault-staleness probe measured against the clock instead of against the repo
+  (#1238).** `skills/discovery/probes/vault-staleness.mjs` now asks whether the upstream repo
+  advanced PAST the last sync, not what `now - lastSync` is — a mirror of a repo nobody has
+  committed to in three weeks is CURRENT, not three weeks stale. Both sides of the comparison
+  (`lastSync`, `lastCommit`) come from one read of the same `_overview.md` frontmatter.
+  Measured against the live vault before the fix (2026-09-05): **33 of 48 overviews reported
+  "stale", 26 of them >7d, with a demonstrably healthy sync chain.** An overview without
+  `lastCommit` still falls back to the wall-clock comparison, marked
+  `basis: 'probe-runtime'` and carried at lower confidence so a consumer can tell a measured
+  delta from a guessed one.
+- **The discovery-validator scanned the WRONG transcript, so effectively every violation it
+  recorded was the coordinator's own prose (#1191).** `input.transcript_path` on
+  `SubagentStop` is the PARENT/main session transcript, not the subagent's — measured
+  2026-09-02 on a seeded random sample of 60 violations: **100 % coordinator text,
+  scope-adjusted precision 0 %**, with `agent` reported as `"unknown"` in 90.8 % of 1,541
+  events. The hook now reads `<transcriptDir>/<session>/subagents/agent-<agent_id>.jsonl`
+  (the layout `subagent-telemetry.mjs` and `wave-transcript-tail.mjs` already use) and NEVER
+  falls back to the parent path: a scan of the wrong transcript is worse than no scan. Claims
+  are additionally collapsed per distinct normalised claim with an `occurrences` count
+  (`normalizeClaim()` / `dedupeViolations()` in `hooks/_lib/subagent-transcript.mjs`, #1198)
+  — the worst repo in the fleet held 3,360 records over 205 distinct claim texts, a ×16.4
+  duplication factor.
+- **The `ecosystem-health` watcher could never start.** Its trigger in
+  `monitors/monitors.json` was `on-skill-invoke:ecosystem-health` — self-referential: the
+  watcher could only start when the `ecosystem-health` skill ran, and that skill has 0
+  recorded invocations fleet-wide, so it never started once. The trigger is now
+  `on-skill-invoke:session-start`.
+
+- **CP11 (the confidential-names owner-leakage check) could fail OPEN and still
+  print `PASS` (#1244).** `getConfidentialNamePatterns()`
+  (`scripts/lib/validate/check-owner-leakage.mjs`) collapsed three different
+  outcomes onto the same `[]` degrade: (a) the standalone single-file copy, where
+  the helpers are genuinely unresolvable — the only case meant to go inert; (b)
+  CP11 simply unconfigured; and (c) CP11 configured but unreadable (missing
+  `js-yaml`, an unparseable `owner.yaml`, or a wholesale-discarded partial
+  config), which used to read identically to (b) and print the clean verdict it
+  never earned. Case (c) now returns a `disabledReason` and the scanner prints
+  `CP11 DISABLED: <reason>` plus a counted FAIL — with no path in the reason
+  string, since this scanner's output is mirrored to a public CI log.
+  `owner-yaml.mjs`'s whole-file discard on an invalid REQUIRED section (#820) now
+  merges a still-VALID optional object section (e.g. `paths:`) back onto its
+  default instead of discarding it too, so a correctly declared
+  `confidential-names-file` no longer vanishes because an unrelated section was
+  malformed; a genuinely invalid optional section is reported via
+  `droppedSections`, and an unparseable file gets the new `reason: 'unparseable'`.
+  A third, unrelated fail-open closed in the same file: `isMain` now compares
+  `realpathSync()` of both sides, so a symlinked invocation path (`/tmp` →
+  `/private/tmp` on macOS) can no longer make the scanner exit 0 having scanned
+  nothing.
+- **CP11's own DISABLED path (above) was itself overbroad, and its degrade
+  path had two further defects — all three closed together in
+  `scripts/lib/validate/check-owner-leakage.mjs` and `.husky/pre-commit`
+  (Wave-4 Codex second-look).** First, DISABLED fired even when NO
+  confidential-names file was ever configured: a healthy `owner.yaml` with
+  only an unrelated invalid optional section (e.g. `paths: { vault-dir: 42
+  }`) and no `confidential-names-file` key reported `CP11 DISABLED` and a
+  counted FAIL, when the correct verdict is "inactive." A new
+  `rawConfidentialNamesKeyState()` re-reads the RAW (pre-validation) key
+  before classifying, so DISABLED now fires only when a names path was
+  actually configured; a healthy owner.yaml with `paths:` present but no
+  names-file key now stays `PASS` with no CP11 line at all, pinned by a new
+  case in `tests/lib/validate/check-owner-leakage.test.mjs`. Second, the
+  standalone-copy inert degrade (the ONE case meant to go silently
+  patterns-`[]`) was scoped by a bare `ERR_MODULE_NOT_FOUND` check, so a
+  missing TRANSITIVE module — not just the scanner's own three vendored
+  sibling imports — also went inert instead of failing closed.
+  `isMissingDirectSibling()` now inspects `err.url` (the URL Node's own
+  `ERR_MODULE_NOT_FOUND` carries) against the scanner's three known
+  direct-sibling import URLs; a miss anywhere deeper now THROWS. Third,
+  `.husky/pre-commit` was capturing but discarding the scanner's own stderr
+  on failure and printing the same "privacy leak detected" line regardless
+  of cause; it now prints the scanner's (redacted) diagnostic tail and
+  distinguishes "the scanner could not run" from "the scanner found a
+  leak." 259/259 tests pass; 4 fake-regression probes (each reverting one
+  of the three fixes above) still turn red; a live repo scan still PASSes.
+- **`checkOwnerConfig()`'s whole-file-discard message claimed "the entire
+  file was discarded" even when a validly-configured OPTIONAL section
+  survived the discard onto its default (#1244 merge rule, Fixed above).**
+  `scripts/lib/owner-config-banner.mjs` now diffs each optional object
+  section (`paths`, `dispatcher`) in the merged config against
+  `getDefaults()`: a section that differs was real and survived, and the
+  banner names it — `"paths" kept, everything else defaulted` — instead of
+  claiming total loss; `droppedSections` renders on this branch too.
+  Reproduced with a tmp owner.yaml carrying an invalid `owner.name`
+  (required, triggers the whole-file path) alongside a valid
+  `paths.confidential-names-file` (a Wave-4 architect-panel finding); a new
+  case in `tests/lib/owner-config-banner.test.mjs` pins the "kept" wording.
+  168/168 tests pass; 2 fake-regression probes still turn red; a real,
+  healthy host's banner still returns null.
+- **`check-skill-script-paths` and `check-validator-registration` answered an
+  existence question from the git INDEX, so a brand-new untracked file's own
+  citation was invisible to them until `git add` (#1248).** Measured in a clone
+  (Wave-1 discovery): an untracked skill citing a non-existent script reported
+  `1 passed, 0 failed` before staging and `0 passed, 1 failed` after — same tree,
+  same defect. New shared `scripts/lib/validate/enumerate-repo-files.mjs`
+  (`enumerateRepoFiles()`) answers "does this exist under these roots right now"
+  via `git ls-files --cached --others --exclude-standard`, honouring
+  `.gitignore` without reopening #1143 (a bare `readdirSync` walk was tried and
+  REFUTED: it pulls a gitignored peer worktree under `.claude/worktrees/` into
+  the census — measured 287 vs 290 `.md` files with one peer worktree present).
+  Both checkers, and the release drift sweep (Changed, above), now share this
+  one enumerator instead of three different partial views.
+- **`enumerateRepoFiles()` (above) silently dropped `stat` failures other than
+  `ENOENT`/`ENOTDIR`, so a permission-denied file read as "does not exist"
+  instead of "unknown" — the release drift sweep (Changed, above) could
+  report a clean sweep on 0 actual reads (Wave-4 Codex second-look).** It
+  now throws a typed `RepoEnumerationError`
+  (`scripts/lib/validate/enumerate-repo-files.mjs`) for
+  `EACCES`/`EPERM`/`ELOOP`/`EIO`/`ENAMETOOLONG`/anything else it cannot
+  classify as "provably absent," carrying the path and the underlying error
+  code; only `ENOENT` and `ENOTDIR` are still treated as absent.
+  `collectDriftHits()` (`scripts/release.mjs`) reports this as exit 128,
+  which the release preflight already reads as "inconclusive" — the same
+  reading a crashed `git grep` got, never a silent clean. 195/195 tests
+  pass across the 5 touched files; the Codex reproduction now shows status
+  128 / `ok:false` instead of a clean sweep; `validate-plugin.mjs` still
+  234/0. Two known sibling sites of the same swallow-class are filed as
+  follow-up issues rather than fixed here: `listRepoFiles()`
+  (`scripts/lib/repo-files.mjs`) has the identical catch-all, and 3 further
+  test files still hand-roll `git init` + a bare recursive `rmSync` in
+  template-string form (invisible to a literal-string census) rather than
+  routing through `tests/_helpers/tmp-fixture.mjs`.
+- **15 more fixture-shaped test files are routed onto the
+  `tests/_helpers/tmp-fixture.mjs` helper (the detached-`git-maintenance` fix,
+  below) this session — 3 of them deleting a weaker inline copy of the same
+  helper that `enumerate-repo-files.test.mjs`, `check-validator-registration.test.mjs`
+  and `check-skill-script-paths.test.mjs` had each written for themselves
+  (above), plus 11 legacy files and a `release.test.mjs` git-grep-to-fixture
+  probe.** `tests/unit/quality-gate-session-config.test.mjs` — the one file
+  this pass left out of scope, needed here because it was also touching
+  `enumerate-repo-files.test.mjs` — is itself routed in this same session (23
+  insertions / 30 deletions: `execSync('git init', ...)` →
+  `fixtureGit(['init', ...])`, `rmSync(repoRoot, ...)` → `removeTree(repoRoot)`,
+  `mkdtempSync(...)` → `makeTmpDir(...)`). Net −28 LOC across the routed
+  files; 526/526 of their own tests unchanged per file; eslint clean. The
+  self-census this whole effort is measured against
+  (`tests/lib/validate/check-test-git-config-target.test.mjs`) cannot resolve
+  a fixture helper's own `...spread` token to a git subcommand, so its floor
+  was lowered from `>50` to `>20` with a Revisit-Trigger comment naming the
+  exact condition ("the census learning to resolve the helper's spread")
+  rather than silently loosened — the remaining git-fixture files are reduced
+  this session, not proven at zero: 3 further sites in template-string form
+  are filed as follow-up issues (above).
+- **The full test suite failed 1–2 tests per run, never the same one twice — a
+  detached `git maintenance` child racing the fixture's own cleanup.**
+  `GIT_TRACE=1` on a bare fixture commit showed `git maintenance run --auto
+  --quiet --detach` still writing into a temp `.git` directory after
+  `execFileSync` returned, so the `afterEach` `rmSync` raced a live process and
+  failed with `ENOTEMPTY`. New `tests/_helpers/tmp-fixture.mjs` (`fixtureGit`,
+  `fixtureGitSpawn`, `removeTree`, `makeTmpDir`) sets `maintenance.auto=false`,
+  `gc.auto=0` and `core.fsmonitor=false` on every fixture repo, and retries
+  removal (`maxRetries: 5`) for what config alone cannot reach. 24 fixture files
+  (118 git call sites, 35 `rmSync` sites, 39 `mkdtemp` sites) now route through
+  it; the detached-maintenance trace line is gone from the routed files, and the
+  494 tests across those 24 files still pass.
+- **10 of the 43 learning-provenance markers the 43→8 generated-rule
+  consolidation (Changed, above) dropped are restored, across
+  `git-and-worktrees`, `guard-design`, `measurement-discipline`,
+  `process-contracts`, `review-and-adapter-contracts`, `test-hygiene` and
+  `toolchain-and-build.md` (+121/−19 across the 7 files).** That consolidation's
+  own claim — "each keeping its provenance markers" — was false for 10 of them
+  when written; a fresh census now counts 43 of 43 keys and 43 of 43 ids (a
+  previously reported "42 ids" was itself a UUID-filter miss, not a real 42nd
+  gap). One of the 10 was a markers-only restoration against an
+  already-present duplicate prose block; the other 9 restore both the prose and
+  its evidence line.
+- **`docs/migration-v4.md` §6 Rollback and its "Cursor still shows the removed
+  commands" recipe both had defects that would have re-broken what they were
+  trying to fix (Wave-4 Codex second-look).** §6's `cursor-install.mjs` /
+  `pi-install.mjs` rollback lines were missing the target-project argument
+  both scripts require — they default to `process.cwd()`
+  (`scripts/cursor-install.mjs:24-51`), so an operator following the doc
+  literally would link the installer into the session-orchestrator checkout
+  itself, not their own project. Both lines now carry
+  `/path/to/your-project` explicitly, with a note that both installers are
+  ADD-ONLY: they skip any destination that already exists, so re-running the
+  3.24.0-checkout installer never resyncs a `hooks.json` or Pi settings file
+  written under 4.0.0 — only adds what your project is missing. The
+  "Cursor still shows the removed commands" recipe used `rm -f` to delete
+  three named files, which deletes a REGULAR file with the same name exactly
+  as readily as a symlink — including a command an operator wrote themselves
+  under one of those three retired names; it is now a `[ -L "$p" ] && rm
+  "$p"` loop, symlink-only. Separately, the session-start plugin-update
+  banner's Pi instruction (Changed, above) led with the dev-fallback checkout
+  recipe though the documented PRIMARY Pi install path is `pi install
+  npm:session-orchestrator` (`docs/pi-setup.md:16`, §"Option 1") —
+  `PLATFORM_UPDATE_INSTRUCTIONS.pi` (`scripts/lib/plugin-update-banner.mjs`)
+  now leads with re-running that exact command, naming the checkout +
+  `--settings-only` recipe only as the fallback for a dev-fallback
+  registration. 25/25 tests pass; `check-skill-links.mjs` reports 86;
+  `validate-plugin.mjs` 234/0.
+- **`#1229` closed — the session-lock heartbeat already refreshes on `Stop`,
+  `PostToolBatch` and `SessionStart`, not only once per wave; the reported gap
+  was a false premise, refuted by measurement.** Live call sites confirmed at
+  `hooks/on-stop.mjs:438` (fires every turn), `hooks/post-tool-batch-wave-signal.mjs:377`,
+  and `hooks/on-session-start.mjs:1078`; a heartbeat mid-wave measured 3 seconds
+  old. No `UserPromptSubmit` hook exists to add a fourth site.
+- **`#1230` closed — `js-yaml` is already lazily required in `owner-yaml.mjs`
+  (`:120-127`, memoised, one WARN on failure) and all 27 hooks already exit 0
+  with both `zx` and `js-yaml` blocked; the reported gap was a false premise,
+  refuted by measurement.** The eager-import class the Predecessor-commits Fixed
+  entry above already closed was re-verified still holding at this session's
+  base commit — no regression, no further code change needed.
+
+#### Predecessor commits (v3.24.0 → `e4674109`)
+
+- **Two silent Session Config parsing bugs fixed across 39 block-shaped parsers
+  (#1162).** New shared module `scripts/lib/config/block-preprocess.mjs` fixes both: (a) a
+  block commented out with a multi-line `<!-- … -->` was read as LIVE config —
+  `stripHtmlCommentBlocks()` now strips it via the existing `htmlCommentSkipper()` state
+  machine; (b) the bold-bullet sub-key rendering (`- **enabled:** true`) matched no sub-key
+  regex and silently fell back to its default — `normalizeBoldSubkeys()` now normalises it
+  to `enabled: true` before parsing. `preprocessBlockLines()` (35 standard parsers) and
+  `preprocessBlockLinesNoDash()` (4 dash-RECORD parsers — `custom-phases`, `remote-hosts`,
+  `evolve`'s `_parseEvolve`, `health-endpoints`) are the two drop-ins for
+  `content.split(/\r?\n/)`; NoDash skips bold-normalisation because de-dashing a record's
+  first key would silently merge it into the previous record.
+  `config-protection.mjs`'s `_isConfigWeakeningAllowed()` and
+  `hooks/pre-bash-destructive-guard.mjs`'s bypass scan deliberately use HTML-comment
+  stripping ONLY, never bold-normalisation — the bold form
+  (`- **allow-config-weakening:** true` / `- **allow-destructive-ops:** true`) must not arm
+  a bypass. An UNTERMINATED `<!--` fails closed in both directions: a block parser gets its
+  lines back UNFILTERED, while both bypass scanners treat it as NOT ARMED (said out loud on
+  stderr, since a silently-ignored bypass would look identical to an operator typo);
+  `scripts/parse-config.mjs` prints one stderr WARN per session, not one per parser. Two
+  new parity test files pin the contract per parser: `tests/lib/config/preprocess-parity-a-l.test.mjs`
+  and `-m-z.test.mjs`.
+- **PSA-007's git-write detector is argument-aware, closing a false-positive AND a
+  false-negative class (#1172, #1215).** `isGitWrite()` in
+  `scripts/lib/wave-transcript-tail.mjs` used to match the subcommand literal alone; it now
+  parses the arguments too. `git stash list`/`show`, `--version`, `--help`/`-h`,
+  `--dry-run`, and `-n` on every subcommand except `commit` (where `-n` means
+  `--no-verify`, still a real write — measured 2026-09-04 that `git commit -h` prints
+  `-n, --no-verify` while `add`/`rm`/`push -h` all print `-n, --[no-]dry-run`) now read as
+  reads, not writes. The value-taking global flags `-C`/`-c`/`--git-dir`/`--work-tree`/
+  `--namespace`/`--exec-path`/`--config-env`, and `command`/`env VAR=x` prefixes, are now
+  absorbed so `git -C /tmp stash` and `env FOO=x git commit` are still recognised as git
+  writes at all (measured false negative before the fix: `isGitWrite('git -C /tmp stash')`
+  returned `false`). `FIXTURE_CONTEXT_RE`'s `cd /tmp` match now also fires on the BARE path
+  with no trailing `/` — the reported false alarm was
+  `cd /tmp && git init && git commit -m x`. 32 table rows added (70 cases in the file
+  after the change) in `tests/lib/wave-transcript-tail.test.mjs`.
+- **`buildLiveSignals()`'s injectable `_scanBacklog` test seam was unused at 5 call sites,
+  so the affected test suite shelled out to a live `glab issue list` on every run
+  (#1169).** `tests/lib/autopilot.test.mjs` now passes a null-returning `_scanBacklog` stub
+  at every call site that does not assert on `signals.backlog` (`selectMode`/`computeDelta`
+  never read that field, so the stub is behaviour-preserving). `scripts/lib/autopilot/loop.mjs`
+  also migrated off the removed `SO_STATE_DIR` constant onto `getStateDir()` (#1153 P5) in
+  the same pass. Test-phase wall time for the affected suite dropped from ~750ms to ~25ms,
+  with no live network calls remaining.
+- **One flaky spawn-timeout test pinned with margin instead of disabled (#1217).**
+  `tests/unit/plugin-manifests-exit-codes.test.mjs`'s "exits 1 (not 2) when plugin.json
+  contains broken JSON" case now passes `{ timeout: 30_000 }` explicitly — measured
+  887–965ms unloaded (W1-D4, 2026-09-04), with one observed 10,095ms outlier attributed to
+  host contention, not spawn cost. Same discriminating-margin pattern as the three tests
+  hardened earlier in this file; no repo-wide pinned-slow list exists (#976 never
+  implemented).
+- **Legacy `.bak.`-delimited backup files were invisible to both rotation and restore
+  (#1173).** `scripts/lib/learnings/io.mjs` exports `backupSuffixOf()`/`isBackupOf()`,
+  accepting both the canonical `.bak-<ISO>` delimiter this module writes and the legacy
+  `.bak.<label>-<ts>` delimiter pre-#721 writers left behind (e.g.
+  `learnings.jsonl.bak.evolve-<ts>`), shared with `backfill-learnings-from-vault`'s restore
+  sweep so the two predicates cannot drift apart again. `rotateBackups()` now sorts on the
+  SUFFIX (a leading non-digit label stripped first) rather than the whole filename —
+  sorting on the whole name grouped every `.`-delimited legacy file after every
+  `-`-delimited one regardless of age (`-` is 0x2D, `.` is 0x2E), so rotation pruned only
+  hyphen-form backups. `scripts/backfill-learnings-expires.mjs` itself was still emitting
+  the dot form on `--apply` — its own backups were the ones going unrotated and unrestored
+  — and now emits the canonical hyphen form (`tests/scripts/backfill-learnings-expires.test.mjs`
+  pins both the new emission and the absence of the old one).
+- **A peer session's `wave-scope.json` drove this session's Bash gates on two hooks, and a
+  rebind of the manifest could suppress its own tamper notice (#1153 P1).**
+  `hooks/enforce-commands.mjs` and `hooks/post-bash-write-verify.mjs` both gain a Gate 3b
+  ownership check — `classifyManifestSession()` against `readProcessLocalSessionIds()` (hook
+  payload + `CLAUDE_CODE_SESSION_ID`, deliberately not the lock-file tier that made a
+  peer's manifest classify as `'own'` under #1194) — and stand down silently when the
+  manifest provably names another session, emitting `orchestrator.scope.foreign_session_ignored`
+  for observability. In `post-bash-write-verify.mjs` the ordering is the fix itself: the
+  control-file hash/enforcement snapshot is now computed BEFORE the Gate 3b stand-down, so
+  a `cat >` rebind of `wave-scope.json` to a fabricated `session_id` can no longer disarm
+  this session's gates AND suppress the #938 control-file notice in the same stroke — the
+  notice now fires once, on the call where the SESSION BINDING itself changed.
+- **`processSession`'s two skipped-noop returns had no `maskerWouldChange` re-probe
+  (#1028, found by the Wave-4 security-reviewer as MED, confirmed HIGH by qa-strategist).**
+  The session-note generator's skip paths (`process.mjs:953`/`:991`) now carry the same
+  `maskerWouldChange` guard the learning-note generator already had at 3 sites
+  (`:703`/`:773`/`:797`); a missing `!force` check in the disambiguation-collision branch is
+  also fixed. 4 new tests, red on HEAD before the fix.
+- **The legacy-flat heal wrote the masked copy to the namespaced path while the plaintext
+  legacy original stayed in place and became unreachable (#1028, qa-strategist HIGH-2).**
+  Both generators (learning-note and session-note) now re-render the leaking legacy note
+  masked IN PLACE (same fix shape at both `#660 IDEMPOTENCY DUAL-PROBE` sites), marking the
+  result `action: 'created'` + `meta.healed_legacy_flat: true` instead of leaving a second,
+  unreachable plaintext copy on disk.
+- **`orchestrator.secret_masker.applied` now emits from all three channels that mask vault
+  content, not two.** `scripts/lib/vault-mirror/process.mjs`,
+  `scripts/lib/vault-status/narrative-mirror.mjs`, and `scripts/export-hw-learnings.mjs`
+  (documented in its own comment as "the third") each carry the emit at the end of their run.
+- **`quality-gate.mjs`'s fail-open corrective-context path was silent (#1205, Wave-4
+  security-reviewer LOW).** Without `CLAUDE_CODE_SESSION_ID` (Codex/Cursor with no
+  process-local witness), a peer's `corrective_context` was kept without any signal. It now
+  prints a stderr WARN naming the UNVERIFIED session id before keeping the context; behaviour
+  is unchanged, only the visibility.
+- **`check-skill-script-paths` had 24 dead script citations sitting unannotated inside
+  `docs/` (#1208).** `docs/` is now in `SCAN_DIRS`; 24 dead citations were annotated with the
+  existing `<!-- path-check: planned #<iid> | historical | example -->` marker convention
+  (measured: 1,087 citations across 259 files, 53 total annotated after this pass). A new
+  `--strict-sh` mode extends the same dead-path scan to `.sh` citations, reported as an
+  advisory count line in `validate-plugin` output (0 findings currently).
+- **A block commented out with `<!-- … -->` still armed the dispatcher-autonomy one-time
+  capture AUQ (#1222).** `isDispatcherAutonomyBlockPresent()` called the shared
+  `hasBlockHeader()` matcher directly on raw content, while `scripts/parse-config.mjs`
+  preprocesses with comment-stripping first — so a `dispatcher-autonomy:` header sitting
+  inside a comment parsed to defaults (correctly) but was reported PRESENT (incorrectly),
+  meaning the operator was never asked. The guard now preprocesses with the same
+  `preprocessBlockLinesNoDash()` the parser uses before testing for the header, so an
+  unterminated `<!--` still fails toward PRESENT (one un-asked question, not a silently
+  disarmed bypass) matching the module's own documented one-time-capture contract.
+  `block-header.mjs`'s docblock now states explicitly that comment-stripping is the caller's
+  job. The three further planned call sites in `skill-evolution.mjs`, `persona-gate-wave.mjs`,
+  and `wave-reviewers.mjs` are NOT part of this change — none of the three currently calls
+  `hasBlockHeader()`/`isDispatcherAutonomyBlockPresent()` at all, so there is nothing to sweep
+  there yet.
+- **`reapStaleBudgetFiles()`'s exact-boundary comparison had no falsifying test (#1153
+  P8).** A file aged exactly `maxAgeDays` is meant to be KEPT (`mtimeMs >= now -
+  maxAgeDays*86400000`); the existing 30-vs-1-day test stayed green even if `>=` were
+  weakened to `>`, which would silently reap a peer session's issue-budget file the instant
+  it turned `maxAgeDays` old. A new test in `tests/unit/hook-issue-budget.test.mjs` seeds one
+  file exactly on the cutoff and one a second past it and asserts the former survives and the
+  latter does not.
+- **`sessionFromLock()`'s `host_id` fallback for a pre-#1072 lock had no test (#1153 P9).**
+  Two new cases in `tests/lib/session-discovery.test.mjs` pin both branches of
+  `lock.host_id ?? stableHostname(...)`: a lock that already carries `host_id` passes it
+  through unchanged, and a lock written before #1072 (no `host_id` field) derives it from the
+  raw `host` — without the fallback pin, a lock-sourced session could silently regress to the
+  raw, non-normalised host for comparison against the registry path's normalised twin.
+- **`markCandidateProcessed()`'s mint branch stamped a self-contradictory terminal record
+  (#1153 P10, follow-up to #1042).** A freshly-minted candidate (no prior sidecar record) was
+  always given `status: 'proposed'` even while being stamped `processed_at` +
+  `outcome: 'rejected'` in the same write — a terminal, declined candidate that still read as
+  a live proposal to anything rendering `status`. `status` now agrees with `outcome`
+  (`'rejected'` when the outcome is `'rejected'`, `'proposed'` otherwise, the only two
+  ReconcileCandidate status values). Separately, the function used to return the
+  freshly-built stamp even when `mergeCandidates`'s dedupe rule kept an OLDER terminal record
+  on disk instead — caller and store then disagreed about the verdict, silently. It now reads
+  the record back out of the merge result and returns that, plus a new `alreadyProcessed`
+  flag (`written` stays `true` in that case: the store IS in the intended terminal state, and
+  `written: false` is reserved for a genuine write failure). Four new tests in
+  `tests/lib/reconcile/idempotency.test.mjs`, red on HEAD before the fix.
+- **A learning whose `file_paths` were entirely unusable produced the same generic
+  "no activation axis" rejection as a learning with no `file_paths` at all (#1153 P13).**
+  `globsFromFilePaths()` now records each skipped entry (glob-metachar / control-char / quote)
+  into an out-parameter sink, rendered by the new `formatDroppedFilePaths()` into a
+  `— dropped file_paths: N (…)` suffix on the never-always-on rejection reason — the message
+  engine.mjs forwards verbatim into the operator-visible candidates ledger. Each dropped value
+  is `JSON.stringify`-escaped (so a raw newline or ANSI control char in a hostile `file_paths`
+  entry cannot inject into the reason string) and hard-truncated to 60 chars with no
+  mid-escape cut. Two new tests in `tests/lib/reconcile/emitter.test.mjs` pin both the naming
+  and the escaping.
+- **`writer.mjs`'s `isOperatorRejection()` inferred an operator rejection from rendered
+  `content` being non-empty, which an operator-declined proposal with an empty rendered body
+  could fail (#1153 P15, closes the inference gap left open by #1042's own documented
+  ceiling).** `skills/session-end/phase-3-6-tail.md` step 6 now stamps every proposal the
+  operator left unselected with an explicit `operatorRejected: true` flag before it joins the
+  engine's `rejected` array; `isOperatorRejection()` keys on that flag first, falling back to
+  the old content-presence heuristic (marked `@deprecated`, kept only for a consumer repo
+  pinning a pre-P15 skill body) when the flag is absent. Two new tests in
+  `tests/lib/reconcile/writer.test.mjs` cover the flag-wins-over-empty-content case and the
+  legacy flagless fallback.
+
+### Security
+
+#### 4.0.0 — audit session
+
+- **The published npm tarball shipped 0 of the 6 files under
+  `.orchestrator/policy/` — including the destructive-command guard's own floor
+  policy (`blocked-commands.json`) — so an npm-installed consumer without a host
+  overlay ran `hooks/pre-bash-destructive-guard.mjs` against `rules: null` and it
+  silently ALLOWED every command the floor exists to block (found by the Wave-1
+  Codex external review, P1: `npm pack --dry-run | grep -c orchestrator/policy`
+  → 0).** `package.json`'s `files[]` now lists `.orchestrator/policy/`;
+  `npm pack --dry-run --json | grep -c "orchestrator/policy"` reports **6**
+  policy files today (`blocked-commands.json`, `ecosystem.schema.json`,
+  `quality-gates.example.json`, `quality-gates.schema.json`,
+  `templates-policy.json`, `test-profiles.json`) where it reported 0 before,
+  pinned by the new `tests/scripts/pack-policy-floor.test.mjs` (a real
+  `npm pack --dry-run`, not a mock). The release leakage gate's `.orchestrator/`
+  exclusion is narrowed to carve THIS directory back IN (`scripts/release.mjs`
+  around line 319) — the operator's own `metrics/`, `debug/` artefacts and live
+  `*.lock` files stay excluded; only the tracked policy floor ships. **The
+  Wave-4 review panel found this test asserted only a FLOOR (≥ 6 files) while
+  `package.json`'s `files[]` admits the WHOLE `.orchestrator/policy/` directory
+  and the carve-out above matched the path anywhere in the string, not just at
+  its start** — an untracked private file dropped into that directory would
+  ship, invisible to a floor check. `pack-policy-floor.test.mjs` now asserts SET
+  EQUALITY between the packed policy entries and `git ls-files
+  .orchestrator/policy` (tracked-only, sorted); the carve-out regex is anchored
+  to the path start (`/^\.orchestrator\/policy\//`, previously unanchored),
+  with the VCS-trust rationale — everything under this one directory ships
+  because it is tracked, not because of a per-file allowlist — recorded in a
+  comment beside it.
+- **`session_profile` was the one free-form string field on the telemetry
+  wire — both an internal Wave-1 review and the Codex review reproduced sending
+  an arbitrary string through it.** `VALID_SESSION_PROFILES` (`['ultradeep']`
+  today) is now enforced on BOTH ends: the client
+  (`scripts/lib/telemetry/schema.mjs`) omits the field when it is not a known
+  profile rather than passing it through, and the ingest server
+  (`server/ingest/validate.mjs`) rejects a record whose `session_profile` fails
+  the same enum plus a 32-char length ceiling. Reproduced before the fix: a
+  crafted `session_profile` string reached the wire; after, the client sends
+  nothing and the server rejects a forged one directly. `detectSandbox()`
+  (`scripts/lib/telemetry/sync.mjs`) now also fails CLOSED — a probe that
+  itself throws returns `{ sandbox: true, reason: 'sandbox:probe-failed' }`
+  instead of falling through to "not a sandbox". `docs/telemetry.md` gained the
+  field table, the no-free-text-fields claim, and a new section documenting the
+  npm update-check's own egress (`SO_DISABLE_UPDATE_CHECK`, `DO_NOT_TRACK`,
+  `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC`).
+- **The `session_profile` whitelist above covered only the LIVE send path — a
+  record already sitting in the offline queue when that whitelist landed still
+  carried whatever it was enqueued with, and `flush()`
+  (`scripts/lib/telemetry/sync.mjs`) forwarded every queued batch to the sender
+  UNCHANGED.** Reproduced by the Wave-4 Codex second-look: a record the ingest
+  server rejects is retried, still rejected, still requeued — the offline queue
+  grew 1 → 2 → 3 and never drained. `sanitizeQueuedRecord()` now re-projects
+  (`projectUsagePing`) and re-whitelists `session_profile` on every queued
+  record before it joins a send batch, closing the same gap the live path was
+  already closed for; the Codex reproduction now shows the queue back at 0
+  after 3 consecutive rejections. A batch the server rejects with HTTP 400/422
+  is now EVICTED (`reason: 'rejected-evicted'`) instead of re-queued: the
+  ingest API validates a batch all-or-nothing with no per-record index, so the
+  only bounded response to "the server will never accept this payload" is to
+  drop the whole batch (named ceiling, BV-004: revisit if the server ever
+  reports which record failed). `defaultSender` now attaches the HTTP status to
+  the thrown error (`err.status`) so `flush()` can tell a schema rejection
+  (evict) from a transport failure (re-queue, unchanged behaviour) — an
+  injected sender that throws a bare `Error` still falls through to the
+  pre-existing re-queue path. `docs/telemetry.md` documents `rejected-evicted`
+  under "When a ping is sent".
+
+### Notes
+
+- **Full Gate (Wave 4, `37169158`):** typecheck 432 OK, lint 0, 642 files / 15,926 passed /
+  0 failed / 11 skipped, `validate-plugin` 249/0, owner-leakage PASS (macOS). Quoted from
+  the Wave-4 commit trailer, not re-run for this entry.
+- **The Wave-4 review panel (3 Opus reviewers: security-reviewer, session-reviewer,
+  qa-strategist) found both HIGH findings above inside its own Wave-2/Wave-3 diff** — the
+  `#1028` masker-guard residue the panel itself was reviewing. Both were closed same-wave by
+  a dedicated fixpass (F-A/F-B/F-C) with fresh red-on-HEAD proofs before the green fix,
+  plus test-hygiene cleanup (`dispatch-common.test.mjs` lost 12 structure-only assertions;
+  `evolve-telemetry.test.mjs`'s regression tests no longer stat the real repo ledger) and
+  three LOW fixes (`evolve-telemetry.mjs`'s `catch {}` now WARNs on stderr;
+  `post-subagent-discovery-validator.mjs`'s German pattern now matches singular `Eintrag`;
+  `.gitlab-ci.yml`/`docs/ci-setup.md` prose brought in line with the now-armed drift gate).
+- **A use-before-define in an intermediate save of `own-session.mjs` blocked every
+  Bash/Edit call of every session on this host for roughly 8 minutes.** `hooks/enforce-commands.mjs`
+  and `hooks/enforce-scope.mjs` both import the module live on every tool call (the #1153
+  P1 Gate 3b wiring), so a `SyntaxError`/`ReferenceError` mid-refactor link-crashed both
+  hooks host-wide rather than degrading to one repo's GUARD INACTIVE banner. Follow-up
+  issue pending to make an intermediate, uncommitted save of a hot-path hook dependency
+  fail more locally.
+- **This session's `session.lock` heartbeat was only refreshed once per wave, not
+  continuously.** A long session-start/plan phase between heartbeats let a foreign
+  `SessionEnd` reap the lock as stale before this session's own wave loop had a chance to
+  refresh it. Deviation logged in this session's narrative; a follow-up issue for a
+  time-based (not wave-based) heartbeat refresh is to be filed at close, not yet opened as of
+  this diff.
+- **Full Gate (session close, uncommitted vs `4b451303`):** 651 files / 16,261 passed /
+  0 failed / 16 skipped, typecheck 435 OK, lint 0, `validate-plugin` 250/0, Semgrep 0 new
+  findings, hook-import-set-check in sync (150 modules) — supersedes the Wave-4 note above.
+
 ## [3.24.0] - 2026-09-02
 
-Five commits since v3.23.0 (4 `feat`, 1 `docs`; 152 files, +14,596/−942), no
-`BREAKING CHANGE:` footer and no `!` subject.
+Six commits since v3.23.0 (4 `feat`, 1 `fix`, 1 `docs`; 160 files,
++15,586/−981 before the release commit), no `BREAKING CHANGE:` footer and no
+`!` subject.
 
 One `docs` commit (`c3ab4801`) adds ADR-0013, naming the ownership-check-before-deregister
 ordering that closed Wave 4 of the previous session. One `feat` commit (`a019d5a4`, deep
@@ -303,6 +1356,19 @@ mint (UUIDv7, semantic session ids) were rejected or dropped by readers built fo
 only — every resume looked foreign — and call sites that needed a repo root passed
 `undefined` instead, so fail-open paths ran on every invocation.
 
+This tag is also the first to carry the thirty-three commits of the 2026-08-22 → 2026-08-25
+line (`141d418..0626387`: 20 `fix`, 11 `feat`, 2 `docs`; 297 files, +24,535/−1,318 — measured
+2026-09-06 @ `befdda47`, `git log --format=%s v3.22.0..0626387` → 33 subjects). A `3.22.1` cut
+dated 2026-08-25 had changelogged that line, but the release commit never left its working
+copy — no push, no tag, no registry tarball — and the next day's work resumed from `0626387`
+without it. Its entries are carried below under *From the 2026-08-22 → 2026-08-25 line*. One
+fact sits under all of them: **a surface that said it was live, and a measurement that never
+had a caller.** Cursor advertised as a first-class platform and loaded only `.cursor/rules` —
+no slash commands, no skills, no hook bridge; `/session` was chat text. The same class shows up
+in the rest of the line: 18 probes with zero mechanical callers, three vault writers that could
+not report their own failure, gates that wrote and never read, and `detectPlatform()` walking
+to `$HOME` until 63 of 84 telemetry records said `platform=pi`.
+
 ### Added
 
 - **Eight core rules ship as sanitized copies, with a report-only leak scanner (#1098).**
@@ -330,6 +1396,27 @@ only — every resume looked foreign — and call sites that needed a repo root
   session-start Phase 0.5, Phase 1.2.1, and both `parallel-aware-*` docs. A real
   `git worktree` two-root integration test goes phantom-peer red → green.
 
+#### From the 2026-08-22 → 2026-08-25 line
+
+- **Cursor is a native surface, not a rules overlay.** `.cursor/commands/*.md`
+  (27 slash-command wrappers), `.cursor/skills/<name>/SKILL.md` (47 wrappers),
+  `.cursor/hooks.json` → `scripts/lib/cursor-hook-bridge.mjs`. Same pattern as
+  Pi: one maintained body in `commands/` and `skills/`, generated adapters,
+  `validate-plugin` check (`check-cursor-adapter.mjs --check`). `cursor-install.mjs`
+  now links commands and skills and writes `hooks.json` for other projects.
+  Cursor has no Skill tool — commands Read `skills/<name>/SKILL.md`.
+- **The coordinator can see its agents, and a foreign model can build (#1113, #1150).**
+  Wave supervision plus `cursor-agent` CLI foreign dispatch (detached worktree,
+  filesystem-measured result, mandatory Claude review, `NEVER_FOREIGN_ROLES`).
+- **`/reconcile` ran for the first time in seven weeks** — 10 learnings became
+  conditional rules (`feat(rules)`).
+- **Express-path** gained a mechanical caller and a single documented reading.
+- **18 measurement probes** now have a mechanical caller (`feat(probes)`);
+  session-start no longer depends on prose to run them.
+- **Vault writers report their own failure**; the vault mirror reports that it
+  is healthy (`feat(vault)`, `feat(telemetry)`).
+- **Ingest server** counts answers; the weekly digest has a caller.
+
 ### Fixed
 
 - **Six onboarding contradictions + a `cursor-install` TARGET guard (#1078).** First
@@ -424,6 +1511,36 @@ only — every resume looked foreign — and call sites that needed a repo root
   one) plus a matching `hookTimeout` bump, and two further spawn-timeout assertions gained
   the same discriminating margin between contention and a genuine failure.
 
+#### From the 2026-08-22 → 2026-08-25 line
+
+- **Cursor hooks were a reference mapping that silent-no-op'd (#919).**
+  `hooks/hooks-cursor.json` is the live handler map. The bridge projects Cursor
+  stdin onto `tool_name` / `tool_input` and maps deny envelopes onto Cursor
+  `{ permission }`. `afterFileEdit` remains post-hoc (cannot unwrite).
+- **`detectPlatform()` walked to `$HOME` and found `~/.pi`** — 63 of 84
+  telemetry records carried `platform=pi` (`fix(platform)`).
+- **Identity compared the machine name, then the working copy, then DHCP**
+  (#1072, #1085 follow-through). Budget and lock judge the session. One machine,
+  one name.
+- **A vault probe wrote into the operator's real vault**; the mirror now writes
+  on the second run too (#1033).
+- **Guards that saw the wrong thing or discarded the right one** (#1029, #1130,
+  #1077, #1125, #979, and a second trio that measured nothing).
+- **Reconcile: a No stays a No**; three paths that turned a rule into silent
+  reject; gates that wrote and never read (EventDrop #484, #386, #385, #429);
+  a type registry is enough (#1042, #1151).
+- **STATE.md: a broken list item costs the item, never the document (#1111).**
+- **Telemetry: noop-silent mirror, recorded aborts, budget reaper (#1151, #1127).**
+  Consent question and flush no longer hang on prose.
+- **Privacy: the operator's machine name leaves the examples (#1151 Review).**
+- **Archive: a citation is not a declaration; foreign files are not mine
+  (#1112, #1123).**
+- **Scope manifest knows whom it belongs to, and the hook asks (#1123, #1082).**
+- **Security copy claimed SAST/Semgrep levels that never existed**; the private
+  npm scope no longer rides along with a copied baseline.
+- **A dying suite at import is counted as what it is**; a blocking guard now
+  says why.
+
 ### Changed
 
 - **Host-registry census counts `semantic_session_id` (#1066).** `hooks/on-session-start.mjs`
@@ -453,6 +1570,12 @@ Two of this session's diffs were authored by foreign models under the #1150 adap
 #1078 by composer-2.5, #1093 by grok-4.6 — each passing mandatory Claude review before
 landing. First production use of the foreign-dispatch path.
 
+npm 3.22.0 never contained the 2026-08-22 → 2026-08-25 line; 3.23.0 is the first registry
+tarball that does (`npm view session-orchestrator versions` @ 2026-09-06: 3.22.0, 3.23.0,
+3.24.0 — no 3.22.1). The 3.22.1 cut that first documented the line was a release commit that
+was never pushed, which is why those entries surface here, one release late, re-measured at
+`befdda47` rather than quoted.
+
 ## [3.22.0] - 2026-08-22
 
 Twenty commits (12 `fix`, 5 `docs`, 2 `feat`, 1 `chore`; 150 files, +17,312/−2,575), no