session-orchestrator 3.24.0 → 4.0.1

package/scripts/lib/wave-executor/dispatch-common.mjs

@@ -0,0 +1,164 @@
+/**
+ * dispatch-common.mjs — shared base for the two foreign-dispatch adapters:
+ * `foreign-dispatch.mjs` (Cursor channel, `cursor-agent`) and
+ * `remote-dispatch.mjs` (remote-host channel, `offload`). Two adapters, one
+ * base (#1204).
+ *
+ * These six symbols moved here because each one is an enforcement point or a
+ * budget constant that must NOT diverge between the two channels: the
+ * `never_foreign` role lock, the run-id path-segment validator, the
+ * SIGTERM→SIGKILL child runner, and the two dispatch-budget constants. Before
+ * this module existed, `remote-dispatch.mjs` imported all five from
+ * `foreign-dispatch.mjs` directly — a Cursor-specific file acting as a shared
+ * base for a channel that has nothing to do with Cursor. Both adapters now
+ * import from here instead, so neither exports something the other must reach
+ * through.
+ *
+ * Revisit-Trigger: if a THIRD dispatch channel ever needs a different budget
+ * default or a different never-foreign list, split the constant per-channel
+ * at that point rather than overriding it at the call site — a call-site
+ * override would silently diverge from the one enforcement point this module
+ * exists to be.
+ */
+
+/**
+ * Roles that may NEVER run on a foreign model. Copied verbatim from
+ * account-switch `tools/routing/routing.yaml` § never_foreign (read 2026-08-25).
+ * Keep in sync by hand — the YAML lives in a different repo and is parsed there
+ * by awk, not by a shared library.
+ * @type {readonly string[]}
+ */
+export const NEVER_FOREIGN_ROLES = Object.freeze([
+  'impl-core',
+  'security-review',
+  'migration',
+  'release',
+  'secrets',
+  'incident',
+  'refactor-crosscut',
+]);
+
+/** Default wall-clock budget for one foreign dispatch, in seconds.
+ * This is a FLOOR, not a suggestion: measured 2026-08-23, `cursor-grok-4.6-high`
+ * ran 2 of 3 hard-test tasks past a 540 s cap (recorded as DNF). Lowering this
+ * manufactures timeouts and reads as model failure. */
+export const DEFAULT_TIMEOUT_SEC = 900;
+
+/**
+ * Grace period between SIGTERM and SIGKILL, in ms.
+ *
+ * `child.kill('SIGTERM')` is a REQUEST: a child that installs a handler and
+ * ignores it never emits `close`, and this module's only resolve paths are
+ * `close` and `error` — so without escalation a wedged `cursor-agent` hangs
+ * `dispatchForeign` forever and takes the whole wave with it. SIGKILL is not
+ * catchable, so the escalation always terminates.
+ *
+ * Named ceiling (BV-004): 10 s is enough for a cooperative child to flush its
+ * stream-json tail and exit. Revisit if a well-behaved `cursor-agent` is ever
+ * measured needing longer than that to shut down — raise the constant, never
+ * drop the escalation.
+ */
+export const DEFAULT_KILL_GRACE_MS = 10_000;
+
+/** A runId names a directory and a log file. Anything outside this alphabet —
+ * or the two relative-path literals the alphabet happens to admit — can escape
+ * the parent it is joined to. */
+const SAFE_RUN_ID = /^[A-Za-z0-9._-]+$/;
+
+/**
+ * @param {unknown} runId
+ * @returns {boolean} true when the id is safe to use as a path segment.
+ */
+export function isSafeRunId(runId) {
+  const s = String(runId ?? '');
+  if (s === '.' || s === '..') return false; // admitted by SAFE_RUN_ID, still an escape
+  return SAFE_RUN_ID.test(s);
+}
+
+/**
+ * @param {string} role
+ * @returns {boolean} true when the role is locked to Claude.
+ */
+export function isNeverForeignRole(role) {
+  return NEVER_FOREIGN_ROLES.includes(String(role || '').trim());
+}
+
+/**
+ * Run the child process, capturing stdout+stderr merged, with a hand-rolled
+ * SIGTERM timeout that ESCALATES to SIGKILL. `spawnFn` is the DI seam so tests
+ * never touch the real `cursor-agent` binary.
+ *
+ * The escalation is the difference between a bounded dispatch and a hung wave:
+ * this function's only resolve paths are the child's `close` and `error`
+ * events, so a child that ignores SIGTERM never lets the promise settle. See
+ * {@link DEFAULT_KILL_GRACE_MS}.
+ *
+ * @returns {Promise<{capture: string, exitCode: number|null, signal: string|null,
+ *   timerFired: boolean, killSignals: string[], errorCode: string|null}>}
+ */
+export function runChild(cmd, args, options, { spawnFn, timeoutMs, killGraceMs }) {
+  return new Promise((resolve) => {
+    /** @type {string[]} */
+    const killSignals = [];
+    let child;
+    try {
+      child = spawnFn(cmd, args, options);
+    } catch (err) {
+      resolve({
+        capture: `spawn failed: ${err && err.message}`,
+        exitCode: null,
+        signal: null,
+        timerFired: false,
+        killSignals,
+        errorCode: (err && err.code) || null,
+      });
+      return;
+    }
+
+    let capture = '';
+    let timerFired = false;
+    let settled = false;
+    let errorCode = null;
+    /** @type {ReturnType<typeof setTimeout>|null} */
+    let graceTimer = null;
+
+    const onChunk = (chunk) => {
+      capture += chunk.toString();
+    };
+    child.stdout?.on('data', onChunk);
+    child.stderr?.on('data', onChunk);
+
+    const send = (signal) => {
+      killSignals.push(signal);
+      try {
+        child.kill(signal);
+      } catch {
+        /* already gone */
+      }
+    };
+
+    const timer = setTimeout(() => {
+      timerFired = true;
+      send('SIGTERM');
+      // SIGTERM is a request; SIGKILL is not. A child that installs a handler
+      // and declines to exit would otherwise hang this promise forever.
+      graceTimer = setTimeout(() => send('SIGKILL'), killGraceMs);
+      graceTimer.unref?.();
+    }, timeoutMs);
+
+    const finish = (exitCode, signal) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      if (graceTimer) clearTimeout(graceTimer);
+      resolve({ capture, exitCode, signal, timerFired, killSignals, errorCode });
+    };
+
+    child.on('error', (err) => {
+      errorCode = (err && err.code) || null;
+      capture += `\nchild error: ${err && err.message}`;
+      finish(null, null);
+    });
+    child.on('close', (code, signal) => finish(code, signal ?? null));
+  });
+}

package/scripts/lib/wave-executor/foreign-dispatch.mjs

@@ -54,45 +54,13 @@ import path from 'node:path';
 
 import { emitEvent, sessionAttribution } from '../events.mjs';
 import { isPathInside } from '../path-utils.mjs';
-
-/**
- * Roles that may NEVER run on a foreign model. Copied verbatim from
- * account-switch `tools/routing/routing.yaml` § never_foreign (read 2026-08-25).
- * Keep in sync by hand — the YAML lives in a different repo and is parsed there
- * by awk, not by a shared library.
- * @type {readonly string[]}
- */
-export const NEVER_FOREIGN_ROLES = Object.freeze([
-  'impl-core',
-  'security-review',
-  'migration',
-  'release',
-  'secrets',
-  'incident',
-  'refactor-crosscut',
-]);
-
-/** Default wall-clock budget for one foreign dispatch, in seconds.
- * This is a FLOOR, not a suggestion: measured 2026-08-23, `cursor-grok-4.6-high`
- * ran 2 of 3 hard-test tasks past a 540 s cap (recorded as DNF). Lowering this
- * manufactures timeouts and reads as model failure. */
-export const DEFAULT_TIMEOUT_SEC = 900;
-
-/**
- * Grace period between SIGTERM and SIGKILL, in ms.
- *
- * `child.kill('SIGTERM')` is a REQUEST: a child that installs a handler and
- * ignores it never emits `close`, and this module's only resolve paths are
- * `close` and `error` — so without escalation a wedged `cursor-agent` hangs
- * `dispatchForeign` forever and takes the whole wave with it. SIGKILL is not
- * catchable, so the escalation always terminates.
- *
- * Named ceiling (BV-004): 10 s is enough for a cooperative child to flush its
- * stream-json tail and exit. Revisit if a well-behaved `cursor-agent` is ever
- * measured needing longer than that to shut down — raise the constant, never
- * drop the escalation.
- */
-export const DEFAULT_KILL_GRACE_MS = 10_000;
+import {
+  DEFAULT_KILL_GRACE_MS,
+  DEFAULT_TIMEOUT_SEC,
+  isNeverForeignRole,
+  isSafeRunId,
+  runChild,
+} from './dispatch-common.mjs';
 
 /**
  * argv prefix for every foreign dispatch, ahead of `--model`/`--output-format`.
@@ -156,29 +124,6 @@ export const FOREIGN_ENV_ALLOWLIST = Object.freeze([
  * directory named this way. */
 export const FOREIGN_TMP_PREFIX = 'so-foreign';
 
-/** A runId names a directory and a log file. Anything outside this alphabet —
- * or the two relative-path literals the alphabet happens to admit — can escape
- * the parent it is joined to. */
-const SAFE_RUN_ID = /^[A-Za-z0-9._-]+$/;
-
-/**
- * @param {unknown} runId
- * @returns {boolean} true when the id is safe to use as a path segment.
- */
-export function isSafeRunId(runId) {
-  const s = String(runId ?? '');
-  if (s === '.' || s === '..') return false; // admitted by SAFE_RUN_ID, still an escape
-  return SAFE_RUN_ID.test(s);
-}
-
-/**
- * @param {string} role
- * @returns {boolean} true when the role is locked to Claude.
- */
-export function isNeverForeignRole(role) {
-  return NEVER_FOREIGN_ROLES.includes(String(role || '').trim());
-}
-
 /**
  * Build the allowlisted child environment.
  * @param {Record<string, string|undefined>} [source]
@@ -317,86 +262,6 @@ export function parseCursorStream(raw) {
  */
 export const MEASUREMENT_EXCLUDES = Object.freeze(['node_modules']);
 
-/**
- * Run the child process, capturing stdout+stderr merged, with a hand-rolled
- * SIGTERM timeout that ESCALATES to SIGKILL. `spawnFn` is the DI seam so tests
- * never touch the real `cursor-agent` binary.
- *
- * The escalation is the difference between a bounded dispatch and a hung wave:
- * this function's only resolve paths are the child's `close` and `error`
- * events, so a child that ignores SIGTERM never lets the promise settle. See
- * {@link DEFAULT_KILL_GRACE_MS}.
- *
- * @returns {Promise<{capture: string, exitCode: number|null, signal: string|null,
- *   timerFired: boolean, killSignals: string[], errorCode: string|null}>}
- */
-export function runChild(cmd, args, options, { spawnFn, timeoutMs, killGraceMs }) {
-  return new Promise((resolve) => {
-    /** @type {string[]} */
-    const killSignals = [];
-    let child;
-    try {
-      child = spawnFn(cmd, args, options);
-    } catch (err) {
-      resolve({
-        capture: `spawn failed: ${err && err.message}`,
-        exitCode: null,
-        signal: null,
-        timerFired: false,
-        killSignals,
-        errorCode: (err && err.code) || null,
-      });
-      return;
-    }
-
-    let capture = '';
-    let timerFired = false;
-    let settled = false;
-    let errorCode = null;
-    /** @type {ReturnType<typeof setTimeout>|null} */
-    let graceTimer = null;
-
-    const onChunk = (chunk) => {
-      capture += chunk.toString();
-    };
-    child.stdout?.on('data', onChunk);
-    child.stderr?.on('data', onChunk);
-
-    const send = (signal) => {
-      killSignals.push(signal);
-      try {
-        child.kill(signal);
-      } catch {
-        /* already gone */
-      }
-    };
-
-    const timer = setTimeout(() => {
-      timerFired = true;
-      send('SIGTERM');
-      // SIGTERM is a request; SIGKILL is not. A child that installs a handler
-      // and declines to exit would otherwise hang this promise forever.
-      graceTimer = setTimeout(() => send('SIGKILL'), killGraceMs);
-      graceTimer.unref?.();
-    }, timeoutMs);
-
-    const finish = (exitCode, signal) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      if (graceTimer) clearTimeout(graceTimer);
-      resolve({ capture, exitCode, signal, timerFired, killSignals, errorCode });
-    };
-
-    child.on('error', (err) => {
-      errorCode = (err && err.code) || null;
-      capture += `\nchild error: ${err && err.message}`;
-      finish(null, null);
-    });
-    child.on('close', (code, signal) => finish(code, signal ?? null));
-  });
-}
-
 /** Read `git` output as text, returning '' on failure (a detached worktree with
  * no commits still answers, but a broken invocation must not throw here). */
 function gitText(args, execFn) {

package/scripts/lib/wave-executor/remote-dispatch.mjs

@@ -6,10 +6,10 @@
  * Relationship to `foreign-dispatch.mjs`: same contract, different channel.
  * That module sends a task to a foreign MODEL on this machine; this one sends
  * a task to Claude on ANOTHER machine. Both share the parts that must not
- * diverge and are therefore IMPORTED, never copied: the `never_foreign` role
- * lock ({@link isNeverForeignRole}), the run-id path-segment validator
- * ({@link isSafeRunId}), the SIGTERM→SIGKILL child runner ({@link runChild}),
- * and the two budget constants.
+ * diverge and are therefore IMPORTED from the common base (`dispatch-common.mjs`,
+ * #1204), never copied: the `never_foreign` role lock ({@link isNeverForeignRole}),
+ * the run-id path-segment validator ({@link isSafeRunId}), the SIGTERM→SIGKILL
+ * child runner ({@link runChild}), and the two budget constants.
  *
  * Three properties are load-bearing here and each has a test:
  *
@@ -40,9 +40,7 @@ import {
   isNeverForeignRole,
   isSafeRunId,
   runChild,
-} from './foreign-dispatch.mjs';
-
-export { DEFAULT_KILL_GRACE_MS, DEFAULT_TIMEOUT_SEC };
+} from './dispatch-common.mjs';
 
 /** The `offload` binary. Resolved on PATH; a missing binary surfaces as ENOENT
  * and is classified as a CHANNEL failure, never as a model failure. */

package/scripts/lib/wave-resource-gate.mjs

@@ -8,7 +8,6 @@
  */
 
 import { probe, evaluate } from './resource-probe.mjs';
-import { isNeverForeignRole } from './wave-executor/foreign-dispatch.mjs';
 
 /**
  * Wave roles that may run on a declared remote host, mapped to the
@@ -147,7 +146,14 @@ async function applyOffloadDecision(result, opts) {
   if (!Array.isArray(hosts) || hosts.length === 0) return result;
 
   const role = String(waveRole ?? '').trim().toLowerCase();
-  if (isNeverForeignRole(role)) return result;
+  // No isNeverForeignRole() check here (D8 #1204 LOW-1): the invariant is
+  // enforced STRUCTURALLY by this mapping table, not by an extra guard.
+  // NEVER_FOREIGN_ROLES {impl-core, security-review, migration, release,
+  // secrets, incident, refactor-crosscut} and OFFLOADABLE_WAVE_ROLES keys
+  // {quality, test, ui, perf} have ZERO overlap — measured by inspection of
+  // both literal lists — so a never-foreign role always falls through to
+  // `mappedRole === undefined` below regardless. A redundant call here was
+  // dead code that a lookup-table edit could not make live again on its own.
   const mappedRole = OFFLOADABLE_WAVE_ROLES[role];
   if (mappedRole === undefined) return result;
 

package/scripts/lib/wave-sizing.mjs

@@ -3,7 +3,10 @@
  * Learning: coordinator-over-worktree-on-shared-files caused back-to-back regressions.
  */
 
-const VALID_SESSION_TYPES = ['housekeeping', 'feature', 'deep'];
+// 'unknown' is accepted because scripts/lib/session-close-backfill.mjs writes it for records whose
+// type it could not measure (4.0.0). It is NOT a mode anyone selects — isolation resolves as for
+// 'deep' (the conservative end). SSOT for the ledger enum: scripts/lib/session-schema/constants.mjs.
+const VALID_SESSION_TYPES = ['housekeeping', 'feature', 'deep', 'unknown'];
 const VALID_COLLISION_RISKS = ['low', 'medium', 'high'];
 const VALID_CONFIG_ISOLATIONS = ['auto', 'worktree', 'none'];
 const VALID_ENFORCEMENTS = ['strict', 'warn', 'off'];

package/scripts/lib/wave-transcript-tail.mjs

@@ -96,9 +96,107 @@ const RE_EMIT_EVERY = 10;
 
 /**
  * git subcommands that mutate the shared index, the stash stack, or remote
- * history — the PSA-007 prohibition list, verbatim.
+ * history — the PSA-007 prohibition list, verbatim. Matching the subcommand
+ * LITERAL is only the first half: the arguments decide whether the invocation
+ * writes anything at all (#1215).
+ *
+ * Group 1 is the subcommand, group 2 the remaining argument string.
+ *
+ * The global-flag run has TWO alternatives on purpose (W4/F2). A bare
+ * `(?:-[^\s]+\s+)*` cannot absorb a VALUE-taking global flag: in
+ * `git -C /tmp stash` the run eats `-C ` and then meets `/tmp`, which is not a
+ * subcommand, so the whole invocation read as NOT a git write — measured 2026-09-04,
+ * `isGitWrite('git -C /tmp stash')` and `isGitWrite('git -c user.name=x commit -m y')`
+ * both returned false. `-C`/`-c`/`--git-dir`/`--work-tree`/`--namespace`/
+ * `--exec-path`/`--config-env` are the value-taking globals; the space-separated
+ * form is matched first, the `--flag=value` form falls through to the generic
+ * alternative unchanged.
+ *
+ * `command git …` and `env VAR=x git …` prefixes are absorbed too — both are
+ * ordinary agent shapes that hid a write behind one token.
+ *
+ * DELIBERATE — `-C <dir>` is NOT treated as fixture context. `FIXTURE_CONTEXT_RE`
+ * keys on `cd /tmp` / `mktemp`, the shapes agents actually write around a test
+ * fixture; teaching it `-C` would hand back the exact one-token evasion this fix
+ * closes (`git -C /tmp/../<repo> commit`). A genuine `git -C "$TMPDIR" commit`
+ * therefore reports — a false alarm on an advisory detector, never a missed breach.
+ *
+ * CEILING (BV-004): the prefix list is enumerated, not general. `sudo git …`,
+ * `nice -n 5 git …` and any other wrapper still hide the write; and a git write
+ * inside `$(…)` or a quoted string was never detected (see `isGitWrite`).
+ * Revisit if a real PSA-007 breach is ever missed through a wrapper.
  */
-const GIT_WRITE_RE = /^\s*git\s+(?:-[^\s]+\s+)*(add|commit|stash|push|mv|rm|reset|checkout\s+--)\b/;
+const GIT_WRITE_RE =
+  /^\s*(?:command\s+|env\s+(?:[A-Za-z_][A-Za-z0-9_]*=\S*\s+)+)*git\s+(?:(?:-C|-c|--git-dir|--work-tree|--namespace|--exec-path|--config-env)\s+\S+\s+|-[^\s]+\s+)*(add|commit|stash|push|mv|rm|reset|checkout)\b(.*)$/;
+
+/**
+ * `git stash` sub-subcommands that actually touch the stash stack. Bare
+ * `git stash` (no sub-subcommand) is `stash push`, so it counts too; anything
+ * else — `list`, `show`, an unknown word — is a read.
+ */
+const STASH_WRITE_SUBS = new Set([
+  'push',
+  'save',
+  'pop',
+  'apply',
+  'drop',
+  'clear',
+  'branch',
+  'create',
+  'store',
+]);
+
+/**
+ * Argument-aware PSA-007 classification. Decision table (#1215):
+ *
+ * | invocation                        | verdict | why                                    |
+ * |-----------------------------------|---------|----------------------------------------|
+ * | `git stash` / `stash push|save`   | write   | pushes onto the shared stash stack     |
+ * | `stash pop|apply|drop|clear`      | write   | mutates / consumes the stack           |
+ * | `stash branch|create|store`       | write   | creates refs from the stack            |
+ * | `git stash list` / `stash show`   | READ    | capability/inspection probe            |
+ * | `--help` / `-h` / `--version`     | READ    | capability probe, any subcommand       |
+ * | `--dry-run` (any subcommand)      | READ    | prints, never writes                   |
+ * | `-n` on add / rm / mv / push      | READ    | `-n` IS `--dry-run` there              |
+ * | `-n` on commit                    | WRITE   | `-n` is `--no-verify` — a REAL commit  |
+ * | `git checkout -- <path>`          | write   | discards sibling work (destructive)    |
+ * | `git checkout <branch>`           | READ    | no index/worktree content destroyed    |
+ * | `git reset` (any form)            | write   | destructive, kept unconditional        |
+ * | `git add|commit|push|mv|rm` else  | write   | the PSA-007 list, verbatim             |
+ *
+ * The `-n` split is measured, not assumed — `git commit -h` prints
+ * `-n, --no-verify` while `git add -h` / `git rm -h` / `git push -h` all print
+ * `-n, --[no-]dry-run` (measured 2026-09-04, git in this repo's PATH).
+ * Treating `commit -n` as a read would blind the detector to
+ * `git commit --no-verify`, which `parallel-sessions.md` § PSA-007 names as an
+ * anti-pattern verbatim.
+ *
+ * Ceiling: flags are matched as whole tokens after quoted spans are stripped,
+ * so `git commit -m "fix -h"` stays a write. Bundled short flags (`-nv`) and
+ * flags hidden in `$(…)` are not decoded — they read as writes, a false alarm,
+ * never a missed breach. Revisit if agents start writing bundled git flags.
+ *
+ * @param {string} sub — the matched git subcommand
+ * @param {string} rawArgs — everything after it in the segment
+ * @returns {boolean}
+ */
+function gitSegmentWrites(sub, rawArgs) {
+  // Strip quoted spans so a commit message can never supply a read flag.
+  const args = String(rawArgs || '').replace(/"[^"]*"|'[^']*'/g, ' ');
+  const tokens = args.split(/\s+/).filter(Boolean);
+
+  for (const t of tokens) {
+    if (t === '--help' || t === '-h' || t === '--version' || t === '--dry-run') return false;
+    if (t === '-n' && sub !== 'commit') return false;
+  }
+
+  if (sub === 'checkout') return tokens.includes('--');
+  if (sub === 'stash') {
+    const first = tokens.find((t) => !t.startsWith('-'));
+    return first === undefined || STASH_WRITE_SUBS.has(first);
+  }
+  return true;
+}
 
 /**
  * STATUS literals that all report as pattern `status-partial`.
@@ -283,9 +381,22 @@ export function classifyErrorClass(text) {
  * `/private/tmp`, `/var/folders`, `$TMPDIR`). A fixture repo created somewhere
  * else is still reported — a false alarm, never a missed breach. Revisit if
  * agents start seeding fixtures outside these paths.
+ *
+ * #1172: the temp path must also match BARE — the reported false alarm was
+ * `cd /tmp && git init && git commit -m x`, where the old pattern required a
+ * trailing `/` after `/tmp` and therefore saw nothing. The terminator class
+ * (`/`, quote, whitespace, `;`, `&`, `|`, end of string) is what keeps
+ * `cd /tmpfoo` — a real directory that is NOT the temp dir — reported.
+ *
+ * The destructive guard's own temp allowlist (`hooks/pre-bash-destructive-guard.mjs`
+ * `isSafeRmTarget`) is deliberately NOT reused: it exports nothing
+ * (`grep -n "^export" hooks/pre-bash-destructive-guard.mjs` → 0 matches,
+ * measured 2026-09-04) and resolves paths on the filesystem against a loaded
+ * policy, whereas this is a lexical test on a transcript string with no repo
+ * context. Same intent, different substrate.
  */
 const FIXTURE_CONTEXT_RE =
-  /\bmktemp\b|\bcd\s+["']?(?:\/private)?\/(?:tmp|var\/folders)\/|\bcd\s+["']?\$\{?(?:TMPDIR|TMP|SCRATCH)/;
+  /\bmktemp\b|\bcd\s+["']?(?:\/private)?\/(?:tmp|var\/folders)(?:["'\s;&|/]|$)|\bcd\s+["']?\$\{?(?:TMPDIR|TMP|SCRATCH)/;
 
 /**
  * True when the Bash command contains a git INDEX/HISTORY write in ANY
@@ -301,7 +412,10 @@ const FIXTURE_CONTEXT_RE =
 export function isGitWrite(command) {
   const text = String(command || '');
   if (FIXTURE_CONTEXT_RE.test(text)) return false;
-  return text.split(/&&|\|\||;|\||\n/).some((seg) => GIT_WRITE_RE.test(seg));
+  return text.split(/&&|\|\||;|\||\n/).some((seg) => {
+    const m = GIT_WRITE_RE.exec(seg);
+    return m ? gitSegmentWrites(m[1], m[2]) : false;
+  });
 }
 
 /**

package/scripts/materialize-wave-scope.mjs

@@ -27,6 +27,10 @@ import { resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { writeJsonAtomicSync } from './lib/io.mjs';
 import { isPeerRecordId } from './lib/scope-gate.mjs';
+import {
+  MANIFEST_SESSION_KEYS,
+  manifestSessionBinding,
+} from './lib/session-identity/own-session.mjs';
 
 const HELP = `Usage: node scripts/materialize-wave-scope.mjs --state-dir <dir> --wave <positive-int> [--json]
 
@@ -220,7 +224,8 @@ export function validateScopeRecords(value) {
 /**
  * Read the session ids the sibling manifest `<state-dir>/wave-scope.json`
  * declares for this state directory (#1123 wrote both `session` — the raw
- * `session_id` — and its human-readable twin `semantic_session`).
+ * `session_id` — and its human-readable twin `semantic_session_id`; the
+ * pre-#1153 spellings `session` / `semantic_session` are still read).
  *
  * A caller may legitimately hold either spelling, so BOTH are returned and a
  * match against either proves ownership. Any failure to read or parse the
@@ -239,10 +244,12 @@ export function manifestSessionIds(stateDir, readFile = readFileSync) {
     return [];
   }
   if (!isRecord(manifest)) return [];
-  return ['session', 'semantic_session']
-    .map((key) => manifest[key])
-    .filter((value) => typeof value === 'string' && value.trim().length > 0)
-    .map((value) => value.trim());
+  // #1153 P2 — the key spellings live in own-session.mjs, which also reads the
+  // pre-#1153 `session`/`semantic_session` names for one transition release.
+  const binding = manifestSessionBinding(manifest);
+  return MANIFEST_SESSION_KEYS.current
+    .map((key) => binding[key])
+    .filter((value) => typeof value === 'string' && value.length > 0);
 }
 
 /**

package/scripts/memory-propose.mjs

@@ -46,7 +46,7 @@ import { dirname, join, isAbsolute } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { isWaveAgentContext, WAVE_AGENT_ENV_VAR, WAVE_AGENT_ENV_VALUE } from './lib/wave-context.mjs';
-import { readProcessLocalSessionIds } from './lib/session-identity/own-session.mjs';
+import { readProcessLocalSessionIds, manifestSessionBinding } from './lib/session-identity/own-session.mjs';
 import { readLockDetailed } from './lib/session-lock.mjs';
 
 // ---------------------------------------------------------------------------
@@ -369,7 +369,7 @@ if (!dryRun && (currentWaveRaw === undefined || currentWaveRaw === null || curre
 // trusted (#1177 FX1) — since #1123 both writers stamp the binding, so a
 // binding-less manifest is a peer's or a stale artefact.
 //
-// The session binding compares `manifest.semantic_session` — the SEMANTIC label
+// The session binding compares the manifest's `semantic_session_id` — the SEMANTIC label
 // — against the semantic id looked up in `session.lock`, and that lookup is only
 // honoured when this PROCESS's own raw session id equals the lock's raw
 // `session_id` (#1188). STATE.md's `session` field is NOT a witness here: it is
@@ -382,14 +382,18 @@ function resolveRunningWaveId() {
       const manifestPath = join(stateDir, 'wave-scope.json');
       if (existsSync(manifestPath)) {
         const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
-        const boundSession = manifest?.semantic_session ?? manifest?.session;
+        // #1153 P2 — key spellings resolved in ONE place (own-session.mjs),
+        // which also reads the pre-#1153 `session` / `semantic_session` names
+        // for one transition release. Absent slots come back as `undefined`.
+        const binding = manifestSessionBinding(manifest);
+        const boundSession = binding.semantic_session_id ?? binding.session_id;
         const unbound =
           boundSession === undefined || boundSession === null || boundSession === '';
         // BOTH sides must be non-empty strings. `undefined === undefined` is
         // true, so a STATE.md WITHOUT a `session` key previously "matched" any
         // manifest whose `semantic_session` was also absent-but-present-in-the
         // -comparison — adopting a foreign coordinator's wave number as its own.
-        const mineSide = manifest?.semantic_session;
+        const mineSide = binding.semantic_session_id;
         // #1188 — STATE.md is a working-copy artefact of the LOCK OWNER, not a
         // process-local witness: when a peer holds the lock the peer wrote BOTH
         // STATE.md and the manifest, so the two "independent" sides agree about
@@ -403,6 +407,16 @@ function resolveRunningWaveId() {
         // Cursor) resolves no process-local id -> binding unprovable ->
         // current-wave + 1 fallback with a stderr line. REVISIT if that fallback
         // rate is measured non-trivial in events.jsonl.
+        //
+        // #1207 — kept hand-rolled rather than calling `attributionForRecord()`
+        // (scripts/lib/events.mjs): that function's contract is `{}`-on-any-
+        // mismatch with no detail, but the stderr diagnostics below (raw id,
+        // lock status, process-local id list) are load-bearing for debugging a
+        // wrongly-bucketed proposal, and attributionForRecord() has no lock-
+        // status channel to source them from (it swallows `readLock()` errors
+        // silently by design). `readLockDetailed()` is used here specifically
+        // for that `.status` field `readLock()` (attributionForRecord's own
+        // primitive) does not return.
         const lock = readLockDetailed({ repoRoot: process.cwd() });
         const processLocal = readProcessLocalSessionIds();
         const lockRaw =
@@ -431,7 +445,7 @@ function resolveRunningWaveId() {
         // bucket. Unbound → say so once on stderr and fall back.
         if (unbound) {
           process.stderr.write(
-            'memory-propose: wave-scope.json unbound (no semantic_session) — ignored\n',
+            'memory-propose: wave-scope.json unbound (no semantic_session_id) — ignored\n',
           );
         }
         if (mine) {

package/scripts/migrate-cold-start-seed.mjs

@@ -143,7 +143,10 @@ if (applyFlag && dryRunFlag) {
   process.exit(1);
 }
 
-// Default is dry-run (matches scripts/migrate-learnings-jsonl.mjs convention).
+// Default is dry-run: a migration script writes only when `--apply` is passed, so an
+// invocation with no flags can never mutate a store. Repo-wide convention for every
+// `scripts/migrate-*` / `scripts/backfill-*` CLI; live example:
+// `scripts/migrate-sessions-jsonl.mjs` (`args.apply = false` default, `--apply` opts in).
 const dryRun = !applyFlag;
 
 // `--repos` is kept as the raw comma-separated string here (split later, at