session-orchestrator 4.1.0 → 5.0.0

package/scripts/lib/owner-yaml.mjs

@@ -2,9 +2,10 @@
  * owner-yaml.mjs — owner.yaml schema, validator, parser, writer (Issue #161, D1).
  *
  * Implements the public Owner Persona Layer API: schema validation, disk I/O,
- * and sensible defaults. Intentionally separate from `owner-config.mjs` (which
- * ships the richer D2-era schema with schema-version, metadata, and extended
- * fields). This module targets the simpler D1 surface defined in the #161 epic.
+ * and sensible defaults. This module IS the live owner-config surface — the
+ * richer D2-era schema (`owner-config.mjs`, with `schema-version`, `metadata`,
+ * and extended fields) was removed on 2026-09-09; this module's D1 surface
+ * from the #161 epic is now the only one.
  *
  * ── Schema (schema-version: 1) ───────────────────────────────────────────────
  *
@@ -95,17 +96,17 @@ let _yamlWarned = false;
  * Resolve `js-yaml` at CALL time instead of at import time (GH#62/#63).
  *
  * WHY `createRequire` and not `await import('js-yaml')`: every caller of
- * {@link loadOwnerConfig} consumes it SYNCHRONOUSLY. Measured 2026-09-06 with
+ * {@link loadOwnerConfig} consumes it SYNCHRONOUSLY. Measured 2026-09-09 with
  * `rg -n --glob '!tests/**' 'loadOwnerConfig\(' scripts hooks skills` (minus
- * this file and the unrelated async homonym in `owner-config-loader.mjs`):
- * 9 call sites — 8 in code, 1 in `skills/session-start/SKILL.md:1113` — and
- * `rg 'await\s+loadOwnerConfig'` over the same scope returns ZERO. Eight read
- * `loadOwnerConfig().config` (`hooks/on-session-start.mjs:639`,
- * `hooks/skill-invocation-telemetry.mjs:155`, `scripts/telemetry.mjs:81,130`,
- * `scripts/vault-mirror.mjs:444`, `scripts/lib/telemetry/sync.mjs:202,269`,
- * and the SKILL.md snippet); the ninth destructures the same sync return
- * (`scripts/lib/soul-resolve.mjs:123`). `writeOwnerConfig` is likewise sync at
- * its single call site, `scripts/lib/owner-interview.mjs:228`.
+ * this file itself — this is the sole loader now, no other async homonym
+ * exists): 8 call sites, all synchronous — `rg 'await\s+loadOwnerConfig'`
+ * over the same scope returns ZERO. All eight read `loadOwnerConfig().config`
+ * (`hooks/on-session-start.mjs:639`, `hooks/skill-invocation-telemetry.mjs:155`,
+ * `scripts/telemetry.mjs:81,130`, `scripts/vault-mirror.mjs:444`,
+ * `scripts/lib/telemetry/sync.mjs:513,643`, and
+ * `skills/session-start/references/phase-6-7-memory-banner-telemetry-consent.md:53`).
+ * `writeOwnerConfig` is likewise sync at its single call site,
+ * `scripts/lib/owner-interview.mjs:228`.
  *
  * Making either loader async would be a breaking change to all of them; a lazy
  * `require()` keeps the sync contract and only fails at CALL time — where the

package/scripts/lib/peer-cards/merger.mjs

@@ -308,3 +308,146 @@ function wrapManagedContent(raw) {
 function escapeRegex(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
+
+// ── body-string → section-map adapter (#1310) ────────────────────────────────
+//
+// The seam this closes: `dialectic-deriver` (agents/dialectic-deriver.md § Output
+// format) emits ONE FULL PEER-CARD BODY STRING per target, while `mergePeerCard`
+// above consumes a SECTION MAP keyed by sentinel name. Nothing translated between
+// the two, so `/evolve dialectic --apply` could not complete (#1310, correcting
+// #1303 point 3 — the signatures line up, the seam did not).
+//
+// The mapping is DERIVED, not invented: every managed region in the live cards
+// wraps exactly one `## ` heading, so the heading IS the section unit. Existing
+// names are read back out of the card rather than re-slugified, because the live
+// names are NOT a pure function of their headings — measured 2026-09-11 in
+// `.orchestrator/peers/AGENT.md`: "Guard and protocol-migration discipline" →
+// `guard-and-protocol-migration` (drops "discipline") and "Review discipline — the
+// refutation mandate" → `review-discipline-refutation-mandate` (drops "the").
+// Re-slugifying either would APPEND a duplicate section instead of replacing it.
+
+const H2_RE = /^##[ \t]+(.+?)[ \t]*$/gm;
+
+/** Normalise a heading for matching: case- and whitespace-insensitive. */
+function headingKey(heading) {
+  return heading.trim().toLowerCase().replace(/\s+/g, ' ');
+}
+
+/**
+ * Slugify a heading into a section name matching the `[\w-]+` grammar.
+ * Only used for headings with NO existing managed section (the append path).
+ * @param {string} heading
+ * @returns {string}
+ */
+function slugifyHeading(heading) {
+  const slug = heading
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '');
+  return slug.length > 0 ? slug : 'section';
+}
+
+/**
+ * Split a proposed full-body string into `{ <section-name>: <content> }`, reusing
+ * the existing card's section names wherever the heading already has a home.
+ *
+ * Behaviour for every input class (no case is silently dropped):
+ *  • Heading whose text matches an existing managed section's own `## ` heading →
+ *    mapped to that section's EXISTING name (`origin: 'existing'`) → REPLACE.
+ *  • Heading with no existing section → slugified name (`origin: 'new'`) →
+ *    APPEND. Collisions get a `-2`, `-3`, … suffix.
+ *  • Text BEFORE the first `## ` heading → returned as `preamble`. It is NOT
+ *    written into any section (it has no sentinel to own it); `mergeDerivedBody`
+ *    surfaces it as an `unmapped-preamble` conflict so a caller cannot miss it.
+ *  • Content under `###`+ headings stays inside its parent `##` section.
+ *  • A proposed body that already carries BEGIN/END sentinels keeps them inside
+ *    the section content — it is the deriver's job not to emit them (see
+ *    `agents/dialectic-deriver.md` § Anti-patterns).
+ *
+ * Pure function — no IO, deterministic.
+ *
+ * @param {string} proposedBody — the deriver's full replacement body for one target
+ * @param {string} [existingBody] — the on-disk body, for existing-name lookup
+ * @returns {{ managedUpdates: Record<string,string>,
+ *             mapping: Array<{heading: string, section: string, origin: 'existing'|'new'}>,
+ *             preamble: string }}
+ */
+export function deriveManagedUpdates(proposedBody, existingBody = '') {
+  if (typeof proposedBody !== 'string') {
+    throw new Error(`deriveManagedUpdates: proposedBody must be string (got ${typeof proposedBody}).`);
+  }
+  if (typeof existingBody !== 'string') {
+    throw new Error(`deriveManagedUpdates: existingBody must be string (got ${typeof existingBody}).`);
+  }
+
+  // heading-key → existing section name, read out of the live card
+  const existingByHeading = new Map();
+  const existingNames = new Set();
+  if (existingBody.length > 0) {
+    for (const s of parseSections(existingBody).sections) {
+      if (s.type !== 'managed') continue;
+      existingNames.add(s.name);
+      const h = s.content.match(/^##[ \t]+(.+?)[ \t]*$/m);
+      if (h && !existingByHeading.has(headingKey(h[1]))) {
+        existingByHeading.set(headingKey(h[1]), s.name);
+      }
+    }
+  }
+
+  H2_RE.lastIndex = 0;
+  const heads = [...proposedBody.matchAll(H2_RE)];
+  const preamble = (heads.length > 0 ? proposedBody.slice(0, heads[0].index) : proposedBody).trim();
+
+  /** @type {Record<string,string>} */
+  const managedUpdates = {};
+  const mapping = [];
+  const used = new Set();
+
+  for (let i = 0; i < heads.length; i++) {
+    const heading = heads[i][1];
+    const start = heads[i].index;
+    const end = i + 1 < heads.length ? heads[i + 1].index : proposedBody.length;
+    const content = proposedBody.slice(start, end).trim();
+
+    const existing = existingByHeading.get(headingKey(heading));
+    let section;
+    let origin;
+    if (existing !== undefined && !used.has(existing)) {
+      section = existing;
+      origin = 'existing';
+    } else {
+      const base = slugifyHeading(heading);
+      let candidate = base;
+      let n = 2;
+      while (used.has(candidate)) {
+        candidate = `${base}-${n++}`;
+      }
+      section = candidate;
+      origin = existingNames.has(candidate) ? 'existing' : 'new';
+    }
+
+    used.add(section);
+    managedUpdates[section] = content;
+    mapping.push({ heading, section, origin });
+  }
+
+  return { managedUpdates, mapping, preamble };
+}
+
+/**
+ * Merge a deriver-shaped FULL BODY STRING into an existing peer-card body.
+ * This is the function `/evolve dialectic --apply` calls; `mergePeerCard` stays
+ * the section-map primitive its existing callers already use.
+ *
+ * @param {string} existingBody
+ * @param {string} proposedBody
+ * @returns {MergeResult & { mapping: Array<{heading: string, section: string, origin: 'existing'|'new'}>, preamble: string }}
+ */
+export function mergeDerivedBody(existingBody, proposedBody) {
+  const { managedUpdates, mapping, preamble } = deriveManagedUpdates(proposedBody, existingBody);
+  const result = mergePeerCard(existingBody, managedUpdates);
+  if (preamble.length > 0) {
+    result.conflicts.push({ type: 'unmapped-preamble', content: preamble });
+  }
+  return { ...result, mapping, preamble };
+}

package/scripts/lib/pre-dispatch-check.mjs

@@ -13,6 +13,7 @@
  */
 
 import { execFileSync } from 'node:child_process';
+import { parsePorcelainEntries } from './git-porcelain.mjs';
 import { pathMatchesPattern } from './hardening.mjs';
 
 /**
@@ -66,28 +67,32 @@ export function checkUntrackedOverlap({ scope, cwd = process.cwd(), mode = 'warn
 }
 
 /**
- * Run `git status --porcelain` and extract untracked files (prefix "??").
+ * Run `git status --porcelain -z` and extract untracked files (status `??`).
  * Returns paths relative to `cwd`. Returns [] on any git failure.
  *
+ * `-z` is load-bearing (#1354): without it git C-quotes any path carrying a
+ * space, a `"`, a TAB or — under the default `core.quotePath=true` — a
+ * non-ASCII byte. The previous hand-unquoting here reversed only `\"` and
+ * `\\`, so `a\tb.txt` and `\303\244.txt` were returned VERBATIM — paths that
+ * exist nowhere on disk, which then matched no scope pattern and silently
+ * dropped the overlap this function exists to detect. `-z` emits every path
+ * raw, so there is no unquoting step at all. Parsing lives in the shared
+ * `scripts/lib/git-porcelain.mjs`.
+ *
  * @param {string} cwd
  * @returns {string[]}
  */
 export function listUntracked(cwd) {
   let stdout;
   try {
-    stdout = execFileSync('git', ['status', '--porcelain'], { cwd, encoding: 'utf8' });
+    stdout = execFileSync('git', ['status', '--porcelain', '-z'], { cwd, encoding: 'utf8' });
   } catch {
     return [];
   }
 
   const files = [];
-  for (const rawLine of stdout.split('\n')) {
-    if (!rawLine.startsWith('?? ')) continue;
-    // Porcelain v1 wraps paths in quotes when they contain special chars. Strip them.
-    let rel = rawLine.slice(3);
-    if (rel.startsWith('"') && rel.endsWith('"')) {
-      rel = rel.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, '\\');
-    }
+  for (const { status, path: rel } of parsePorcelainEntries(stdout)) {
+    if (status !== '??' || !rel) continue;
     // Directory entries end with `/` in porcelain output — expand to file list for fidelity.
     if (rel.endsWith('/')) {
       files.push(...expandDirectory(cwd, rel));
@@ -112,13 +117,14 @@ function expandDirectory(cwd, relDir) {
   try {
     const stdout = execFileSync(
       'git',
-      ['ls-files', '--others', '--exclude-standard', '--', relDir],
+      ['ls-files', '-z', '--others', '--exclude-standard', '--', relDir],
       { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }
     );
-    const lines = stdout
-      .split('\n')
-      .map((line) => line.trim())
-      .filter((line) => line.length > 0);
+    // `-z` for the same reason as the caller: git quotes special-char paths
+    // otherwise, and a quoted path does not exist on disk. NUL-separated
+    // output is emitted verbatim, so no trimming (which would eat a legal
+    // trailing space in a filename).
+    const lines = stdout.split('\0').filter((line) => line.length > 0);
     return lines.length > 0 ? lines : [relDir];
   } catch {
     return [relDir];

package/scripts/lib/project-hygiene.mjs

@@ -46,6 +46,7 @@ import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import yaml from 'js-yaml';
 import { tokenizeCommand, splitChainSegments, resolveSegmentVerb } from './command-blocker.mjs';
+import { parsePorcelainEntries } from './git-porcelain.mjs';
 
 /** Commits past the newest tag before release hygiene is worth mentioning. */
 export const DEFAULT_RELEASE_DRIFT_COMMITS = 50;
@@ -148,16 +149,17 @@ export function checkReleaseHygiene(repoRoot, driftCommits = DEFAULT_RELEASE_DRI
  *   - Everything outside `.orchestrator/` is untouched, which is where a real
  *     "nothing currently decides" stray lives.
  *
- * Prefix match on the porcelain path. `git status --porcelain` quotes a path only
- * when it carries special characters, so the optional leading quote is stripped
- * before comparing.
+ * Prefix match on the porcelain path. The caller reads `git status -z`, whose
+ * paths are NUL-terminated and therefore never quoted or escaped — the value
+ * arriving here is the literal path, so it is compared verbatim. Do not
+ * reintroduce a leading-quote strip: under `-z` a path that really begins with
+ * `"` is a path, not a quoting artefact.
  *
- * @param {string} porcelainPath path field of a `?? ` porcelain line
+ * @param {string} porcelainPath path field of a `?? ` porcelain entry
  * @returns {boolean}
  */
 function isOwnRuntimeArtifact(porcelainPath) {
-  const p = porcelainPath.replace(/^"/, '');
-  return p === '.orchestrator' || p.startsWith('.orchestrator/');
+  return porcelainPath === '.orchestrator' || porcelainPath.startsWith('.orchestrator/');
 }
 
 /**
@@ -171,6 +173,14 @@ function isOwnRuntimeArtifact(porcelainPath) {
  * `.gitignore` intends to version something that was never committed. In one
  * repo this hid 23 rule files the `.gitignore` explicitly un-ignored.
  *
+ * Reads `git status -z`: without it git QUOTES any path carrying a space, tab or
+ * non-ASCII byte (`"ign dir/"`, `"ign\tt.bin"`, `"ign\303\244.bin"`), and the
+ * quoted string does not exist on disk — so `duBytesBatch` dropped it and its
+ * bytes never reached the sum. Measured (#1348): a tree with `ign dir/` 3 MB,
+ * `ign<TAB>t.bin` 5 MB, `ignä.bin` 5 MB and `big.bin` 5 MB reported "5 MB
+ * (largest: big.bin 5MB)" against an actual 18 MB, low enough to fall under the
+ * report threshold entirely. `-z` is NUL-separated and never quotes.
+ *
  * @param {string} repoRoot
  * @param {number} ballastMb
  * @returns {object[]}
@@ -179,26 +189,30 @@ export function checkIgnoredBallast(repoRoot, ballastMb = DEFAULT_BALLAST_MB) {
   const findings = [];
 
   const ignored = git(
-    ['status', '--ignored=matching', '--porcelain', '--untracked-files=all'],
+    ['status', '--ignored=matching', '--porcelain', '--untracked-files=all', '-z'],
     repoRoot,
   );
   if (ignored === null) return findings;
 
   const ignoredPaths = [];
   let untrackedUnignored = 0;
-  for (const line of ignored.split('\n').filter(Boolean)) {
-    if (line.startsWith('!! ')) ignoredPaths.push(line.slice(3));
-    else if (line.startsWith('?? ') && !isOwnRuntimeArtifact(line.slice(3))) untrackedUnignored++;
+  // Porcelain v1 `-z` parsing (including the bare rename/copy source field that
+  // follows an `R`/`C` entry) lives in the shared parser — see
+  // `scripts/lib/git-porcelain.mjs`. Only `!!`/`??` are of interest here, so a
+  // rename/copy entry falls through both branches exactly as before.
+  for (const { status, path } of parsePorcelainEntries(ignored)) {
+    if (status === '!!') ignoredPaths.push(path);
+    else if (status === '??' && !isOwnRuntimeArtifact(path)) untrackedUnignored++;
   }
 
   // Size only the top-level ignored entries — recursing every path would cost
   // more than the finding is worth on a large tree.
   let totalBytes = 0;
   const heaviest = [];
+  const sizes = duBytesBatch(repoRoot, ignoredPaths);
   for (const p of ignoredPaths) {
-    const abs = join(repoRoot, p);
-    const bytes = duBytes(abs);
-    if (bytes === null) continue;
+    const bytes = sizes.get(stripTrailingSlash(p));
+    if (bytes === undefined) continue;
     totalBytes += bytes;
     heaviest.push({ path: p, bytes });
   }
@@ -228,26 +242,63 @@ export function checkIgnoredBallast(repoRoot, ballastMb = DEFAULT_BALLAST_MB) {
   return findings;
 }
 
+// Ceiling on operands per `du` call. Every path is one argv entry and macOS
+// caps argv+environment at ARG_MAX = 1 048 576 bytes; 500 paths stay far below
+// that even at ~1 KB each. Today: 298 ignored top-level entries in this repo
+// (2026-09-12) — one call. Revisit trigger: repos with more than ~5000 ignored
+// entries, where `git status --ignored` itself turns expensive — then move the
+// probe into a detached child with a cache (see the revisit note in
+// scripts/lib/session-start-probes.mjs).
+const DU_CHUNK_SIZE = 500;
+
+/** @param {string} p */
+function stripTrailingSlash(p) {
+  return p.replace(/\/+$/, '');
+}
+
 /**
- * Directory/file size in bytes via `du -sk`, or null when unavailable.
- * `du` is POSIX and present on macOS and Linux; Windows yields null, which
- * degrades the ballast check to a silent skip rather than a crash.
- * @param {string} absPath
- * @returns {number|null}
+ * Sizes of repo-relative paths in bytes via batched `du -sk`, one process per
+ * {@link DU_CHUNK_SIZE} paths instead of one per path (spawn overhead was the
+ * whole cost: 298 single calls 0.685 s vs. one batched call 0.051 s).
+ *
+ * Keys are the paths without trailing slash; a path absent from the map could
+ * not be sized. `du` exits non-zero when ANY operand vanished or is unreadable
+ * but still sizes the rest on stdout, so that stdout is parsed rather than
+ * discarded — otherwise one bad path would silence the whole ballast check.
+ * No `du` at all (Windows) yields an empty map: a silent skip, not a crash.
+ * `-l` keeps parity with the old per-path measurement: without it a batched
+ * `du` counts an inode shared by hard links only under the FIRST operand
+ * (pnpm `node_modules/` pointing into one store → the later ones read ~0).
+ * BSD and GNU `du` both define `-l` as "count sizes many times if hard linked".
+ * @param {string} repoRoot
+ * @param {string[]} relPaths porcelain paths relative to repoRoot
+ * @returns {Map<string, number>}
  */
-function duBytes(absPath) {
-  try {
-    if (!existsSync(absPath)) return null;
-    const out = execFileSync('du', ['-sk', absPath], {
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: 10_000,
-    });
-    const kb = Number(out.trim().split(/\s+/)[0]);
-    return Number.isFinite(kb) ? kb * 1024 : null;
-  } catch {
-    return null;
+function duBytesBatch(repoRoot, relPaths) {
+  const sizes = new Map();
+  const existing = relPaths.filter((p) => existsSync(join(repoRoot, p)));
+  for (let i = 0; i < existing.length; i += DU_CHUNK_SIZE) {
+    const chunk = existing.slice(i, i + DU_CHUNK_SIZE);
+    let out;
+    try {
+      out = execFileSync('du', ['-skl', '--', ...chunk], {
+        cwd: repoRoot,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+        timeout: 30_000,
+      });
+    } catch (err) {
+      out = typeof err?.stdout === 'string' ? err.stdout : '';
+    }
+    for (const line of out.split('\n')) {
+      const tab = line.indexOf('\t');
+      if (tab <= 0) continue;
+      const kb = Number(line.slice(0, tab));
+      if (!Number.isFinite(kb)) continue;
+      sizes.set(stripTrailingSlash(line.slice(tab + 1)), kb * 1024);
+    }
   }
+  return sizes;
 }
 
 /**

package/scripts/lib/quality-gate.mjs

@@ -65,6 +65,7 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { emitEvent, sessionAttribution } from './events.mjs';
+import { parsePorcelainZ } from './git-porcelain.mjs';
 import { admitSuiteCounts, extractTestCounts } from './gates/gate-helpers.mjs';
 import { redactDiagnosticsBundle } from './quality-gate/diagnostics.mjs';
 import { readProcessLocalSessionIds } from './session-identity/own-session.mjs';
@@ -117,16 +118,18 @@ function resolveRepoRoot(explicit) {
  * Closed set of `degraded` reasons for {@link loadCommandsFromSessionConfigDetailed}.
  *
  * Its own enum, deliberately not shared with `ci-status-banner.mjs`'s
- * `DEGRADED_REASONS`: the members below are exactly the three ways THIS
+ * `DEGRADED_REASONS`: the members below are the ways THIS
  * config-read can fail, and an enum whose members are not exhaustively
  * reachable cannot be switched on exhaustively.
  *
+ *   - `invalid-repo-root` — no non-blank string root was supplied.
  *   - `script-missing` — `scripts/parse-config.mjs` is not on disk.
  *   - `spawn-failed`   — the subprocess exited non-zero, timed out, or wrote
  *                        nothing to stdout.
  *   - `parse-error`    — stdout was not parseable JSON (or the read threw).
  */
 export const CONFIG_READ_DEGRADED_REASONS = Object.freeze([
+  'invalid-repo-root',
   'script-missing',
   'spawn-failed',
   'parse-error',
@@ -168,13 +171,18 @@ function sessionConfigFileExists(repoRoot) {
  * `degraded` is OMITTED, not set to null, on the success path, so a strict
  * `toEqual({commands: {…}})` pin holds for every readable config.
  *
- * Never throws.
+ * Requires an explicit, non-blank repository root; callers that intend cwd
+ * must resolve that default before invoking this loader. Never throws.
  *
  * @param {string} repoRoot
  * @returns {{commands: {lint?: string, typecheck?: string, test?: string},
- *            degraded?: 'script-missing'|'spawn-failed'|'parse-error'}}
+ *            degraded?: 'invalid-repo-root'|'script-missing'|'spawn-failed'|'parse-error'}}
  */
 export function loadCommandsFromSessionConfigDetailed(repoRoot) {
+  // Node inherits cwd for undefined/null, which would read another repo's config.
+  if (typeof repoRoot !== 'string' || !repoRoot.trim()) {
+    return { commands: {}, degraded: 'invalid-repo-root' };
+  }
   try {
     const scriptPath = join(
       dirname(fileURLToPath(import.meta.url)),
@@ -229,9 +237,9 @@ export function loadCommandsFromSessionConfigDetailed(repoRoot) {
  * Returns a partial object — keys that fail to resolve are simply absent
  * (the caller falls through to DEFAULT_COMMANDS for those).
  *
- * Thin wrapper over {@link loadCommandsFromSessionConfigDetailed}; byte-identical
- * return value for every input, including every failure path. Callers that need
- * to tell a failed read from an empty config use the detailed variant.
+ * Returns the commands half of {@link loadCommandsFromSessionConfigDetailed},
+ * including an empty object for an invalid root. Callers that need to tell a
+ * failed read from an empty config use the detailed variant.
  *
  * Never throws.
  *
@@ -277,6 +285,11 @@ function resolveCommands(override, repoRoot) {
  */
 function runGate(cmd, cwd) {
   try {
+    // Gate commands are executable configuration from the caller or local
+    // Session Config, not data interpolated into a command template. Shell
+    // syntax is intentional; callers must trust both command sources (including
+    // uncommitted config). See security.md: Session Config Command Trust.
+    // nosemgrep: unsafe-shell-spawn
     const result = spawnSync(cmd, {
       cwd,
       shell: true,
@@ -284,6 +297,14 @@ function runGate(cmd, cwd) {
       stdio: ['ignore', 'pipe', 'pipe'],
       timeout: GATE_TIMEOUT_MS,
       maxBuffer: 16 * 1024 * 1024, // 16 MiB cap
+      // #1360: gate runs are where worker over-subscription was measured to
+      // cause timeout failures (integration fixtures spawn their own Node/npm/
+      // git children on top of Vitest's workers). `vitest.config.mjs` reads this
+      // flag and bounds `maxWorkers`; a bare `npm test` never sets it and keeps
+      // Vitest's default fanout, which measured 59% faster on an idle host.
+      // Inherited by every gate subprocess, not only the test one — typecheck
+      // and lint ignore it, so setting it unconditionally costs nothing.
+      env: { ...process.env, SO_BOUNDED_WORKERS: '1' },
     });
     const combined = (result.stdout ?? '') + (result.stderr ?? '');
     const tail = combined.split('\n').slice(-OUTPUT_TAIL_LINES).join('\n').trim();
@@ -345,71 +366,6 @@ function writeLastGreenSha(repoRoot) {
   }
 }
 
-/**
- * Parse `git status --porcelain -z` stdout into repo-root-relative paths.
- *
- * `-z` is not a convenience flag here — it is the only shape of this command
- * whose paths are unambiguous. Measured 2026-08-23 (git 2.53.0) on a fixture
- * carrying a space, a non-ASCII name, a literal `"` and a rename:
- *
- * ```
- *   git status --porcelain            git status --porcelain -z
- *   ------------------------------    ---------------------------------
- *    M "scripts/lib/old name.mjs"      M scripts/lib/old name.mjs
- *    M "scripts/lib/\303\274ml.mjs"    M scripts/lib/üml.mjs
- *   ?? "scripts/lib/quo\"te.mjs"      ?? scripts/lib/quo"te.mjs
- *   R  old.mjs -> new.mjs             R  new.mjs \0 old.mjs
- * ```
- *
- * The non-`-z` form C-quotes any path containing a space, a `"` or — under the
- * default `core.quotePath=true` — a non-ASCII byte. `-c core.quotePath=false`
- * repairs only the non-ASCII third of that (measured: the space and the `"`
- * stayed quoted). A field-splitting parser over the non-`-z` form fails three
- * separate ways on one input — measured `awk '{print $2}'` output for the four
- * lines above: `"scripts/lib/old` (truncated at the space), the undecoded
- * `\303\274` octal escape, and `old.mjs` (the PRE-rename path) for the `R`
- * line. `-z` emits every path verbatim, so there is no unquoting step to get
- * wrong.
- *
- * Rename/copy entries carry their ORIGINAL path as the NEXT NUL field, with NO
- * `XY ` prefix. Consuming that extra field is mandatory, not optional: a naive
- * per-field `slice(3)` would emit `.mjs`-suffixed garbage (`d.mjs` for
- * `old.mjs`) as if it were a real path. Both paths are kept — a file moved OUT
- * of `scripts/lib/` is as much a shared-lib touch as one moved in, and a fixer
- * needs the old path to make sense of the new one. `R`/`C` are checked in BOTH
- * status columns because git-status(1) documents `R `/`C ` (renamed/copied in
- * index) as well as ` R`/` C` (renamed/copied in work tree).
- *
- * Untracked DIRECTORIES are not a case this parser has to handle: the caller
- * passes `-uall`, which expands them to individual files (measured: `?? nd/`
- * became `?? nd/a.mjs` + `?? nd/b.mjs`).
- *
- * @param {string} raw — raw stdout of `git status --porcelain -z …`.
- * @returns {string[]} repo-root-relative paths, in git's emission order.
- */
-function parsePorcelainZ(raw) {
-  const fields = String(raw ?? '').split('\0');
-  const paths = [];
-  for (let i = 0; i < fields.length; i += 1) {
-    const entry = fields[i];
-    // `XY P` is the shortest well-formed entry. Anything shorter — including
-    // the empty trailing field `split` always produces — is not an entry
-    // header, and the `[2] === ' '` check rejects a stray original-path field
-    // that a malformed stream could leave unconsumed.
-    if (typeof entry !== 'string' || entry.length < 4 || entry[2] !== ' ') continue;
-    const filePath = entry.slice(3);
-    if (filePath) paths.push(filePath);
-    const x = entry[0];
-    const y = entry[1];
-    if (x === 'R' || x === 'C' || y === 'R' || y === 'C') {
-      i += 1;
-      const original = fields[i];
-      if (typeof original === 'string' && original) paths.push(original);
-    }
-  }
-  return paths;
-}
-
 /**
  * Files that differ between `baseRef` and `HEAD` — the COMMITTED half of the
  * change set. Best-effort: `[]` on any git failure.

package/scripts/lib/reconcile/engine.mjs

@@ -896,12 +896,23 @@ const KNOWN_TARGETS = ['repo-local', 'baseline'];
  * target list). `aborted`/`reason` appear only when the never-throws guard
  * fired; their absence means "ran to the end", never "unknown".
  *
+ * `candidate_store_merged` says the `reconcile-candidates.jsonl` idempotency
+ * sidecar was merged — the engine's ONLY disk write. It is NOT a rule-write
+ * signal: this event is emitted before the operator-approval AUQ and the engine
+ * never touches `.claude/rules/`. For "a rule reached `.claude/rules/`" read
+ * `orchestrator.reconcile.rules_written`. The legacy alias `written` carries the
+ * same boolean until 2027-03-13 (#1315).
+ *
  * @param {ReconcileResult} result
  * @param {{ trigger?: string, targets?: string[], dryRun?: boolean, durationMs: number }} ctx
  * @returns {Record<string, unknown>}
  */
 function buildReconcilePayload(result, ctx) {
   const summary = (result && result.summary) || {};
+  // `summary.written` is the `reconcile-candidates.jsonl` SIDECAR merge flag —
+  // the engine's only disk write. Named `candidate_store_merged` in the payload
+  // since #1315; the local const keeps both emitted keys on one source.
+  const candidateStoreMerged = summary.written === true;
   /** @type {Record<string, unknown>} */
   const payload = {
     trigger: typeof ctx.trigger === 'string' && ctx.trigger.trim() !== '' ? ctx.trigger : 'unknown',
@@ -912,7 +923,14 @@ function buildReconcilePayload(result, ctx) {
     rejected: summary.rejected ?? 0,
     capped: summary.capped ?? 0,
     already_materialized: summary.alreadyMaterialized ?? 0,
-    written: summary.written === true,
+    candidate_store_merged: candidateStoreMerged,
+    // @deprecated `written` — renamed to `candidate_store_merged` (#1315) because
+    // the old name read as "rule files were written", which this engine never does.
+    // Kept for one generation so existing readers keep working, per the
+    // `orchestrator.session.stopped` → `orchestrator.turn.stopped` precedent
+    // (#1234). REMOVAL: 2027-03-13. Written from the SAME expression as the new
+    // key, so the two can never disagree.
+    written: candidateStoreMerged,
     duration_ms: ctx.durationMs,
   };
   // `targets` originates in operator-authored Session Config (`reconcile.targets`)