session-orchestrator 5.0.0 → 5.2.0

package/hooks/_lib/hook-import-set.json

@@ -1,6 +1,6 @@
 {
-  "generated_at": "2026-09-13T09:10:50.839Z",
-  "head": "ff1ed19177795b743186eebfc387319de0e90c31",
+  "generated_at": "2026-09-16T17:00:47.173Z",
+  "head": "1ef26415ce80164bd7e27705a4e7d97c37c72126",
   "entries": [
     {
       "file": "hooks/_lib/atomic-json.mjs",
@@ -268,7 +268,8 @@
       "reachable_from": [
         "on-session-end.mjs",
         "on-session-start.mjs",
-        "post-edit-validate.mjs"
+        "post-edit-validate.mjs",
+        "skill-invocation-telemetry.mjs"
       ]
     },
     {
@@ -358,6 +359,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -381,6 +383,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -660,6 +663,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -699,6 +703,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -838,7 +843,8 @@
         "post-tool-batch-wave-signal.mjs",
         "post-tooluse-frontend-slop.mjs",
         "pre-auq-clarity.mjs",
-        "pre-bash-memory-propose-audit.mjs"
+        "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs"
       ]
     },
     {
@@ -859,7 +865,8 @@
         "post-tool-batch-wave-signal.mjs",
         "post-tooluse-frontend-slop.mjs",
         "pre-auq-clarity.mjs",
-        "pre-bash-memory-propose-audit.mjs"
+        "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs"
       ]
     },
     {
@@ -882,6 +889,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -990,6 +998,16 @@
         "skill-invocation-telemetry.mjs"
       ]
     },
+    {
+      "file": "scripts/lib/is-main-module.mjs",
+      "reachable_from": [
+        "enforce-scope.mjs",
+        "on-session-end.mjs",
+        "on-session-start.mjs",
+        "pre-task-scope-disjoint.mjs",
+        "skill-invocation-telemetry.mjs"
+      ]
+    },
     {
       "file": "scripts/lib/issue-budget.mjs",
       "reachable_from": [
@@ -1024,6 +1042,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -1047,6 +1066,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -1070,6 +1090,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -1196,6 +1217,12 @@
         "on-session-start.mjs"
       ]
     },
+    {
+      "file": "scripts/lib/scope-echo.mjs",
+      "reachable_from": [
+        "pre-task-scope-disjoint.mjs"
+      ]
+    },
     {
       "file": "scripts/lib/scope-gate.mjs",
       "reachable_from": [
@@ -1244,7 +1271,8 @@
         "post-tool-batch-wave-signal.mjs",
         "post-tooluse-frontend-slop.mjs",
         "pre-auq-clarity.mjs",
-        "pre-bash-memory-propose-audit.mjs"
+        "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs"
       ]
     },
     {
@@ -1267,6 +1295,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -1290,6 +1319,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -1431,6 +1461,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -1462,6 +1493,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -1527,6 +1559,14 @@
         "skill-invocation-telemetry.mjs"
       ]
     },
+    {
+      "file": "scripts/lib/user-invocable-skills.mjs",
+      "reachable_from": [
+        "on-session-end.mjs",
+        "on-session-start.mjs",
+        "skill-invocation-telemetry.mjs"
+      ]
+    },
     {
       "file": "scripts/lib/wave-context.mjs",
       "reachable_from": [

package/hooks/_lib/subagent-paths.mjs

@@ -21,6 +21,21 @@
  * override completely unvalidated. That containment check is a NEW rule this
  * consolidation introduces, not a preserved behaviour.
  *
+ * MEASURED NON-DEFECT (2026-09-16, #1289 Befund 2). The ~90 %
+ * `transcript_found:false` rate on `orchestrator.agent.stopped` is NOT a defect
+ * of this derivation. Over 15.457 records: 0 of 5077 distinct false `agent_id`s
+ * have a sidecar anywhere on the host (8626 sidecar ids found via
+ * `find ~/.claude/projects -path '*subagents/agent-*.jsonl'`), 0 have a
+ * `SubagentStart` record, and 0 records carrying a valid id got a null result
+ * from this function — the false mass is the #939/#949 phantom-stop class (the
+ * harness fires SubagentStop for an ephemeral class that never existed; the
+ * evidence is in the header of hooks/subagent-telemetry.mjs). Driving this
+ * resolver with the 30 newest real false-case payloads resolves 0/30 because the
+ * file does not exist, while the 30 newest true-case payloads resolve 26/30 (the
+ * other 4 are aged-out transcripts of 2026-09-13 sessions). Widening the
+ * derivation — a directory scan, a nested `subagents/` fallback, an unbounded id
+ * — would resolve onto a FOREIGN agent's sidecar without recovering one record.
+ *
  * @module hooks/_lib/subagent-paths
  */
 

package/hooks/_lib/vcs-create-matcher.mjs

@@ -96,28 +96,25 @@
  *     triage of a per-session counter file
  *     (`.orchestrator/runtime/issue-budget/<hash>.json`, #1141) or in a
  *     transcript census of real create calls.
- *   - An `xargs`-driven create is NOT matched, and `xargs` is deliberately not
- *     a transparent wrapper: `command-blocker.mjs` classes it as an INTERPRETER
- *     (`SHELL_EXEC_INTERPRETERS`), because unwrapping it there would LOOSEN the
- *     destructive-command guard that shares this lexer. Measured 2026-09-09
- *     against this file — all four shapes yield 0 statements, so neither the
- *     cap nor the loop-deny sees them:
- *
- *         xargs glab issue create --title X                          → 0
- *         echo X | xargs -I% glab issue create --title %             → 0
- *         seq 1 50 | xargs -I% gh api -X POST …/issues -f title=%    → 0
- *         xargs -n1 glab issue create                                → 0
- *
- *     Widening this one shape means changing what `resolveSegmentVerb` reports
- *     for `xargs` — read by the four OTHER consumers of that resolver
- *     (`grep -rln resolveSegmentVerb scripts/ hooks/`, 2026-09-09:
- *     `scripts/lib/project-hygiene.mjs`, `scripts/lib/scope-gate.mjs`,
- *     `hooks/pre-bash-sessions-ledger-guard.mjs`,
- *     `hooks/pre-bash-destructive-guard.mjs`) — so it is a deliberate
- *     cross-consumer change, never a local patch here.
- *     Pinned by `tests/hooks/vcs-create-matcher.test.mjs`. Revisit when an
- *     `xargs`-driven create shows up in a transcript census or in the overflow
- *     triage of a per-session counter file.
+ *   - An `xargs`-driven create IS matched since #1289 — but LOCALLY, in
+ *     {@link xargsDrivenRemainder}, never by changing what `resolveSegmentVerb`
+ *     reports for `xargs`. That resolver still answers `verb: 'xargs'`, because
+ *     `command-blocker.mjs` classes `xargs` as an INTERPRETER
+ *     (`SHELL_EXEC_INTERPRETERS`) and unwrapping it there would LOOSEN the
+ *     destructive-command guard the five positional consumers of that resolver
+ *     share. Measured 2026-09-16 against this file — the four shapes that
+ *     yielded 0 statements before now yield 1 each, flagged `bulk: true`:
+ *
+ *         xargs glab issue create --title X                          → 1
+ *         echo X | xargs -I% glab issue create --title %             → 1
+ *         seq 1 50 | xargs -I% gh api -X POST …/issues -f title=%    → 1
+ *         xargs -n1 glab issue create                                → 1
+ *
+ *     A `bulk` statement is never CHARGED: the multiplicity comes from the
+ *     stdin word list and is unknowable before the shell runs, so
+ *     `hooks/pre-bash-issue-budget.mjs` treats it exactly like a loop body —
+ *     deny in `strict`, report the undercount in `warn`. The remaining ceiling
+ *     is the option grammar, named at {@link xargsDrivenRemainder}.
  *   - A paren glued to the verb (`(glab issue create …)`) is not reached: it
  *     lexes as the single word `(glab`. This is `command-blocker.mjs`'s own
  *     named ceiling on `COMMAND_POSITION_KEYWORDS` (#1145), inherited here
@@ -164,7 +161,14 @@ export const CREATE_REGEX = /^\s*(gh|glab)\s+(pr|mr|issue)\s+(create|new)\b/;
 function statementsOf(command) {
   if (typeof command !== 'string' || command.length === 0) return [];
   try {
-    return splitChainSegments(tokenizeCommand(command));
+    const segments = splitChainSegments(tokenizeCommand(command));
+    const out = [];
+    for (const segment of segments) {
+      out.push(segment);
+      const rest = xargsDrivenRemainder(segment);
+      if (rest !== null) out.push(rest);
+    }
+    return out;
   } catch {
     // Fail OPEN, matching every other error path in the two consuming hooks:
     // a lexer that throws must not wedge every Bash call. Worst case is a
@@ -173,6 +177,64 @@ function statementsOf(command) {
   }
 }
 
+/**
+ * xargs' own options, split by whether they consume a SEPARATE next token.
+ * Both the separated (`-n 1`) and the attached (`-n1`, `-I%`) spellings are
+ * handled — the attached form is what agents actually write.
+ */
+const XARGS_VALUE_FLAGS = new Set(['-I', '-i', '-n', '-P', '-L', '-s', '-E', '-d', '-a']);
+
+/**
+ * The UTILITY xargs drives, as an additional statement — or `null` when the
+ * segment is not an `xargs` call, or nothing follows its options (#1289).
+ *
+ * ## Why here and not in the shared lexer
+ *
+ * `command-blocker.mjs` classes `xargs` as an INTERPRETER, deliberately NOT a
+ * transparent wrapper: unwrapping it there would resolve past it for the FIVE
+ * positional consumers of `resolveSegmentVerb` and LOOSEN the destructive-command
+ * guard. So the widening stays local to this matcher, where the only question is
+ * "does this command file issues?" — the shared verb resolution is untouched,
+ * and `resolveSegmentVerb` still reports `verb: 'xargs'`.
+ *
+ * The returned array carries a non-index `xargsDriven` marker so
+ * {@link findIssueCreateStatements} can flag the statement `bulk: true`: the
+ * multiplicity is set by the STDIN word list, which does not exist at hook time,
+ * so such a create can never be charged — only denied or reported.
+ *
+ * NAMED CEILING (BV-004): only the option spellings in `XARGS_VALUE_FLAGS` plus
+ * bare boolean/unknown short flags are skipped. A SEPARATED long form
+ * (`--max-args 5`) leaves its operand in verb position, so the remainder does not
+ * match a create shape and the call is missed — the pre-#1289 behaviour, i.e. an
+ * under-report, never a false deny. REVISIT TRIGGER: a separated-long-form xargs
+ * create in a transcript census.
+ *
+ * @param {Array<{ text: string, quoted: boolean }>} segment
+ * @returns {Array<{ text: string, quoted: boolean }>|null}
+ */
+function xargsDrivenRemainder(segment) {
+  if (segment.length === 0) return null;
+  const head = segment[0];
+  if (head.quoted || head.text.replace(/^.*\//, '') !== 'xargs') return null;
+
+  let i = 1;
+  while (i < segment.length) {
+    const tok = segment[i];
+    if (tok.quoted) break; // a quoted word is the utility, never an option
+    const text = tok.text;
+    if (text === '--') { i++; break; }
+    if (!text.startsWith('-') || text === '-') break;
+    if (XARGS_VALUE_FLAGS.has(text)) { i += 2; continue; } // separated: `-n 1`
+    if (XARGS_VALUE_FLAGS.has(text.slice(0, 2))) { i += 1; continue; } // attached: `-I%`
+    i += 1; // boolean (`-0`, `-r`, `-t`) or an unknown flag
+  }
+
+  const rest = segment.slice(i);
+  if (rest.length === 0) return null;
+  rest.xargsDriven = true;
+  return rest;
+}
+
 /**
  * `--help` short-circuits a cobra command (both `gh` and `glab` are cobra
  * CLIs): the help text is printed and the command body never runs, so
@@ -609,13 +671,19 @@ export function findIssueCreateStatements(command) {
       continue;
     }
     literalCatPaths ??= singleQuotedCatPaths(command);
-    out.push({
+    const statement = {
       shape,
       tokens,
       text: tokens.map((t) => t.text).join(' '),
       ...fieldsFromTokens(tokens, shape, literalCatPaths),
       cwdChanged,
-    });
+    };
+    // `bulk` — the create files an UNKNOWN number of issues (#1289). Today the
+    // only source is an `xargs`-driven statement, whose multiplicity is the
+    // stdin word list; the key is present ONLY when true, so every existing
+    // consumer of this shape is unaffected.
+    if (tokens.xargsDriven === true) statement.bulk = true;
+    out.push(statement);
   }
   return out;
 }
@@ -689,6 +757,124 @@ export function isIssueCreate(command) {
   return matchVcsCreate(command)?.kind === 'issue';
 }
 
+/**
+ * EVERY issue-create STATEMENT that sits inside a LOOP BODY — one token array
+ * per implicated loop, `[]` when none (#1145, #1379).
+ *
+ * Returning the statements rather than a boolean is what lets the consuming hook
+ * bind the CAP EXEMPTION to the statement that CAUSED the bulk classification.
+ * Measured 2026-09-16 against `hooks/pre-bash-issue-budget.mjs` before this
+ * change, which classified the exemption on `statements[0]`:
+ *
+ *     for i in 1 2 3; do glab issue create --title junk$i; done
+ *       → DENY
+ *     glab issue create --title "[Carryover] real"; for i in 1 2 3; do \
+ *       glab issue create --title junk$i; done
+ *       → ALLOW
+ *
+ * The second command files an unknowable number of UNTEMPLATED issues, lifted
+ * by an unrelated neighbour's exemption. That is `.claude/rules/guard-design.md`
+ * § "Widening a matcher without narrowing its bypass" (#1106 class) in the
+ * exemption lane instead of the bypass lane — same shape, same fix: judge the
+ * exemption on the statement the gate fired on, never on a sibling.
+ *
+ * Each element is the segment the loop-depth scan implicated, so the caller can
+ * rebuild its classification text exactly as {@link findIssueCreateStatements}
+ * does (`tokens.map((t) => t.text).join(' ')`).
+ *
+ * ## Why ALL of them, not the first (#1379)
+ *
+ * The 2026-09-16 scan below collected every candidate head but `return`ed on
+ * the first one found at `depth > 0`. Since the consuming hook classifies the
+ * cap exemption PER bulk statement, reporting one loop for a two-loop command
+ * means an EXEMPT first loop is the only loop judged and every later loop goes
+ * unexamined. Reproduced 2026-09-17 @ `9e8146b4` against the live hook in a
+ * strict-mode throwaway repo:
+ *
+ *     for i in 1 2 3; do glab issue create --label carryover --title x$i; done;
+ *     for j in 1 2 3; do glab issue create --title junk$j; done
+ *       → ALLOW, ledger count=1 exempt=1   (must DENY)
+ *
+ * Same class as the exemption-binding fix this docblock already describes, one
+ * level up: judging the exemption on ONE of several bulk statements is the same
+ * defect as judging it on a sibling.
+ *
+ * @param {string} command
+ * @returns {Array<Array<{ text: string, quoted: boolean }>>} one entry per loop
+ */
+export function findLoopedIssueCreates(command) {
+  if (typeof command !== 'string' || command.length === 0) return [];
+
+  let tokens;
+  let segments;
+  try {
+    tokens = tokenizeCommand(command);
+    segments = splitChainSegments(tokens);
+  } catch {
+    return []; // fail OPEN, same posture as statementsOf
+  }
+
+  // EVERY issue-create statement is a candidate, keyed by its HEAD token's
+  // object identity — the position in the raw stream at which the loop depth
+  // must be read.
+  //
+  // Until 2026-09-16 this considered only the FIRST create statement of ANY
+  // kind and then checked its `kind`, mirroring the pre-#1163 hook whose G3 was
+  // a single `isIssueCreate(command)` boolean. That mirror is obsolete and was
+  // a MISS: since #1163 the hook judges EVERY statement via
+  // {@link findIssueCreateStatements}, and the old first-only scan reported
+  // `false` for any command whose first create sits outside the loop. Measured
+  // 2026-09-16 against HEAD:
+  //
+  //     glab issue create --title "[Carryover] real"; for i in 1 2 3; do \
+  //       glab issue create --title junk$i; done          → false (should be true)
+  //     glab mr create --title m; for i in 1 2; do \
+  //       glab issue create --title j; done               → false (should be true)
+  //     for i in 1 2 3; do glab issue create --title j; done → true
+  //
+  // The first shape files an unknowable number of issues and was ALLOWED by the
+  // budget gate. Scanning all candidates is the fail-CLOSED direction and no
+  // longer disagrees with the hook about which statements exist.
+  const createHeads = new Map();
+  for (const seg of segments) {
+    const shape = matchStatement(seg);
+    if (shape && shape.kind === 'issue') createHeads.set(seg[0], seg);
+  }
+  if (createHeads.size === 0) return [];
+
+  const kept = new Set(segments.flat());
+  const found = [];
+  let depth = 0;
+  for (const tok of tokens) {
+    // A create head at depth 0 is a create AFTER (or BEFORE) a loop, not inside
+    // one: `while x; do echo a; done; glab issue create` stays unimplicated.
+    if (createHeads.has(tok)) {
+      if (depth > 0) found.push(createHeads.get(tok));
+      continue;
+    }
+    if (tok.quoted || kept.has(tok)) continue; // an argument, or a separator
+    if (tok.text === 'do') depth += 1;
+    else if (tok.text === 'done' && depth > 0) depth -= 1;
+  }
+  return found;
+}
+
+/**
+ * The FIRST looped issue-create statement, or `null`.
+ *
+ * @deprecated since #1379 — use {@link findLoopedIssueCreates}, which reports
+ * EVERY implicated loop. A caller that classifies anything per loop (a cap
+ * exemption, a per-loop deny reason) is WRONG on this API for a command with
+ * two loops; kept only because this module has no `exports` map, so every
+ * export is a public entrypoint a consumer may already import.
+ *
+ * @param {string} command
+ * @returns {Array<{ text: string, quoted: boolean }>|null}
+ */
+export function findLoopedIssueCreate(command) {
+  return findLoopedIssueCreates(command)[0] ?? null;
+}
+
 /**
  * True when the matched issue-create statement sits inside a LOOP BODY, i.e.
  * the command creates an unknown number of issues (#1145).
@@ -730,47 +916,16 @@ export function isIssueCreate(command) {
  * to charging 1 for N. The unit test `tests/hooks/vcs-create-matcher.test.mjs`
  * pins the coupling directly. Revisit if that set is ever narrowed.
  *
+ * Boolean wrapper over {@link findLoopedIssueCreates} — kept as the named
+ * question for callers that only need the FACT (and for the sibling suites that
+ * pin it). A caller that must classify the cap exemption asks for the STATEMENT
+ * instead; see that function's docblock for why the distinction is load-bearing.
+ *
  * @param {string} command
  * @returns {boolean} false when the command has no issue-create statement at all
  */
 export function isLoopedIssueCreate(command) {
-  if (typeof command !== 'string' || command.length === 0) return false;
-
-  let tokens;
-  let segments;
-  try {
-    tokens = tokenizeCommand(command);
-    segments = splitChainSegments(tokens);
-  } catch {
-    return false; // fail OPEN, same posture as statementsOf
-  }
-
-  // The create statement's HEAD token, by object identity — the position in the
-  // raw stream at which the loop depth must be read.
-  //
-  // Deliberately the FIRST create statement of any kind, then a kind check —
-  // exactly what isIssueCreate() does via matchVcsCreate(). Searching for the
-  // first ISSUE create instead would diverge on `glab mr create … ; glab issue
-  // create …`: the hook's G3 would look at the mr, this at the issue, and the
-  // two would disagree about which statement they are judging.
-  let headTok = null;
-  for (const seg of segments) {
-    const shape = matchStatement(seg);
-    if (!shape) continue;
-    if (shape.kind === 'issue') headTok = seg[0];
-    break;
-  }
-  if (!headTok) return false;
-
-  const kept = new Set(segments.flat());
-  let depth = 0;
-  for (const tok of tokens) {
-    if (tok === headTok) return depth > 0;
-    if (tok.quoted || kept.has(tok)) continue; // an argument, or a separator
-    if (tok.text === 'do') depth += 1;
-    else if (tok.text === 'done' && depth > 0) depth -= 1;
-  }
-  return false;
+  return findLoopedIssueCreates(command).length > 0;
 }
 
 /**

package/hooks/enforce-scope.mjs

@@ -529,7 +529,48 @@ async function main() {
   // Coordinator carveout (#245): exact-path allowlist for harness-owned files.
   // STATE.md and wave-scope.json are written by the coordinator between waves;
   // per-wave allowedPaths lists should not need to enumerate harness infrastructure.
-  if (isCoordinatorCarveout(normalizedRel, projectRoot, scopePath)) {
+  //
+  // CALLER DISCRIMINATION (#1361) — the carve-out is the COORDINATOR's, exactly
+  // as Gate 5c's is (#1352), and for a sharper reason: the two files it covers
+  // are the harness's own control surfaces. STATE.md is coordinator-owned by
+  // contract (`skills/_shared/state-ownership.md`), and `wave-scope.json` IS the
+  // manifest every later gate of this wave reads — a subagent permitted to write
+  // it can rewrite its own file scope and disarm the guard for the rest of the
+  // wave. A `'subagent'` therefore falls through to Gate 7, where a manifest that
+  // does not grant the path is a DENY.
+  //
+  // ALLOW-CENSUS (RCR-007, the precondition for forbidding what is allowed
+  // today): 1069 transcripts across 46 sessions of this repo carried 4385
+  // subagent writes; 0 targeted a carve-out path (2026-09-13 @ `5501f700`). The
+  // fix takes nothing away from any observed legitimate writer.
+  //
+  // FAIL-OPEN on ambiguity, same as Gate 5c and for the same reason: the other
+  // three classifications keep the ALLOW, because fail-closed would deny the
+  // coordinator's own `/close` STATE.md writes. The classification is emitted so
+  // that fail-open stays COUNTABLE (HR-105) — before #1361 this branch called
+  // `emitAllow()` (`process.exit(0)`, no log, no event), so whether it ever fired
+  // was unfalsifiable after the fact.
+  const carveoutCaller = classifyCaller(input);
+  if (carveoutCaller !== 'subagent' && isCoordinatorCarveout(normalizedRel, projectRoot, scopePath)) {
+    // One event per decision point, awaited before emitAllow() — emitAllow()
+    // calls process.exit(), which would discard a pending append.
+    try {
+      const { emitEvent } = await import('../scripts/lib/events.mjs');
+      await emitEvent(
+        'orchestrator.scope.coordinator_carveout_allowed',
+        {
+          hook: HOOK_NAME,
+          manifest: scopePath,
+          wave: scope.wave,
+          // Repo-RELATIVE by choice: the carve-out set is in-repo by
+          // construction, so the relative form carries the whole decision
+          // without putting a host-local absolute path into the ledger.
+          file_path: normalizedRel,
+          discriminator: carveoutCaller,
+        },
+        { repoRoot: projectRoot },
+      );
+    } catch { /* observability is best-effort — never blocks the decision */ }
     return emitAllow();
   }
 

package/hooks/hooks-codex.json

@@ -7,7 +7,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "echo '🎯 Session Orchestrator v5.0.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
+            "command": "echo '🎯 Session Orchestrator v5.2.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
             "async": false
           },
           {

package/hooks/hooks.json

@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "echo '🎯 Session Orchestrator v5.0.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
+            "command": "echo '🎯 Session Orchestrator v5.2.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
             "async": false
           },
           {

package/hooks/on-session-end.mjs

@@ -618,8 +618,20 @@ async function main() {
   //     Dead-by-age relaxation (relaxDeadByAge/assumeDeadBeforeMs, #731 — used by the
   //     historical migration CLI) is NEVER passed here: a foreign lock that is live
   //     at hook-time is, by definition, a real active session, not stale history.
+  //     `ownSessionIsEnding` (#1376) rides the SAME `isRecordedSession`
+  //     attestation as `duration_ms` / `semantic_session_id` above, for the
+  //     same reason: it is a claim made ON BEHALF of the recorded session, and
+  //     a foreign terminating window that inherited this repo's
+  //     `current-session.json` identity (#863 defect (b)) must never make it.
+  //     With the attestation false the core keeps its blanket own-live-lock
+  //     skip, so the #863 behaviour is preserved exactly where #863 applied.
   try {
-    const res = await backfillAbandonedSession({ repoRoot: projectRoot, sessionId, semanticSessionId });
+    const res = await backfillAbandonedSession({
+      repoRoot: projectRoot,
+      sessionId,
+      semanticSessionId,
+      ownSessionIsEnding: isRecordedSession,
+    });
     await emitBackfillOutcome('abandoned', res, { sessionId, semanticSessionId });
   } catch { /* best-effort — never block teardown */ }
 
@@ -627,7 +639,7 @@ async function main() {
   //      above and to THIS session's own id: it reads STATE.md directly and
   //      repairs a PAST session whose `status: completed` was set (by hand or
   //      otherwise) without session-end's Phase 3.7 ever writing the matching
-  //      sessions.jsonl record — the exact state `commands/close.md`'s
+  //      sessions.jsonl record — the exact state `skills/close/SKILL.md`'s
   //      Pre-Check then reads as "already finalized" forever after. Cheap
   //      no-op on the overwhelmingly common path (STATE.md status is
   //      'active'/'paused'/'idle', or the record already exists).