session-orchestrator 5.1.0 → 5.2.0

package/docs/rule-authoring.md

@@ -112,7 +112,7 @@ Before `syncRules()` writes a source file into a consumer repo's `.claude/rules/
 
 | Probe | Severity | Rejects / flags |
 |-------|----------|------------------|
-| `paths-frontmatter` | error | A top-level `paths:` frontmatter key — `rule-loader.mjs` only recognises `globs:`; a `paths:` key is silently ignored and the rule loads always-on instead of the intended glob-scoped subset. |
+| `paths-frontmatter` | error | A top-level `paths:` frontmatter key **in a `rules/` library source**. Since #795 `rule-loader.mjs` accepts `paths:` as an alias for `globs:`, so such a rule IS glob-scoped — this is a vendoring-CONVENTION gate (`globs:` is the canonical form for vendored rules, #742), not a loader-compatibility gate. Its population is what `syncRules()` reads, i.e. `<pluginRoot>/rules/**` as listed by `rules/_index.md`; the consolidated files under `.claude/rules/` are `paths:`-canonical (see § Consolidated rules point 3) and are never its input. |
 | `provenance-header` | error (opt-in via `requireProvenance`, default `true` in `syncRules()`) | Missing provenance header on a library source — without it, `rules-sync.mjs` mis-detects the file as a local override on the next re-sync and can never update it again. |
 | `placeholder` | error | Unfilled placeholder tokens: `{{PROJECT_NAME}}`-style handlebars, a `## TODO: Customize` heading, or a `<!-- TODO:` comment — skeleton content, not a finished rule. |
 | `zero-match-globs` | warn | A `globs:` pattern matching 0 files in the target repo's tracked file list (`git ls-files`, falling back to a directory walk). Legitimately possible in a freshly-scaffolded repo. |
@@ -285,19 +285,25 @@ them silently loses a learning or regenerates it:
    TTL past what its type registry granted it.) State the rule in the file
    itself, so the next editor does not "fix" it upward.
 
-3. **Keep BOTH `globs:` and `paths:`, as byte-identical mirrors, each the
-   UNION of the parts.** The merged file loads for any path any of its parts
-   covered, so both lists are the union of theirs — never `globs:` alone.
-   `rule-loader.mjs` resolves `globs:` for wave-time injection, while Claude
-   Code's OWN native rule loader reads ONLY `paths:` and treats a rule
-   lacking it as unconditional, always-on (`check-rules.mjs` check #1108,
-   measured this session) — a `globs:`-only merged file is scoped everywhere
-   it is inspected and loads everywhere it is used, exactly the
-   instruction-budget failure consolidation exists to prevent. `rule-loader.mjs`
-   still resolves `globs:` and `paths:` with `globs:` winning SILENTLY when
-   both are present (issue #795, `parseGlobsFrontmatter`), but keeping the two
-   lists identical makes that precedence moot — there is no divergent value
-   left for it to pick between.
+3. **`paths:` is the canonical scope key, and it carries the UNION of the
+   parts.** The merged file loads for any path any of its parts covered, so its
+   list is the union of theirs. `paths:` is the key Claude Code's OWN native
+   rule loader reads, and it treats a rule lacking it as unconditional,
+   always-on (`check-rules.mjs` check #1108) — exactly the instruction-budget
+   failure consolidation exists to prevent. `globs:` is an accepted ALIAS, not a
+   second required mirror: `rule-loader.mjs` resolves either key
+   (`parseGlobsFrontmatter`, issue #795) and `instruction-budget-guard.mjs`
+   (`:960`) goes through that same parser, so a `paths:`-only file is
+   glob-scoped for every reader in this repo and still counts under
+   `bySurface.pathScoped`. Measured 2026-09-16 over the live tree
+   (`for f in .claude/rules/*.md; do awk '/^---$/{n++;next} n==1 && /^(paths|globs):/{print FILENAME": "$1}' "$f"; done`):
+   10 path-scoped rule files — 9 `paths:`-only, 1 (`cli-design.md`) carrying
+   both. `globs:` is canonical only for rules VENDORED OUT through the `rules/`
+   fleet library, where `validate-vendored-rules.mjs`'s `paths-frontmatter`
+   probe enforces it (issue #742); that probe judges `rules/` sources only and
+   never sees a consolidated file under `.claude/rules/`. Carrying both keys is
+   allowed, but NEVER with different values: `globs:` wins SILENTLY when both
+   are present (#795), and `check-rules.mjs` fails a divergent pair outright.
 
 4. **Substance in, boilerplate out.** Each absorbed learning becomes an `###`
    heading carrying its original rule sentence, plus its evidence line. What is
@@ -330,6 +336,69 @@ This writes `.orchestrator/runtime/reconcile-candidates.jsonl` (creating it if
 absent). Verify with a dry run: `alreadyMaterialized` must equal
 absorbed + dropped, not absorbed alone.
 
+#### The expiry sweep (`scripts/sweep-expired-rules.mjs`, #1377)
+
+`rule-loader.mjs` stops INJECTING a generated rule once its `expires-at` has
+passed; nothing removed one from disk, so an expired consolidated file stayed
+tracked, kept costing bytes against `generated-byte-ceiling`, and kept reading
+as live corpus to every human and every grep. The sweep
+(`scripts/lib/reconcile/rule-expiry-sweep.mjs`, CLI
+`node scripts/sweep-expired-rules.mjs`, `--dry-run` default) closes that gap
+under four contracts, all of them consequences of the four merge rules above:
+
+1. **Prose goes, the pair STAYS.** An expired entry's `###` block is deleted;
+   its provenance pair is converted to the `markers only` shape already present
+   in the corpus — a same-line HTML comment appended to the `- learning-id:`
+   bullet, leaving the backticked value regex-visible to
+   `BODY_LEARNING_ID_RE`. Per point 1, deleting the pair would make the
+   learning look unmaterialized and `/reconcile` would regenerate it. **A pair
+   is never deleted while its file survives.**
+
+2. **Two fail-open cases, both reported rather than guessed.** An entry carries
+   no date of its own; its date is recoverable only via `learning-id` →
+   `.orchestrator/metrics/learnings.jsonl` `expires_at` (measured 2026-09-17 @
+   `9e8146b4`: 87 of 92 unique ids resolve, 5 do not). An **unresolvable id**
+   keeps its entry and blocks the file delete. An **ambiguous file** — where the
+   `###` headings do not map 1:1 onto the non-`markers only` pairs, because
+   several learnings were merged into one prose entry — gets `action: 'keep'`
+   plus a `skipped` record with reason `no-1to1-mapping`. Measured the same day,
+   the 1:1 mapping held in 3 of the 7 live files
+   (`measurement-discipline` 12/12, `process-contracts` 6/6,
+   `toolchain-and-build` 10/10) and failed in the other 4. Malformed
+   `learnings.jsonl` lines are COUNTED (`malformedLines`), never skipped.
+
+3. **Deleting a whole file obeys the stamp-before-delete rule above.** A file is
+   deleted only when it has zero kept AND zero unresolved pairs, and EVERY pair
+   on it — markers-only ones included, since those are dedupe markers too — is
+   stamped via `markCandidateProcessed` BEFORE the `unlink`. Stamping afterwards
+   leaves a window in which neither the file nor a terminal verdict exists.
+
+4. **The header is recomputed only for a file the sweep actually rewrites.**
+   Point 2's earliest-date rule is re-applied over the pairs that remain and
+   are not expired, in the frontmatter and in the body sentence
+   ``**`expires-at` <D> = the EARLIEST of the <N> absorbed dates**``. A file
+   with nothing expired is left BYTE-IDENTICAL, so a recompute-on-every-run
+   cannot silently shorten a healthy file's TTL. The discrepancy is reported as
+   the plan's `advisory` field instead — computed over every RESOLVABLE pair on
+   the file and emitted BEFORE the `no-1to1-mapping` skip, so an ambiguous file
+   still gets one. Measured 2026-09-17
+   (`node scripts/sweep-expired-rules.mjs --json`, 7 files scanned, 0 expired),
+   **6 of the 7 files carry a discrepancy**: `identity-and-locks` 2026-10-01 vs
+   2026-10-02, `measurement-discipline` 2026-10-04 vs 2026-10-02,
+   `process-contracts` 2026-10-04 vs 2026-10-27,
+   `review-and-adapter-contracts` 2026-10-04 vs 2026-10-02, `test-hygiene`
+   2026-10-20 vs 2026-10-07, `toolchain-and-build` 2026-10-01 vs 2026-10-16 —
+   only `guard-design` agrees with its content. Three are the harmful direction,
+   a header OUTLIVING its content (`measurement-discipline`,
+   `review-and-adapter-contracts`, `test-hygiene`); the other three expire
+   earlier than they need to, which costs injection and loses nothing. `N`
+   counts the pairs remaining in the file, which is the total pair count — an
+   absorbed date stays absorbed after its prose is gone, and all 7 live
+   sentences carry that number.
+
+`--apply` emits `orchestrator.rules.expiry_sweep_applied` after the writes
+succeed (see `docs/events-schema.md`); a dry run emits nothing.
+
 ## Authoring Examples
 
 ### (a) Hand-authored always-on rule (no frontmatter)

package/docs/scope-collision-guard.md

@@ -157,6 +157,8 @@ Why it exists: the in-ledger `scopeSignals` counter (§ 4.1, rows 5/6) is a **wa
 
 A cryptographic proof still needs that platform boundary: no mechanism inside this repo can distinguish a copied digest from a read one.
 
+**The digest now JOINS the two halves (#1092, 2026-09-16).** Everything above stays true — what changed is that the halves became joinable at all. `scope_checked` carries `scope_digest` (`scopeDigest()` over the paths extracted from the prompt, omitted for an empty scope rather than defaulted to the empty-string digest), `echo_instruction_present`, `instructed_digest` and `digest_consistent`; `scope_echo_checked` already carried `expected_digest` / `actual_digest`; and `materialize-wave-scope` writes one `scope_materialized` record per wave carrying `transport_observable`. `node scripts/lib/scope-echo.mjs --verify --wave <N> --state-dir <dir>` joins all three **on the digest, never on `agent_id`** — measured 2026-09-16 over this host's ledger, 609 send-side against 51 receive-side records whose agent-id sets overlap in ZERO elements (send records the dispatch `description` + `subagent_type`, receive the coordinator's short handle), so before the digest the two halves could not be paired even in principle. Its closed verdict enum — `matched` · `injected-not-echoed` · `echoed-not-injected` · `injection-missing` · `digest-unknown` · `duplicate-claim`, all degrading to `echo-only` when the transport is unobservable — is what makes the issue's AC-2 (an omitted injection turning an end-to-end probe red) a measurable state rather than an unfalsifiable absence. `digest_consistent: false` additionally catches agent A's fenced block beside agent B's echo line **at dispatch time**, from the prompt alone. None of this raises the ceiling above: a joined digest still proves transport of a LINE, never obedience.
+
 **Revisit-Trigger** (verbatim from issue #1092, for the transport half this section deliberately does NOT close):
 
 > Implement when the platform exposes a stable prompt-assembly hook or when a coordinator-owned digest event can be proven against the real dispatched transcript.

package/docs/session-config-reference.md

@@ -332,7 +332,7 @@ slopcheck:
 | `memory-cleanup-threshold` | integer | `5` | Recommend `/memory-cleanup` after N accumulated session memory files. |
 | `memory-cleanup-soft-limit` | integer | `180` | Hard ceiling on accumulated memory files before the cleanup nudge escalates from a soft suggestion to a strong recommendation. PRD F2.2 / issue #502. Used by `scripts/lib/auto-dream.mjs`. |
 
-**Nudge retirement (2026-09-09, #1246-adjacent).** The two session-end nudges that used to read these thresholds — Phase 3.6.5 Auto-Dream and Phase 3.6.7 Auto-Dialectic — are RETIRED as standalone close-time prompts: measured across consumer repos, the auto-dialectic nudge recorded `decided: true` while nobody ever ran it, and memory-cleanup had run in only 1 of 3 repos, because both fired at the moment the operator is closing down, not the moment they can act. `shouldDispatchAutoDream()` and `shouldDispatchAutoDialectic()` are unchanged as pure signal functions and still consult these two keys — but they are now called from the session-START `maintenance-due` probe (`scripts/lib/maintenance-due-banner.mjs`, see § Reconcile below), which reads them as two of its six signals and reports a single `⚠ maintenance due: N of 6 …` banner at the one moment the operator can actually run `/session housekeeping`.
+**Nudge retirement (2026-09-09, #1246-adjacent).** The two session-end nudges that used to read these thresholds — Phase 3.6.5 Auto-Dream and Phase 3.6.7 Auto-Dialectic — are RETIRED as standalone close-time prompts: measured across consumer repos, the auto-dialectic nudge recorded `decided: true` while nobody ever ran it, and memory-cleanup had run in only 1 of 3 repos, because both fired at the moment the operator is closing down, not the moment they can act. `shouldDispatchAutoDream()` and `shouldDispatchAutoDialectic()` are unchanged as pure signal functions and still consult these two keys — but they are now called from the session-START `maintenance-due` probe (`scripts/lib/maintenance-due-banner.mjs`, see § Reconcile below), which reads them as two of its seven signals and reports a single `⚠ maintenance due: N of 7 …` banner at the one moment the operator can actually run `/session housekeeping`.
 | `learning-expiry-days` | integer | `30` | Legacy/default expiry window used by review/extend flows. New analyzer learnings preserve a candidate-supplied `expires_at` or derive expiry from `LEARNING_TTL_DAYS[type]` (for example, `autonomy-verdict` is 90 days). |
 | `learnings-surface-top-n` | integer | `15` | Cap on how many learnings the session-start Phase 5.6 and session-plan Step 0.5 sections surface, ranked by confidence descending. `0` = do not surface any learnings. Applies to Project Intelligence output. |
 | `learning-decay-rate` | float (0.0 ≤ x < 1.0) | `0.05` | Confidence decay applied to every untouched learning at session-end (after touched-set update, before prune). `0.0` = disable decay. A learning starting at `0.5` confidence survives ~10 untouched sessions with default decay. |
@@ -1008,7 +1008,7 @@ dialectic:
 
 | Field | Type | Default | Description |
 |-------|------|---------|-------------|
-| `dialectic.cadence` | integer | `5` | Number of sessions between auto-dialectic dispatches. Set to `0` to disable all dispatches (kill-switch). Non-integer and negative values silently fall back to default. **The dispatch moment moved (2026-09-09):** `shouldDispatchAutoDialectic()` is still the decision function this key feeds, but session-end Phase 3.6.7's own auto-trigger nudge is gone — retired as a standalone close-time prompt, and its recording wrapper (with the `orchestrator.dialectic.nudge_decided` event) removed in #1288 — see § Persistence & Safety above "Nudge retirement". The session-start `maintenance-due` probe now calls it as one of six signals, so a due dialectic surfaces where the operator can act on it (session start), not where they are closing down. |
+| `dialectic.cadence` | integer | `5` | Number of sessions between auto-dialectic dispatches. Set to `0` to disable all dispatches (kill-switch). Non-integer and negative values silently fall back to default. **The dispatch moment moved (2026-09-09):** `shouldDispatchAutoDialectic()` is still the decision function this key feeds, but session-end Phase 3.6.7's own auto-trigger nudge is gone — retired as a standalone close-time prompt, and its recording wrapper (with the `orchestrator.dialectic.nudge_decided` event) removed in #1288 — see § Persistence & Safety above "Nudge retirement". The session-start `maintenance-due` probe now calls it as one of seven signals, so a due dialectic surfaces where the operator can act on it (session start), not where they are closing down. |
 | `dialectic.model` | string | `haiku` | Model tier for the critique call. Must be one of `haiku`, `sonnet`, `opus`. **Fail-fast**: unknown values cause parse-config.mjs to exit 1 at startup — NOT silently ignored. |
 | `dialectic.budget-tokens` | integer | `8000` | Input token budget per call. Output budget is fixed at 4000 (per #506). Non-integer and negative values fall back to default. |
 
@@ -1343,7 +1343,9 @@ Read by: `scripts/lib/config/evolve.mjs` (parser), `skills/evolve/SKILL.md` Step
 
 Opt-in configuration for the learning→conditional-rule reconciliation engine (Epic #693). When enabled, the reconciliation engine runs at session-end Phase 3.6.8 and proposes new `.claude/rules/` entries derived from accumulated learnings. The proposal is always operator-AUQ-gated — rules are **never** auto-applied. FA3 (#696) delivers proposals via `AskUserQuestion`; FA4 (#697) adds the guardrail config block documented here. When `enabled: false` (the default), Phase 3.6.8 is a silent no-op and the engine never runs.
 
-**The former `reconcile-nudge` session-start probe is SUBSUMED (2026-09-09), not replaced 1:1.** `reconcile-nudge-banner.mjs`'s `computeReconcileNudge()` function is unchanged and still the reconcile-specific signal — but it is no longer surfaced as its own standalone banner. `scripts/lib/maintenance-due-banner.mjs` now calls it wholesale as one of six ANDed maintenance signals (`reconcile: computeReconcileNudge().nudge === true`) behind the single session-start `maintenance-due` probe, alongside `evolve`, `sweep`, `dialectic`, `memory-cleanup` and `pending-sidecar`. The reconcile signal is therefore not lost — it is reported as `⚠ maintenance due: N of 6 (…) — run /session housekeeping.` rather than as its own line, with a 7-day cooldown after any housekeeping session (`HOUSEKEEPING_COOLDOWN_DAYS`) so a repo that just ran the loop stays silent instead of re-nagging.
+**The former `reconcile-nudge` session-start probe is SUBSUMED (2026-09-09), not replaced 1:1.** `reconcile-nudge-banner.mjs`'s `computeReconcileNudge()` function is unchanged and still the reconcile-specific signal — but it is no longer surfaced as its own standalone banner. `scripts/lib/maintenance-due-banner.mjs` now calls it wholesale as one of seven ANDed maintenance signals (`reconcile: computeReconcileNudge().nudge === true`) behind the single session-start `maintenance-due` probe, alongside `evolve`, `sweep`, `dialectic`, `memory-cleanup`, `pending-sidecar` and `generated-rules-expiring`. The reconcile signal is therefore not lost — it is reported as `⚠ maintenance due: N of 7 (…) — run /session housekeeping.` rather than as its own line, with a 7-day cooldown after any housekeeping session (`HOUSEKEEPING_COOLDOWN_DAYS`) so a repo that just ran the loop stays silent instead of re-nagging.
+
+**`generated-rules-expiring` (7th signal, 2026-09-16, #1372 follow-up).** Due when a machine-generated rule under `.claude/rules/` is expired or expires within `GENERATED_RULE_EXPIRY_HORIZON_DAYS` (7, a module constant — **no Session Config key**, same posture as every other threshold in this probe). Population and predicate come from `scripts/lib/instruction-budget-guard.mjs` (`listMachineGeneratedRules` / `daysUntilGeneratedRuleExpiry`), the same set its generated byte ceiling judges. The row names the files and their dates, because the repair is per-file: consolidate the content into a live thematic rule, move the `- learning-key:` / `- learning-id:` pairs with it, then delete. `rule-loader.mjs` filters an expired rule at READ time but nothing deletes it, so it keeps costing bytes and is still loaded verbatim by Claude Code (#1372). This alarm deliberately does NOT live in the test suite: an assertion against today's date turns `npm test` red on a calendar date with nothing committed, blocking unrelated work, and no test run can perform the consolidation.
 
 All fields live under a top-level `reconcile` object in your Session Config host file (`CLAUDE.md` or `AGENTS.md`), for example:
 
@@ -1770,7 +1772,7 @@ Leave disabled (default) when:
 - The wave's deliverable is server-side / backend-only and persona evaluation would be noise.
 
 **Related skills and files:**
-- `commands/persona-panel.md` — standalone `/persona-panel` command for ad-hoc panel runs (not gated on `persona-gate-wave.enabled`).
+- `skills/persona-panel/SKILL.md` — standalone `/persona-panel` command for ad-hoc panel runs (not gated on `persona-gate-wave.enabled`).
 - `skills/persona-panel/SKILL.md` — full skill spec (catalog format, consolidation modes, sidecar shape).
 - `skills/wave-executor/wave-loop.md` § 3b — the wave-executor hook contract.
 - `agents/schemas/persona-panel-sidecar.schema.json` — sidecar JSON Schema enforced before write.

package/hooks/_lib/hook-import-set.json

@@ -1,6 +1,6 @@
 {
-  "generated_at": "2026-09-13T09:10:50.839Z",
-  "head": "ff1ed19177795b743186eebfc387319de0e90c31",
+  "generated_at": "2026-09-16T17:00:47.173Z",
+  "head": "1ef26415ce80164bd7e27705a4e7d97c37c72126",
   "entries": [
     {
       "file": "hooks/_lib/atomic-json.mjs",
@@ -268,7 +268,8 @@
       "reachable_from": [
         "on-session-end.mjs",
         "on-session-start.mjs",
-        "post-edit-validate.mjs"
+        "post-edit-validate.mjs",
+        "skill-invocation-telemetry.mjs"
       ]
     },
     {
@@ -358,6 +359,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -381,6 +383,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -660,6 +663,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -699,6 +703,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -838,7 +843,8 @@
         "post-tool-batch-wave-signal.mjs",
         "post-tooluse-frontend-slop.mjs",
         "pre-auq-clarity.mjs",
-        "pre-bash-memory-propose-audit.mjs"
+        "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs"
       ]
     },
     {
@@ -859,7 +865,8 @@
         "post-tool-batch-wave-signal.mjs",
         "post-tooluse-frontend-slop.mjs",
         "pre-auq-clarity.mjs",
-        "pre-bash-memory-propose-audit.mjs"
+        "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs"
       ]
     },
     {
@@ -882,6 +889,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -990,6 +998,16 @@
         "skill-invocation-telemetry.mjs"
       ]
     },
+    {
+      "file": "scripts/lib/is-main-module.mjs",
+      "reachable_from": [
+        "enforce-scope.mjs",
+        "on-session-end.mjs",
+        "on-session-start.mjs",
+        "pre-task-scope-disjoint.mjs",
+        "skill-invocation-telemetry.mjs"
+      ]
+    },
     {
       "file": "scripts/lib/issue-budget.mjs",
       "reachable_from": [
@@ -1024,6 +1042,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -1047,6 +1066,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -1070,6 +1090,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -1196,6 +1217,12 @@
         "on-session-start.mjs"
       ]
     },
+    {
+      "file": "scripts/lib/scope-echo.mjs",
+      "reachable_from": [
+        "pre-task-scope-disjoint.mjs"
+      ]
+    },
     {
       "file": "scripts/lib/scope-gate.mjs",
       "reachable_from": [
@@ -1244,7 +1271,8 @@
         "post-tool-batch-wave-signal.mjs",
         "post-tooluse-frontend-slop.mjs",
         "pre-auq-clarity.mjs",
-        "pre-bash-memory-propose-audit.mjs"
+        "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs"
       ]
     },
     {
@@ -1267,6 +1295,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -1290,6 +1319,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -1431,6 +1461,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -1462,6 +1493,7 @@
         "pre-auq-clarity.mjs",
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs",
         "skill-invocation-telemetry.mjs"
       ]
     },
@@ -1527,6 +1559,14 @@
         "skill-invocation-telemetry.mjs"
       ]
     },
+    {
+      "file": "scripts/lib/user-invocable-skills.mjs",
+      "reachable_from": [
+        "on-session-end.mjs",
+        "on-session-start.mjs",
+        "skill-invocation-telemetry.mjs"
+      ]
+    },
     {
       "file": "scripts/lib/wave-context.mjs",
       "reachable_from": [

package/hooks/_lib/subagent-paths.mjs

@@ -21,6 +21,21 @@
  * override completely unvalidated. That containment check is a NEW rule this
  * consolidation introduces, not a preserved behaviour.
  *
+ * MEASURED NON-DEFECT (2026-09-16, #1289 Befund 2). The ~90 %
+ * `transcript_found:false` rate on `orchestrator.agent.stopped` is NOT a defect
+ * of this derivation. Over 15.457 records: 0 of 5077 distinct false `agent_id`s
+ * have a sidecar anywhere on the host (8626 sidecar ids found via
+ * `find ~/.claude/projects -path '*subagents/agent-*.jsonl'`), 0 have a
+ * `SubagentStart` record, and 0 records carrying a valid id got a null result
+ * from this function — the false mass is the #939/#949 phantom-stop class (the
+ * harness fires SubagentStop for an ephemeral class that never existed; the
+ * evidence is in the header of hooks/subagent-telemetry.mjs). Driving this
+ * resolver with the 30 newest real false-case payloads resolves 0/30 because the
+ * file does not exist, while the 30 newest true-case payloads resolve 26/30 (the
+ * other 4 are aged-out transcripts of 2026-09-13 sessions). Widening the
+ * derivation — a directory scan, a nested `subagents/` fallback, an unbounded id
+ * — would resolve onto a FOREIGN agent's sidecar without recovering one record.
+ *
  * @module hooks/_lib/subagent-paths
  */