session-orchestrator 5.11.0 → 5.13.0

package/scripts/autopilot.mjs

@@ -53,6 +53,8 @@ import { probe, evaluate, DEFAULT_RESOURCE_THRESHOLDS } from './lib/resource-pro
 import { detectPeers } from './lib/session-registry.mjs';
 import { normalizeSession } from './lib/session-schema.mjs';
 import { isBackfillStub, readCanonicalSessions } from './lib/sessions-canonical.mjs';
+import { resolveEventsLedgerRoot } from './lib/platform.mjs';
+import { resolveLedgerPath } from './lib/ledger-path.mjs';
 
 // ---------------------------------------------------------------------------
 // CLI-level flag extraction
@@ -152,7 +154,7 @@ const thresholds = loadResourceThresholds();
 // decay-floor-factor) actually take effect here (#670). Errors swallowed → [].
 
 const surfacedLearnings = await surfaceTopN(
-  resolve('.orchestrator/metrics/learnings.jsonl'),
+  resolveLedgerPath('.orchestrator/metrics/learnings.jsonl', process.cwd()), // #1722
   15,
   { decay: decayOptsFromConfig(config && config['evolve.decay']) }
 );
@@ -182,7 +184,10 @@ const branch = detectBranch();
 // sessions.jsonl helpers for sessionRunner
 // ---------------------------------------------------------------------------
 
-const SESSIONS_JSONL_PATH = resolve('.orchestrator/metrics/sessions.jsonl');
+// #1592: the child runs with cwd = process.cwd() and its close writes the
+// ledger at resolveEventsLedgerRoot(process.cwd()) (emit-session.mjs) — read
+// the same file, or a run from a linked worktree finds no record.
+const SESSIONS_JSONL_PATH = resolve(resolveEventsLedgerRoot(process.cwd()), '.orchestrator/metrics/sessions.jsonl');
 
 /**
  * Read the child's canonical record by its raw harness UUID, independent of
@@ -253,9 +258,10 @@ async function modeSelector() {
   // in backlog-scan.mjs (`DEFAULT_BACKLOG_LIMIT`). The hand-written 50 that
   // stood here under-read this repo's own backlog and hid its critical issues.
   // `repoRoot` is passed EXPLICITLY (#1071) rather than left to the helper's
-  // cwd default: this driver already reads learnings.jsonl and sessions.jsonl
-  // relative to the invocation directory, and an implicit default is the seam
-  // where those two roots silently drift apart.
+  // cwd default: this driver already reads learnings.jsonl relative to the
+  // invocation directory (and sessions.jsonl from that directory's ledger root,
+  // `SESSIONS_JSONL_PATH`, #1592), and an implicit default is the seam where
+  // those roots silently drift apart.
   const signals = await buildLiveSignals({
     repoRoot: process.cwd(),
     learnings: surfacedLearnings,

package/scripts/backfill-abandoned-sessions.mjs

@@ -44,7 +44,7 @@ import { parseArgs } from 'node:util';
 import { backfillAbandonedSession, isUuid } from './lib/session-close-backfill.mjs';
 import { SCAN_CHUNK_BYTES, emitEvent, eventsFilePath, listEventSourcesNewestFirst, tombstoneGap } from './lib/events.mjs';
 import { ARCHIVE_DIR_NAME } from './lib/events-schema.mjs';
-import { getProjectDir } from './lib/platform.mjs';
+import { getProjectDir, resolveEventsLedgerRoot } from './lib/platform.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
 import { isLockLive, readLock } from './lib/session-lock.mjs';
 import { readProcessLocalSessionIds } from './lib/session-identity/own-session.mjs';
@@ -277,7 +277,13 @@ function forEachJsonlRecord(filePath, onRecord) {
     return;
   }
   try {
-    const size = fs.fstatSync(fd).size;
+    const stats = fs.fstatSync(fd);
+    // Windows opens a directory "as a file" with size 0; surface it through the
+    // same warning POSIX reaches via EISDIR on the first read.
+    if (!stats.isFile()) {
+      throw Object.assign(new Error('EISDIR: illegal operation on a directory, read'), { code: 'EISDIR' });
+    }
+    const size = stats.size;
     const buf = Buffer.alloc(SCAN_CHUNK_BYTES);
     let pos = 0;
     let carry = Buffer.alloc(0);
@@ -365,7 +371,10 @@ function readRunningSessionIds(repoRoot) {
  * @returns {Set<string>}
  */
 function readRecordedIds(repoRoot) {
-  const records = readJsonl(path.join(repoRoot, '.orchestrator', 'metrics', 'sessions.jsonl'));
+  // #1592: the SAME ledger the core dedupes and writes against (main checkout
+  // of a linked worktree) — a worktree-local read let already-recorded
+  // candidates through and spent the SessionStart latency cap on them.
+  const records = readJsonl(path.join(resolveEventsLedgerRoot(repoRoot), '.orchestrator', 'metrics', 'sessions.jsonl'));
   const ids = new Set();
   for (const r of records) {
     if (!r) continue;
@@ -655,6 +664,7 @@ async function flushTelemetryOnSessionStart(repoRoot) {
   try {
     const { flush } = await import('./lib/telemetry/sync.mjs');
     await flush({
+      // ledger-root: metricsDir for the telemetry flush; buildBatch resolves each ledger in it
       metricsDir: path.join(repoRoot, '.orchestrator', 'metrics'),
       timeoutMs: STARTUP_FLUSH_TIMEOUT_MS,
     });

package/scripts/backfill-evidence-digest.mjs

@@ -51,6 +51,7 @@ import { join, relative, resolve } from 'node:path';
 
 import { computeEvidenceDigest } from './lib/reconcile/renderer.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
+import { resolveLedgerPath } from './lib/ledger-path.mjs';
 
 /** ISO-8601 instant — mirrors the renderer's `EVIDENCE_RECORDED_AT_RE`. */
 const EVIDENCE_RECORDED_AT_RE = /^\d{4}-\d{2}-\d{2}T[0-9:.]+(?:Z|[+-]\d{2}:\d{2})$/;
@@ -198,7 +199,7 @@ const kebab = (s) =>
  */
 function loadCreatedAtByKey(repoRoot) {
   const map = new Map();
-  const p = join(repoRoot, '.orchestrator', 'metrics', 'learnings.jsonl');
+  const p = resolveLedgerPath('.orchestrator/metrics/learnings.jsonl', repoRoot); // #1722
   if (!existsSync(p)) return map;
   for (const line of readFileSync(p, 'utf8').split('\n')) {
     const trimmed = line.trim();

package/scripts/backfill-learnings-from-vault.mjs

@@ -72,7 +72,15 @@ import { subjectToSlug, parseFrontmatter } from './lib/vault-mirror/utils.mjs';
 import { kebab } from './lib/learnings/kebab.mjs';
 import { validateLearning } from './lib/learnings/schema.mjs';
 import { appendLearning, isBackupOf, withLearningsLock } from './lib/learnings/io.mjs';
+import {
+  isCanonicalStore,
+  inboxPathFor,
+  receiptsPathFor,
+  archivePathFor,
+  resolveStoreRole,
+} from './lib/learnings/store-role.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
+import { resolveLedgerPath } from './lib/ledger-path.mjs';
 
 const DEFAULT_RULES_DIR = '.claude/rules';
 const DEFAULT_STORE = '.orchestrator/metrics/learnings.jsonl';
@@ -621,6 +629,39 @@ function idsInStore(filePath) {
   return ids;
 }
 
+/**
+ * Inbox ids that count as already present for the canonical store (#1516,
+ * #1685). The rule depends on this host's store role:
+ *
+ * - `inbox`: EVERY inbox id is present. `appendLearning()` lands a restore in
+ *   the inbox here, and re-appending a receipted or archived id is pointless —
+ *   the receipt or archive hides it again, so every --apply would re-append.
+ * - any other role (`writer`, `invalid` — invalid refuses the write anyway):
+ *   only VISIBLE inbox ids, i.e. not receipted and not archived, mirroring
+ *   `readInboxView()` in io.mjs. A receipted id that later left the live store
+ *   is seen by no reader, so it must stay an orphan the backfill restores.
+ *   Live ids need no exclusion here: callers check the live store themselves.
+ *
+ * `hidden` is the subset of `present` that no reader sees (receipted or
+ * archived) — non-empty only on an inbox host, where such ids still count as
+ * present. The report gives them their own status (`present-in-inbox-hidden`,
+ * #1689) instead of claiming they sit in the store's read view.
+ *
+ * Both empty for a non-canonical store path, which has no inbox semantics.
+ *
+ * @param {string} storeAbs
+ * @returns {{ present: Set<string>, hidden: Set<string> }}
+ */
+function presentInboxIds(storeAbs) {
+  if (!isCanonicalStore(storeAbs)) return { present: new Set(), hidden: new Set() };
+  const inboxIds = idsInStore(inboxPathFor(storeAbs));
+  // Receipt lines are `{id, ingested_at}` — idsInStore reads their ids.
+  const hiddenAny = new Set([...idsInStore(receiptsPathFor(storeAbs)), ...idsInStore(archivePathFor(storeAbs))]);
+  const hidden = new Set([...inboxIds].filter((id) => hiddenAny.has(id)));
+  if (resolveStoreRole().role === 'inbox') return { present: inboxIds, hidden };
+  return { present: new Set([...inboxIds].filter((id) => !hidden.has(id))), hidden: new Set() };
+}
+
 /**
  * List `<store>.bak[-.]*` siblings (a verbatim original beats any
  * reconstruction). Both delimiter forms count — the legacy dot form
@@ -681,7 +722,7 @@ function printHuman(report) {
   out.push(`  vault     : ${report.vault_learnings_dir} (${s.vault_notes_indexed} learning notes indexed)`);
   out.push('');
   out.push(
-    `Rules with provenance: ${s.rules_with_provenance} · resolved in store: ${s.present_in_store} · in archive: ${s.present_in_archive} · recoverable verbatim from a .bak: ${s.recoverable_from_backup} · ORPHANED: ${s.orphans}`
+    `Rules with provenance: ${s.rules_with_provenance} · resolved in store: ${s.present_in_store} · in archive: ${s.present_in_archive} · in inbox, hidden: ${s.present_in_inbox_hidden} · recoverable verbatim from a .bak: ${s.recoverable_from_backup} · ORPHANED: ${s.orphans}`
   );
   out.push('');
 
@@ -757,6 +798,8 @@ export async function main(argv = [], deps = {}) {
   let rulesDir = DEFAULT_RULES_DIR;
   let storeArg = DEFAULT_STORE;
   let archiveArg = DEFAULT_ARCHIVE;
+  let storeExplicit = false;
+  let archiveExplicit = false;
 
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
@@ -767,8 +810,8 @@ export async function main(argv = [], deps = {}) {
     else if (a === '--vault-dir') vaultDirArg = argv[++i];
     else if (a === '--vault-subdir') vaultSubdir = argv[++i];
     else if (a === '--rules-dir') rulesDir = argv[++i];
-    else if (a === '--store') storeArg = argv[++i];
-    else if (a === '--archive') archiveArg = argv[++i];
+    else if (a === '--store') { storeArg = argv[++i]; storeExplicit = true; }
+    else if (a === '--archive') { archiveArg = argv[++i]; archiveExplicit = true; }
     else {
       process.stderr.write(`backfill-learnings-from-vault: unknown argument: ${a}\n`);
       return { code: 1 };
@@ -819,8 +862,10 @@ export async function main(argv = [], deps = {}) {
   // `resolve` (not `join`) so an ABSOLUTE --store/--archive/--rules-dir wins over
   // the repo root instead of being silently nested under it.
   const rulesAbs = resolve(root, rulesDir);
-  const storeAbs = resolve(root, storeArg);
-  const archiveAbs = resolve(root, archiveArg);
+  // #1722: the DEFAULT store/archive route through the ledger resolver (main
+  // checkout when root is a linked worktree that gitignores them).
+  const storeAbs = storeExplicit ? resolve(root, storeArg) : resolveLedgerPath(DEFAULT_STORE, root);
+  const archiveAbs = archiveExplicit ? resolve(root, archiveArg) : resolveLedgerPath(DEFAULT_ARCHIVE, root);
   const learningsAbs = resolve(vaultDir, vaultSubdir);
 
   if (!existsSync(rulesAbs)) {
@@ -834,6 +879,7 @@ export async function main(argv = [], deps = {}) {
 
   // ── Load inputs ──────────────────────────────────────────────────────────
   const storeIds = idsInStore(storeAbs);
+  const { present: inboxIds, hidden: hiddenInboxIds } = presentInboxIds(storeAbs);
   const archiveIds = idsInStore(archiveAbs);
   const backups = backupPaths(storeAbs).map((p) => ({ path: p, ids: idsInStore(p) }));
   const { notes, unreadable } = indexVaultNotes(learningsAbs);
@@ -868,12 +914,20 @@ export async function main(argv = [], deps = {}) {
     const id = prov.learningId;
     const foundIn = [];
     if (storeIds.has(id)) foundIn.push('store');
+    if (inboxIds.has(id)) foundIn.push('inbox');
     if (archiveIds.has(id)) foundIn.push('archive');
     for (const b of backups) if (b.ids.has(id)) foundIn.push(basename(b.path));
 
     let status;
+    // A visible inbox id is part of the store's read view (readers union it
+    // in), so it counts as present-in-store — after the archive, which wins
+    // for an id in both; `found_in` names the file. A present but HIDDEN one
+    // (inbox host, receipted/archived) is seen by no reader, so it is not
+    // claimed as part of the store (#1689).
     if (storeIds.has(id)) status = 'present-in-store';
     else if (archiveIds.has(id)) status = 'present-in-archive';
+    else if (hiddenInboxIds.has(id)) status = 'present-in-inbox-hidden';
+    else if (inboxIds.has(id)) status = 'present-in-store';
     else if (foundIn.length > 0) status = 'recoverable-verbatim-from-backup';
     else status = 'orphan';
 
@@ -942,7 +996,7 @@ export async function main(argv = [], deps = {}) {
       // appendLearning() re-enters the held lock (reentrant per async call
       // chain, io.mjs).
       await withLearningsLock(storeAbs, async () => {
-        const present = new Set([...idsInStore(storeAbs), ...idsInStore(archiveAbs)]);
+        const present = new Set([...idsInStore(storeAbs), ...presentInboxIds(storeAbs).present, ...idsInStore(archiveAbs)]);
         for (const r of candidates) {
           // This is what makes a second --apply a no-op rather than a
           // duplicate append; `present.add` below covers two rules naming one id.
@@ -983,6 +1037,7 @@ export async function main(argv = [], deps = {}) {
       vault_notes_indexed: notes.length,
       present_in_store: records.filter((r) => r.status === 'present-in-store').length,
       present_in_archive: records.filter((r) => r.status === 'present-in-archive').length,
+      present_in_inbox_hidden: records.filter((r) => r.status === 'present-in-inbox-hidden').length,
       recoverable_from_backup: records.filter((r) => r.status === 'recoverable-verbatim-from-backup').length,
       orphans: orphans.length,
       located_in_vault: orphans.filter((r) => r.vault_note).length,

package/scripts/backfill-sessions.mjs

@@ -29,9 +29,10 @@
  */
 
 import { readFileSync, copyFileSync, existsSync } from 'node:fs';
-import { basename } from 'node:path';
+import { basename, join, resolve } from 'node:path';
 import { atomicWriteWithBackup, envelopeToError } from './lib/io.mjs';
 import { validateSession, normalizeSession, ValidationError } from './lib/session-schema.mjs';
+import { resolveEventsLedgerRoot } from './lib/platform.mjs';
 
 const DEFAULT_FILE = '.orchestrator/metrics/sessions.jsonl';
 
@@ -115,8 +116,21 @@ function detectUnmappableReason(entry) {
   return null;
 }
 
+/**
+ * Default target: sessions.jsonl of the repo's one ledger root (#1514/#1584,
+ * #1722) — the main checkout when cwd is a linked worktree. Outside one the
+ * relative DEFAULT_FILE is kept verbatim, so paths in output do not change.
+ *
+ * @returns {string}
+ */
+function defaultFile() {
+  const root = resolveEventsLedgerRoot(process.cwd());
+  // ledger-root: `root` is resolveEventsLedgerRoot() of the line above
+  return root === resolve(process.cwd()) ? DEFAULT_FILE : join(root, DEFAULT_FILE);
+}
+
 function parseArgs(argv) {
-  const args = { file: DEFAULT_FILE, mode: 'dry-run' };
+  const args = { file: defaultFile(), mode: 'dry-run' };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === '--file') args.file = argv[++i];

package/scripts/check-package-manager.mjs

@@ -30,6 +30,10 @@
 //            `prepare: husky` script never ran because ignore-scripts=true,
 //            so commit-msg/pre-commit/pre-push are inactive. Warns locally
 //            and recommends `npx husky`; silent under CI.
+//        h2  core.hooksPath IS `.husky/_` but that directory is missing in
+//            this worktree (#1662) — a linked worktree inherits the value from
+//            the shared `.git/config`, yet `.husky/_` is never generated there
+//            because `prepare: husky` does not run. Same advisory treatment.
 //
 // SCOPE GUARD:
 //   This script only guards the REPOSITORY ROOT package.json. If invoked
@@ -275,21 +279,34 @@ export function parseCiEnv(value) {
 export const HUSKY_INACTIVE_WARNING =
   '⚠ check-package-manager: git core.hooksPath is not set to .husky/_ — Husky hooks (commit-msg, pre-commit, pre-push) are INACTIVE in this clone because .npmrc ignore-scripts=true skips the prepare script (#1458). Run: npx husky';
 
+/** One-line stderr WARN for a set-but-missing hooks directory (#1662, linked worktrees). */
+export const HUSKY_MISSING_DIR_WARNING =
+  '⚠ check-package-manager: git core.hooksPath is .husky/_ but that directory is MISSING in this worktree — Husky hooks (commit-msg, pre-commit, pre-push) are INACTIVE here; a linked worktree inherits core.hooksPath from the shared .git/config, but ignore-scripts=true skips the prepare script that generates .husky/_ (#1662). Run: npx husky';
+
 /**
  * Advisory check (#1458): `.npmrc` `ignore-scripts=true` (SEC-020) means the
  * `prepare: husky` script never runs on `npm ci`, so a fresh clone has no
  * `core.hooksPath` and every Husky hook is silently inactive. This only
  * REPORTS the state — it never runs `npx husky`, never writes git config and
  * never affects the guard's `ok`/exit code. Silent under CI.
+ *
+ * A matching value alone is not enough (#1662): a linked worktree inherits
+ * `core.hooksPath=.husky/_` from the shared `.git/config` while `.husky/_`
+ * itself was never generated there. The directory is therefore resolved —
+ * a relative hooksPath against `repoRoot` (the current worktree top-level),
+ * an absolute one as is — and a missing directory reports `active: false`
+ * with `missingDir: true`.
  * @param {string} repoRoot
  * @param {{ env?: NodeJS.ProcessEnv, ci?: boolean }} [opts] — `env` is also
  *   passed to the git subprocess (lets tests isolate from global git config).
- * @returns {{ hooksPath: string, active: boolean, skipped: 'ci'|'no-husky-dir'|null }}
+ * @returns {{ hooksPath: string, active: boolean, missingDir: boolean, skipped: 'ci'|'no-husky-dir'|null }}
  */
 export function checkHuskyHooksPath(repoRoot, { env = process.env, ci } = {}) {
-  if (ci ?? parseCiEnv(env.CI)) return { hooksPath: '', active: false, skipped: 'ci' };
+  if (ci ?? parseCiEnv(env.CI)) {
+    return { hooksPath: '', active: false, missingDir: false, skipped: 'ci' };
+  }
   if (!existsSync(join(repoRoot, '.husky'))) {
-    return { hooksPath: '', active: false, skipped: 'no-husky-dir' };
+    return { hooksPath: '', active: false, missingDir: false, skipped: 'no-husky-dir' };
   }
 
   let hooksPath;
@@ -305,11 +322,12 @@ export function checkHuskyHooksPath(repoRoot, { env = process.env, ci } = {}) {
   }
 
   const norm = hooksPath.replace(/\\/g, '/').replace(/\/+$/, '');
-  const active =
+  const matches =
     norm !== '' &&
     (isAbsolute(hooksPath) ? norm.endsWith('/.husky/_') : posix.normalize(norm) === '.husky/_');
+  const missingDir = matches && !existsSync(resolve(repoRoot, hooksPath));
 
-  return { hooksPath, active, skipped: null };
+  return { hooksPath, active: matches && !missingDir, missingDir, skipped: null };
 }
 
 /**
@@ -317,7 +335,7 @@ export function checkHuskyHooksPath(repoRoot, { env = process.env, ci } = {}) {
  * only side effects are read-only fs/git calls. Never throws or exits.
  * `hooks` carries the advisory Husky check (#1458); it never affects `ok`.
  * @param {{ cwd?: string, ci?: boolean, allowMissingNodeModules?: boolean, repoRoot?: string, env?: NodeJS.ProcessEnv }} [opts]
- * @returns {{ ok: boolean, ci: boolean, skipped: boolean, repoRoot: string, findings: Array<{code: string, severity: string, effectiveSeverity: string, message: string}>, hooks?: { hooksPath: string, active: boolean, skipped: 'ci'|'no-husky-dir'|null } }}
+ * @returns {{ ok: boolean, ci: boolean, skipped: boolean, repoRoot: string, findings: Array<{code: string, severity: string, effectiveSeverity: string, message: string}>, hooks?: { hooksPath: string, active: boolean, missingDir: boolean, skipped: 'ci'|'no-husky-dir'|null } }}
  */
 export function runPackageManagerGuard(opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
@@ -464,9 +482,9 @@ if (isMain) {
 
   const result = runPackageManagerGuard({ allowMissingNodeModules: opts.allowMissingNodeModules });
 
-  // Advisory only (#1458) — never changes the exit code.
+  // Advisory only (#1458, #1662) — never changes the exit code.
   if (result.hooks && !result.hooks.active && result.hooks.skipped === null) {
-    console.error(HUSKY_INACTIVE_WARNING);
+    console.error(result.hooks.missingDir ? HUSKY_MISSING_DIR_WARNING : HUSKY_INACTIVE_WARNING);
   }
 
   if (opts.json) {

package/scripts/check-sessions-integrity.mjs

@@ -50,6 +50,7 @@ import { fileURLToPath } from 'node:url';
 
 import { checkSessionsIntegrity, SESSIONS_PATH } from './lib/sessions-integrity-banner.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
+import { resolveEventsLedgerRoot } from './lib/platform.mjs';
 
 const SELF_DIR = dirname(fileURLToPath(import.meta.url));
 
@@ -146,7 +147,9 @@ export function parseArgs(argv) {
  * @returns {number}
  */
 function countLedgerRecords(repoRoot, sessionId) {
-  const filePath = join(repoRoot, SESSIONS_PATH);
+  // #1592: the same file checkSessionsIntegrity reads — the main checkout's
+  // ledger from a linked worktree, or a record written there reads as missing.
+  const filePath = join(resolveEventsLedgerRoot(repoRoot), SESSIONS_PATH);
   if (!existsSync(filePath)) return 0;
   let matched = 0;
   for (const line of readFileSync(filePath, 'utf8').split('\n')) {

package/scripts/ci/assert-vitest-green.mjs

@@ -96,6 +96,9 @@ export function verifyVitestResult(result, opts = {}) {
   if (success !== true) {
     return { ok: false, reason: `success is ${JSON.stringify(success)} (expected true)`, summary };
   }
+  if (numPassedTests <= 0 || result.numPendingTests >= numTotalTests) {
+    return { ok: false, reason: 'no executed passing tests (all tests pending/skipped)', summary };
+  }
   // Floor guard: a suspiciously small run signals a truncated/partial/empty
   // execution masquerading as green. The real suite is ~12.1k tests (2026-07-17).
   if (numTotalTests < minTests) {

package/scripts/ci/windows-smoke.mjs

@@ -0,0 +1,201 @@
+#!/usr/bin/env node
+// Native Windows regression probes (#1612). Fresh SessionStart needs npm-registry
+// access; unavailable network is explicitly unmeasurable, never a measured PASS.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawn, spawnSync } from 'node:child_process';
+
+if (process.platform !== 'win32') {
+  console.log('windows-smoke: nur win32');
+  console.log('SUMMARY 0/0');
+} else {
+  const repo = fileURLToPath(new URL('../../', import.meta.url));
+  const { runCheck } = await import('../lib/gates/gate-helpers.mjs');
+  const { spawnInGroup } = await import('../lib/process-group.mjs');
+  const { REGISTRY_URL, CACHE_FILENAME, readCachedLatest } = await import('../lib/plugin-update-banner.mjs');
+  const { httpRequest } = await import('../lib/http-request.mjs');
+  // Hook stdout is untrusted: a crashed hook prints nothing or a stack trace.
+  const parseJson = (text) => { try { return JSON.parse(text); } catch { return null; } };
+  const results = [];
+  const record = (name, ok, detail) => {
+    results.push(ok);
+    console.log(`${ok ? 'PASS' : 'FAIL'} ${name} :: ${JSON.stringify(detail)}`);
+  };
+  const probe = async (name, fn) => {
+    try { await fn(); } catch (error) { record(name, false, error.message); }
+  };
+  let work;
+  try {
+    work = fs.mkdtempSync(path.join(os.tmpdir(), 'so windows smoke '));
+    const config = path.join(work, 'private config');
+    const env = {
+      ...process.env,
+      SO_CONFIG_HOME: config,
+      SO_SESSION_REGISTRY_DIR: path.join(config, 'sessions'),
+      SO_HOST_ALIASES_FILE: path.join(config, 'host-aliases.json'),
+      SO_LOOP_GUARD_DIR: path.join(work, 'loop guard'),
+      SO_VAULT_DIR: path.join(work, 'vault'),
+      NAVIGATOR_CONFIG_DIR: path.join(work, 'navigator'),
+      SO_EVENTS_LEDGER_SANDBOX: path.join(work, 'events.jsonl'),
+      CLANK_EVENT_URL: '', CLANK_EVENT_SECRET: '',
+      CLAUDE_CONFIG_DIR: path.join(work, 'claude config'),
+      XDG_CONFIG_HOME: path.join(work, 'xdg'),
+      TMPDIR: work, TMP: work, TEMP: work,
+      SO_TELEMETRY_DISABLED: '1',
+      SO_DISABLE_UPDATE_CHECK: '1',
+      SO_DISABLE_STARTUP_PROBES: '1',
+      SO_HOOK_PROFILE: 'full', SO_DISABLED_HOOKS: '',
+    };
+    for (const dir of [config, env.SO_SESSION_REGISTRY_DIR, env.SO_LOOP_GUARD_DIR,
+      env.SO_VAULT_DIR, env.CLAUDE_CONFIG_DIR, env.XDG_CONFIG_HOME]) {
+      fs.mkdirSync(dir, { recursive: true });
+    }
+    const node = `"${process.execPath}"`;
+    await probe('gate capture', async () => {
+      const r = await runCheck(`${node} -e "console.log('out-äöü-€'); console.error('err-line')"`, { repoRoot: work, cwd: work, env });
+      record('gate capture', r.status === 'pass' && r.fullOutput.includes('out-äöü-€') && r.fullOutput.includes('err-line'), r.fullOutput);
+    });
+    for (const code of [0, 3]) await probe(`gate exit ${code}`, async () => {
+      const r = await runCheck(`${node} -e "process.exit(${code})"`, { repoRoot: work, cwd: work, env });
+      record(`gate exit ${code}`, r.exitCode === code && r.status === (code === 0 ? 'pass' : 'fail'), { exit: r.exitCode, status: r.status });
+    });
+    await probe('gate missing command', async () => {
+      const r = await runCheck('so-windows-smoke-definitely-not-a-command', { repoRoot: work, cwd: work, env });
+      // `cmd /d /s /c` exits 1 for an unknown command (9009 only inside batch
+      // files), so the hint text is absent on Windows; what must hold is that a
+      // missing command is a failure, never a skip (#1612, GH#76 point 5).
+      record('gate missing command', r.status === 'fail' && r.exitCode !== 0, { status: r.status, exitCode: r.exitCode });
+    });
+    await probe('gate timeout tree', async () => {
+      const pidsDir = path.join(work, 'pids');
+      fs.mkdirSync(pidsDir);
+      const grandchild = path.join(work, 'grandchild.mjs');
+      const child = path.join(work, 'child.mjs');
+      fs.writeFileSync(grandchild, `import fs from 'node:fs'; fs.writeFileSync(${JSON.stringify(pidsDir)} + '/gc-' + process.pid, ''); setInterval(() => {}, 1000);`);
+      fs.writeFileSync(child, `import fs from 'node:fs'; import { spawn } from 'node:child_process'; fs.writeFileSync(${JSON.stringify(pidsDir)} + '/ch-' + process.pid, ''); for (let i=0;i<2;i++) spawn(process.execPath, [${JSON.stringify(grandchild)}], { stdio: 'ignore' }); setInterval(() => {}, 1000);`);
+      const r = await runCheck(`${node} "${child}"`, { repoRoot: work, cwd: work, env, timeoutMs: 4000 });
+      const pids = fs.readdirSync(pidsDir).map(f => Number(f.split('-')[1]));
+      await new Promise(resolve => setTimeout(resolve, 1500));
+      const still = pids.filter(pid => {
+        const check = spawnSync('tasklist.exe', ['/FI', `PID eq ${pid}`, '/NH', '/FO', 'CSV'], { encoding: 'utf8', timeout: 5000 });
+        if (check.error || check.status !== 0) throw new Error(`tasklist failed: ${check.error?.message ?? check.status}`);
+        return check.stdout.includes(`"${pid}"`);
+      });
+      record('gate timeout tree', r.status === 'fail' && r.timedOut && pids.length === 3 && still.length === 0 && r.survivors?.length === 0,
+        { pids, still, timedOut: r.timedOut, survivors: r.survivors, output: r.output });
+      for (const pid of still) {
+        const killed = spawnSync('taskkill.exe', ['/PID', String(pid), '/T', '/F'], { encoding: 'utf8', timeout: 5000 });
+        if (killed.error || killed.status !== 0) throw new Error(`survivor cleanup failed: ${pid}`);
+      }
+    });
+    await probe('argv literal', async () => {
+      const dir = path.join(work, "dir with space's");
+      fs.mkdirSync(dir);
+      const script = path.join(dir, 'argv.mjs');
+      fs.writeFileSync(script, 'console.log(JSON.stringify(process.argv.slice(1)));');
+      const args = [script, 'a b', "it's", '%PATH%', '&echo x'];
+      const r = await spawnInGroup([process.execPath, ...args], { repoRoot: work, cwd: work, env, timeoutMs: 20000 });
+      const parsed = JSON.parse(r.fullOutput.trim());
+      record('argv literal', r.exitCode === 0 && JSON.stringify(parsed) === JSON.stringify(args), parsed);
+    });
+
+    const bash = path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Git', 'bin', 'bash.exe');
+    const hooks = JSON.parse(fs.readFileSync(path.join(repo, 'hooks/hooks.json'), 'utf8')).hooks;
+    const project = path.join(work, 'project with spaces');
+    fs.mkdirSync(project);
+    fs.writeFileSync(path.join(project, 'transcript.jsonl'), '');
+    const runtimes = [];
+    const runHook = async (event, matcher, command, cwd = project, extra = {}, overrides = {}) => {
+      const tool = (matcher === '*' ? 'Bash' : matcher || 'Bash').split('|')[0];
+      const input = tool === 'Bash' ? { command: 'ls -la' }
+        : tool === 'Skill' ? { skill: 'session-orchestrator:session' }
+          : tool === 'Agent' ? { description: 'smoke', prompt: 'smoke' }
+            : tool === 'AskUserQuestion' ? { questions: [] }
+              : { file_path: path.join(cwd, 'src/a.mjs'), content: 'export const a = 1;\n', old_string: 'x', new_string: 'y' };
+      const payload = { session_id: `windows-smoke-${path.basename(cwd)}`, cwd,
+        transcript_path: path.join(cwd, 'transcript.jsonl'), permission_mode: 'default', hook_event_name: event,
+        ...(event.includes('Tool') ? { tool_name: tool, tool_input: input, tool_response: {} } : {}),
+        ...(event === 'SessionStart' ? { source: 'startup' } : {}),
+        ...(event === 'SessionEnd' ? { reason: 'other' } : {}), ...extra };
+      // Reuse the production timeout/tree cleanup; only adapt stdin for hook payloads.
+      const stdoutChunks = [];
+      let stdinError = null;
+      const r = await spawnInGroup([bash, '-c', command], { cwd, repoRoot: cwd, timeoutMs: 5000,
+        env: { ...env, CLAUDE_PLUGIN_ROOT: repo, CLAUDE_PROJECT_DIR: cwd, ...overrides },
+        spawnFn: (executable, args, options) => {
+          const child = spawn(executable, args, { ...options, stdio: ['pipe', 'pipe', 'pipe'] });
+          child.stdout.on('data', chunk => { stdoutChunks.push(chunk); });
+          child.stdin.on('error', error => {
+            stdinError = error.message;
+          });
+          child.stdin.end(JSON.stringify(payload));
+          return child;
+        } });
+      runtimes.push({ event, command, ms: r.durationMs });
+      return { ...r, stdout: Buffer.concat(stdoutChunks).toString('utf8'), stdinError };
+    };
+    for (const [event, groups] of Object.entries(hooks)) for (const group of groups) for (const hook of group.hooks) {
+      const name = `${event}/${path.basename(hook.command.split('"').at(-2) || hook.command)}`;
+      await probe(name, async () => {
+        const r = await runHook(event, group.matcher, hook.command);
+        record(name, r.exitCode === 0 && !r.timedOut && !r.stdinError,
+          { exit: r.exitCode, ms: r.durationMs, stdinError: r.stdinError, output: r.output });
+      });
+    }
+    const guard = hooks.PreToolUse.flatMap(group => group.hooks).find(hook => hook.command.includes('pre-bash-destructive-guard'));
+    await probe('destructive guard', async () => {
+      // Payload only: never execute this command. Split for the outer shell guard.
+      const command = ['git', 'reset', '--hard', 'HEAD~1'].join(' ');
+      const r = await runHook('PreToolUse', 'Bash', guard.command, project, { tool_input: { command } });
+      const output = parseJson(r.stdout.trim());
+      record('destructive guard', r.exitCode === 0 && !r.timedOut && !r.stdinError && output?.hookSpecificOutput?.permissionDecision === 'deny', output ?? r.output);
+    });
+    const start = hooks.SessionStart.flatMap(group => group.hooks).find(hook => hook.command.includes('on-session-start'));
+    // Do not inherit any update kill-switch into the first-start regression path.
+    const freshEnv = { SO_DISABLE_UPDATE_CHECK: undefined, DO_NOT_TRACK: undefined,
+      CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: undefined, SO_DISABLE_STARTUP_PROBES: undefined };
+    for (let i = 0; i < 5; i++) await probe(`fresh SessionStart ${i + 1}`, async () => {
+      const fresh = fs.mkdtempSync(path.join(work, 'fresh project '));
+      // Minimal empty git repository fixture; no git-writing commands are needed.
+      for (const dir of ['.git/objects', '.git/refs/heads']) fs.mkdirSync(path.join(fresh, dir), { recursive: true });
+      fs.writeFileSync(path.join(fresh, '.git/HEAD'), 'ref: refs/heads/main\n');
+      fs.writeFileSync(path.join(fresh, '.git/config'), '[core]\nrepositoryformatversion = 0\nbare = false\n');
+      fs.writeFileSync(path.join(fresh, 'transcript.jsonl'), '');
+      const r = await runHook('SessionStart', 'startup', start.command, fresh, {}, freshEnv);
+      const output = parseJson(r.stdout.trim());
+      const ok = r.exitCode === 0 && !r.timedOut && !r.stdinError && typeof output === 'object' && output !== null && !/Assertion failed/.test(r.fullOutput);
+      record(`fresh SessionStart ${i + 1}`, ok, { exit: r.exitCode, ms: r.durationMs, output: r.output });
+      if (!ok) return;
+      const cacheDir = path.join(fresh, '.orchestrator/runtime');
+      const cache = readCachedLatest({ cacheDir });
+      if (cache) record(`fresh update ${i + 1}`, true, { version: cache.version });
+      else {
+        // A missing cache alone cannot distinguish offline from a broken hook.
+        let reachable = false;
+        try {
+          // Never fetch here: fetch + exit is the Windows crash this smoke guards (#1612).
+          const response = await httpRequest(REGISTRY_URL, { timeoutMs: 2000 });
+          reachable = response.ok && typeof (await response.json())?.version === 'string';
+        } catch (error) {
+          console.log(`INFO fresh update ${i + 1} :: ${JSON.stringify(error.message)}`);
+        }
+        if (reachable || fs.existsSync(path.join(cacheDir, CACHE_FILENAME))) {
+          record(`fresh update ${i + 1}`, false, 'registry reachable or cache invalid, but hook wrote no usable cache');
+        } else console.log(`SKIP fresh update ${i + 1} :: nicht messbar: npm registry unavailable (network required)`);
+      }
+    });
+    record('Hook-Laufzeit', runtimes.length > 0 && runtimes.every(r => r.ms < 4000),
+      { maxMs: Math.max(...runtimes.map(r => r.ms)), slow: runtimes.filter(r => r.ms >= 4000) });
+  } catch (error) {
+    record('smoke setup', false, error.message);
+  } finally {
+    if (work) {
+      try { fs.rmSync(work, { recursive: true, force: true, maxRetries: 3, retryDelay: 200 }); }
+      catch (error) { record('cleanup', false, error.message); }
+    }
+    console.log(`SUMMARY ${results.filter(Boolean).length}/${results.length}`);
+    process.exitCode = results.every(Boolean) ? 0 : 1;
+  }
+}