session-orchestrator 5.11.0 → 5.13.0

package/scripts/lib/state-md/idle-reset.mjs

@@ -0,0 +1,248 @@
+/**
+ * Idle Reset for STATE.md (issue #1560) — the code form of session-start
+ * Phase 1.5 § "Idle Reset" (skills/session-start/references/phase-1-5-session-continuity.md).
+ *
+ * Until #1560 the reset existed only as prose and every coordinator rewrote
+ * STATE.md by hand. Its Rule 6 deleted the five recommendation keys from the
+ * frontmatter, which is exactly what Phase 7.5's `buildLiveSignals()` reads —
+ * so after every clean `/close` the Mode-Selector saw no recommendation and
+ * fell back to `feature` at confidence 0. The keys now STAY in the frontmatter:
+ * they are the session-to-session handoff, and session-end Phase 3.7a (their
+ * sole writer) overwrites them at the next close.
+ *
+ * Deliberately NOT re-exported from `scripts/lib/state-md.mjs`: that barrel is
+ * part of the hook import closure (`hooks/_lib/hook-import-set.json`), and no
+ * hook needs the reset. The CLI `scripts/state-md-idle-reset.mjs` imports this
+ * module directly.
+ */
+
+import { parseStateMd, serializeStateMd } from './yaml-parser.mjs';
+import { existsSync } from 'node:fs';
+import { resolveStateMdWriteTarget, updateFrontmatterFields, warnForeignStateMd, writeStateMd } from './frontmatter-mutators.mjs';
+import { parseRecommendations } from './recommendations.mjs';
+
+/** Rule 7: the drift-baseline keys that must not survive into session N+1. */
+const SCOPE_BASELINE_KEYS = [
+  'scope-baseline-intent',
+  'scope-baseline-owner-boundary',
+  'scope-baseline-planned-files',
+  'scope-baseline-session',
+  'scope-baseline-frozen-at',
+];
+
+/** A level-2 heading (`## X`), never a deeper one (`### X`). */
+const H2_RE = /^##(?!#)\s/;
+
+/** Rule 6: heading of the human-readable recommendations copy. */
+const RECOMMENDATIONS_HEADING = '### Recommendations (archived from v1.1 frontmatter)';
+
+/**
+ * Splits a STATE.md body into the text before the first level-2 heading and
+ * one record per level-2 section. Every record keeps its raw lines (heading
+ * included, up to the next level-2 heading), so re-joining an untouched
+ * section is byte-identical.
+ *
+ * KNOWN CEILING: a `## ` line inside a fenced code block is read as a heading,
+ * the same limitation every helper in body-sections.mjs shares. No STATE.md
+ * section observed so far carries fenced code.
+ *
+ * @param {string} body
+ * @returns {{preamble: string[], sections: Array<{heading: string, lines: string[]}>}}
+ */
+function splitSections(body) {
+  const preamble = [];
+  const sections = [];
+  for (const line of body.split('\n')) {
+    if (H2_RE.test(line)) sections.push({ heading: line, lines: [line] });
+    else if (sections.length === 0) preamble.push(line);
+    else sections[sections.length - 1].lines.push(line);
+  }
+  return { preamble, sections };
+}
+
+/** @param {string} heading @param {string} title */
+function isSection(heading, title) {
+  // The title must END there (or open a parenthesis): `## Wave History Archive`
+  // is a different section.
+  return new RegExp(`^##\\s+${title}(?:\\s*\\(|\\s*$)`).test(heading);
+}
+
+/** Drops leading and trailing blank lines. */
+function trimBlankLines(lines) {
+  let start = 0;
+  let end = lines.length;
+  while (start < end && lines[start].trim() === '') start++;
+  while (end > start && lines[end - 1].trim() === '') end--;
+  return lines.slice(start, end);
+}
+
+/** @param {number} x  a ratio in 0..1 */
+function pct(x) {
+  return `${Math.round(x * 100)}%`;
+}
+
+/**
+ * Rule 6: the human-readable copy of the recommendation fields. Null fields
+ * are omitted; `null` overall when there is nothing to show.
+ *
+ * @param {object} frontmatter
+ * @returns {string|null}
+ */
+function renderRecommendationsBlock(frontmatter) {
+  const rec = parseRecommendations(frontmatter);
+  if (rec === null) return null;
+  const bullets = [];
+  if (rec.mode !== null) bullets.push(`- **Recommended mode:** ${rec.mode}`);
+  if (rec.rationale !== null) bullets.push(`- **Rationale:** ${rec.rationale}`);
+  if (rec.completionRate !== null) bullets.push(`- **Completion rate:** ${pct(rec.completionRate)}`);
+  if (rec.carryoverRatio !== null) bullets.push(`- **Carryover ratio:** ${pct(rec.carryoverRatio)}`);
+  if (rec.priorities !== null) {
+    const list = rec.priorities.length > 0 ? rec.priorities.map((id) => `#${id}`).join(', ') : 'none';
+    bullets.push(`- **Top priorities:** ${list}`);
+  }
+  if (bullets.length === 0) return null;
+  return [RECOMMENDATIONS_HEADING, ...bullets].join('\n');
+}
+
+/**
+ * Removes one `### <heading>` subsection (up to the next `### ` or `## ` line).
+ *
+ * @param {string[]} lines
+ * @param {string} heading  the full `### …` line
+ * @returns {string[]}
+ */
+function dropSubsection(lines, heading) {
+  const out = [];
+  let skipping = false;
+  for (const line of lines) {
+    if (line.trimEnd() === heading) skipping = true;
+    else if (skipping && /^#{2,3}\s/.test(line)) skipping = false;
+    if (!skipping) out.push(line);
+  }
+  return out;
+}
+
+/**
+ * Resets a `status: completed` STATE.md to idle (Phase 1.5 § Idle Reset,
+ * Rules 1-7). Pure: string in, result out, no file I/O.
+ *
+ * 1. `status: idle`. 2. `current-wave: 0`. 3. Every `## Wave History` body moves
+ * into a new `## Previous Session` section (appended at the end of the body,
+ * replacing any earlier one) under `### Wave History (<session>)`; the original
+ * section is removed. 4. `## Deviations` keeps its heading with an empty body;
+ * `## What Not To Retry` and `## Open Questions` stay byte-for-byte. 5. Other
+ * frontmatter keys are untouched. 6. The five recommendation keys STAY in the
+ * frontmatter (Phase 7.5 reads them); a readable copy heads `## Previous Session`.
+ * 7. The five `scope-baseline-*` keys are deleted, no other key.
+ *
+ * When neither a Wave History section nor a recommendation exists, an existing
+ * `## Previous Session` is left as it is — there is nothing to replace it with.
+ * With recommendations but no Wave History (a coordinator-direct session), the
+ * earlier archive body stays below the new recommendations block.
+ *
+ * @param {string} contents  STATE.md contents
+ * @returns {{changed: boolean, contents: string, reason?: 'status-not-completed'|'unparseable'}}
+ */
+export function resetStateMdToIdle(contents) {
+  const parsed = parseStateMd(contents);
+  if (parsed === null) return { changed: false, contents, reason: 'unparseable' };
+  if (parsed.frontmatter.status !== 'completed') {
+    return { changed: false, contents, reason: 'status-not-completed' };
+  }
+
+  const { preamble, sections } = splitSections(parsed.body);
+  const waveHistory = sections.filter((s) => isSection(s.heading, 'Wave History'));
+  const recBlock = renderRecommendationsBlock(parsed.frontmatter);
+  const archive = waveHistory.length > 0 || recBlock !== null;
+  // Rule 6 PREPENDS: without a new Wave History, the earlier archive stays below
+  // the fresh recommendations block (minus its own, now superseded, copy).
+  const keptArchive =
+    waveHistory.length === 0
+      ? trimBlankLines(
+          dropSubsection(
+            sections.filter((s) => isSection(s.heading, 'Previous Session')).flatMap((s) => s.lines.slice(1)),
+            RECOMMENDATIONS_HEADING,
+          ),
+        )
+      : [];
+
+  const lines = [...preamble];
+  for (const { heading, lines: own } of sections) {
+    if (isSection(heading, 'Wave History')) continue;
+    if (archive && isSection(heading, 'Previous Session')) continue;
+    lines.push(...(isSection(heading, 'Deviations') ? [heading, ''] : own));
+  }
+
+  let body = lines.join('\n');
+  if (archive) {
+    const blocks = [];
+    if (recBlock !== null) blocks.push(recBlock);
+    if (waveHistory.length > 0) {
+      const session = typeof parsed.frontmatter.session === 'string' ? parsed.frontmatter.session : '';
+      const heading = session ? `### Wave History (${session})` : '### Wave History';
+      const moved = trimBlankLines(waveHistory.flatMap((s) => s.lines.slice(1)));
+      blocks.push([heading, ...moved].join('\n'));
+    }
+    if (keptArchive.length > 0) blocks.push(keptArchive.join('\n'));
+    // Only ever ADD newlines before the new section — trimming would change the
+    // trailing bytes of whatever section now precedes it (possibly WNTR).
+    if (body.length > 0 && !body.endsWith('\n\n')) body += body.endsWith('\n') ? '\n' : '\n\n';
+    body += `## Previous Session\n\n${blocks.join('\n\n')}\n`;
+  }
+
+  const fields = { status: 'idle', 'current-wave': 0 };
+  for (const key of SCOPE_BASELINE_KEYS) fields[key] = null;
+  const next = updateFrontmatterFields(
+    serializeStateMd({ frontmatter: parsed.frontmatter, body }),
+    fields,
+  );
+  return { changed: next !== contents, contents: next };
+}
+
+/**
+ * Applies `resetStateMdToIdle` to the repo's STATE.md under the STATE.md lock
+ * (`writeStateMd`). A missing or empty STATE.md is a no-op with reason `missing`;
+ * when the only STATE.md belongs to another platform's foreign session it is
+ * `foreign-state-md` (#1618), with one stderr WARN naming that file.
+ * A write the size-ceiling / frontmatter-safe guards refuse comes back as
+ * `changed: false` with that guard's reason.
+ *
+ * @param {string} repoRoot  absolute repository root (required)
+ * @param {object} [opts]    passed through to `writeStateMd`
+ * @returns {Promise<{changed: boolean, reason?: string, path: string}>}
+ * @throws {Error} when repoRoot is missing
+ */
+export async function resetStateMdToIdleOnDisk(repoRoot, opts = {}) {
+  if (!repoRoot) {
+    throw new Error(`resetStateMdToIdleOnDisk: repoRoot is required (got ${typeof repoRoot}).`);
+  }
+  // No STATE.md: answer before the lock, which would otherwise create
+  // <repoRoot>/.orchestrator/ in whatever directory a mistyped root names.
+  // Probe the same path writeStateMd will target (#1618), never a foreign one.
+  // The reset is the hand-over that turns the PREVIOUS session's completed
+  // record into idle, so a preferred `status: completed` file qualifies (#1640).
+  const writeOpts = { ...opts, completedHandoff: true };
+  const { path: statePath, rejected } = resolveStateMdWriteTarget(repoRoot, writeOpts);
+  if (!existsSync(statePath)) {
+    if (rejected) warnForeignStateMd('resetStateMdToIdleOnDisk', rejected, statePath);
+    return { changed: false, reason: rejected ? 'foreign-state-md' : 'missing', path: statePath };
+  }
+  let reason;
+  const result = await writeStateMd(
+    repoRoot,
+    (contents) => {
+      if (contents === '') {
+        reason = 'missing';
+        return null;
+      }
+      const reset = resetStateMdToIdle(contents);
+      reason = reset.reason;
+      return reset.changed ? reset.contents : null;
+    },
+    writeOpts,
+  );
+  const out = { changed: result.written, path: result.path };
+  const why = result.reason ?? reason;
+  if (why !== undefined) out.reason = why;
+  return out;
+}

package/scripts/lib/state-md/mission-status.mjs

@@ -23,7 +23,7 @@
  */
 
 import { parseStateMd, serializeStateMd } from './yaml-parser.mjs';
-import { updateFrontmatterFields, writeStateMd } from './frontmatter-mutators.mjs';
+import { resolveStateMdWriteTarget, updateFrontmatterFields, writeStateMd } from './frontmatter-mutators.mjs';
 
 const MISSION_STATUS_HEADING_RE = /^##\s+Mission Status\s*$/;
 const WRITER_TIMESTAMP_SOURCE = '\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{3}Z';
@@ -677,9 +677,13 @@ const REFUSAL_REASONS = Object.freeze({
  */
 export async function setMissionStatusOnDisk(repoRoot, taskId, status, opts = {}) {
   let refused;
+  // A fail-closed write target (#1618) hands an empty buffer; writeStateMd
+  // already names the rejected foreign STATE.md, so do not blame its content.
+  const foreign = resolveStateMdWriteTarget(repoRoot, opts).rejected !== null;
   const result = await writeStateMd(
     repoRoot,
     (contents) => {
+      if (foreign && contents === '') return contents;
       const outcome = setMissionStatusDetailed(contents, taskId, status);
       refused = outcome.refused;
       if (outcome.refused) {

package/scripts/lib/state-md/recommendations.mjs

@@ -37,10 +37,7 @@ export function parseRecommendations(frontmatter) {
   const mode = typeof frontmatter['recommended-mode'] === 'string'
     ? frontmatter['recommended-mode']
     : null;
-  const priorities = Array.isArray(frontmatter['top-priorities'])
-    && frontmatter['top-priorities'].every((x) => Number.isInteger(x))
-    ? frontmatter['top-priorities'].slice()
-    : null;
+  const priorities = parsePriorities(frontmatter['top-priorities']);
   const carryoverRatio = typeof frontmatter['carryover-ratio'] === 'number'
     && !Number.isNaN(frontmatter['carryover-ratio'])
     ? frontmatter['carryover-ratio']
@@ -55,3 +52,28 @@ export function parseRecommendations(frontmatter) {
 
   return { mode, priorities, carryoverRatio, completionRate, rationale };
 }
+
+/** An entry that is exactly an issue reference of THIS repo: `42` or `#42`. */
+const ISSUE_REF_RE = /^#?\d+$/;
+
+/**
+ * Normalises `top-priorities` to issue numbers. Integers pass; strings that are
+ * exactly an issue ref (`"#42"`, `"42"`) become integers; every other entry is
+ * dropped. A hand-written `"#370 fix banner"` or `"other-repo#74"` is never
+ * mined for digits, because the number may belong to another repo. An array
+ * that held entries but keeps none is a type mismatch (`null`), as before.
+ *
+ * @param {unknown} raw
+ * @returns {number[]|null}
+ */
+function parsePriorities(raw) {
+  if (!Array.isArray(raw)) return null;
+  const ids = [];
+  for (const entry of raw) {
+    if (Number.isInteger(entry)) ids.push(entry);
+    else if (typeof entry === 'string' && ISSUE_REF_RE.test(entry.trim())) {
+      ids.push(Number.parseInt(entry.trim().replace('#', ''), 10));
+    }
+  }
+  return raw.length > 0 && ids.length === 0 ? null : ids;
+}

package/scripts/lib/state-md-peer-guard.mjs

@@ -55,6 +55,8 @@ function orderedStateMdCandidates() {
  * @returns {string}  Absolute path (may not exist on disk).
  */
 function _resolveStateMdPath(repoRoot) {
+  // #1636 decision: no ownership filter here — this guard exists to SEE another
+  // session's STATE.md, so a foreign file is its input, not noise to drop.
   const candidates = orderedStateMdCandidates();
   for (const candidate of candidates) {
     const abs = join(repoRoot, candidate);

package/scripts/lib/state-md.mjs

@@ -19,6 +19,7 @@
 import { parseStateMd as _parseStateMd } from './state-md/yaml-parser.mjs';
 import { updateFrontmatterFields as _updateFrontmatterFields } from './state-md/frontmatter-mutators.mjs';
 import { readLock as _readLock } from './session-lock.mjs';
+import { readProcessLocalSessionIds as _readProcessLocalSessionIds } from './session-identity/own-session.mjs';
 
 export { parseStateMd, serializeStateMd } from './state-md/yaml-parser.mjs';
 
@@ -195,27 +196,49 @@ export function resolveSessionStartedAt({ repoRoot } = {}) {
 /**
  * The session ids a STATE.md writer may stamp into frontmatter: `session-id`
  * (the RAW/native harness id) and `session` (the semantic attribution label),
- * both read from the live lock.
+ * both read from the live lock — and `session-id` only when the lock is
+ * provably THIS process's own (#1663).
  *
- * Both fields are `null` when no usable lock exists — ABSENCE IS NEVER
- * COERCED, and a writer must then OMIT the key rather than write a
- * placeholder. Neither id grants ownership of anything (see
+ * The lock is repo-global: a session that lost the acquire race, or a
+ * pre-#1641 lock without `claude_pid` that survives until its TTL, names a
+ * PEER. Since #1661 `/close` decides ownership by comparing STATE.md
+ * `session-id` against `readProcessLocalSessionIds()`, so stamping the peer's
+ * id would make this session's own STATE.md read `foreign` and stop its own
+ * close. Hence:
+ *   - `session_id` is the lock's raw id only when it is contained in
+ *     `readProcessLocalSessionIds({ env })`; otherwise `null`. A process that
+ *     cannot name its own id (Cursor, Pi, Codex without a thread id) gets
+ *     `null` too — unprovable is not own.
+ *   - `semantic_session_id` is `null` when the lock is PROVABLY foreign (this
+ *     process has an id and the lock names another). Ceiling (BV-004): when
+ *     the process has no id at all, the label is still taken from the lock,
+ *     as before #1663, so the #429 label join keeps working on those
+ *     harnesses — it may then name a peer. Revisit when every harness
+ *     exposes a native id.
+ *
+ * ABSENCE IS NEVER COERCED: a writer must OMIT a `null` key rather than write
+ * a placeholder. Neither id grants ownership of anything (see
  * `skills/_shared/state-ownership.md`); `session-id` exists so `/close`'s #429
  * pre-check can join STATE.md to sessions.jsonl on a native identity instead
  * of falling through to the label + timestamp path.
  *
  * Never throws.
  *
- * @param {{ repoRoot?: string }} [opts]
+ * @param {{ repoRoot?: string, env?: object }} [opts]  `env` defaults to
+ *   `process.env`; injectable for tests.
  * @returns {{ session_id: string|null, semantic_session_id: string|null }}
  */
-export function resolveSessionIds({ repoRoot } = {}) {
+export function resolveSessionIds({ repoRoot, env = process.env } = {}) {
   const pick = (value) => (typeof value === 'string' && value.trim().length > 0 ? value.trim() : null);
   try {
     const lock = _readLock({ repoRoot });
+    const lockId = pick(lock?.session_id);
+    const ownIds = _readProcessLocalSessionIds({ env });
+    const own = lockId !== null && ownIds.includes(lockId);
+    const provablyForeign = lockId !== null && ownIds.length > 0 && !own;
     return {
-      session_id: pick(lock?.session_id),
-      semantic_session_id: pick(lock?.semantic_session_id),
+      session_id: own ? lockId : null,
+      semantic_session_id: provablyForeign ? null : pick(lock?.semantic_session_id),
     };
   } catch {
     return { session_id: null, semantic_session_id: null };

package/scripts/lib/sunset/walker.mjs

@@ -42,6 +42,7 @@ import path from 'node:path';
 import { normalizeSkillInvocation } from '../skill-invocations-schema.mjs';
 import { normalizeSkillJudgment } from '../skill-judgments-schema.mjs';
 import { isMainModule } from '../is-main-module.mjs';
+import { resolveLedgerPath } from '../ledger-path.mjs';
 import { userInvocableSkills } from '../user-invocable-skills.mjs';
 
 // ---------------------------------------------------------------------------
@@ -948,15 +949,15 @@ export function runSunsetWalk(repoRoot, opts = {}) {
 
   const subagentsPath =
     opts.subagentsPath ??
-    path.join(repoRoot, '.orchestrator', 'metrics', 'subagents.jsonl');
+    resolveLedgerPath('.orchestrator/metrics/subagents.jsonl', repoRoot);
 
   const invocationsPath =
     opts.invocationsPath ??
-    path.join(repoRoot, '.orchestrator', 'metrics', 'skill-invocations.jsonl');
+    resolveLedgerPath('.orchestrator/metrics/skill-invocations.jsonl', repoRoot);
 
   const judgmentsPath =
     opts.judgmentsPath ??
-    path.join(repoRoot, '.orchestrator', 'metrics', 'skill-judgments.jsonl');
+    resolveLedgerPath('.orchestrator/metrics/skill-judgments.jsonl', repoRoot);
 
   const surface = enumerateSurface(repoRoot);
   const dispatch = readDispatchCounts(subagentsPath, { windowDays, now: nowMs });

package/scripts/lib/telemetry/consent.mjs

@@ -159,11 +159,13 @@ export function readTelemetryState({ path } = {}) {
 export function writeTelemetryState(record, { path } = {}) {
   const target = path || TELEMETRY_JSON_PATH;
   try {
-    mkdirSync(dirname(target), { recursive: true });
+    // 0o700: the default target is the private config dir, which must not come
+    // out 0777 under umask 000 (#1629).
+    mkdirSync(dirname(target), { recursive: true, mode: 0o700 });
   } catch (err) {
     return { ok: false, error: err?.message ?? String(err) };
   }
-  const res = writeJsonAtomicSync(target, record);
+  const res = writeJsonAtomicSync(target, record, { mode: 0o600 }); // consent + anon_id are host-private (#1632)
   return res.ok ? { ok: true } : { ok: false, error: res.error };
 }
 

package/scripts/lib/telemetry/queue.mjs

@@ -91,7 +91,7 @@ function _serializedByteLength(entries) {
  * via tmp-file + `renameSync` in the SAME directory (same-filesystem rename
  * is atomic on POSIX — mirrors `writeJsonAtomicSync` in `scripts/lib/io.mjs`,
  * which has no NDJSON-array variant). Creates the parent directory with
- * `mkdirSync(dir, { recursive: true })` first.
+ * `mkdirSync(dir, { recursive: true, mode: 0o700 })` first.
  *
  * @param {string} filePath
  * @param {Array<object>} entries
@@ -101,10 +101,10 @@ function _serializedByteLength(entries) {
  */
 function _writeEntriesAtomicSync(filePath, entries) {
   const dir = dirname(filePath);
-  mkdirSync(dir, { recursive: true });
+  mkdirSync(dir, { recursive: true, mode: 0o700 }); // private config dir; 0777 under umask 000 otherwise (#1629)
   const tmpSuffix = randomBytes(6).toString('hex');
   const tmpFile = join(dir, `.tmp.${tmpSuffix}`);
-  writeFileSync(tmpFile, _toNdjson(entries), 'utf8');
+  writeFileSync(tmpFile, _toNdjson(entries), { encoding: 'utf8', mode: 0o600 }); // rename keeps this mode (#1632)
   renameSync(tmpFile, filePath);
 }
 

package/scripts/lib/telemetry/sync.mjs

@@ -23,9 +23,10 @@
  * queue (bounded, oldest-dropped) and the session closes with zero user-facing
  * error.
  *
- * Node ESM. The only network dependency is the global `fetch`.
+ * Node ESM. Networking uses the Stdlib HTTP helper.
  */
 
+import { httpRequest } from '../http-request.mjs';
 import path from 'node:path';
 import os from 'node:os';
 import fs from 'node:fs';
@@ -43,10 +44,11 @@ import { loadOwnerConfig } from '../owner-yaml.mjs';
 import { readJsonlFile } from '../io.mjs';
 import { readEventsWithRotations } from '../events.mjs';
 import { resolveEventsLedgerRoot } from '../platform.mjs';
+import { resolveLedgerPath } from '../ledger-path.mjs';
 import { readCanonicalSessions } from '../sessions-canonical.mjs';
 import { resolvePrivateConfigDir } from '../config/private-config-dir.mjs';
 import { readSessionProfile } from '../state-md.mjs';
-import { resolveStateMdPath } from '../state-md/frontmatter-mutators.mjs';
+import { resolveStateMdWriteTarget } from '../state-md/frontmatter-mutators.mjs';
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -73,7 +75,7 @@ function resolveEndpoint(env) {
 
 /**
  * The default network sender: one POST carrying the whole batch array as the
- * JSON body (the server accepts arrays), with an AbortSignal timeout. Resolves
+ * JSON body (the server accepts arrays), with a wall-clock timeout. Resolves
  * on a 2xx status, rejects on anything else (which routes the caller into the
  * offline queue).
  *
@@ -85,11 +87,12 @@ function resolveEndpoint(env) {
 function defaultSender({ env, timeoutMs }) {
   const endpoint = resolveEndpoint(env);
   return async (batches) => {
-    const res = await fetch(endpoint, {
+    const res = await httpRequest(endpoint, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify(batches),
-      signal: AbortSignal.timeout(timeoutMs),
+      timeoutMs,
+      maxBytes: 64 * 1024,
     });
     if (!res.ok) {
       // The status travels ON the error: `flush` needs it to tell a TRANSPORT
@@ -307,7 +310,15 @@ export function readSessionProfileForMetricsDir(metricsDir) {
     // metricsDir is `<repoRoot>/.orchestrator/metrics` by construction (every
     // caller builds it that way); two levels up is the repo root.
     const repoRoot = path.resolve(metricsDir, '..', '..');
-    return readSessionProfile(fs.readFileSync(resolveStateMdPath(repoRoot), 'utf8'));
+    // #1636: the write side's ownership rule — another platform's STATE.md not
+    // proven to be this process's is no profile source (ABSENT IS NOT EMPTY:
+    // null ⇒ the ping omits the field). Deliberately NO warnForeignStateMd line:
+    // this runs inside flush, which the hooks call in-process at SessionEnd or
+    // spawn detached with `stdio: 'ignore'` — the line would be hook noise or
+    // lost, and an omitted optional field needs no operator action.
+    const { path: stateMdPath, rejected } = resolveStateMdWriteTarget(repoRoot);
+    if (rejected) return null;
+    return readSessionProfile(fs.readFileSync(stateMdPath, 'utf8'));
   } catch {
     return null;
   }
@@ -494,6 +505,23 @@ export function deriveSessionFromEvents(metricsDir) {
   }
 }
 
+/**
+ * `skill-invocations.jsonl` for the metrics dir `metricsDir` (#1722): a
+ * `<root>/.orchestrator/metrics` dir resolves through {@link resolveLedgerPath}
+ * for `<root>` — the main checkout's ledger when `<root>` is a linked worktree
+ * that ignores it, else the dir's own — and any other dir is read as given.
+ *
+ * @param {string} metricsDir
+ * @returns {string}
+ */
+function skillInvocationsPathFor(metricsDir) {
+  const parent = path.dirname(metricsDir);
+  if (path.basename(metricsDir) === 'metrics' && path.basename(parent) === '.orchestrator') {
+    return resolveLedgerPath('.orchestrator/metrics/skill-invocations.jsonl', path.dirname(parent));
+  }
+  return path.join(metricsDir, 'skill-invocations.jsonl');
+}
+
 /**
  * Build ONE whitelist-projected usage-ping record from the local JSONL streams.
  *
@@ -537,11 +565,19 @@ export function buildBatch({
   consentState,
 } = {}) {
   try {
+    // `dir` stays the caller's metrics dir: STATE.md and the events fallback
+    // below derive their own roots from it.
+    // ledger-root: the caller's dir as given; each ledger in it resolves below
     const dir = metricsDir || path.join(process.cwd(), '.orchestrator', 'metrics');
     const nowIso = now || new Date().toISOString();
 
-    const sessions = readCanonicalSessions({ filePath: path.join(dir, 'sessions.jsonl') });
-    const invocations = readJsonlFile(path.join(dir, 'skill-invocations.jsonl'), { skipInvalid: true });
+    // #1722: each ledger resolves on its own, an explicit metricsDir included
+    // (the SessionEnd flush hands over the LAUNCH dir's, which is a linked
+    // worktree for a session started there; deriveSessionFromEvents maps the
+    // events fallback the same way) — sessions via the one-ledger root
+    // (#1514/#1584), skill-invocations via skillInvocationsPathFor().
+    const sessions = readCanonicalSessions({ filePath: path.join(resolveEventsLedgerRoot(dir), 'sessions.jsonl') });
+    const invocations = readJsonlFile(skillInvocationsPathFor(dir), { skipInvalid: true });
 
     const sessionRecord = mostRecentSession(sessions);
 
@@ -855,7 +891,7 @@ export function shouldDailyFlush({ statePath, queuePath, metricsDir, now = Date.
     //     (271 records / 292 KB in this repo, 2026-08-23) that is sub-millisecond
     //     and it only runs once the 24h gate above has already passed. Revisit
     //     with a tail-read if any repo's sessions.jsonl passes ~10 MB.
-    const dir = metricsDir || path.join(process.cwd(), '.orchestrator', 'metrics');
+    const dir = metricsDir || path.join(resolveEventsLedgerRoot(process.cwd()), '.orchestrator', 'metrics');
     const sessions = readCanonicalSessions({ filePath: path.join(dir, 'sessions.jsonl') });
     const last = mostRecentSession(sessions);
     const completedMs = Date.parse(last?.completed_at);

package/scripts/lib/test-runner/artifact-paths.mjs

@@ -17,6 +17,7 @@
  */
 
 import path from 'node:path';
+import { resolveLedgerPath } from '../ledger-path.mjs';
 
 const ROLLUP_REL = '.orchestrator/metrics/test-runs.jsonl';
 const TEST_RUNS_REL = '.orchestrator/metrics/test-runs';
@@ -62,6 +63,7 @@ export function makeRunId() {
  * @throws {TypeError} on an invalid runId (see {@link assertRunId})
  */
 export function runDirPath(runId) {
+  // ledger-root: per-run artifact dir of this working tree, kept local
   return path.join(TEST_RUNS_REL, assertRunId(runId));
 }
 
@@ -112,8 +114,14 @@ export function consoleLogPath(runId) {
 
 /**
  * Path to the shared JSONL rollup file (across all runs).
+ *
+ * Without `repoRoot` it is the repo-relative constant. With `repoRoot` it is
+ * the absolute ledger path, routed to the main checkout when `repoRoot` is a
+ * linked worktree of a repo that ignores the rollup (#1722).
+ *
+ * @param {string} [repoRoot]
  * @returns {string}
  */
-export function jsonlRollupPath() {
-  return ROLLUP_REL;
+export function jsonlRollupPath(repoRoot) {
+  return typeof repoRoot === 'string' && repoRoot !== '' ? resolveLedgerPath(ROLLUP_REL, repoRoot) : ROLLUP_REL;
 }