session-orchestrator 5.11.0 → 5.13.0

package/scripts/lib/vault-mirror/process.mjs

@@ -10,7 +10,7 @@ import { basename, join, resolve, sep } from 'node:path';
 import { createRequire } from 'node:module';
 import { randomUUID } from 'node:crypto';
 import { createSecretValueMasker } from '../secret-masker.mjs';
-import { subjectToSlug, isValidSlug, uuidPrefix8, recordKeySuffix8, toDate, parseFrontmatter } from './utils.mjs';
+import { subjectToSlug, legacySubjectToSlug, isValidSlug, uuidPrefix8, recordKeySuffix8, toDate, parseFrontmatter, slugifyIdSafe, noteIdFor, noteIdMatches, withNoteId } from './utils.mjs';
 import { isRealSession } from '../session-schema/filters.mjs';
 import { resolveRepoNamespace } from './namespace.mjs';
 import { detectLearningSchema, normalizeLearningEntry, generateLearningNote, generateLearningNoteV2, learningSourceRecord } from './render-learnings.mjs';
@@ -19,13 +19,13 @@ import { emitMirrorEvent } from './telemetry.mjs';
 import {
   ARCHIVE_ROOT,
   canonicalNamespace,
-  legacyConcatSlug,
   noteNarrativeChars,
   markArchived,
   noteInsightKey,
   renderRollup,
   rollupRelPath,
   rollupRowFromNote,
+  section,
   sessionNarrativeChars,
 } from './retention.mjs';
 
@@ -269,6 +269,23 @@ export function matchesModuloRedaction(existingVal, renderedVal) {
   return new RegExp(`^${pattern}$`).test(renderedVal);
 }
 
+/**
+ * Does a session note on disk carry LESS free text than the record (#1513
+ * review H2), so it must be re-rendered? Not when the only difference is a
+ * `[REDACTED]` span (#1025): `[REDACTED]` and the raw value differ in length,
+ * so the bare char-count compare reported "stale" whenever the secret was
+ * missing from the current env and re-rendered the note WITH the raw value.
+ * Found while pinning #1601 (release-review HOCH 1, MR !148).
+ *
+ * @param {string} existingContent
+ * @param {string} renderedBody
+ * @returns {boolean}
+ */
+function sessionNotesStale(existingContent, renderedBody) {
+  if (noteNarrativeChars(existingContent) === noteNarrativeChars(renderedBody)) return false;
+  return !matchesModuloRedaction(section(existingContent, 'Notes') ?? '', section(renderedBody, 'Notes') ?? '');
+}
+
 /**
  * Return true when the existing vault note content and the freshly-rendered
  * candidate share identical canonical fields (i.e. no meaningful update needed).
@@ -450,17 +467,6 @@ function disambigSlugFor(dir, slug, { legacyId, recordKey }) {
   return { slug: hashed, exists: null };
 }
 
-/**
- * Replace the frontmatter `id:` line of a note — used when a displaced note
- * moves to its disambiguated name (#1506.2), whose `id` must match the file.
- * @param {string} content
- * @param {string} id
- * @returns {string}
- */
-function withNoteId(content, id) {
-  return content.replace(/^id: .*$/m, `id: ${id}`);
-}
-
 /**
  * Emit `skipped-foreign-owner` for a note the writer must not touch: one stderr
  * `SKIP` line (vault-relative path, like every other SKIP line) and the stdout
@@ -904,7 +910,7 @@ function maskEntrySecrets(entry) {
  * @param {'v1'|'v2'} schema
  * @returns {string}
  */
-function learningSlug(entry, schema) {
+function learningSlug(entry, schema, slugger = learningNameSlugger(entry)) {
   const entryId = entry.id;
   let slugSource;
   if (schema === 'v2') {
@@ -916,7 +922,7 @@ function learningSlug(entry, schema) {
   }
   let slug;
   if (typeof slugSource === 'string' && slugSource.length > 0) {
-    slug = subjectToSlug(slugSource);
+    slug = slugger(slugSource);
   } else {
     slug = '';
   }
@@ -936,6 +942,62 @@ function learningSlug(entry, schema) {
 }
 
 
+/** A record without representable provenance (v1 or v2) keeps its historical name. */
+function learningNameSlugger(entry) {
+  return learningSourceRecord(entry) === null ? legacySubjectToSlug : subjectToSlug;
+}
+
+/** Compare BEFORE filename capping so a changed concatenated name is protected. */
+function hasLearningSlugTransition(entry, schema) {
+  if (learningNameSlugger(entry) === legacySubjectToSlug) return false;
+  const source = schema === 'v2' ? entry.id : entry.subject;
+  if (typeof source !== 'string' || source.length === 0) return false;
+  const normalized = schema === 'v1' ? source.trim().replace(/\s+/g, '-') : source;
+  return subjectToSlug(normalized) !== legacySubjectToSlug(normalized) ||
+    (schema === 'v1' && subjectToSlug(source) !== legacySubjectToSlug(source));
+}
+
+function historicalConcatSlug(subject) {
+  if (typeof subject !== 'string') return '';
+  return legacySubjectToSlug(subject);
+}
+
+/** All historical names, including both generations of disambiguation suffix. */
+function learningSlugVariants(entry, schema) {
+  const bases = new Set([learningSlug(entry, schema), learningSlug(entry, schema, legacySubjectToSlug)]);
+  if (schema === 'v1') {
+    const concat = historicalConcatSlug(entry.subject);
+    if (isValidSlug(concat)) {
+      bases.add(concat);
+      if (concat.length > 240) bases.add(concat.slice(0, 240).replace(/-+$/, ''));
+    }
+  }
+  const names = new Set(bases);
+  const id = String(entry.id);
+  for (const base of bases) {
+    names.add(`${base}-${uuidPrefix8(id)}`);
+    names.add(`${base}-${recordKeySuffix8(learningSourceRecord(entry) ?? id)}`);
+  }
+  return [...names];
+}
+
+/**
+ * Does the note `fm` name `slug`? #1601/#1602: its `id` is the bare slug (a note
+ * written before the namespaced id) or the slug namespaced under the writer's
+ * folder or under the note's OWN `source-repo` — a moved or relabelled note keeps
+ * its old prefix, and the folder, not the label, decides ownership (#1503 F1).
+ */
+function fmNamesSlug(fm, slug, repoNs) {
+  return Boolean(fm) && (noteIdMatches(fm['id'], slug, repoNs) || noteIdMatches(fm['id'], slug, fm['source-repo']));
+}
+
+/** Only explicit, exact provenance permits assigning an old name to a record. */
+function positiveLearningOwner(fm, name, repoNs, recordKey) {
+  return recordKey !== null && notOurGenerator(fm) === null &&
+    fmNamesSlug(fm, name, repoNs) && fm['source-record'] === recordKey && fm['source-repo'] === repoNs;
+}
+
+
 export async function processLearning(rawEntry, _lineNum, ctx) {
   const {
     vaultDir,
@@ -1023,10 +1085,8 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
   // #1513 review M2: a hyphen alias (`gotzendorferv2`) resolves to the
   // canonical folder already in the vault (`gotzendorfer-v2`), so the mirror
   // and the pruner agree on where a repo's notes live.
-  const repoNs = canonicalNamespace(
-    vaultDir,
-    resolveRepoNamespace({ vaultName: ctx?.vaultName ?? null, repoRoot: ctx?.repoRoot ?? null }),
-  );
+  const stableNs = resolveRepoNamespace({ vaultName: ctx?.vaultName ?? null, repoRoot: ctx?.repoRoot ?? null });
+  const repoNs = canonicalNamespace(vaultDir, stableNs);
   // #725 D2: thread the resolved repo namespace into the learning frontmatter as
   // `source-repo` for cross-repo attribution. repoNs is already sanitised +
   // leak-guarded by resolveRepoNamespace, so it is safe to interpolate as-is. The
@@ -1075,18 +1135,56 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
     return null;
   };
   const targetDir = join(resolve(vaultDir), '40-learnings', repoNs);
-  if (!dryRun) mkdirSync(targetDir, { recursive: true });
 
   let targetPath = join(targetDir, `${slug}.md`);
 
+  // #1548: inspect EVERY candidate before mutation when normalization changes
+  // a name. Missing/foreign/ambiguous provenance is not permission to create a
+  // second note, including under --force. Keep the actual flat or namespace path.
+  const slugTransition = hasLearningSlugTransition(entry, schema);
+  if (slugTransition) {
+    const matches = [];
+    for (const dir of [targetDir, join(resolve(vaultDir), '40-learnings')]) {
+      for (const name of learningSlugVariants(entry, schema)) {
+        const path = join(dir, `${name}.md`);
+        if (!existsSync(path)) continue;
+        const fm = parseFrontmatter(readFileSync(path, 'utf8'));
+        matches.push({ path, name, valid: positiveLearningOwner(fm, name, repoNs, writer.recordKey) });
+      }
+    }
+    if (matches.length > 1 || matches.some((match) => !match.valid)) {
+      return emitEntryAction(_lineNum, ctx, {
+        action: 'skipped-foreign-owner', path: null, id: entryId,
+        meta: { reason: 'slug transition: ambiguous or missing/contradictory provenance' },
+      });
+    }
+    if (matches.length === 1) {
+      slug = matches[0].name;
+      targetPath = matches[0].path;
+    }
+  }
+
+  // A provenance-less flat v2 note cannot be assigned to this namespace.
+  // Keep it untouched rather than creating a second copy on an advanced date.
+  if (schema === 'v2' && writer.recordKey === null &&
+      learningSlugVariants(entry, schema).some((name) =>
+        existsSync(join(resolve(vaultDir), '40-learnings', name + '.md')))) {
+    return emitEntryAction(_lineNum, ctx, {
+      action: 'skipped-foreign-owner', path: null, id: entryId,
+      meta: { reason: 'flat note: missing representable source provenance' },
+    });
+  }
+
+  if (!dryRun) mkdirSync(targetDir, { recursive: true });
+
   // #1513 LEGACY SLUG: until #725 D1 a v1 subject was slugged WITHOUT the
   // whitespace → hyphen pre-map ("3parallelimplagents…"); the canonical form
   // hyphenates ("3-parallel-impl-agents…"). When only the legacy variant of
   // THIS record's note exists, it IS the note: it is updated in place under
   // its own name instead of a second file being created beside it (the vault
   // carried 364 such twins). New notes always get the canonical name.
-  if (schema === 'v1') {
-    const legacySlug = legacyConcatSlug(entry.subject);
+  if (!slugTransition && schema === 'v1') {
+    const legacySlug = historicalConcatSlug(entry.subject);
     const flatDir = join(resolve(vaultDir), '40-learnings');
     if (
       isValidSlug(legacySlug) &&
@@ -1100,11 +1198,13 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
         const legacyFm = parseFrontmatter(readFileSync(legacyPath, 'utf8'));
         if (
           notOurGenerator(legacyFm) === null &&
-          legacyFm['id'] === legacySlug &&
+          fmNamesSlug(legacyFm, legacySlug, repoNs) &&
           foreignOwnerReason(legacyFm, writer) === null
         ) {
           slug = legacySlug;
-          targetPath = join(targetDir, `${legacySlug}.md`);
+          targetPath = positiveLearningOwner(legacyFm, legacySlug, repoNs, writer.recordKey)
+            ? legacyPath
+            : join(targetDir, `${legacySlug}.md`);
           break;
         }
       }
@@ -1114,8 +1214,8 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
   // #660 IDEMPOTENCY DUAL-PROBE: before treating the namespaced path as absent,
   // also check the legacy flat path. If a note with the same slug already exists
   // in the flat layout (pre-namespace migration), treat it as existing to avoid
-  // duplicating the note. The deferred-migration decision means we only skip;
-  // we do NOT move the flat note into the namespaced dir here.
+  // duplicating the note. Positive provenance also permits an update at the
+  // actual flat path; notes without that evidence keep their historical rules.
   const legacyFlatPath = join(resolve(vaultDir), '40-learnings', `${slug}.md`);
   // Set when a still-leaking legacy flat note was healed in place below, so the
   // action emitted for THIS entry can say so (see the write sites at the end).
@@ -1137,12 +1237,16 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
     // neither a duplicate to skip on nor a file to rewrite with THIS record's
     // content; this entry proceeds to its own namespaced path (a different
     // file). A leak in it is masked in place, keeping its owner and content.
-    const legacyMarked = Boolean(legacyFm) && legacyFm['_generator'] === GENERATOR_MARKER && legacyFm['id'] === slug;
+    const legacyMarked = Boolean(legacyFm) && legacyFm['_generator'] === GENERATOR_MARKER && fmNamesSlug(legacyFm, slug, repoNs);
     const legacyForeign = legacyMarked && foreignOwnerReason(legacyFm, writer) !== null;
     if (legacyForeign && legacyStillLeaks) {
       healedForeignLeak = maskForeignNoteInPlace(legacyFlatPath, legacyContent, ctx);
     }
-    if (legacyMarked && !legacyForeign) {
+    if (positiveLearningOwner(legacyFm, slug, repoNs, writer.recordKey)) {
+      // A proven flat note is the update target. Let the common existing-note
+      // branch below compare/render/heal it ONCE; never pre-write a healed copy.
+      targetPath = legacyFlatPath;
+    } else if (legacyMarked && !legacyForeign) {
       const entryUpdated = toDate(dateSource);
       if (!force && legacyFm['updated'] && legacyFm['updated'] >= entryUpdated) {
         // Date has not advanced — but content may have changed (confidence, insight, etc.).
@@ -1152,6 +1256,9 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
           // #1028 residue 1: the five-field compare cannot see a raw secret
           // sitting in a non-canonical field (e.g. `evidence`) — the
           // `legacyStillLeaks` probe above is what makes this match trustworthy.
+          // #1601: `id` is not a compared field, and a schema-violating old id
+          // is NOT a reason to rewrite here — re-rendering would bring back
+          // plaintext a past run masked (#1025). `migrate-ids.mjs` repairs it.
           return emitEntryAction(_lineNum, ctx, { action: 'skipped-noop', path: legacyFlatPath, id: slug });
         }
         // Content differs, or the on-disk note still leaks under the current
@@ -1220,7 +1327,7 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
     const entryDay = toDate(dateSource);
     if (
       routedByRecord &&
-      fm['id'] === slug &&
+      fmNamesSlug(fm, slug, repoNs) &&
       !expired &&
       /^\d{4}-\d{2}-\d{2}$/.test(entryDay) &&
       typeof fm['created'] === 'string' &&
@@ -1233,7 +1340,7 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
       if (takenOver !== null) return takenOver;
     }
 
-    if (fm['id'] !== slug || routedByRecord) {
+    if (!fmNamesSlug(fm, slug, repoNs) || routedByRecord) {
       // Different id (or different record) → collision: disambiguate
       const picked = disambigSlugFor(targetDir, slug, {
         legacyId: String(entryId),
@@ -1313,8 +1420,8 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
 
     // #1506.2: the main note is this record's — a live disambiguation copy of
     // the same record (left by an interrupted takeover) is superseded.
-    const stale = fm['source-record'] === writer.recordKey
-      ? staleOwnDisambig(targetDir, slug, entryId, writer)
+    const stale = !slugTransition && fm['source-record'] === writer.recordKey
+      ? staleOwnDisambig(targetDir, slug, entryId, writer, repoNs)
       : null;
 
     // Same id: check if updated would advance (unless --force overrides).
@@ -1327,6 +1434,9 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
       if (learningContentMatches(existingContent, candidateContent)) {
         // #1028 residue 1: probe the on-disk content against the CURRENT masker
         // before trusting the five-field match — see maskerWouldChange above.
+        // #1601: `id` is deliberately NOT part of this decision — an id-only
+        // difference must never re-render the note (that would bring back
+        // plaintext a past run masked, #1025); `migrate-ids.mjs` repairs it.
         mainUnchanged = !maskerWouldChange(existingContent);
       }
       // Content differs, or the on-disk note still leaks under the current env —
@@ -1351,14 +1461,19 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
       return emitEntryAction(_lineNum, ctx, { action: 'skipped-noop', path: targetPath, id: slug });
     }
 
-    // Overwrite with advanced updated date (or forced re-render)
+    // Overwrite with advanced updated date (or forced re-render). A retained
+    // flat note, including an old Unicode slug, is healed by this single write.
     const content = generator(entry, slug, generatorOpts);
+    healedLegacyFlat = !dryRun && targetPath === legacyFlatPath && maskerWouldChange(existingContent);
     if (!dryRun) writeFileSync(targetPath, content, 'utf8');
     return emitEntryAction(_lineNum, ctx, {
       action: 'updated',
       path: targetPath,
       id: slug,
-      ...(stale !== null ? { meta: { superseded_id: basename(stale.path, '.md') } } : {}),
+      ...((stale !== null || healedLegacyFlat) ? { meta: {
+        ...(stale !== null ? { superseded_id: basename(stale.path, '.md') } : {}),
+        ...(healedLegacyFlat ? { healed_legacy_flat: true } : {}),
+      } } : {}),
     });
   }
 
@@ -1388,14 +1503,14 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
  *
  * @returns {{ path: string, next: string }|null} the rewrite, or null.
  */
-function staleOwnDisambig(targetDir, slug, entryId, writer) {
+function staleOwnDisambig(targetDir, slug, entryId, writer, repoNs) {
   if (typeof writer.recordKey !== 'string') return null;
   const own = disambigSlugFor(targetDir, slug, { legacyId: String(entryId), recordKey: writer.recordKey });
   const path = join(targetDir, `${own.slug}.md`);
   if (!(own.exists ?? existsSync(path))) return null;
   const content = readFileSync(path, 'utf8');
   const fm = parseFrontmatter(content);
-  if (notOurGenerator(fm) !== null || fm['source-record'] !== writer.recordKey || fm['id'] !== own.slug) return null;
+  if (notOurGenerator(fm) !== null || fm['source-record'] !== writer.recordKey || !fmNamesSlug(fm, own.slug, repoNs)) return null;
   const next = markArchived(content, 'superseded');
   return next === content ? null : { path, next };
 }
@@ -1425,14 +1540,14 @@ function takeOverMainNote({
     if (notOurGenerator(dfm) !== null || dfm['source-record'] !== displacedKey) return null;
   }
 
-  const ownStale = staleOwnDisambig(targetDir, slug, entryId, writer);
+  const ownStale = staleOwnDisambig(targetDir, slug, entryId, writer, generatorOpts.repoNs);
 
   if (!dryRun) {
     // Re-read: an in-place leak heal above may have rewritten the note.
     const current = readFileSync(targetPath, 'utf8');
     // Rewritten even when it exists (and is ours, checked above): a stale copy
     // there may carry `status: archived` from an earlier archive pass.
-    writeFileSync(displacedPath, withNoteId(current, displaced.slug), 'utf8');
+    writeFileSync(displacedPath, withNoteId(current, noteIdFor(generatorOpts.repoNs, displaced.slug)), 'utf8');
     // Before the main note: a crash between the two writes must leave the
     // takeover re-runnable (the main note still foreign), never a main note of
     // ours beside a stale live disambiguation note of the same record.
@@ -1465,17 +1580,7 @@ function takeOverMainNote({
 export function learningNoteSlugs(rawEntry) {
   const entry = normalizeLearningEntry(rawEntry);
   if (!entry || entry.id === null || entry.id === undefined) return [];
-  const schema = detectLearningSchema(entry);
-  const slugs = [learningSlug(entry, schema)];
-  if (schema === 'v1') {
-    const legacy = legacyConcatSlug(entry.subject);
-    if (isValidSlug(legacy) && !slugs.includes(legacy)) slugs.push(legacy);
-  }
-  const id = String(entry.id);
-  for (const name of [`${slugs[0]}-${uuidPrefix8(id)}`, `${slugs[0]}-${recordKeySuffix8(learningSourceRecord(entry) ?? id)}`]) {
-    if (!slugs.includes(name)) slugs.push(name);
-  }
-  return slugs;
+  return learningSlugVariants(entry, detectLearningSchema(entry));
 }
 
 /**
@@ -1515,20 +1620,43 @@ export async function processArchivedLearning(rawEntry, _lineNum, ctx) {
       meta: { reason: 'archived record: a live record owns this note' },
     });
   if (names.length === 0) return liveOwned();
-  const repoNs = canonicalNamespace(
-    vaultDir,
-    resolveRepoNamespace({ vaultName: ctx?.vaultName ?? null, repoRoot: ctx?.repoRoot ?? null }),
-  );
+  const stableNs = resolveRepoNamespace({ vaultName: ctx?.vaultName ?? null, repoRoot: ctx?.repoRoot ?? null });
+  const repoNs = canonicalNamespace(vaultDir, stableNs);
   const nsDir = join(resolve(vaultDir), '40-learnings', repoNs);
   const flatDir = join(resolve(vaultDir), '40-learnings');
   const writer = { recordKey: learningSourceRecord(entry) };
+  const schema = detectLearningSchema(entry);
+  if (schema === 'v2' && writer.recordKey === null &&
+      allNames.some((name) => existsSync(join(flatDir, name + '.md')))) {
+    return emitEntryAction(_lineNum, ctx, {
+      action: 'skipped-foreign-owner', path: null, id: entry.id,
+      meta: { reason: 'flat note: missing representable source provenance' },
+    });
+  }
+  if (hasLearningSlugTransition(entry, schema)) {
+    const matches = [];
+    for (const dir of [nsDir, flatDir]) {
+      for (const name of allNames) {
+        const path = join(dir, `${name}.md`);
+        if (!existsSync(path)) continue;
+        const fm = parseFrontmatter(readFileSync(path, 'utf8'));
+        matches.push(positiveLearningOwner(fm, name, repoNs, writer.recordKey));
+      }
+    }
+    if (matches.length > 1 || matches.some((valid) => !valid)) {
+      return emitEntryAction(_lineNum, ctx, {
+        action: 'skipped-foreign-owner', path: null, id: entry.id,
+        meta: { reason: 'slug transition: ambiguous or missing/contradictory provenance' },
+      });
+    }
+  }
   for (const dir of [nsDir, flatDir]) {
     for (const name of names) {
       const path = join(dir, `${name}.md`);
       if (!existsSync(path)) continue;
       const content = readFileSync(path, 'utf8');
       const fm = parseFrontmatter(content);
-      if (notOurGenerator(fm) !== null || fm['id'] !== name) continue;
+      if (notOurGenerator(fm) !== null || !fmNamesSlug(fm, name, repoNs)) continue;
       if (foreignOwnerReason(fm, writer) !== null) continue;
       const next = markArchived(content, reason);
       if (next === content) {
@@ -1615,8 +1743,8 @@ export async function processSession(rawEntry, _lineNum, ctx) {
   const generator =
     schema === 'v3' ? generateSessionNoteV3 : schema === 'v2' ? generateSessionNoteV2 : generateSessionNote;
 
-  // Validate session_id as a filesystem-safe slug; fall back via subjectToSlug
-  // (which collapses slashes to last segment + strips invalid chars) before
+  // Validate session_id as a filesystem-safe slug; preserve old Session identity
+  // with the historical sanitizer (collapse slash paths + strip invalid chars), before
   // resorting to a uuid-derived slug. Without subjectToSlug, raw slashes in
   // rawSessionId (e.g. "feat/opus-4-7-...") would survive uuidPrefix8 and
   // produce a path with directory separators in the basename.
@@ -1624,7 +1752,7 @@ export async function processSession(rawEntry, _lineNum, ctx) {
   if (isValidSlug(rawSessionId)) {
     session_id = rawSessionId;
   } else if (typeof rawSessionId === 'string' && rawSessionId.length > 0) {
-    const sanitised = subjectToSlug(rawSessionId);
+    const sanitised = legacySubjectToSlug(rawSessionId);
     session_id = isValidSlug(sanitised) ? sanitised : `session-${uuidPrefix8(rawSessionId)}`;
   } else {
     session_id = `session-${uuidPrefix8(randomUUID())}`;
@@ -1671,10 +1799,8 @@ export async function processSession(rawEntry, _lineNum, ctx) {
   // owner-leaky repo's real name reached the vault through the session-note
   // frontmatter even though the directory AND the learning `source-repo` field
   // were already pseudonym-mapped/redacted (#732 leak-guard bypass).
-  const repoNs = canonicalNamespace(
-    vaultDir,
-    resolveRepoNamespace({ vaultName: ctx?.vaultName ?? null, repoRoot: ctx?.repoRoot ?? null }),
-  );
+  const stableNs = resolveRepoNamespace({ vaultName: ctx?.vaultName ?? null, repoRoot: ctx?.repoRoot ?? null });
+  const repoNs = canonicalNamespace(vaultDir, stableNs);
 
   // Narrative gate (#1513, replaces the PRD F1.2 rendered-length gate). A
   // session gets its own note only when its FREE-TEXT fields (`notes`,
@@ -1714,6 +1840,12 @@ export async function processSession(rawEntry, _lineNum, ctx) {
   // (`subjectToSlug`), caps at 240 chars, or falls back to a uuid slug. A note
   // carrying either id is this record's own note.
   const renderedId = parseFrontmatter(renderedBody)?.id;
+  // #1601/#1602: a note written before the namespaced id carries the bare slug
+  // (`session_id`, or the renderer's whitespace-hyphenated slug); either form,
+  // with or without the repo prefix, names this session.
+  const legacyRenderedId = slugifyIdSafe(rawSessionId) ?? session_id;
+  const isOwnSessionId = (fm) =>
+    fm['id'] === renderedId || fmNamesSlug(fm, session_id, repoNs) || fmNamesSlug(fm, legacyRenderedId, repoNs);
 
   // Canonical filename pattern (issue #343): `<session_id>.md` where session_id
   // follows `<branch>-<YYYY-MM-DD>-<HHmm>-<slug>` per the session-id schema.
@@ -1740,14 +1872,14 @@ export async function processSession(rawEntry, _lineNum, ctx) {
     const legacyStillLeaks = legacyFm !== null && maskerWouldChange(legacyContent);
     // #1503: a flat note from a foreign record is not ours — see processLearning's
     // dual-probe. A leak in it is masked in place, keeping its owner and content.
-    const legacyMarked = Boolean(legacyFm) && legacyFm['_generator'] === GENERATOR_MARKER && legacyFm['id'] === session_id;
+    const legacyMarked = Boolean(legacyFm) && legacyFm['_generator'] === GENERATOR_MARKER && isOwnSessionId(legacyFm);
     const legacyForeign = legacyMarked && foreignOwnerReason(legacyFm, writer) !== null;
     if (legacyForeign && legacyStillLeaks) {
       healedForeignLeak = maskForeignNoteInPlace(legacyFlatPath, legacyContent, ctx);
     }
     if (legacyMarked && !legacyForeign) {
       const entryUpdated = toDate(entry.completed_at);
-      const legacyNarrativeStale = noteNarrativeChars(legacyContent) !== noteNarrativeChars(renderedBody);
+      const legacyNarrativeStale = sessionNotesStale(legacyContent, renderedBody);
       if (!force && !legacyStillLeaks && !legacyNarrativeStale && legacyFm['updated'] && legacyFm['updated'] >= entryUpdated) {
         return emitEntryAction(_lineNum, ctx, { action: 'skipped-noop', path: legacyFlatPath, id: session_id });
       }
@@ -1786,7 +1918,7 @@ export async function processSession(rawEntry, _lineNum, ctx) {
     // no disambiguation scheme. Checked before the date comparison; `--force`
     // does not bypass it. A leak in a foreign note is masked in place, never
     // rewritten from this record.
-    const sameSession = fm['id'] === session_id || fm['id'] === renderedId;
+    const sameSession = isOwnSessionId(fm);
     const foreign = foreignOwnerReason(fm, writer) ?? (sameSession ? null : 'id mismatch');
     if (foreign !== null) {
       const healed = existingLeaks && maskForeignNoteInPlace(targetPath, existingContent, ctx);
@@ -1797,7 +1929,7 @@ export async function processSession(rawEntry, _lineNum, ctx) {
     // #1513 review H2: a note rendered before narrative/summary were printed
     // carries less free text than the record — heal it once, or the pruner
     // archives it as metrics-only and the mirror re-creates it every run.
-    const narrativeStale = noteNarrativeChars(existingContent) !== noteNarrativeChars(renderedBody);
+    const narrativeStale = sessionNotesStale(existingContent, renderedBody);
     if (!force && !existingLeaks && !narrativeStale && fm['updated'] && fm['updated'] >= entryUpdated) {
       return emitEntryAction(_lineNum, ctx, { action: 'skipped-noop', path: targetPath, id: session_id });
     }

package/scripts/lib/vault-mirror/prune.mjs

@@ -54,7 +54,7 @@ import {
 import { createHash } from 'node:crypto';
 import { basename, dirname, join, resolve, sep } from 'node:path';
 
-import { parseFrontmatter, subjectToSlug } from './utils.mjs';
+import { parseFrontmatter, subjectToSlug, noteIdMatches } from './utils.mjs';
 import {
   GENERATOR_MARKER,
   ROLLUP_PREFIX,
@@ -287,7 +287,10 @@ export function planPrune({ vaultDir, today, minNarrativeChars = 400, aliases =
     const target = `${n.zone}/${n.effNs}/${n.name}`;
     if (claimed.has(target) || existingRel.has(target)) {
       const twin = notes.find((m) => m.rel === target);
-      if (twin && twin.fm.id === n.fm.id && !decided.has(twin.rel)) {
+      // #1601/#1602: the twin may already carry the namespaced id while the flat
+      // note keeps the bare pre-#1601 one — same note, either form.
+      const sameId = twin && (twin.fm.id === n.fm.id || noteIdMatches(twin.fm.id, n.fm.id, n.effNs) || noteIdMatches(n.fm.id, twin.fm.id, n.effNs));
+      if (sameId && !decided.has(twin.rel)) {
         actions.push({ path: n.rel, reason: 'duplicate', action: 'archive', target: archivePathFor(n.rel), keep: target });
       } else {
         actions.push({ path: n.rel, reason, action: 'keep', note: `relocation target taken: ${target}` });

package/scripts/lib/vault-mirror/render-learnings.mjs

@@ -5,7 +5,7 @@
  *          sourceRecordValue, learningSourceRecord, sourceRecordLine (#1503)
  */
 
-import { toDate, truncateAtWord, yamlQuoteIfNeeded, subjectToSlug, isValidSlug, buildTag, resolveSourceSessionLink } from './utils.mjs';
+import { toDate, truncateAtWord, yamlQuoteIfNeeded, legacySubjectToSlug, isValidSlug, buildTag, resolveSourceSessionLink, noteIdFor, yamlNoteId } from './utils.mjs';
 
 const GENERATOR_MARKER = 'session-orchestrator-vault-mirror@1';
 
@@ -118,9 +118,10 @@ export function normalizeLearningEntry(entry) {
     e.evidence = joinList(e.evidence_sessions) ?? joinList(e.files) ?? joinList(e.sessions) ?? '(none recorded)';
   }
   if (e.id === null || e.id === undefined) {
-    // subjectToSlug strips whitespace without hyphenating (designed for
+    // Keep historical ASCII deletion for record identity; only note names
+    // transliterate. The old slugger strips whitespace (designed for
     // kebab-ish inputs) — pre-map whitespace to hyphens for prose subjects.
-    const derived = firstString(e.subject) ? subjectToSlug(e.subject.trim().replace(/\s+/g, '-')) : '';
+    const derived = firstString(e.subject) ? legacySubjectToSlug(e.subject.trim().replace(/\s+/g, '-')) : '';
     if (isValidSlug(derived)) e.id = derived;
   }
   if (e.source_session === null || e.source_session === undefined) {
@@ -157,7 +158,7 @@ export function generateLearningNote(entry, slug, opts = {}) {
   // through buildTag so each is kebab-slugified and capped at 64 chars. The
   // existing source/<session> slug is preserved (buildTag is idempotent for an
   // already-kebab value and adds the length cap).
-  const sourceTag = subjectToSlug(String(source_session)) || 'unknown';
+  const sourceTag = legacySubjectToSlug(String(source_session)) || 'unknown';
   const tags = `[${buildTag(['learning', type])}, ${buildTag(['status', status])}, ${buildTag(['source', sourceTag])}]`;
 
   // Check if expires has a value; it's optional in schema
@@ -185,7 +186,7 @@ export function generateLearningNote(entry, slug, opts = {}) {
   const sourceSessionBodyLink = _srcIsLink ? `[[${_srcTarget}]]` : _srcTarget;
 
   return `---
-id: ${slug}
+id: ${yamlNoteId(noteIdFor(opts.repoNs, slug))}
 type: learning
 title: ${title}
 status: ${status}
@@ -230,7 +231,7 @@ export function generateLearningNoteV2(entry, slug, opts = {}) {
   const title = yamlQuoteIfNeeded(titleRaw);
 
   // #602: type/status interpolated raw upstream — slugify + cap each segment.
-  const scopeTag = subjectToSlug(scope) || 'unscoped';
+  const scopeTag = legacySubjectToSlug(scope) || 'unscoped';
   const tags = `[${buildTag(['learning', type])}, ${buildTag(['status', status])}, ${buildTag(['scope', scopeTag])}]`;
 
   // #725 D2: emit `source-repo` for cross-repo attribution when the caller threads
@@ -241,7 +242,7 @@ export function generateLearningNoteV2(entry, slug, opts = {}) {
   const recordLine = sourceRecordLine(learningSourceRecord(entry));
 
   return `---
-id: ${slug}
+id: ${yamlNoteId(noteIdFor(opts.repoNs, slug))}
 type: learning
 title: ${title}
 status: ${status}