session-orchestrator 5.11.0 → 5.13.0

package/scripts/lib/wave-executor/foreign-dispatch.mjs

@@ -80,6 +80,25 @@ import {
  * ever observed writing outside its worktree despite this flag, the sandbox is
  * not the boundary it is assumed to be here and the `hookTampering` check below
  * becomes the only defence rather than the backstop.
+ *
+ * `--disable-codebase-ref` keeps the CLI from starting its codebase index
+ * (#1683). Without it every run leaves a `worker-server` and an
+ * `npx typescript-language-server --stdio` pair behind; they detach via setsid,
+ * so the timeout kill in `runChild` never reaches them. Measured 2026-10-19 on
+ * cursor-agent 2026.10.01-e373342: 3 orphans per run without the flag, 0 with
+ * it, same answer either way. The foreign agent loses semantic search and
+ * LSP-backed lints; read and grep stay, and the Claude diff review remains the
+ * quality anchor. Named ceiling (BV-004): the flag is registered in the CLI but
+ * missing from `--help`, so a release may drop it silently. Revisit trigger: a
+ * `worker-server` or `typescript-language-server` with PPID 1 after a dispatch.
+ *
+ * The hidden `--disable-indexing` flag is deliberately absent (#1687): it only
+ * gates the codebase sync inside that same `worker-server`, which this argv
+ * never starts. Measured 2026-10-20 on cursor-agent 2026.10.01-e373342 with
+ * per-process `nettop` against a 1.5 MB throwaway repo: 52–71 KB out per run
+ * with or without the flag, no worker-server, while a 1.5 MB loopback control
+ * read back as exactly 1,500,000 bytes. Revisit trigger: a dispatch whose
+ * outbound volume grows with the worktree size.
  * @type {readonly string[]}
  */
 export const FOREIGN_AGENT_BASE_ARGS = Object.freeze([
@@ -87,6 +106,7 @@ export const FOREIGN_AGENT_BASE_ARGS = Object.freeze([
   '--force',
   '--sandbox',
   'enabled',
+  '--disable-codebase-ref',
 ]);
 
 /**

package/scripts/lib/win-process-tree.mjs

@@ -0,0 +1,137 @@
+/** Windows tree cleanup: PowerShell 5.1 CIM identities, then taskkill and readback. */
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+
+// Ceiling per native call: 5 s. Revisit if measured CIM startup exceeds this;
+// a hung PowerShell must never hang gate cleanup (including the exit handler).
+const OPTIONS = { encoding: 'utf8', shell: false, windowsHide: true, timeout: 5000, maxBuffer: 16 * 1024 * 1024 };
+const system32 = () => path.join(process.env.SystemRoot || 'C:\\Windows', 'System32');
+
+function readWindowsProcesses(spawnSyncFn = spawnSync) {
+  const result = spawnSyncFn(
+    path.join(system32(), 'WindowsPowerShell', 'v1.0', 'powershell.exe'),
+    ['-NoProfile', '-NonInteractive', '-Command', 'Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,CreationDate | ConvertTo-Json -Compress'],
+    OPTIONS,
+  );
+  if (result.error || result.status !== 0) throw new Error('CIM snapshot failed');
+  let parsed;
+  try {
+    parsed = JSON.parse(String(result.stdout));
+  } catch {
+    // A truncated or banner-polluted snapshot is "not measurable", never "no processes".
+    throw new Error('CIM snapshot output is not JSON');
+  }
+  const rows = Array.isArray(parsed) ? parsed : [parsed];
+  if (!rows.length || rows.some(p => !p || !Number.isInteger(p.ProcessId)
+    || !Number.isInteger(p.ParentProcessId))) {
+    throw new Error('CIM snapshot has no usable process identities');
+  }
+  return rows;
+}
+
+// PowerShell 5.1 ConvertTo-Json uses /Date(epoch milliseconds)/.
+// Other formats (including WMI dates) remain explicitly unmeasurable.
+function creationMs(row) {
+  const match = /^\/Date\((-?\d+)\)\/$/.exec(row?.CreationDate);
+  return match && Number.isFinite(Number(match[1])) ? Number(match[1]) : null;
+}
+
+function descendantIds(rows, seeds) {
+  const ids = new Set(seeds);
+  let size;
+  do {
+    size = ids.size;
+    for (const p of rows) if (ids.has(p.ParentProcessId)) ids.add(p.ProcessId);
+  } while (ids.size !== size);
+  return ids;
+}
+
+/** Same synchronous primitive for timeout and process-exit cleanup.
+ * A live ChildProcess holds libuv's Windows handle, preventing root PID reuse.
+ * After exit, only dated descendants may be targeted; the root is never killed.
+ * null survivors means unmeasurable, never a successful empty measurement.
+ */
+export function killWindowsProcessTree(pid, {
+  spawnSyncFn = spawnSync,
+  snapshotFn = () => readWindowsProcesses(spawnSyncFn),
+  child,
+  spawnedAtMs,
+  verifyTree = true,
+} = {}) {
+  const base = { signalsSent: [], aborted: null };
+  const unknown = reason => ({ ...base, ok: false, survivors: null, error: `nicht messbar auf win32: ${reason}` });
+  const rootHeld = child?.exitCode === null && child?.signalCode === null;
+  let killError = null;
+  const kill = (target, tree = true) => {
+    base.signalsSent.push('taskkill');
+    try {
+      const args = tree ? ['/PID', String(target), '/T', '/F'] : ['/PID', String(target), '/F'];
+      const result = spawnSyncFn(path.join(system32(), 'taskkill.exe'), args, OPTIONS);
+      if (result.error || result.status !== 0) killError = result.error?.message ?? `taskkill exit ${result.status}`;
+    } catch (err) { killError = String(err); }
+  };
+  if (!verifyTree) {
+    if (rootHeld) kill(pid);
+    return unknown(`nicht gemessen (verifyTree: false)${killError ? `; ${killError}` : ''}`);
+  }
+
+  let before;
+  let measurementError;
+  try {
+    before = snapshotFn();
+    if (!Array.isArray(before)) throw Error('invalid snapshot');
+  } catch (err) { measurementError = err; }
+  if (measurementError) {
+    if (rootHeld) kill(pid);
+    return unknown(measurementError);
+  }
+  const ids = descendantIds(before, [pid]);
+  const floor = Number.isFinite(spawnedAtMs) ? spawnedAtMs - 2000 : null;
+  let targets = before.filter(p => ids.has(p.ProcessId));
+  if (!rootHeld) {
+    targets = targets.filter(p => p.ProcessId !== pid);
+    if (floor === null || targets.some(p => creationMs(p) === null)) return unknown('missing descendant CreationDate or spawnedAtMs');
+    targets = targets.filter(p => creationMs(p) >= floor);
+    for (const p of targets) kill(p.ProcessId);
+  } else {
+    // Windows never rewrites ParentProcessId when a parent dies, so a process
+    // older than our root can still name the root's (reused) PID as its parent
+    // (Opus review M2, #1612). Such a process is not ours: drop it from the
+    // targets, and when one exists, end ours one by one without /T so
+    // taskkill's own PPID walk cannot reach it.
+    const rootBorn = creationMs(targets.find(p => p.ProcessId === pid)) ?? floor;
+    const stale = rootBorn === null ? [] : targets.filter(p => p.ProcessId !== pid
+      && creationMs(p) !== null && creationMs(p) < rootBorn);
+    if (stale.length === 0) {
+      kill(pid);
+    } else {
+      targets = targets.filter(p => !stale.includes(p));
+      for (const p of targets) kill(p.ProcessId, false);
+    }
+  }
+
+  let after;
+  try {
+    after = snapshotFn();
+    if (!Array.isArray(after)) throw Error('invalid snapshot');
+  } catch (err) { return unknown(err); }
+  if ((rootHeld && !targets.some(p => p.ProcessId === pid))
+    || targets.some(p => creationMs(p) === null)
+    || after.some(p => targets.some(q => q.ProcessId === p.ProcessId) && creationMs(p) === null)) {
+    return unknown('missing tree identity');
+  }
+  const survivors = new Set(targets.filter(p => after.some(q =>
+    q.ProcessId === p.ProcessId && q.CreationDate === p.CreationDate)).map(p => p.ProcessId));
+
+  // Include descendants born during taskkill, following parents through both
+  // snapshots even when an intermediate parent has already disappeared.
+  const treeIds = new Set([pid, ...targets.map(p => p.ProcessId)]);
+  const related = descendantIds([...before, ...after], treeIds);
+  for (const p of after) {
+    if (p.ProcessId === pid || !related.has(p.ParentProcessId)) continue;
+    const date = creationMs(p);
+    if (date === null || floor === null) return unknown('missing descendant CreationDate or spawnedAtMs');
+    if (date >= floor) survivors.add(p.ProcessId);
+  }
+  return { ...base, ok: survivors.size === 0 && !killError, survivors: [...survivors], error: killError };
+}

package/scripts/lib/workspace.mjs

@@ -13,7 +13,7 @@
 import fs from 'node:fs/promises';
 import fsSync from 'node:fs';
 import path from 'node:path';
-import { $ } from 'zx';
+import { $ } from './zx.mjs';
 import { listWorktrees } from './worktree.mjs';
 
 // Do not spam stdout/stderr with git command echoes.

package/scripts/lib/worktree/constants.mjs

@@ -7,7 +7,7 @@
  * Side effect: configures zx to suppress git command echoes on load.
  */
 
-import { $ } from 'zx';
+import { $ } from '../zx.mjs';
 
 // Do not spam stdout/stderr with git command echoes.
 $.verbose = false;

package/scripts/lib/worktree/lifecycle.mjs

@@ -17,7 +17,7 @@
  *   lifecycle → config.mjs (readConfigFile, parseSessionConfig)
  */
 
-import { $, nothrow, ProcessOutput } from 'zx';
+import { $, nothrow, ProcessOutput } from '../zx.mjs';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/scripts/lib/worktree/listing.mjs

@@ -10,7 +10,7 @@
  * lifecycle import chain (lifecycle imports listing, not the reverse).
  */
 
-import { $ as defaultDollar } from 'zx';
+import { $ as defaultDollar } from '../zx.mjs';
 import fs from 'node:fs/promises';
 import path from 'node:path';
 

package/scripts/lib/zx.mjs

@@ -0,0 +1,50 @@
+import { existsSync as fileExistsSync } from 'node:fs';
+import { win32 as path } from 'node:path';
+import { $, quote } from 'zx';
+
+export * from 'zx';
+
+// Windows 11 / Node 24.14 / zx 8.8.5 / Git 2.55, measured 2026-10-14:
+// MSYS halves backslashes in Node's -c command line before bash interprets
+// ANSI-C quoting (\b becomes backspace, \r CR). Doubling zx's escapes gave
+// 14/14 exact argument roundtrips, versus 10/14 with stock quote (#1612).
+// Always start from stock quote, so repeated configuration cannot stack escapes.
+const quoteGitBash = (arg) => quote(arg).replace(/\\/g, '\\\\');
+
+/** Configure the zx singleton; injection also permits Windows checks on POSIX. */
+export function configureZx({
+  platform = process.platform,
+  existsSync = fileExistsSync,
+  target = $,
+  env = process.env,
+} = {}) {
+  if (platform !== 'win32') return;
+
+  const shell = typeof target.shell === 'string' ? path.normalize(target.shell) : '';
+  const wsl = path.join(env.SystemRoot || 'C:\\Windows', 'System32', 'bash.exe');
+  if (!target.shell || shell.toLowerCase() === wsl.toLowerCase()) {
+    const candidates = [env.ProgramFiles, env['ProgramFiles(x86)']]
+      .filter(Boolean).map(dir => path.join(dir, 'Git', 'bin', 'bash.exe'));
+    let bash = candidates.find(candidate => existsSync(candidate));
+    if (!bash) {
+      for (const dir of (env.PATH || '').split(';').filter(Boolean)) {
+        const gitDir = dir.replace(/^"|"$/g, '');
+        if (!existsSync(path.join(gitDir, 'git.exe'))) continue;
+        const candidate = path.resolve(gitDir, '..', 'bin', 'bash.exe');
+        if (existsSync(candidate)) {
+          bash = candidate;
+          break;
+        }
+      }
+    }
+    if (!bash) return;
+    target.shell = bash;
+  }
+
+  if (typeof target.shell === 'string' &&
+      /\\(?:Git\\bin|usr\\bin)\\bash\.exe$/i.test(path.normalize(target.shell))) {
+    target.quote = quoteGitBash;
+  }
+}
+
+configureZx();

package/scripts/mcp-server.mjs

@@ -6,6 +6,8 @@ import { join } from 'node:path';
 import { createInterface } from 'node:readline';
 import { isSessionConfigHeading } from './lib/config/section-extractor.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
+import { canonicalizeSessions, isMeasuredSession } from './lib/sessions-canonical.mjs';
+import { resolveEventsLedgerRoot } from './lib/platform.mjs';
 
 const SERVER_INFO = { name: 'session-orchestrator', version: '2.0.0' };
 const TOOLS = [
@@ -16,7 +18,7 @@ const TOOLS = [
   },
   {
     name: 'session_metrics',
-    description: 'Reads the last 5 REAL session metrics entries from .orchestrator/metrics/sessions.jsonl (abandoned phantom stubs excluded)',
+    description: 'Reads the last 5 MEASURED session metrics entries from .orchestrator/metrics/sessions.jsonl (unmeasured records excluded)',
     inputSchema: { type: 'object', properties: {}, required: [] },
   },
 ];
@@ -65,24 +67,31 @@ export function readSessionConfig(root) {
   return body.join('\n').replace(/\n+$/, '') || `No '## Session Config' section found in ${file}`;
 }
 
-/** Read the last five real records, with whole-ledger stub count and token coverage. */
+/** Read the last five canonical measured records, with exclusions and token coverage. */
 export function readSessionMetrics(root) {
-  const file = ['.orchestrator', '.claude'].map((dir) => join(root, dir, 'metrics', 'sessions.jsonl'))
+  const file = ['.orchestrator', '.claude'].map((dir) => join(resolveEventsLedgerRoot(root), dir, 'metrics', 'sessions.jsonl'))
     .find((path) => isFile(path));
   if (!file) return 'No metrics found (checked .orchestrator/metrics/ and .claude/metrics/)';
   const entries = [];
   let stubCount = 0;
+  const parsed = [];
   for (const line of readFileSync(file, 'utf8').split(/\r?\n/)) {
     let record;
     try { record = JSON.parse(line); } catch { continue; }
-    // Torn writes and non-record JSON must not hide subsequent valid sessions.
+    // Preserve torn-write/non-record guards and actionable read errors.
     if (!record || typeof record !== 'object' || Array.isArray(record)) continue;
-    if (record.status === 'abandoned') { stubCount++; continue; }
+    parsed.push(record);
+  }
+  // Keep ID-less legacy measurements and original append order for the window.
+  const canonical = new Set(canonicalizeSessions(parsed, { keepUnidentified: true }));
+  for (const record of parsed) {
+    if (!canonical.has(record)) continue;
+    if (!isMeasuredSession(record)) { stubCount++; continue; }
     entries.push(record);
     if (entries.length > 5) entries.shift();
   }
   if (!entries.length) {
-    return stubCount ? `No real sessions (abandoned stubs excluded: ${stubCount})`
+    return stubCount ? `No measured sessions (unmeasured records excluded: ${stubCount})`
       : 'No metrics found (file is empty)';
   }
   const record = entries.findLast((entry) => (entry.total_token_input !== null && entry.total_token_input !== undefined)
@@ -95,7 +104,7 @@ export function readSessionMetrics(root) {
       + ` [session: ${record.session_id ?? 'unknown'}]`
     : 'tokens: no token data in last 5 sessions (subagent telemetry not yet captured)';
   return entries.map((entry) => JSON.stringify(entry)).join('\n')
-    + `\n\nabandoned stubs excluded: ${stubCount}\n\n--- token summary ---\n${summary}`;
+    + `\n\nunmeasured records excluded: ${stubCount}\n\n--- token summary ---\n${summary}`;
 }
 
 /** Handle one JSON-RPC line. null means a notification or blank line, not a reply. */

package/scripts/mcp-server.sh

@@ -8,8 +8,8 @@ set -euo pipefail
 #   - session_config  — reads Session Config from the project instruction file
 #                       (CLAUDE.md, or AGENTS.md alias on Codex CLI — see
 #                       skills/_shared/instruction-file-resolution.md)
-#   - session_metrics — reads last 5 REAL session metrics entries (#834:
-#                       abandoned phantom stubs are filtered out first)
+#   - session_metrics — reads last 5 canonical MEASURED session metrics entries
+#                       via the shared native reader (#1584)
 
 # ---------------------------------------------------------------------------
 # Helpers
@@ -85,7 +85,7 @@ handle_tools_list() {
       },
       {
         "name": "session_metrics",
-        "description": "Reads the last 5 REAL session metrics entries from .orchestrator/metrics/sessions.jsonl (abandoned phantom stubs excluded)",
+        "description": "Reads the last 5 MEASURED session metrics entries from .orchestrator/metrics/sessions.jsonl (unmeasured records excluded)",
         "inputSchema": {"type": "object", "properties": {}, "required": []}
       }
     ]
@@ -171,88 +171,18 @@ tool_session_metrics() {
     return
   }
 
-  local metrics_file="$project_root/.orchestrator/metrics/sessions.jsonl"
-  if [[ ! -f "$metrics_file" ]]; then
-    metrics_file="$project_root/.claude/metrics/sessions.jsonl"
-  fi
-  if [[ ! -f "$metrics_file" ]]; then
-    respond "$id" "$(text_content "No metrics found (checked .orchestrator/metrics/ and .claude/metrics/)")"
-    return
-  fi
-
-  # Filter out phantom `status: 'abandoned'` stubs (#834, session-close-backfill
-  # — 0 waves, seconds of runtime) BEFORE taking the tail, so a recent phantom
-  # cannot displace real session records out of the last-5 window.
-  #
-  # `-R` (raw-input) + `fromjson?` parses each line individually and SKIPS
-  # unparseable ones instead of aborting the whole stream — plain
-  # `jq -c 'select(...)'` aborts at the FIRST malformed line (jq: parse error,
-  # exit 5), which is fatal here because sessions.jsonl is append-only from
-  # multiple writers and a torn write is exactly the case that matters. This
-  # mirrors the per-line try/catch behaviour of the .mjs path
-  # (scripts/lib/session-schema/filters.mjs).
-  local entries
-  entries=$(jq -R -c 'fromjson? | select(.status != "abandoned")' "$metrics_file" 2>/dev/null | tail -n 5) || true
-
-  # Report the stubs the filter above dropped (#1296) — counted over the WHOLE
-  # file, not the tail, with the same torn-line tolerance (`fromjson?`, plus
-  # `.status?` so a non-object line cannot abort the count either). Computed
-  # BEFORE the empty check: a stubs-only ledger is not an empty file.
-  local stub_count
-  stub_count=$(jq -R -n '[inputs | fromjson? | select(.status? == "abandoned")] | length' "$metrics_file" 2>/dev/null) || stub_count=0
-  [[ -z "$stub_count" ]] && stub_count=0
-
-  if [[ -z "$entries" ]]; then
-    if [[ "$stub_count" -gt 0 ]]; then
-      respond "$id" "$(text_content "No real sessions (abandoned stubs excluded: ${stub_count})")"
-    else
-      respond "$id" "$(text_content "No metrics found (file is empty)")"
-    fi
+  # Delegate to the same reader as the native transport: canonical identity,
+  # measured-session definition, main-checkout ledger and token summary.
+  local server_dir output
+  server_dir=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+  if ! output=$(node --input-type=module -e '
+    import { pathToFileURL } from "node:url";
+    const { readSessionMetrics } = await import(pathToFileURL(process.argv[2]).href);
+    process.stdout.write(readSessionMetrics(process.argv[3]));
+  ' session-metrics-reader "$server_dir/mcp-server.mjs" "$project_root" </dev/null); then
+    respond_error "$id" -32603 "Unable to read session data"
     return
   fi
-
-  # Derive a token summary from the most-recent record that carries token totals.
-  # Fields total_token_input / total_token_output / subagents_with_tokens are
-  # optional (null when no subagent token data was captured for that session).
-  # Low coverage (subagents_with_tokens == 0 while matched_records > 0) means
-  # the total is PARTIAL — do not read it as "free / zero cost".
-  local token_summary
-  # Use -Rrs (raw-input + slurp + raw-output) so jq receives the multi-line
-  # JSONL block as a single string, can split + parse each line independently,
-  # and outputs plain text (no surrounding JSON quotes on the result string).
-  # The plain -r flag alone does not work for multi-record JSONL piped as one
-  # string — it treats the entire input as a single JSON value.
-  token_summary=$(printf '%s' "$entries" | \
-    jq -Rrs '
-      # Parse each non-empty line as JSON; skip malformed lines.
-      [ split("\n")[] | select(length > 0) | (try fromjson catch null) | select(. != null) ]
-      | reverse
-      | ( map(select( (.total_token_input != null) or (.total_token_output != null) )) | first ) as $rec
-      | if $rec then
-          "tokens: \($rec.total_token_input // "?") in / \($rec.total_token_output // "?") out" +
-          " (coverage: \($rec.subagents_with_tokens // 0) subagents)" +
-          ( if ($rec.subagents_with_tokens // 0) == 0 then
-              " ⚠ partial — subagent token data missing; total is not a reliable cost estimate"
-            else "" end ) +
-          " [session: \($rec.session_id // "unknown")]"
-        else
-          "tokens: no token data in last 5 sessions (subagent telemetry not yet captured)"
-        end
-    ' 2>/dev/null) || token_summary=""
-
-  local output
-  entries="${entries}
-
-abandoned stubs excluded: ${stub_count}"
-  if [[ -n "$token_summary" ]]; then
-    output="${entries}
-
---- token summary ---
-${token_summary}"
-  else
-    output="$entries"
-  fi
-
   respond "$id" "$(text_content "$output")"
 }
 

package/scripts/measure-policy-cache-effectiveness.mjs

@@ -37,7 +37,7 @@ import { spawnSync } from 'node:child_process';
 import { mkdtempSync, writeFileSync, rmSync, mkdirSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 
 // ---------------------------------------------------------------------------
 // CLI flags
@@ -57,8 +57,8 @@ const _REPO_ROOT = resolve(flagValue('--repo-root', process.cwd()));
 const JSON_MODE = flagBool('--json');
 
 const SCRIPT_DIR = fileURLToPath(new URL('.', import.meta.url));
-const CACHE_MODULE = join(SCRIPT_DIR, 'lib', 'quality-gates-cache.mjs');
-const POLICY_MODULE = join(SCRIPT_DIR, 'lib', 'quality-gates-policy.mjs');
+const CACHE_MODULE = pathToFileURL(join(SCRIPT_DIR, 'lib', 'quality-gates-cache.mjs')).href;
+const POLICY_MODULE = pathToFileURL(join(SCRIPT_DIR, 'lib', 'quality-gates-policy.mjs')).href;
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -340,11 +340,13 @@ async function main() {
     } else {
       printHumanReport(report);
     }
-
-    process.exit(0);
   } finally {
     teardownTmpRepo(tmpRepo);
   }
+  // Exit only AFTER the finally: process.exit() ends the process on the spot,
+  // so calling it inside the try skipped teardownTmpRepo and leaked one
+  // pce-repo-* dir under os.tmpdir() on every successful run (#1648).
+  process.exit(0);
 }
 
 function deriveRecommendation(cacheSubprocess, cacheInProcess, policySubprocess, _policyInProcess) {

package/scripts/memory-propose.mjs

@@ -278,12 +278,19 @@ let stateMdReadOk = false;
 let stateDir = null;
 
 try {
-  // resolveStateMdPath from state-md.mjs: falls back to .claude/STATE.md
   const stateMdMod = await import('./lib/state-md.mjs');
-  const stateMdPath = stateMdMod.resolveStateMdPath(process.cwd());
+  const { resolveStateMdWriteTarget, warnForeignStateMd } = await import(
+    './lib/state-md/frontmatter-mutators.mjs'
+  );
+  // #1636: the write side's ownership rule — another platform's STATE.md not
+  // proven to be this process's takes the "missing" branch. On rejection
+  // `stateMdPath` is this platform's own target, so stateDir (also the wave
+  // manifest's dir) never points into the foreign platform's state dir.
+  const { path: stateMdPath, rejected } = resolveStateMdWriteTarget(process.cwd());
+  if (rejected) warnForeignStateMd('memory-propose', rejected, stateMdPath);
   stateDir = dirname(stateMdPath);
 
-  if (!existsSync(stateMdPath)) {
+  if (rejected || !existsSync(stateMdPath)) {
     if (!dryRun) {
       exit(
         { status: STATUS.REJECTED_WRONG_CONTEXT, detail: 'STATE.md missing or unparseable' },

package/scripts/migrate-cold-start-seed.mjs

@@ -245,6 +245,13 @@ async function processRepo(repo, { apply }) {
 
   // Sessions.jsonl liveness check — even if marker is absent, an active repo
   // should not get a "welcome" banner.
+  // Deliberately THIS path's own ledger, not resolveEventsLedgerRoot(repo)
+  // (#1592): the inputs are main-checkout repo paths by construction
+  // (--repos / dormant-repos), and the marker above is seeded into this same
+  // path — liveness and seed stay one checkout. Ceiling: a linked worktree
+  // passed via --repos is judged by its own (absent) ledger; revisit if
+  // worktree paths ever enter dormant-repos.
+  // ledger-root: deliberate own-path ledger (#1592), see the comment above
   const sessionsPath = join(repo, SESSIONS_REL);
   try {
     if (await sessionsHasContent(sessionsPath)) {

package/scripts/migrate-legacy-learnings.sh

@@ -7,6 +7,28 @@ set -euo pipefail
 ROOT="${1:-$(pwd)}"
 CANONICAL="$ROOT/.orchestrator/metrics/learnings.jsonl"
 TODAY="$(date +%Y-%m-%d)"
+
+# #1516: a host whose learnings-store role is `inbox` never rewrites the
+# canonical store. The role resolver is the JS one (env SO_LEARNINGS_STORE_ROLE
+# > owner.yaml learnings.store-role > writer), imported relative to this script.
+# Fail-closed: if node fails, or the role is `invalid` (set but unusable) or
+# anything other than writer/inbox, nothing is written and the script exits 4.
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+STORE_ROLE="$(node --input-type=module -e '
+const { pathToFileURL } = await import("node:url");
+const m = await import(pathToFileURL(process.argv[1]).href);
+process.stdout.write(m.resolveStoreRole().role);
+' "$SCRIPT_DIR/lib/learnings/store-role.mjs" 2>/dev/null)" || STORE_ROLE="unresolved"
+if [ "$STORE_ROLE" = "inbox" ]; then
+  echo "migrate-legacy-learnings: learnings store role is inbox on this host (#1516) — nothing written; run it on the writer host" >&2
+  printf '{"status":"refused_store_role"}\n'
+  exit 3
+fi
+if [ "$STORE_ROLE" != "writer" ]; then
+  echo "migrate-legacy-learnings: learnings store role is ${STORE_ROLE} on this host (#1516) — nothing written; fix owner.yaml learnings.store-role or SO_LEARNINGS_STORE_ROLE" >&2
+  printf '{"status":"refused_store_role_invalid"}\n'
+  exit 4
+fi
 LEGACY_PATHS=("$ROOT/.claude/metrics/learnings.jsonl" "$ROOT/.codex/metrics/learnings.jsonl" "$ROOT/.cursor/metrics/learnings.jsonl")
 
 tmp=""

package/scripts/migrate-sessions-jsonl.mjs

@@ -39,9 +39,10 @@
  */
 
 import { readFileSync, copyFileSync, existsSync } from 'node:fs';
-import { basename } from 'node:path';
+import { basename, join, resolve } from 'node:path';
 import { atomicWriteWithBackup, envelopeToError } from './lib/io.mjs';
 import { validateSession, normalizeSession, ValidationError } from './lib/session-schema.mjs';
+import { resolveEventsLedgerRoot } from './lib/platform.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
 
 const DEFAULT_FILE = '.orchestrator/metrics/sessions.jsonl';
@@ -327,8 +328,21 @@ function processEntry(raw) {
 // CLI
 // ---------------------------------------------------------------------------
 
+/**
+ * Default target: sessions.jsonl of the repo's one ledger root (#1514/#1584,
+ * #1722) — the main checkout when cwd is a linked worktree. Outside one the
+ * relative DEFAULT_FILE is kept verbatim, so paths in output do not change.
+ *
+ * @returns {string}
+ */
+function defaultFile() {
+  const root = resolveEventsLedgerRoot(process.cwd());
+  // ledger-root: `root` is resolveEventsLedgerRoot() of the line above
+  return root === resolve(process.cwd()) ? DEFAULT_FILE : join(root, DEFAULT_FILE);
+}
+
 function parseArgs(argv) {
-  const args = { file: DEFAULT_FILE, apply: false };
+  const args = { file: defaultFile(), apply: false };
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     if (a === '--file') {