session-orchestrator 5.12.0 → 5.13.0

package/scripts/lib/learnings/surface.mjs

@@ -40,7 +40,10 @@
  * Slice: `.slice(0, n)` after sort.
  */
 
+import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
+import { readLearnings } from './io.mjs';
+import { inboxPathFor, isCanonicalStore } from './store-role.mjs';
 
 const MS_PER_DAY = 86_400_000;
 
@@ -147,6 +150,49 @@ export function effectiveScore(entry, nowMs, decay) {
  *   then sliced to `n`. Returns [] on missing/unreadable file or all-empty input.
  */
 export async function surfaceTopN(filePath, n = 5, opts = {}) {
+  // Preserve the pre-read clock used by the existing file reader.
+  const now = opts.now instanceof Date ? opts.now.getTime()
+    : typeof opts.now === 'number' ? opts.now : Date.now();
+  let raw;
+  try {
+    raw = await readFile(filePath, 'utf8');
+  } catch {
+    return [];
+  }
+  return surfaceLearningsText(await withVisibleInboxText(filePath, raw), n, { ...opts, now });
+}
+
+/**
+ * `raw` (the live store's text) plus the visible inbox records of the
+ * canonical store, one JSON line each (#1516) — the same visibility rule
+ * `readLearnings()` applies. Without an inbox file beside a canonical store
+ * `raw` comes back unchanged, so every pre-#1516 output stays byte-identical.
+ *
+ * Ceiling (BV-004): the live file is read twice when an inbox exists (once
+ * raw here, once by `readLearnings`); revisit if the inbox grows past the
+ * 1 MiB trigger named in io.mjs.
+ *
+ * @param {string} filePath — the store `raw` was read from
+ * @param {string} raw
+ * @returns {Promise<string>}
+ */
+export async function withVisibleInboxText(filePath, raw) {
+  if (!isCanonicalStore(filePath) || !existsSync(inboxPathFor(filePath))) return raw;
+  let read;
+  try {
+    read = await readLearnings(filePath);
+  } catch {
+    return raw; // an unreadable inbox never costs the live surface
+  }
+  const { entries, inbox } = read;
+  const visible = inbox ? entries.slice(entries.length - inbox.visible) : [];
+  if (visible.length === 0) return raw;
+  const sep = raw.length === 0 || raw.endsWith('\n') ? '' : '\n';
+  return `${raw}${sep}${visible.map((e) => JSON.stringify(e)).join('\n')}\n`;
+}
+
+/** Same surface policy over one already-read JSONL snapshot; no I/O. */
+export function surfaceLearningsText(raw, n = 5, opts = {}) {
   const { now: nowOpt, confidenceFloor = 0.3, decay: decayOpt } = opts;
   const nowMs =
     nowOpt instanceof Date
@@ -163,13 +209,6 @@ export async function surfaceTopN(filePath, n = 5, opts = {}) {
     floorFactor: decayOpt?.floorFactor ?? DECAY_DEFAULTS.floorFactor,
   };
 
-  let raw;
-  try {
-    raw = await readFile(filePath, 'utf8');
-  } catch {
-    return [];
-  }
-
   const lines = raw
     .split('\n')
     .map((l) => l.trim())

package/scripts/lib/ledger-path.mjs

@@ -0,0 +1,113 @@
+/**
+ * Where a ledger under `.orchestrator/` lives when its writer or reader runs
+ * in a linked git worktree (#1722).
+ *
+ * A linked worktree has its own working tree, so `<worktree>/.orchestrator/
+ * metrics/<x>.jsonl` is a different file from the main checkout's. Which one is
+ * right depends on whether the repo versions the ledger:
+ *
+ *   - **gitignored** (this plugin repo, `.gitignore:57`): the worktree copy is
+ *     lost when the worktree is removed, and every reader that maps to the main
+ *     checkout never sees it. Measured 2026-10-22: `eval.jsonl` stranded in
+ *     `_wt/session-orchestrator/so-66c`, `skill-invocations.jsonl` and
+ *     `eval.jsonl` in `so-1e`. → the main checkout's copy.
+ *   - **versioned** (27 fleet repos track `learnings`/`sessions`/… under
+ *     `.orchestrator/metrics/`, counted 2026-10-21T23:06Z; the bootstrap
+ *     template calls them durable project data): the worktree copy travels
+ *     with the branch and reaches main through the merge. Writing the main
+ *     checkout's copy instead would dirty another session's working tree and
+ *     leave the branch without the record. → the worktree's own copy.
+ *
+ * `git check-ignore` (index-aware: a tracked file is never reported ignored)
+ * decides between the two. It is spawned ONLY inside a linked worktree — a
+ * plain checkout, a non-git dir and a test tmpdir resolve spawn-free to the
+ * local path, as before — and memoised per process.
+ *
+ * Only a worktree's TOP LEVEL maps. A root below it (a caller's cwd in
+ * `scripts/` or in an ignored `.orchestrator/tmp/…`) keeps the local path, as
+ * before #1722: `git check-ignore` would answer for the ignored subdirectory,
+ * not for the ledger, and the mapped path would land inside the main
+ * checkout's copy of that subdirectory.
+ *
+ * Not used for `events.jsonl` and `sessions.jsonl`: those map unconditionally
+ * through {@link resolveEventsLedgerRoot} (owner decision on #1514 point 1,
+ * and #1584), versioned or not.
+ *
+ * Ceiling: a failed or timed-out `git check-ignore` (exit ≥ 128, no git, 2 s)
+ * keeps the local path — the pre-#1722 behaviour, never a write into a foreign
+ * working tree on an unmeasured answer. Revisit if a `*.jsonl` is found growing
+ * inside a linked worktree of a repo that ignores it.
+ *
+ * @module scripts/lib/ledger-path
+ */
+
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { dotGitAncestor, getProjectDir, resolveEventsLedgerRoot } from './platform.mjs';
+
+/** @type {Map<string, boolean>} `<root>\0<rel>` → ignored in that worktree */
+const ignoredMemo = new Map();
+
+/**
+ * The `git` child must answer for `root`: an ambient `GIT_DIR` outranks `-C`
+ * (see `scripts/lib/git-config-drift.mjs`), and a hook can run inside a git
+ * hook that exports it.
+ */
+function gitEnv() {
+  const env = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (!key.startsWith('GIT_')) env[key] = value;
+  }
+  return env;
+}
+
+function isIgnoredIn(root, relPath) {
+  const key = `${root}\0${relPath}`;
+  if (ignoredMemo.has(key)) return ignoredMemo.get(key);
+  const r = spawnSync('git', ['-C', root, 'check-ignore', '-q', '--', relPath], {
+    env: gitEnv(),
+    stdio: 'ignore',
+    timeout: 2000,
+  });
+  const ignored = r.status === 0;
+  ignoredMemo.set(key, ignored);
+  return ignored;
+}
+
+/**
+ * The repo root the ledger `relPath` lives under for a caller rooted at `root`:
+ * the main checkout when `root` is a linked worktree that ignores the ledger,
+ * else `root` itself (resolved). Path guards that require a target inside the
+ * project validate against THIS root, so a mapped ledger passes and a path
+ * outside it is still refused.
+ *
+ * @param {string} relPath  ledger path relative to the repo root
+ * @param {string} [root]  repo root the caller works in; default {@link getProjectDir}
+ * @returns {string}  absolute root
+ */
+export function resolveLedgerRoot(relPath, root) {
+  const base = path.resolve(typeof root === 'string' && root.trim() !== '' ? root : getProjectDir());
+  const mainRoot = resolveEventsLedgerRoot(base);
+  if (mainRoot === base || dotGitAncestor(base) !== base) return base;
+  return isIgnoredIn(base, relPath) ? mainRoot : base;
+}
+
+/**
+ * Absolute path of the ledger `relPath` for a writer or reader rooted at `root`.
+ *
+ * @param {string} relPath  ledger path relative to the repo root, e.g.
+ *   `.orchestrator/metrics/eval.jsonl`; an absolute path is returned unchanged
+ *   (an explicit override stays exactly what the caller asked for)
+ * @param {string} [root]  repo root the caller works in; default
+ *   {@link getProjectDir} (the launch dir in a hook, the cwd's project in a CLI)
+ * @returns {string}
+ */
+export function resolveLedgerPath(relPath, root) {
+  if (path.isAbsolute(relPath)) return relPath;
+  return path.join(resolveLedgerRoot(relPath, root), relPath);
+}
+
+/** Test seam: forget memoised `git check-ignore` answers. */
+export function _resetLedgerPathMemo() {
+  ignoredMemo.clear();
+}

package/scripts/lib/maintenance-due-banner.mjs

@@ -79,12 +79,13 @@ import { sweepExpiredLearnings } from './learnings/expiry-sweep.mjs';
 import { shouldDispatchAutoDialectic } from './auto-dialectic.mjs';
 import { shouldDispatchAutoDream } from './auto-dream.mjs';
 import { resolveMemoryDir } from './memory-paths.mjs';
-import { readCanonicalSessions } from './sessions-canonical.mjs';
-import { filterRealSessions } from './session-schema.mjs';
+import { resolveLedgerPath } from './ledger-path.mjs';
+import { readCanonicalSessions, isMeasuredSession } from './sessions-canonical.mjs';
 import {
   daysUntilGeneratedRuleExpiry,
   listMachineGeneratedRules,
 } from './instruction-budget-guard.mjs';
+import { planRuleExpirySweep } from './reconcile/rule-expiry-sweep.mjs';
 
 /**
  * How many signals this probe knows about. The banner denominator is this
@@ -233,7 +234,7 @@ function readLastEvolveRun(repoRoot) {
  */
 function readLastHousekeeping(repoRoot) {
   try {
-    const entries = filterRealSessions(readCanonicalSessions({ repoRoot }));
+    const entries = readCanonicalSessions({ repoRoot }).filter(isMeasuredSession);
     let max = null;
     for (const e of entries) {
       if (e?.session_type !== 'housekeeping') continue;
@@ -275,6 +276,40 @@ function isClaudePlatform(platform) {
  *   lastHousekeeping: string|null,
  * }>}
  */
+/**
+ * Generated rule files the expiry sweep can never act on from THIS host: the
+ * sweep's plan at the end of the warning horizon keeps the file whole because
+ * not one of its entries resolves to a learning in the local store. The
+ * learnings store is host-local and untracked, so a host whose store lacks the
+ * ids (measured 2026-10-19 on the M5: 6 records, 0 of 77 rule ids) was told to
+ * run a command that sweeps nothing. A failing plan (unreadable store) yields
+ * an empty set, i.e. the pre-existing recommendation.
+ *
+ * @param {string} repoRoot
+ * @param {number} now epoch ms
+ * @returns {Promise<Set<string>>} rule file names
+ */
+async function unsweepableRuleFiles(repoRoot, now) {
+  try {
+    const plan = await planRuleExpirySweep({
+      repoRoot,
+      now: new Date(now + GENERATED_RULE_EXPIRY_HORIZON_DAYS * 86_400_000).toISOString(),
+    });
+    return new Set(
+      plan.plans
+        .filter(
+          (p) =>
+            p.action === 'keep' &&
+            p.substantivePairs > 0 &&
+            p.unresolvedPairIds.length === p.substantivePairs,
+        )
+        .map((p) => p.file),
+    );
+  } catch {
+    return new Set();
+  }
+}
+
 export async function computeMaintenanceDue(opts = {}) {
   const repoRoot =
     typeof opts.repoRoot === 'string' && opts.repoRoot.length > 0 ? opts.repoRoot : process.cwd();
@@ -323,7 +358,8 @@ export async function computeMaintenanceDue(opts = {}) {
     if (nudge.nudge === true) {
       // HR-106: report what the rule JUDGED. `computeReconcileNudge` nudges on
       // a BACKLOG — rule-eligible learnings minus those already materialized
-      // in the sidecar or `.claude/rules/` (`countReconcileBacklog`, #1380;
+      // in the sidecar, the verdict ledger (#1710) or `.claude/rules/`
+      // (`countReconcileBacklog`, #1380;
       // before #1380 it counted all eligible ones) — never on a date — so
       // printing `lastRunAt` here put today's date next to the word "due" and
       // read as "last run today and already due again". Measured 2026-09-09
@@ -339,10 +375,9 @@ export async function computeMaintenanceDue(opts = {}) {
 
   // --- sweep (S2) ----------------------------------------------------------
   try {
-    const metrics = path.join(repoRoot, '.orchestrator', 'metrics');
     const res = await sweepExpiredLearnings({
-      filePath: path.join(metrics, 'learnings.jsonl'),
-      archivePath: path.join(metrics, 'learnings-archive.jsonl'),
+      filePath: resolveLedgerPath('.orchestrator/metrics/learnings.jsonl', repoRoot),
+      archivePath: resolveLedgerPath('.orchestrator/metrics/learnings-archive.jsonl', repoRoot),
       now: opts.now,
       dryRun: true,
     });
@@ -426,11 +461,27 @@ export async function computeMaintenanceDue(opts = {}) {
         // finding. The sweep (#1377) is the mechanical half — prose out, the
         // provenance pair kept as `markers only` — and an operator who is told
         // only which files expired has to rediscover that the command exists.
-        markDue(
-          'generated-rules-expiring',
-          `${expiring.map((r) => `${r.file} ${r.expiresAt}`).join(', ')} → ` +
-            'node scripts/sweep-expired-rules.mjs (dry-run first)',
-        );
+        const unsweepable = await unsweepableRuleFiles(repoRoot, now);
+        const sweepable = expiring.filter((r) => !unsweepable.has(r.file));
+        const stuck = expiring.filter((r) => unsweepable.has(r.file));
+        const parts = [];
+        if (sweepable.length > 0) {
+          parts.push(
+            `${sweepable.map((r) => `${r.file} ${r.expiresAt}`).join(', ')} → ` +
+              'node scripts/sweep-expired-rules.mjs (dry-run first)',
+          );
+        }
+        if (stuck.length > 0) {
+          // The sweep resolves every entry's date through its learning in the
+          // HOST-LOCAL learnings store; with none of a file's ids there it keeps
+          // the file whole, so recommending the command would be a no-op.
+          parts.push(
+            `${stuck.map((r) => `${r.file} ${r.expiresAt}`).join(', ')} → not sweepable on this host ` +
+              '(none of their learning ids are in .orchestrator/metrics/learnings.jsonl), ' +
+              'sweep on the host that holds them',
+          );
+        }
+        markDue('generated-rules-expiring', parts.join('; '));
       }
     }
   } catch {

package/scripts/lib/memory-banner.mjs

@@ -28,6 +28,8 @@ import { readDreamSignals } from './auto-dream.mjs';
 import { readPeerCards } from './peer-cards/reader.mjs';
 import { surfaceTopN, decayOptsFromConfig } from './learnings/surface.mjs';
 import { countSessionsInJsonl } from './sessions-canonical.mjs';
+import { resolveEventsLedgerRoot } from './platform.mjs';
+import { resolveLedgerPath } from './ledger-path.mjs';
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -346,7 +348,7 @@ export async function readBannerInputs({ repoRoot, memoryDir, learningsPath, now
     : resolveMemoryDir(repoRoot);
   const learningsFile = typeof learningsPath === 'string' && learningsPath.length > 0
     ? learningsPath
-    : path.join(repoRoot, '.orchestrator', 'metrics', 'learnings.jsonl');
+    : resolveLedgerPath('.orchestrator/metrics/learnings.jsonl', repoRoot);
   const clock = now instanceof Date ? now : new Date();
 
   // --- Top learnings ---------------------------------------------------------
@@ -385,11 +387,8 @@ export async function readBannerInputs({ repoRoot, memoryDir, learningsPath, now
   try {
     const signals = await readDreamSignals({ repoRoot, memoryDir: memDir });
     const memoryFiles = await countMemoryFiles(memDir);
-    // We deliberately use the actual sessions.jsonl path under repoRoot for
-    // the count of "sessions ever" — readDreamSignals exposes sessionsFilePath
-    // computed the same way, so we re-derive locally to keep this dependency
-    // surface lean and explicit.
-    const sessionsPath = path.join(repoRoot, '.orchestrator', 'metrics', 'sessions.jsonl');
+    // Use the same main-checkout ledger as the cleanup signals above.
+    const sessionsPath = path.join(resolveEventsLedgerRoot(repoRoot), '.orchestrator', 'metrics', 'sessions.jsonl');
     const sessionsEver = await countSessionIdentities(sessionsPath);
 
     let daysSinceCleanup = null;

package/scripts/lib/memory-proposals/collector.mjs

@@ -18,6 +18,7 @@
 import { readFile, readdir } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import path from 'node:path';
+import { resolveLedgerPath } from '../ledger-path.mjs';
 
 // ---------------------------------------------------------------------------
 // Path helpers
@@ -30,7 +31,9 @@ import path from 'node:path';
  * @returns {string}
  */
 function proposalsJsonlPath(repoRoot) {
-  return path.join(repoRoot, '.orchestrator', 'metrics', 'proposals.jsonl');
+  // #1722: same root as store.mjs — a linked worktree of a repo that ignores
+  // the queue reads the main checkout's copy.
+  return resolveLedgerPath('.orchestrator/metrics/proposals.jsonl', repoRoot);
 }
 
 /**
@@ -40,7 +43,7 @@ function proposalsJsonlPath(repoRoot) {
  * @returns {string}
  */
 function metricsDir(repoRoot) {
-  return path.join(repoRoot, '.orchestrator', 'metrics');
+  return path.dirname(proposalsJsonlPath(repoRoot));
 }
 
 // ---------------------------------------------------------------------------

package/scripts/lib/memory-proposals/sink.mjs

@@ -47,6 +47,7 @@ import path from 'node:path';
 import { appendLearning } from '../learnings/io.mjs';
 import { validatePathInsideProject } from '../path-utils.mjs';
 import { atomicWriteWithBackup } from '../io.mjs';
+import { resolveLedgerRoot } from '../ledger-path.mjs';
 
 // ---------------------------------------------------------------------------
 // Path constants (relative to repoRoot)
@@ -219,7 +220,7 @@ export async function writeApproved({ approved, repoRoot, sessionId, ...rest })
     return { written: 0, errors: [] };
   }
 
-  const learningsResult = validateSinkTarget(LEARNINGS_REL, repoRoot);
+  const learningsResult = validateSinkTarget(LEARNINGS_REL, resolveLedgerRoot(LEARNINGS_REL, repoRoot));
   if (!learningsResult.ok) {
     return { written: 0, errors: [`path-safety: ${learningsResult.reason} (${LEARNINGS_REL})`] };
   }
@@ -262,7 +263,8 @@ export async function archiveRejected({ rejected, repoRoot, reason }) {
     return { archived: 0, errors: [] };
   }
 
-  const rejectedResult = validateSinkTarget(REJECTED_LOG_REL, repoRoot);
+  // The rejected log sits beside the queue it records (#1722): same mapped root.
+  const rejectedResult = validateSinkTarget(REJECTED_LOG_REL, resolveLedgerRoot(PROPOSALS_REL, repoRoot));
   if (!rejectedResult.ok) {
     return { archived: 0, errors: [`path-safety: ${rejectedResult.reason} (${REJECTED_LOG_REL})`] };
   }
@@ -346,7 +348,7 @@ export async function archiveRejected({ rejected, repoRoot, reason }) {
  * @returns {Promise<{ cleared: boolean, summariesCleared: number, reason?: string }>}
  */
 export async function clearProposalsJsonl({ repoRoot }) {
-  const proposalsResult = validateSinkTarget(PROPOSALS_REL, repoRoot);
+  const proposalsResult = validateSinkTarget(PROPOSALS_REL, resolveLedgerRoot(PROPOSALS_REL, repoRoot));
   if (!proposalsResult.ok) {
     return { cleared: false, summariesCleared: 0, reason: `path-safety: ${proposalsResult.reason}` };
   }
@@ -360,7 +362,8 @@ export async function clearProposalsJsonl({ repoRoot }) {
     try {
       const preClearContent = readFileSync(proposalsPath, 'utf8');
       if (preClearContent.length > 0) {
-        const archiveResult = validateSinkTarget(PROPOSALS_ARCHIVE_REL, repoRoot);
+        // Archive and queue never sit in different checkouts (#1722).
+        const archiveResult = validateSinkTarget(PROPOSALS_ARCHIVE_REL, resolveLedgerRoot(PROPOSALS_REL, repoRoot));
         if (!archiveResult.ok) {
           return { cleared: false, summariesCleared: 0, reason: `path-safety: ${archiveResult.reason}` };
         }

package/scripts/lib/memory-proposals/store.mjs

@@ -24,6 +24,7 @@ import { serializeProposal } from './schema.mjs';
 import { validatePathInsideProject } from '../path-utils.mjs';
 import { tryAcquireFileLock, releaseFileLock } from '../file-lock.mjs';
 import { writeJsonAtomicSync } from '../io.mjs';
+import { resolveLedgerRoot } from '../ledger-path.mjs';
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -40,6 +41,19 @@ const DEFAULT_CONFIDENCE_FLOOR = 0.5;
 const DEFAULT_LOCK_TIMEOUT_MS = 1000;
 const LOCK_POLL_MS = 50;
 
+/**
+ * Root of the whole proposals store (queue, overflow, lock, summaries). One
+ * root for all of them, decided by the queue ledger: the lock and the summary
+ * files are no `*.jsonl`, so asking `git check-ignore` per file could split
+ * the lock from the ledger it guards.
+ *
+ * @param {string} repoRoot
+ * @returns {string}
+ */
+function storeRootFor(repoRoot) {
+  return resolveLedgerRoot(PROPOSALS_JSONL, repoRoot);
+}
+
 // ---------------------------------------------------------------------------
 // Internal helpers
 // ---------------------------------------------------------------------------
@@ -160,7 +174,7 @@ function ensureDir(filePath) {
  * @returns {string}
  */
 function lockPathFor(repoRoot) {
-  return safePath(repoRoot, PROPOSALS_LOCK);
+  return safePath(storeRootFor(repoRoot), PROPOSALS_LOCK);
 }
 
 /**
@@ -169,7 +183,7 @@ function lockPathFor(repoRoot) {
  * @returns {string}
  */
 function jsonlPathFor(repoRoot) {
-  return safePath(repoRoot, PROPOSALS_JSONL);
+  return safePath(storeRootFor(repoRoot), PROPOSALS_JSONL);
 }
 
 /**
@@ -178,11 +192,14 @@ function jsonlPathFor(repoRoot) {
  * @returns {string}
  */
 function overflowPathFor(repoRoot) {
-  return safePath(repoRoot, PROPOSALS_OVERFLOW_JSONL);
+  return safePath(storeRootFor(repoRoot), PROPOSALS_OVERFLOW_JSONL);
 }
 
 /** Flush a directory entry before depending on its persistence. */
 function syncOverflowDirectory(directory) {
+  // Windows rejects fsync on a directory handle (EPERM); NTFS metadata
+  // journaling already covers the directory entry there.
+  if (process.platform === 'win32') return;
   const fd = fs.openSync(directory, 'r');
   try {
     fs.fsyncSync(fd);
@@ -294,7 +311,7 @@ function appendOverflow(repoRoot, overflowPath, line) {
     fs.appendFileSync(overflowPath, lineBytes);
     return;
   }
-  const root = fs.realpathSync(repoRoot);
+  const root = fs.realpathSync(storeRootFor(repoRoot));
   const directory = path.dirname(overflowPath);
   const token = randomUUID();
   const archive = safePath(root, path.relative(root, `${overflowPath}.archive-${token}.jsonl`));
@@ -332,7 +349,7 @@ function summaryPathFor(repoRoot, waveId) {
   if (!/^[A-Za-z0-9_-]+$/.test(waveId)) {
     throw new TypeError(`store.mjs: waveId contains invalid characters: ${waveId}`);
   }
-  return safePath(repoRoot, `${PROPOSALS_SUMMARY_PREFIX}${waveId}.json`);
+  return safePath(storeRootFor(repoRoot), `${PROPOSALS_SUMMARY_PREFIX}${waveId}.json`);
 }
 
 /**

package/scripts/lib/mode-selector-accuracy.mjs

@@ -33,6 +33,7 @@
 
 import { appendLearning } from './learnings.mjs';
 import { isValidMode } from './recommendations-v0.mjs';
+import { resolveLedgerPath } from './ledger-path.mjs';
 
 export const LEARNING_TYPE = 'mode-selector-accuracy';
 export const INITIAL_CONFIDENCE = 0.5;
@@ -66,7 +67,7 @@ export async function recordAccuracy(opts) {
   const recommended = opts?.recommended;
   const chosen = opts?.chosen;
   const sessionId = opts?.sessionId;
-  const filePath = opts?.filePath || '.orchestrator/metrics/learnings.jsonl';
+  const filePath = opts?.filePath || resolveLedgerPath('.orchestrator/metrics/learnings.jsonl', process.cwd());
 
   // No-op when the selector did not render a recommendation (banner suppressed,
   // confidence 0.0, etc). Caller passes recommended=null in that case.

package/scripts/lib/no-follow-open.mjs

@@ -0,0 +1,57 @@
+/**
+ * no-follow-open.mjs — open a regular file for reading without following a
+ * symlink in the final path component, on every platform (#1744).
+ *
+ * Node leaves `fs.constants.O_NOFOLLOW` and `O_NONBLOCK` undefined on win32, so
+ * callers that gated their read on those flags silently skipped it there.
+ */
+
+import { constants as fsConstants, promises as fsPromises } from 'node:fs';
+
+const codedError = (message, code) => Object.assign(new Error(message), { code });
+
+/**
+ * Open `target` read-only without following a final-component symlink.
+ *
+ * - POSIX (`O_NOFOLLOW` and `O_NONBLOCK` both defined): one
+ *   `open(O_RDONLY | O_NOFOLLOW | O_NONBLOCK)`; a symlink fails with the
+ *   kernel's `ELOOP`. Callers keep doing their own stat checks on the handle.
+ * - Fallback (either flag missing, i.e. win32): `lstat` first — a symlink
+ *   (Node reports Windows junctions as symlinks too) throws `code: 'ELOOP'`, a
+ *   non-regular file throws `code: 'ERR_NOT_REGULAR_FILE'`; then `open('r')`
+ *   and compare the handle's identity with the lstat. A non-regular file or a
+ *   different `dev`/`ino` closes the handle and throws `code: 'ERR_FILE_CHANGED'`
+ *   (the path was swapped between check and open). Bigint stats, because
+ *   Windows file IDs can exceed 2^53.
+ *
+ * BV-004 ceiling: the fallback still has a window between lstat and open. On
+ * win32 there are no FIFOs in the filesystem namespace, so the open cannot
+ * block, and the post-open identity check catches a swap. Revisit when a POSIX
+ * platform lacks O_NONBLOCK, or a caller must read a FIFO-capable location on
+ * such a platform.
+ *
+ * @param {string} target
+ * @param {{ constants?: Record<string, number|undefined>, fsImpl?: typeof fsPromises }} [options]
+ *   Injection exists only so the fallback branch is testable on POSIX CI;
+ *   production callers pass nothing.
+ * @returns {Promise<import('node:fs/promises').FileHandle>} caller closes it
+ */
+export async function openNoFollow(target, { constants = fsConstants, fsImpl = fsPromises } = {}) {
+  if (typeof constants.O_NOFOLLOW === 'number' && typeof constants.O_NONBLOCK === 'number') {
+    return fsImpl.open(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+  }
+  const before = await fsImpl.lstat(target, { bigint: true });
+  if (before.isSymbolicLink()) throw codedError(`${target} is a symbolic link`, 'ELOOP');
+  if (!before.isFile()) throw codedError(`${target} is not a regular file`, 'ERR_NOT_REGULAR_FILE');
+  const handle = await fsImpl.open(target, 'r');
+  try {
+    const after = await handle.stat({ bigint: true });
+    if (!after.isFile() || after.dev !== before.dev || after.ino !== before.ino) {
+      throw codedError(`${target} changed between check and open`, 'ERR_FILE_CHANGED');
+    }
+  } catch (err) {
+    await handle.close();
+    throw err;
+  }
+  return handle;
+}

package/scripts/lib/orphan-reaper/reaper-audit.mjs

@@ -9,7 +9,8 @@ import path from 'node:path';
 
 import { replaceRegularFile } from '../process-group.mjs';
 import { readTailWindow } from '../tail-window.mjs';
-import { REAPER_DEFAULTS, underRepo } from './defaults.mjs';
+import { REAPER_DEFAULTS } from './defaults.mjs';
+import { resolveLedgerPath } from '../ledger-path.mjs';
 import { NOT_A_REGULAR_FILE, appendNoFollow } from './no-follow-append.mjs';
 
 /** Relative path of the JSONL kill audit (B5). Gitignored via `.gitignore:55`
@@ -67,7 +68,8 @@ function isRateDecision(record) {
 /** Absolute path of the kill audit for a repo. One constant per path.
  *  @param {string} repoRoot @returns {string} */
 export function auditPath(repoRoot) {
-  return underRepo(repoRoot, REAPER_AUDIT_RELPATH);
+  // #1722: a linked worktree of a repo that ignores the audit maps to the main checkout.
+  return resolveLedgerPath(REAPER_AUDIT_RELPATH, repoRoot);
 }
 
 /**