session-orchestrator 5.12.0 → 5.13.0

package/scripts/lib/quality-gate.mjs

@@ -69,7 +69,7 @@ import { fileURLToPath } from 'node:url';
 import { emitEvent, sessionAttribution } from './events.mjs';
 import { resolveWaveNumber } from './quality-gate-wave.mjs';
 import { parsePorcelainZ } from './git-porcelain.mjs';
-import { admitSuiteCounts, extractTestCounts } from './gates/gate-helpers.mjs';
+import { admitSuiteCounts, extractTestCounts, leftoverGroupLine } from './gates/gate-helpers.mjs';
 import {
   DEFAULT_GATE_TIMEOUT_MS,
   buildCommandSignature,
@@ -78,6 +78,7 @@ import {
 import { redactDiagnosticsBundle } from './quality-gate/diagnostics.mjs';
 import { atomicWriteWithBackup, writeJsonAtomicSync } from './io.mjs';
 import { readProcessLocalSessionIds } from './session-identity/own-session.mjs';
+import { resolveOwnLockRoot } from '../../hooks/_lib/hook-root.mjs';
 
 export { redactDiagnosticsBundle } from './quality-gate/diagnostics.mjs';
 
@@ -319,7 +320,8 @@ function resolveCommands(override, repoRoot) {
  *   (`spawnFn`, `killFn`, `isAliveFn`, `sleepFn`, `killGraceMs`, `verifyWaitMs`).
  *   Test seam only; production passes nothing and gets the module defaults.
  * @returns {Promise<{ exitCode: number, output: string, timedOut: boolean,
- *   overflow: boolean, killSignals: string[], survivors: number[], pgid: number }>}
+ *   overflow: boolean, killSignals: string[], survivors: number[]|null, error?: string, pgid: number,
+ *   leftoverGroup?: {pgid: number, signals: string[], survivors: number[]} }>}
  */
 async function runGate(cmd, cwd, opts = {}) {
   try {
@@ -349,9 +351,16 @@ async function runGate(cmd, cwd, opts = {}) {
     // A process that outlived SIGKILL (one that `setsid`-ed out of the group) is
     // SAID OUT LOUD on the channel the operator and the diagnostics bundle both
     // read. Silence here would be the exact failure the ladder exists to expose.
-    const output = result.survivors.length > 0
+    const survivorOutput = result.survivors === null
+      ? `${result.output}\nÜberlebende nicht messbar: ${result.error}`.trim()
+      : result.survivors.length > 0
       ? `${result.output}\ngate: ${result.survivors.length} process(es) survived SIGKILL: ${result.survivors.join(', ')}`.trim()
       : result.output;
+    // #1704: a group still alive after a NORMAL exit was reaped by the ladder.
+    // Named here, never a status change (pass/fail stays the exit code's).
+    const output = result.leftoverGroup
+      ? `${survivorOutput}\n${leftoverGroupLine(result.leftoverGroup)}`.trim()
+      : survivorOutput;
 
     return {
       exitCode: result.exitCode,
@@ -360,6 +369,8 @@ async function runGate(cmd, cwd, opts = {}) {
       overflow: result.overflow,
       killSignals: result.killSignals,
       survivors: result.survivors,
+      ...(result.survivors === null ? { error: result.error, ok: false } : {}),
+      ...(result.leftoverGroup ? { leftoverGroup: result.leftoverGroup } : {}),
       pgid: result.pgid,
     };
   } catch (err) {
@@ -607,16 +618,25 @@ function classifyCurrentSessionOwnership(parsed, ownIds) {
  * WARN is not de-duplicated; this function runs at most once per fixer dispatch
  * plus once at abort, and each line marks a distinct decision point.
  *
+ * The file is read beside THIS session's own lock (#1630): after /clear in an
+ * entered worktree the lock and `current-session.json` live there (#1605), and
+ * after ExitWorktree the gate runs with `repoRoot` on the main checkout, where
+ * the file belongs to another session. `resolveOwnLockRoot` follows the host
+ * registry's `session_root` pointer — the lookup the hook writer
+ * (`post-tool-failure-corrective-context.mjs`) uses — and answers `repoRoot`
+ * unchanged when no own lock is found elsewhere.
+ *
  * @param {string} repoRoot
  * @returns {Array<object>}
  */
 function readCorrectiveContext(repoRoot) {
   try {
-    const p = join(repoRoot, '.orchestrator', 'current-session.json');
+    const ownIds = readOwnSessionIds();
+    const ownRoot = resolveOwnLockRoot({ session_id: [...ownIds][0] ?? null, cwd: repoRoot }, repoRoot);
+    const p = join(ownRoot, '.orchestrator', 'current-session.json');
     if (!existsSync(p)) return [];
     const raw = readFileSync(p, 'utf8');
     const parsed = JSON.parse(raw);
-    const ownIds = readOwnSessionIds();
     const { verdict, fileIds } = classifyCurrentSessionOwnership(parsed, ownIds);
     if (verdict === 'foreign') {
       process.stderr.write(
@@ -791,13 +811,15 @@ function coerceMaxRetries(n) {
  * - `kill_signals` — the signals actually sent, in order (`SIGTERM`, `SIGKILL`).
  *   Copied, because `spawnInGroup` records them at send time into a live array.
  *
- * @param {{timedOut?: boolean, killSignals?: string[], survivors?: number[]}|null|undefined} run
- * @returns {{timed_out: boolean, survivors: number, kill_signals: string[]}}
+ * @param {{timedOut?: boolean, killSignals?: string[], survivors?: number[]|null, error?: string}|null|undefined} run
+ * @returns {{timed_out: boolean, survivors: number|null, error?: string, kill_signals: string[]}}
  */
+// Explicit null is an unmeasurable cleanup, never a measured zero.
 export function gateKillFields(run) {
   return {
     timed_out: run?.timedOut === true,
-    survivors: Array.isArray(run?.survivors) ? run.survivors.length : 0,
+    survivors: run?.survivors === null ? null : (Array.isArray(run?.survivors) ? run.survivors.length : 0),
+    ...(run?.survivors === null ? { error: run.error, ok: false } : {}),
     kill_signals: Array.isArray(run?.killSignals) ? [...run.killSignals] : [],
   };
 }
@@ -887,7 +909,7 @@ export function gateKillFields(run) {
  * @param {number} attempts
  * @param {string|null} gate
  * @param {{passed: number, failed: number, total: number}|null} [counts]
- * @param {{timedOut?: boolean, killSignals?: string[], survivors?: number[]}|null} [killRun]
+ * @param {{timedOut?: boolean, killSignals?: string[], survivors?: number[]|null, error?: string}|null} [killRun]
  *   the run that decided the verdict — the last attempt's failing gate; `null`
  *   on the passing path, where every gate exited 0 and so none was killed
  *   (`spawnInGroup` only starts its kill ladder on timeout or overflow, and
@@ -1036,6 +1058,8 @@ export async function runQualityGateWithRetry(opts) {
         timedOut: result.timedOut,
         killSignals: result.killSignals,
         survivors: result.survivors,
+        ...(result.survivors === null ? { error: result.error, ok: false } : {}),
+        ...(result.leftoverGroup ? { leftoverGroup: result.leftoverGroup } : {}),
         command: cmd,
         attempt,
       };

package/scripts/lib/reconcile/backlog.mjs

@@ -41,11 +41,13 @@
 import { readFileSync, readdirSync } from 'node:fs';
 import { isAbsolute, join } from 'node:path';
 
+import { resolveLedgerPath } from '../ledger-path.mjs';
 import { learningKeyOf } from '../learnings/kebab.mjs';
 import { migrateLegacyLearning, normalizeLearning } from '../learnings/schema.mjs';
 import { isRuleExpired, parseGlobsFrontmatter } from '../rule-loader.mjs';
 import { filterEligible } from './eligibility.mjs';
 import { isProcessed, loadCandidates as realLoadCandidates } from './idempotency.mjs';
+import { loadVerdictLedger } from './verdict-ledger.mjs';
 
 /** Default repo-relative location of the learnings corpus. */
 export const DEFAULT_LEARNINGS_PATH = '.orchestrator/metrics/learnings.jsonl';
@@ -65,7 +67,7 @@ export function defaultLoadLearnings(repoRoot) {
   const root = typeof repoRoot === 'string' && repoRoot.length > 0 ? repoRoot : process.cwd();
   const absPath = isAbsolute(DEFAULT_LEARNINGS_PATH)
     ? DEFAULT_LEARNINGS_PATH
-    : join(root, DEFAULT_LEARNINGS_PATH);
+    : resolveLedgerPath(DEFAULT_LEARNINGS_PATH, root);
 
   let raw;
   try {
@@ -198,12 +200,15 @@ const BODY_LEARNING_ID_RE = /-\s*learning-id:\s*`([^`]+)`/g;
  * unparseable `expires-at` is NOT expired; fail-closed would un-materialize the
  * whole corpus on one typo).
  *
- * KNOWN LIMIT (measured 2026-09-18): this covers only the on-disk half of
- * {@link partitionMaterialized} (`sidecarTerminal || onDisk`). 79 of this
- * repo's 92 provenance keys are ALSO terminal in the idempotency sidecar, so
- * only 13 actually become re-proposable; the sidecar half is left untouched on
- * purpose because it carries operator DECLINES. See `docs/rule-authoring.md`
- * § Consolidated rules.
+ * KNOWN LIMIT (measured 2026-09-18): this covers only the on-disk third of
+ * {@link partitionMaterialized} (`sidecarTerminal || ledgerTerminal || onDisk`).
+ * 79 of this repo's 92 provenance keys are ALSO terminal in the idempotency
+ * sidecar, so only 13 actually become re-proposable; the sidecar and the
+ * verdict ledger (#1710) are left untouched on purpose because they carry
+ * operator DECLINES — the ledger holds DECISIONS only (`rejected`,
+ * `expired-swept`; never the branch-scoped `written` / `already-on-disk`), so
+ * an expiring rule's own `written` verdict never pins it there. See
+ * `docs/rule-authoring.md` § Consolidated rules.
  *
  * Gated the same way as {@link defaultLoadCandidatesForDedupe}: an absent
  * `repoRoot` yields empty sets rather than falling back to `process.cwd()`.
@@ -267,20 +272,22 @@ export function defaultReadMaterializedProvenance(repoRoot) {
  * Split rule-eligible learnings into the ones still awaiting a rule and the ones
  * already materialized (#484/#1242 dedupe contract). A learning is materialized
  * when the idempotency sidecar carries a terminal verdict for its `learning_key`
- * (CACHE) OR a `.claude/rules/*.md` provenance marker names its key/id
- * (AUTHORITATIVE).
+ * (CACHE) OR the append-only verdict ledger does (`./verdict-ledger.mjs`, #1710 —
+ * survives worktrees and hosts the sidecar does not) OR a `.claude/rules/*.md`
+ * provenance marker names its key/id (AUTHORITATIVE).
  *
  * Pure: reads nothing, writes nothing, emits nothing — the engine and the
  * session-start reconcile nudge share it so both judge the same backlog (#1380).
  *
  * @param {Array<Record<string, unknown>>} eligible - output of `filterEligible().eligible`.
- * @param {{ existingCandidates: import('./idempotency.mjs').ReconcileCandidate[], materialized: { keys: Set<string>, ids: Set<string> } }} sources
+ * @param {{ existingCandidates: import('./idempotency.mjs').ReconcileCandidate[], materialized: { keys: Set<string>, ids: Set<string> }, ledgerKeys?: { has(key: string): boolean } }} sources
+ *        `ledgerKeys` — terminal learning keys of the verdict ledger; absent ⇒ none.
  * @returns {{
  *   stillEligible: Array<Record<string, unknown>>,
- *   materializedItems: Array<{ learning: Record<string, unknown>, learningKey: string|null, sidecarTerminal: boolean, onDisk: boolean }>,
+ *   materializedItems: Array<{ learning: Record<string, unknown>, learningKey: string|null, sidecarTerminal: boolean, ledgerTerminal: boolean, onDisk: boolean }>,
  * }}
  */
-export function partitionMaterialized(eligible, { existingCandidates, materialized }) {
+export function partitionMaterialized(eligible, { existingCandidates, materialized, ledgerKeys }) {
   /** @type {Array<Record<string, unknown>>} */
   const stillEligible = [];
   const materializedItems = [];
@@ -296,14 +303,16 @@ export function partitionMaterialized(eligible, { existingCandidates, materializ
 
     const sidecarTerminal =
       learningKey !== null && isProcessed({ learning_key: learningKey }, existingCandidates);
+    const ledgerTerminal =
+      learningKey !== null && !!ledgerKeys && typeof ledgerKeys.has === 'function' && ledgerKeys.has(learningKey);
     const onDisk =
       (learningKey !== null && materialized.keys.has(learningKey)) ||
       (learningId !== null && materialized.ids.has(learningId));
 
-    if (!sidecarTerminal && !onDisk) {
+    if (!sidecarTerminal && !ledgerTerminal && !onDisk) {
       stillEligible.push(learning);
     } else {
-      materializedItems.push({ learning, learningKey, sidecarTerminal, onDisk });
+      materializedItems.push({ learning, learningKey, sidecarTerminal, ledgerTerminal, onDisk });
     }
   }
   return { stillEligible, materializedItems };
@@ -312,7 +321,8 @@ export function partitionMaterialized(eligible, { existingCandidates, materializ
 /**
  * Count the reconcile BACKLOG the way a real `/reconcile` run would see it:
  * rule-eligible learnings (expiry-gated by `now`) minus those already
- * materialized in the sidecar or under `.claude/rules/`. This is the quantity
+ * materialized in the sidecar, the verdict ledger (#1710) or under
+ * `.claude/rules/`. This is the quantity
  * `/reconcile` can actually drive to zero — the session-start nudge judges on it
  * (#1380; HR-101: a probe that counts already-materialized learnings can never
  * go green).
@@ -332,6 +342,8 @@ export function partitionMaterialized(eligible, { existingCandidates, materializ
  *        already-loaded sidecar records (DI seam for a caller that read the store
  *        itself — the session-start nudge does, for the last-run timestamp). Absent
  *        ⇒ this function reads the store via {@link defaultLoadCandidatesForDedupe}.
+ * @param {{ has(key: string): boolean }} [params.ledgerKeys] - terminal keys of the verdict
+ *        ledger (DI seam). Absent ⇒ read via `loadVerdictLedger(repoRoot)` (repoRoot-gated).
  * @param {Date|number} [params.now] - clock for the expiry gate (defaults to `Date.now()`).
  * @param {number} [params.minInsightChars] - forwarded to `filterEligible`.
  * @returns {{ eligible: number, alreadyMaterialized: number, backlog: number }}
@@ -340,6 +352,7 @@ export function countReconcileBacklog({
   repoRoot,
   learnings,
   existingCandidates,
+  ledgerKeys,
   now,
   minInsightChars,
 } = {}) {
@@ -356,6 +369,7 @@ export function countReconcileBacklog({
         ? existingCandidates
         : defaultLoadCandidatesForDedupe(repoRoot).records,
       materialized: defaultReadMaterializedProvenance(repoRoot),
+      ledgerKeys: ledgerKeys ?? loadVerdictLedger(repoRoot).terminalKeys,
     });
     return {
       eligible: eligible.length,

package/scripts/lib/reconcile/engine.mjs

@@ -125,6 +125,7 @@ import {
   makeCandidateId,
   mergeCandidates as realMergeCandidates,
 } from './idempotency.mjs';
+import { appendRun, loadVerdictLedger } from './verdict-ledger.mjs';
 
 /**
  * Re-exported from the LEAF module `./backlog.mjs` (which now owns the
@@ -354,6 +355,10 @@ export function resolveEffectiveTargets({ targets, baselineRoot } = {}) {
  * @param {(repoRoot?: string) => { keys: Set<string>, ids: Set<string> }} [opts.readMaterializedProvenance]
  *        override the `.claude/rules/` provenance scan used by the same dedupe step —
  *        defaults to {@link defaultReadMaterializedProvenance} (same repoRoot gate).
+ * @param {(repoRoot?: string) => { terminalKeys: { has(key: string): boolean } }} [opts.loadVerdictLedger]
+ *        override the append-only verdict-ledger read (#1710) used by the same dedupe step —
+ *        defaults to `loadVerdictLedger` (same repoRoot gate). After a successful non-dryRun
+ *        merge the engine appends one run record to that ledger (explicit repoRoot only).
  * @param {boolean} [opts.dryRun]         - when true, compute proposals but SKIP the merge entirely.
  * @returns {Promise<ReconcileResult>}
  */
@@ -381,6 +386,8 @@ async function runReconcileInner(
       typeof opts.readMaterializedProvenance === 'function'
         ? opts.readMaterializedProvenance
         : defaultReadMaterializedProvenance;
+    const readVerdictLedger =
+      typeof opts.loadVerdictLedger === 'function' ? opts.loadVerdictLedger : loadVerdictLedger;
     // Volume brake (#900 D) — always active; a missing/invalid override falls
     // back to the same default the Session Config parser uses.
     const maxProposalsPerRun =
@@ -453,18 +460,24 @@ async function runReconcileInner(
     // shape" test in `tests/lib/reconcile/engine.test.mjs`.
     const { records: existingCandidates } = loadCandidatesForDedupe(repoRoot) ?? { records: [] };
     const materialized = readMaterializedProvenance(repoRoot) ?? { keys: new Set(), ids: new Set() };
+    // #1710 — the append-only verdict ledger carries terminal verdicts into a
+    // fresh worktree / another host, where the checkout-local sidecar is empty.
+    const ledgerKeys = readVerdictLedger(repoRoot)?.terminalKeys;
 
     const { stillEligible, materializedItems } = partitionMaterialized(eligible, {
       existingCandidates,
       materialized,
+      ledgerKeys,
     });
     const alreadyMaterialized = materializedItems.length;
 
-    for (const { learning, learningKey, sidecarTerminal, onDisk } of materializedItems) {
+    for (const { learning, learningKey, sidecarTerminal, ledgerTerminal, onDisk } of materializedItems) {
       const type = learningType(learning);
       const reason = sidecarTerminal
         ? 'already processed — the idempotency sidecar already carries a terminal verdict for this learning-key'
-        : 'already materialized — a .claude/rules/ file already carries this learning-key/learning-id';
+        : ledgerTerminal
+          ? 'already processed — the reconcile verdict ledger already carries a terminal verdict for this learning-key'
+          : 'already materialized — a .claude/rules/ file already carries this learning-key/learning-id';
       rejected.push({ learningKey, type, reason, status: 'rejected' });
 
       // Freshly discovered on-disk materialization (not yet reflected in the
@@ -632,6 +645,17 @@ async function runReconcileInner(
         if (mergeResult && Number.isFinite(mergeResult.skipped)) {
           skipped = Number(mergeResult.skipped);
         }
+        // #1710 — record the run itself, so run recency survives a checkout
+        // without the sidecar, with the learnings count it saw (the nudge's
+        // "new since last run" baseline). Explicit repoRoot only (never cwd).
+        if (written && typeof repoRoot === 'string' && repoRoot.length > 0) {
+          const run = appendRun(repoRoot, createdAt, totalLearnings);
+          if (run.ok !== true) {
+            process.stderr.write(
+              `⚠ reconcile: run record not appended to the verdict ledger (${run.error ?? 'unknown error'})\n`,
+            );
+          }
+        }
       } catch {
         // Merge failure is non-fatal; proposals still returned, written stays
         // false and `skipped` stays absent (the store was never inspected).

package/scripts/lib/reconcile/idempotency.mjs

@@ -61,6 +61,7 @@ import { readFileSync } from 'node:fs';
 import { isAbsolute, join } from 'node:path';
 import { createHash } from 'node:crypto';
 import { atomicWriteWithBackup } from '../io.mjs';
+import { appendVerdicts, isDecisionOutcome, loadVerdictLedger } from './verdict-ledger.mjs';
 
 /** Default repo-relative location of the reconcile-candidate work-queue. */
 export const DEFAULT_STORE_PATH = '.orchestrator/runtime/reconcile-candidates.jsonl';
@@ -317,11 +318,22 @@ export function isProcessed(candidate, existing) {
  * (malformed JSON, or a record missing `learning_key`/`created_at`). Because the
  * store is rewritten in full, those lines are DROPPED from disk by this call —
  * the count is what makes that loss attributable instead of silent.
+ *
+ * Verdict ledger (#1710): after a successful store write, and ONLY when
+ * `repoRoot` was passed explicitly, every terminal DECISION of the merged store
+ * (`isDecisionOutcome` — not the branch-scoped `written` / `already-on-disk` /
+ * absent outcome, see `BRANCH_SCOPED_OUTCOMES`) whose `learning_key` the
+ * append-only ledger (`./verdict-ledger.mjs`) does not yet hold is appended
+ * there — new stamps AND older sidecar verdicts (a one-time backfill). The
+ * ledger outlives the gitignored, checkout-local sidecar, so a fresh worktree
+ * keeps an operator decline. A ledger failure never turns a successful store
+ * write into a failure; it is reported in the additive `ledger` field (absent
+ * when the ledger was not consulted) and as ONE stderr WARN.
  * @param {Object} [params]
  * @param {ReconcileCandidate[]} [params.candidates] - newly minted candidates to merge.
  * @param {string} [params.repoRoot]
  * @param {string} [params.storePath]
- * @returns {{ merged: ReconcileCandidate[], written: boolean, skipped: number }}
+ * @returns {{ merged: ReconcileCandidate[], written: boolean, skipped: number, ledger?: { ok: boolean, appended: number, error?: string } }}
  */
 export function mergeCandidates({ candidates, repoRoot, storePath } = {}) {
   const absPath = resolveStorePath(repoRoot, storePath);
@@ -353,7 +365,28 @@ export function mergeCandidates({ candidates, repoRoot, storePath } = {}) {
   );
 
   const result = writeStore(absPath, merged);
-  return { merged, written: result.ok === true, skipped };
+  const written = result.ok === true;
+  if (!written || typeof repoRoot !== 'string' || repoRoot.length === 0) {
+    return { merged, written, skipped };
+  }
+
+  const ledger = loadVerdictLedger(repoRoot);
+  if (ledger.readError) {
+    // Unreadable ledger: appending blind would duplicate every verdict.
+    process.stderr.write('⚠ mergeCandidates: verdict ledger unreadable — no verdicts mirrored this merge\n');
+    return { merged, written, skipped, ledger: { ok: false, appended: 0, error: 'ledger unreadable' } };
+  }
+  const missing = merged.filter(
+    (rec) => isTerminal(rec) && isDecisionOutcome(rec.outcome) && !ledger.terminalKeys.has(rec.learning_key),
+  );
+  const appended = appendVerdicts(repoRoot, missing);
+  if (appended.ok !== true) {
+    process.stderr.write(
+      `⚠ mergeCandidates: verdict ledger append failed (${appended.error ?? 'unknown error'}) — ` +
+        `${missing.length} verdict(s) not mirrored\n`,
+    );
+  }
+  return { merged, written, skipped, ledger: appended };
 }
 
 /**
@@ -376,7 +409,10 @@ export function mergeCandidates({ candidates, repoRoot, storePath } = {}) {
  * `mergeCandidates`'s own dedupe rule still applies underneath this call: if
  * the existing record is ALREADY terminal (a prior `processed_at`), the merge
  * keeps the existing verdict and this call is a no-op on disk — a terminal
- * verdict is never regressed, even by a second stamp attempt.
+ * verdict is never regressed, even by a second stamp attempt. One exception
+ * (#1710): a DECISION (`isDecisionOutcome`) stamped over a kept `written` /
+ * `already-on-disk` record is still appended to the verdict ledger (explicit
+ * `repoRoot` only), so a dropped or swept rule stays dropped in other checkouts.
  *
  * Never throws (delegates to the never-throwing `loadCandidates`/
  * `mergeCandidates`); on write failure returns `{ written: false, ... }`.
@@ -460,6 +496,32 @@ export function markCandidateProcessed({
   // the caller a verdict that is nowhere on disk. `merged` IS the array that was
   // just written, so reading the record back out of it is the honest answer.
   const persisted = result.merged.find((rec) => rec && rec.learning_key === learningKey);
+
+  // A DECISION stamped over a kept branch-scoped terminal record (`written` /
+  // `already-on-disk`) never reaches the ledger through `mergeCandidates`: the
+  // store keeps the old outcome, and only decisions are mirrored. That is the
+  // rule-drop recipe and the expiry sweep's delete stamp — append it here so the
+  // drop holds in other checkouts too (#1710).
+  if (
+    result.written === true &&
+    typeof repoRoot === 'string' &&
+    repoRoot.length > 0 &&
+    isDecisionOutcome(outcome) &&
+    persisted &&
+    !isDecisionOutcome(persisted.outcome)
+  ) {
+    const ledger = loadVerdictLedger(repoRoot);
+    if (!ledger.readError && !ledger.terminalKeys.has(learningKey)) {
+      const appended = appendVerdicts(repoRoot, [{ learning_key: learningKey, outcome, processed_at: stampAt }]);
+      if (appended.ok !== true) {
+        process.stderr.write(
+          `⚠ markCandidateProcessed: verdict ledger append failed (${appended.error ?? 'unknown error'}) — ` +
+            `${outcome} for ${learningKey} not mirrored\n`,
+        );
+      }
+    }
+  }
+
   return {
     written: result.written === true,
     stamped: persisted ?? stamped,

package/scripts/lib/reconcile/rule-expiry-sweep.mjs

@@ -141,10 +141,13 @@
  */
 
 import { lstatSync, readFileSync, unlinkSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
 import { join, resolve, sep } from 'node:path';
 
 import { atomicWriteWithBackup } from '../io.mjs';
-import { readLearnings } from '../learnings/io.mjs';
+import { resolveLedgerPath } from '../ledger-path.mjs';
+import { parseLearningsText } from '../learnings/io.mjs';
+import { archivePathFor } from '../learnings/store-role.mjs';
 import { listMachineGeneratedRules } from '../instruction-budget-guard.mjs';
 import { parseGlobsFrontmatter, ruleExpiryInstantMs } from '../rule-loader.mjs';
 import { markCandidateProcessed } from './idempotency.mjs';
@@ -371,26 +374,57 @@ export function parseConsolidatedRule(content) {
 }
 
 /**
- * Read `learnings.jsonl` into `id -> expires_at`, counting malformed lines.
+ * Read the archive and live `learnings.jsonl` into `id -> expires_at`,
+ * counting malformed lines separately for each source.
  *
  * Malformed lines are COUNTED, never silently dropped: a leniently-skipping
  * JSONL parser turns a partial read into a clean verdict, and this sweep
  * DELETES prose on the strength of that verdict.
  *
+ * Boundary (BV-004, #1685): the index reads the live store and archive, never the
+ * sibling `learnings-inbox.jsonl` (#1516). An inbox-only id resolves as absent:
+ * consolidated pairs stay unresolved/kept, a single-entry file falls back to
+ * its own `expires-at`. Including the inbox would not be purely conservative —
+ * a resolvable past `expires_at` would let `rewriteContent` remove a pair that
+ * is kept today. Ceiling: an inbox record's later `expires_at` cannot delay a
+ * single-entry delete. Revisit trigger: the first real inbox host, or a
+ * generated rule citing an inbox-only learning-id.
+ * The archive is admissible because each learning's own `expires_at` carries
+ * the expiry evidence; live records override archived records with the same id.
+ * Superseded/merged tombstones stay excluded because their content lives in a
+ * winner; revisit pointer resolution if a rule section stays permanently
+ * unresolved because it cites only a tombstone.
+ *
  * @param {string} absPath
- * @returns {Promise<{expiryById: Map<string, string>, malformedLines: number}>}
+ * @returns {Promise<{expiryById: Map<string, string>, malformedLines: number, archiveMalformedLines: number}>}
  */
 async function loadExpiryIndex(absPath) {
   const expiryById = new Map();
-  const { entries, malformed } = await readLearnings(absPath);
-  for (const entry of entries) {
+  // Unlike the shared tolerant reader, a sweep needs evidence that the store
+  // was actually read: an absent store must not become an empty expiry index.
+  const { entries, malformed } = parseLearningsText(await readFile(absPath, 'utf8'));
+  let archiveText = '';
+  try {
+    archiveText = await readFile(archivePathFor(absPath), 'utf8');
+  } catch (err) {
+    if (err?.code !== 'ENOENT') throw err;
+  }
+  const archive = parseLearningsText(archiveText);
+  const archivedLearnings = archive.entries.filter((entry) =>
+    !Object.hasOwn(entry, '_superseded_by') &&
+    !Object.hasOwn(entry, '_merged_into') &&
+    entry._archive_reason !== 'superseded' &&
+    entry._archive_reason !== 'merged',
+  );
+  // Overlay the live store last: a reactivated learning may have a later expiry.
+  for (const entry of [...archivedLearnings, ...entries]) {
     const id = entry?.id;
     const expiresAt = entry?.expires_at;
     if (typeof id === 'string' && id.length > 0 && typeof expiresAt === 'string') {
       expiryById.set(id, expiresAt);
     }
   }
-  return { expiryById, malformedLines: malformed.length };
+  return { expiryById, malformedLines: malformed.length, archiveMalformedLines: archive.malformed.length };
 }
 
 /** `now` as epoch-ms, accepting a Date, a number, an ISO string, or nothing. */
@@ -569,7 +603,7 @@ function keepOrRaisePlan(base, parsed, advisory, raiseTo) {
  *   swept. Default 0: unlike the learnings sweep, nothing re-stamps a rule
  *   file's `expires-at`, so there is no re-stamp window to protect.
  * @param {string} [opts.learningsPath]    override the learnings store
- * @returns {Promise<{plans: Array<object>, skipped: Array<{file: string, reason: string}>, malformedLines: number, ok: boolean}>}
+ * @returns {Promise<{plans: Array<object>, skipped: Array<{file: string, reason: string}>, malformedLines: number, archiveMalformedLines: number, ok: boolean}>}
  */
 export async function planRuleExpirySweep(opts = {}) {
   const { repoRoot, now, graceDays = 0, learningsPath } = opts;
@@ -582,11 +616,18 @@ export async function planRuleExpirySweep(opts = {}) {
 
   const nowMs = toEpochMs(now);
   const cutoffMs = nowMs - graceDays * MS_PER_DAY;
-  const { expiryById, malformedLines } = await loadExpiryIndex(
-    join(repoRoot, learningsPath ?? DEFAULT_LEARNINGS_PATH),
-  );
-
   const listed = listMachineGeneratedRules({ repoRoot });
+  // Ohne generierte Regeln gibt es nichts zu pruefen: der Bestand wird dann
+  // nicht gelesen, damit ein Repo ohne learnings.jsonl nicht mit ENOENT endet
+  // (Housekeeping Schritt 3 ruft die CLI repo-unabhaengig auf).
+  const { expiryById, malformedLines, archiveMalformedLines } =
+    listed.rules.length === 0
+      ? { expiryById: new Map(), malformedLines: 0, archiveMalformedLines: 0 }
+      : await loadExpiryIndex(
+          // #1722: the default store (and its archive beside it) follows the
+          // ledger root; an explicit learningsPath stays repo-relative as before.
+          learningsPath ? join(repoRoot, learningsPath) : resolveLedgerPath(DEFAULT_LEARNINGS_PATH, repoRoot),
+        );
   const rulesDir = join(repoRoot, '.claude', 'rules');
   /** @type {Array<object>} */
   const plans = [];
@@ -807,7 +848,7 @@ export async function planRuleExpirySweep(opts = {}) {
     });
   }
 
-  return { plans, skipped, malformedLines, ok: listed.ok };
+  return { plans, skipped, malformedLines, archiveMalformedLines, ok: listed.ok };
 }
 
 /**