session-orchestrator 5.12.0 → 5.13.0

package/scripts/lib/vault-mirror/migrate-ids.mjs

@@ -0,0 +1,321 @@
+#!/usr/bin/env node
+/**
+ * migrate-ids.mjs — one-time repair of the frontmatter `id` of notes the vault
+ * mirror wrote before #1601/#1602.
+ *
+ * Why a separate pass: the mirror's hot path (`process.mjs`) never rewrites a
+ * note because only its `id` is wrong. Its only rewrite is a full re-render
+ * from the ledger record, and that re-render brought back plaintext that an
+ * earlier run had masked to `[REDACTED]` (#1025) whenever the secret was
+ * missing from the current env. That was the release-review finding HOCH 1 on
+ * MR !148. This pass changes ONE line and nothing else.
+ *
+ * Contract:
+ *  - Only notes with the vault-mirror `_generator` marker are considered, in
+ *    `40-learnings/`, `50-sessions/` and their `90-archive/mirror/` copies,
+ *    flat (`<zone>/<file>`) or namespaced (`<zone>/<ns>/<file>`). Month
+ *    rollups are skipped (their id is not derived from the filename).
+ *  - The new id is `noteIdFor(<ns>, <filename slug>)`: the same id the
+ *    generator renders today. The namespace is the folder; a flat note uses
+ *    its own `source-repo` (as `fmNamesSlug` in process.mjs does).
+ *  - `schema` changes: the old id breaks the vault-sync schema (missing, over
+ *    128 chars, all digits, not a kebab slug). Always planned.
+ *  - `namespace` changes: the old id is the bare pre-#1602 slug. Planned only
+ *    with `includeBare`, because it touches every older generated note once.
+ *  - Two notes of the same layer (live, or `90-archive/`) that would end up
+ *    with the same id are both left alone and reported as `conflicts`. A live
+ *    note and its archive copy never conflict: the vault-sync validator does
+ *    not check `90-archive/`, so blocking the live repair on its copy would
+ *    leave the schema error in place.
+ *  - A note whose frontmatter has no `id:` line is not planned (the one-line
+ *    rewrite has no line to change); it is reported as `unrepairable`.
+ *  - Apply replaces only the `id:` line inside the frontmatter
+ *    (`withNoteId`), checks that nothing else changed, re-reads the file and
+ *    skips it if it changed since the plan, and writes atomically: a tmp
+ *    sibling in the same folder, then rename (`atomicWriteWithBackup`).
+ *  - Apply refuses to write anything when the plan has more changes than
+ *    `maxChanges`. The CLI requires `--max-changes` with `--apply`, so the
+ *    count comes from a dry run first.
+ *
+ * Usage (dry run is the default and writes nothing):
+ *   node scripts/lib/vault-mirror/migrate-ids.mjs --vault-dir PATH [--include-bare]
+ *   node scripts/lib/vault-mirror/migrate-ids.mjs --vault-dir PATH [--include-bare] --apply --max-changes N
+ *
+ * Output: one JSON line per planned change ({path, from, to, reason}), then
+ * one summary line. Paths are vault-relative. The `from` values are the
+ * record needed to undo a run.
+ *
+ * Exit codes: 0 success · 1 usage error · 2 refused (over the cap), per-file
+ * errors, or `unrepairable` notes left after --apply
+ */
+
+import { readdirSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import yaml from 'js-yaml';
+
+import { atomicWriteWithBackup } from '../io.mjs';
+import { expandTilde } from '../common.mjs';
+import { isMainModule } from '../is-main-module.mjs';
+import { NOTE_ID_MAX_LENGTH, isValidSlug, noteIdFor, noteIdMatches, parseFrontmatter, slugifyIdSafe, withNoteId } from './utils.mjs';
+import { ARCHIVE_ROOT, GENERATOR_MARKER, ROLLUP_PREFIX } from './retention.mjs';
+
+const ZONES = ['40-learnings', '50-sessions'];
+/** The vault-sync schema's id pattern (`skills/vault-sync/validator.mjs` slugRegex). */
+const SCHEMA_SLUG = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const ID_LINE = /^id:(.*)$/m;
+
+/** Every `.md` of a zone root: flat files and one folder level below. */
+function listZoneFiles(vaultDir, zoneRel) {
+  const out = [];
+  let top;
+  try {
+    top = readdirSync(join(vaultDir, zoneRel), { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const ent of top) {
+    if (ent.isFile() && ent.name.endsWith('.md')) out.push({ rel: `${zoneRel}/${ent.name}`, dirNs: '', name: ent.name });
+    else if (ent.isDirectory()) {
+      let inner;
+      try {
+        inner = readdirSync(join(vaultDir, zoneRel, ent.name), { withFileTypes: true });
+      } catch {
+        continue;
+      }
+      for (const f of inner) {
+        if (f.isFile() && f.name.endsWith('.md')) out.push({ rel: `${zoneRel}/${ent.name}/${f.name}`, dirNs: ent.name, name: f.name });
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * Does the on-disk id break the vault-sync schema (`z.string().regex(slug).max(128)`)?
+ * `cur` is the parseFrontmatter value (quotes stripped, always a string);
+ * `raw` is the literal after `id:`. An unquoted `433` is a YAML NUMBER even
+ * though parseFrontmatter hands it back as a string — the #1601 shape — so
+ * the raw literal goes through a real YAML parse too.
+ */
+function idViolatesSchema(cur, raw) {
+  if (typeof cur !== 'string' || cur.length > NOTE_ID_MAX_LENGTH || !SCHEMA_SLUG.test(cur)) return true;
+  try {
+    return typeof yaml.load(`id: ${raw}`)?.id !== 'string';
+  } catch {
+    return true;
+  }
+}
+
+/** The leading frontmatter block, or null. */
+function frontmatterHead(content) {
+  if (!content.startsWith('---')) return null;
+  const end = content.indexOf('\n---', 3);
+  return end === -1 ? null : content.slice(0, end);
+}
+
+/**
+ * Plan the id migration. Read-only.
+ *
+ * @param {{ vaultDir: string, includeBare?: boolean }} opts
+ * @returns {{ changes: Array<{path: string, from: string, to: string, reason: 'schema'|'namespace'}>,
+ *   conflicts: Array<{path: string, to: string, reason: 'schema'|'namespace'}>, unrepairable: Array<{path: string, reason: 'no-id-line'}>,
+ *   scanned: number, unrecognised: number, contents: Map<string, string> }}
+ *   `contents` holds the bytes each change was planned against (apply compares them).
+ */
+export function planIdMigration({ vaultDir, includeBare = false }) {
+  const candidates = [];
+  // `<layer>:<id>` → count of notes that carry or would carry it. Counted per
+  // layer: a live note and its archive copy share an id by design.
+  const targets = new Map();
+  const unrepairable = [];
+  let scanned = 0;
+  let unrecognised = 0;
+  const zoneRoots = [...ZONES, ...ZONES.map((z) => `${ARCHIVE_ROOT}/${z}`)];
+  for (const zoneRel of zoneRoots) {
+    const layer = zoneRel.startsWith(`${ARCHIVE_ROOT}/`) ? 'archive' : 'live';
+    for (const { rel, dirNs, name } of listZoneFiles(vaultDir, zoneRel)) {
+      if (name.startsWith(ROLLUP_PREFIX)) continue;
+      let content;
+      try {
+        content = readFileSync(join(vaultDir, rel), 'utf8');
+      } catch {
+        continue;
+      }
+      const fm = parseFrontmatter(content);
+      if (!fm || fm['_generator'] !== GENERATOR_MARKER) continue;
+      const head = frontmatterHead(content);
+      if (head === null) continue;
+      scanned += 1;
+      const stem = name.slice(0, -'.md'.length);
+      // The generator's id base: a learning's filename IS its slug; a session
+      // file is named by the raw session id, which the renderer slugifies.
+      const base = isValidSlug(stem) ? stem : (slugifyIdSafe(stem) ?? stem);
+      const ns = dirNs || (typeof fm['source-repo'] === 'string' ? fm['source-repo'] : null);
+      const to = noteIdFor(ns, base);
+      const cur = typeof fm['id'] === 'string' ? fm['id'] : undefined;
+      const rawLine = head.match(ID_LINE);
+      if (!rawLine) {
+        unrepairable.push({ path: rel, reason: 'no-id-line' });
+        continue;
+      }
+      const from = rawLine[1].trim();
+      const violates = idViolatesSchema(cur, from);
+      let reason = null;
+      if (violates) reason = 'schema';
+      else if (cur !== to) {
+        const bare = cur === base || cur === stem || noteIdMatches(cur, base, fm['source-repo']);
+        if (bare && includeBare) reason = 'namespace';
+        else if (!bare) unrecognised += 1;
+      }
+      const finalId = reason === null ? cur : to;
+      if (typeof finalId === 'string') targets.set(`${layer}:${finalId}`, (targets.get(`${layer}:${finalId}`) ?? 0) + 1);
+      if (reason !== null) candidates.push({ path: rel, from, to, reason, content, layer });
+    }
+  }
+  const changes = [];
+  const conflicts = [];
+  const contents = new Map();
+  for (const c of candidates) {
+    if ((targets.get(`${c.layer}:${c.to}`) ?? 0) > 1) {
+      conflicts.push({ path: c.path, to: c.to, reason: c.reason });
+      continue;
+    }
+    changes.push({ path: c.path, from: c.from, to: c.to, reason: c.reason });
+    contents.set(c.path, c.content);
+  }
+  return { changes, conflicts, unrepairable, scanned, unrecognised, contents };
+}
+
+/**
+ * True when `next` differs from `content` in the frontmatter `id:` line only.
+ * A belt against a future change to `withNoteId`, not an independent check:
+ * it strips the line with the same `id:` pattern `withNoteId` rewrites, so it
+ * only catches a `withNoteId` that starts touching anything else
+ * (BV-002: data-loss prevention).
+ */
+function onlyIdLineChanged(content, next) {
+  const strip = (s) => {
+    const head = frontmatterHead(s);
+    return head === null ? s : head.replace(ID_LINE, 'id:') + s.slice(head.length);
+  };
+  return strip(content) === strip(next);
+}
+
+/**
+ * Apply a plan from {@link planIdMigration}.
+ *
+ * @param {ReturnType<typeof planIdMigration>} plan
+ * @param {{ vaultDir: string, maxChanges: number, fs?: object }} opts
+ *   `fs` is passed to `atomicWriteWithBackup` (test seam).
+ * @returns {{ ok: boolean, refused?: 'over-limit', written: string[],
+ *   skipped: Array<{path: string, reason: string}>, errors: Array<{path: string, error: string}> }}
+ */
+export function applyIdMigration(plan, { vaultDir, maxChanges, fs: injectedFs } = {}) {
+  const written = [];
+  const skipped = [];
+  const errors = [];
+  if (!Number.isInteger(maxChanges) || maxChanges < 0 || plan.changes.length > maxChanges) {
+    return { ok: false, refused: 'over-limit', written, skipped, errors };
+  }
+  for (const change of plan.changes) {
+    const abs = join(vaultDir, change.path);
+    let content;
+    try {
+      content = readFileSync(abs, 'utf8');
+    } catch (err) {
+      errors.push({ path: change.path, error: err?.code ?? 'read-failed' });
+      continue;
+    }
+    if (content !== plan.contents.get(change.path)) {
+      skipped.push({ path: change.path, reason: 'changed-since-plan' });
+      continue;
+    }
+    const next = withNoteId(content, change.to);
+    if (next === content || !onlyIdLineChanged(content, next)) {
+      skipped.push({ path: change.path, reason: 'not-a-single-line-change' });
+      continue;
+    }
+    const res = atomicWriteWithBackup(abs, next, { tmpPrefix: '.vault-mirror-migrate-ids.tmp', ...(injectedFs ? { fs: injectedFs } : {}) });
+    if (res.ok) written.push(change.path);
+    else errors.push({ path: change.path, error: res.code ?? 'write-failed' });
+  }
+  return { ok: errors.length === 0, written, skipped, errors };
+}
+
+const HELP = `Usage: node scripts/lib/vault-mirror/migrate-ids.mjs --vault-dir PATH [--include-bare]
+       [--apply --max-changes N]
+
+Repairs the frontmatter id of vault-mirror notes (#1601/#1602). Dry run is the
+default: it prints the planned changes and writes nothing. --apply needs
+--max-changes N (take N from the dry run); a plan with more changes is refused.
+
+  --include-bare   Also namespace ids that are valid but carry no repo prefix
+`;
+
+/**
+ * @param {string[]} argv
+ * @returns {{ vaultDir: string|null, apply: boolean, includeBare: boolean, maxChanges: number|null, help: boolean }}
+ */
+export function parseArgs(argv) {
+  const args = { vaultDir: null, apply: false, includeBare: false, maxChanges: null, help: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    const a = argv[i];
+    if (a === '--help' || a === '-h') args.help = true;
+    else if (a === '--apply') args.apply = true;
+    else if (a === '--include-bare') args.includeBare = true;
+    else if (a === '--vault-dir') args.vaultDir = argv[++i] ?? null;
+    else if (a === '--max-changes') {
+      const raw = argv[++i];
+      const n = Number(raw);
+      if (!Number.isInteger(n) || n < 0) throw new Error(`invalid --max-changes "${raw}"`);
+      args.maxChanges = n;
+    } else throw new Error(`unknown argument "${a}"`);
+  }
+  return args;
+}
+
+if (isMainModule(import.meta.url)) {
+  let args;
+  try {
+    args = parseArgs(process.argv.slice(2));
+  } catch (err) {
+    process.stderr.write(`migrate-ids: ${err.message}\n`);
+    process.exit(1);
+  }
+  if (args.help) {
+    process.stdout.write(HELP);
+    process.exit(0);
+  }
+  if (!args.vaultDir) {
+    process.stderr.write('migrate-ids: --vault-dir is required\n');
+    process.exit(1);
+  }
+  if (args.apply && args.maxChanges === null) {
+    process.stderr.write('migrate-ids: --apply needs --max-changes N (run without --apply first to see N)\n');
+    process.exit(1);
+  }
+  const vaultDir = resolve(expandTilde(args.vaultDir));
+  const plan = planIdMigration({ vaultDir, includeBare: args.includeBare });
+  for (const c of plan.changes) process.stdout.write(`${JSON.stringify(c)}\n`);
+  const summary = {
+    mode: args.apply ? 'apply' : 'dry-run',
+    scanned: plan.scanned,
+    planned: plan.changes.length,
+    conflicts: plan.conflicts,
+    unrepairable: plan.unrepairable,
+    unrecognised: plan.unrecognised,
+  };
+  if (plan.unrepairable.length > 0) {
+    process.stderr.write(`migrate-ids: ${plan.unrepairable.length} note(s) have no id line and are not repaired; see "unrepairable"\n`);
+  }
+  if (!args.apply) {
+    process.stdout.write(`${JSON.stringify(summary)}\n`);
+    process.exit(0);
+  }
+  const res = applyIdMigration(plan, { vaultDir, maxChanges: args.maxChanges });
+  process.stdout.write(`${JSON.stringify({ ...summary, ...res, written: res.written.length })}\n`);
+  // A run that leaves schema violations behind (no id line, or a schema repair
+  // blocked by a conflict) is not a success, even if every planned write landed.
+  const schemaLeft = plan.unrepairable.length + plan.conflicts.filter((c) => c.reason === 'schema').length;
+  process.exit(res.ok && schemaLeft === 0 ? 0 : 2);
+}

package/scripts/lib/vault-mirror/namespace.mjs

@@ -56,7 +56,7 @@
 import { basename, resolve } from 'node:path';
 
 import { legacySubjectToSlug } from './utils.mjs';
-import { isOwnerLeakySegment } from '../../lib/validate/check-owner-leakage.mjs';
+import { inspectOwnerPatterns, isOwnerLeakySegment } from '../../lib/validate/check-owner-leakage.mjs';
 import { loadPseudonymMap } from './pseudonym-map.mjs';
 import { loadHostPaths, resolveHostPath } from '../config/host-paths.mjs';
 import { isQueryFailure, resolvePreferredRemote } from '../vcs-repo-spec.mjs';
@@ -261,6 +261,22 @@ function lookupPseudonym(base, seg) {
   return null;
 }
 
+/**
+ * WARN line for a redaction. An unsafe private config dir (#1629, e.g. 0777 under
+ * umask 000) makes isOwnerLeakySegment() fail closed with CP1 for EVERY segment —
+ * the redaction stays, but calling that a leak hid the real cause.
+ *
+ * @param {string} where
+ * @param {string} pattern
+ * @returns {string}
+ */
+function redactionWarning(where, pattern) {
+  if (inspectOwnerPatterns().reason === 'unsafe-config-dir') {
+    return `WARN vault-mirror/namespace: owner policy unavailable (unsafe config dir); redacting ${where} to 'redacted-repo'\n`;
+  }
+  return `WARN vault-mirror/namespace: owner-privacy leak detected in ${where} (pattern: ${pattern}); redacting to 'redacted-repo'\n`;
+}
+
 /**
  * Resolve the sanitised repository namespace segment for vault path scoping.
  *
@@ -332,9 +348,7 @@ export function resolveRepoNamespace({ vaultName = null, repoRoot = null } = {})
   if (rawMatch !== null) {
     const pseudonym = lookupPseudonym(base, seg);
     if (pseudonym) return pseudonym;
-    process.stderr.write(
-      `WARN vault-mirror/namespace: owner-privacy leak detected in repo identifier (pattern: ${rawMatch}); redacting to 'redacted-repo'\n`,
-    );
+    process.stderr.write(redactionWarning('repo identifier', rawMatch));
     return 'redacted-repo';
   }
 
@@ -342,9 +356,7 @@ export function resolveRepoNamespace({ vaultName = null, repoRoot = null } = {})
   if (segMatch !== null) {
     const pseudonym = lookupPseudonym(base, seg);
     if (pseudonym) return pseudonym;
-    process.stderr.write(
-      `WARN vault-mirror/namespace: owner-privacy leak detected in sanitised namespace segment (pattern: ${segMatch}); redacting to 'redacted-repo'\n`,
-    );
+    process.stderr.write(redactionWarning('sanitised namespace segment', segMatch));
     return 'redacted-repo';
   }
 

package/scripts/lib/vault-mirror/process.mjs

@@ -10,7 +10,7 @@ import { basename, join, resolve, sep } from 'node:path';
 import { createRequire } from 'node:module';
 import { randomUUID } from 'node:crypto';
 import { createSecretValueMasker } from '../secret-masker.mjs';
-import { subjectToSlug, legacySubjectToSlug, isValidSlug, uuidPrefix8, recordKeySuffix8, toDate, parseFrontmatter } from './utils.mjs';
+import { subjectToSlug, legacySubjectToSlug, isValidSlug, uuidPrefix8, recordKeySuffix8, toDate, parseFrontmatter, slugifyIdSafe, noteIdFor, noteIdMatches, withNoteId } from './utils.mjs';
 import { isRealSession } from '../session-schema/filters.mjs';
 import { resolveRepoNamespace } from './namespace.mjs';
 import { detectLearningSchema, normalizeLearningEntry, generateLearningNote, generateLearningNoteV2, learningSourceRecord } from './render-learnings.mjs';
@@ -25,6 +25,7 @@ import {
   renderRollup,
   rollupRelPath,
   rollupRowFromNote,
+  section,
   sessionNarrativeChars,
 } from './retention.mjs';
 
@@ -268,6 +269,23 @@ export function matchesModuloRedaction(existingVal, renderedVal) {
   return new RegExp(`^${pattern}$`).test(renderedVal);
 }
 
+/**
+ * Does a session note on disk carry LESS free text than the record (#1513
+ * review H2), so it must be re-rendered? Not when the only difference is a
+ * `[REDACTED]` span (#1025): `[REDACTED]` and the raw value differ in length,
+ * so the bare char-count compare reported "stale" whenever the secret was
+ * missing from the current env and re-rendered the note WITH the raw value.
+ * Found while pinning #1601 (release-review HOCH 1, MR !148).
+ *
+ * @param {string} existingContent
+ * @param {string} renderedBody
+ * @returns {boolean}
+ */
+function sessionNotesStale(existingContent, renderedBody) {
+  if (noteNarrativeChars(existingContent) === noteNarrativeChars(renderedBody)) return false;
+  return !matchesModuloRedaction(section(existingContent, 'Notes') ?? '', section(renderedBody, 'Notes') ?? '');
+}
+
 /**
  * Return true when the existing vault note content and the freshly-rendered
  * candidate share identical canonical fields (i.e. no meaningful update needed).
@@ -449,17 +467,6 @@ function disambigSlugFor(dir, slug, { legacyId, recordKey }) {
   return { slug: hashed, exists: null };
 }
 
-/**
- * Replace the frontmatter `id:` line of a note — used when a displaced note
- * moves to its disambiguated name (#1506.2), whose `id` must match the file.
- * @param {string} content
- * @param {string} id
- * @returns {string}
- */
-function withNoteId(content, id) {
-  return content.replace(/^id: .*$/m, `id: ${id}`);
-}
-
 /**
  * Emit `skipped-foreign-owner` for a note the writer must not touch: one stderr
  * `SKIP` line (vault-relative path, like every other SKIP line) and the stdout
@@ -974,10 +981,20 @@ function learningSlugVariants(entry, schema) {
   return [...names];
 }
 
+/**
+ * Does the note `fm` name `slug`? #1601/#1602: its `id` is the bare slug (a note
+ * written before the namespaced id) or the slug namespaced under the writer's
+ * folder or under the note's OWN `source-repo` — a moved or relabelled note keeps
+ * its old prefix, and the folder, not the label, decides ownership (#1503 F1).
+ */
+function fmNamesSlug(fm, slug, repoNs) {
+  return Boolean(fm) && (noteIdMatches(fm['id'], slug, repoNs) || noteIdMatches(fm['id'], slug, fm['source-repo']));
+}
+
 /** Only explicit, exact provenance permits assigning an old name to a record. */
 function positiveLearningOwner(fm, name, repoNs, recordKey) {
   return recordKey !== null && notOurGenerator(fm) === null &&
-    fm['id'] === name && fm['source-record'] === recordKey && fm['source-repo'] === repoNs;
+    fmNamesSlug(fm, name, repoNs) && fm['source-record'] === recordKey && fm['source-repo'] === repoNs;
 }
 
 
@@ -1181,7 +1198,7 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
         const legacyFm = parseFrontmatter(readFileSync(legacyPath, 'utf8'));
         if (
           notOurGenerator(legacyFm) === null &&
-          legacyFm['id'] === legacySlug &&
+          fmNamesSlug(legacyFm, legacySlug, repoNs) &&
           foreignOwnerReason(legacyFm, writer) === null
         ) {
           slug = legacySlug;
@@ -1220,7 +1237,7 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
     // neither a duplicate to skip on nor a file to rewrite with THIS record's
     // content; this entry proceeds to its own namespaced path (a different
     // file). A leak in it is masked in place, keeping its owner and content.
-    const legacyMarked = Boolean(legacyFm) && legacyFm['_generator'] === GENERATOR_MARKER && legacyFm['id'] === slug;
+    const legacyMarked = Boolean(legacyFm) && legacyFm['_generator'] === GENERATOR_MARKER && fmNamesSlug(legacyFm, slug, repoNs);
     const legacyForeign = legacyMarked && foreignOwnerReason(legacyFm, writer) !== null;
     if (legacyForeign && legacyStillLeaks) {
       healedForeignLeak = maskForeignNoteInPlace(legacyFlatPath, legacyContent, ctx);
@@ -1239,6 +1256,9 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
           // #1028 residue 1: the five-field compare cannot see a raw secret
           // sitting in a non-canonical field (e.g. `evidence`) — the
           // `legacyStillLeaks` probe above is what makes this match trustworthy.
+          // #1601: `id` is not a compared field, and a schema-violating old id
+          // is NOT a reason to rewrite here — re-rendering would bring back
+          // plaintext a past run masked (#1025). `migrate-ids.mjs` repairs it.
           return emitEntryAction(_lineNum, ctx, { action: 'skipped-noop', path: legacyFlatPath, id: slug });
         }
         // Content differs, or the on-disk note still leaks under the current
@@ -1307,7 +1327,7 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
     const entryDay = toDate(dateSource);
     if (
       routedByRecord &&
-      fm['id'] === slug &&
+      fmNamesSlug(fm, slug, repoNs) &&
       !expired &&
       /^\d{4}-\d{2}-\d{2}$/.test(entryDay) &&
       typeof fm['created'] === 'string' &&
@@ -1320,7 +1340,7 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
       if (takenOver !== null) return takenOver;
     }
 
-    if (fm['id'] !== slug || routedByRecord) {
+    if (!fmNamesSlug(fm, slug, repoNs) || routedByRecord) {
       // Different id (or different record) → collision: disambiguate
       const picked = disambigSlugFor(targetDir, slug, {
         legacyId: String(entryId),
@@ -1401,7 +1421,7 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
     // #1506.2: the main note is this record's — a live disambiguation copy of
     // the same record (left by an interrupted takeover) is superseded.
     const stale = !slugTransition && fm['source-record'] === writer.recordKey
-      ? staleOwnDisambig(targetDir, slug, entryId, writer)
+      ? staleOwnDisambig(targetDir, slug, entryId, writer, repoNs)
       : null;
 
     // Same id: check if updated would advance (unless --force overrides).
@@ -1414,6 +1434,9 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
       if (learningContentMatches(existingContent, candidateContent)) {
         // #1028 residue 1: probe the on-disk content against the CURRENT masker
         // before trusting the five-field match — see maskerWouldChange above.
+        // #1601: `id` is deliberately NOT part of this decision — an id-only
+        // difference must never re-render the note (that would bring back
+        // plaintext a past run masked, #1025); `migrate-ids.mjs` repairs it.
         mainUnchanged = !maskerWouldChange(existingContent);
       }
       // Content differs, or the on-disk note still leaks under the current env —
@@ -1480,14 +1503,14 @@ export async function processLearning(rawEntry, _lineNum, ctx) {
  *
  * @returns {{ path: string, next: string }|null} the rewrite, or null.
  */
-function staleOwnDisambig(targetDir, slug, entryId, writer) {
+function staleOwnDisambig(targetDir, slug, entryId, writer, repoNs) {
   if (typeof writer.recordKey !== 'string') return null;
   const own = disambigSlugFor(targetDir, slug, { legacyId: String(entryId), recordKey: writer.recordKey });
   const path = join(targetDir, `${own.slug}.md`);
   if (!(own.exists ?? existsSync(path))) return null;
   const content = readFileSync(path, 'utf8');
   const fm = parseFrontmatter(content);
-  if (notOurGenerator(fm) !== null || fm['source-record'] !== writer.recordKey || fm['id'] !== own.slug) return null;
+  if (notOurGenerator(fm) !== null || fm['source-record'] !== writer.recordKey || !fmNamesSlug(fm, own.slug, repoNs)) return null;
   const next = markArchived(content, 'superseded');
   return next === content ? null : { path, next };
 }
@@ -1517,14 +1540,14 @@ function takeOverMainNote({
     if (notOurGenerator(dfm) !== null || dfm['source-record'] !== displacedKey) return null;
   }
 
-  const ownStale = staleOwnDisambig(targetDir, slug, entryId, writer);
+  const ownStale = staleOwnDisambig(targetDir, slug, entryId, writer, generatorOpts.repoNs);
 
   if (!dryRun) {
     // Re-read: an in-place leak heal above may have rewritten the note.
     const current = readFileSync(targetPath, 'utf8');
     // Rewritten even when it exists (and is ours, checked above): a stale copy
     // there may carry `status: archived` from an earlier archive pass.
-    writeFileSync(displacedPath, withNoteId(current, displaced.slug), 'utf8');
+    writeFileSync(displacedPath, withNoteId(current, noteIdFor(generatorOpts.repoNs, displaced.slug)), 'utf8');
     // Before the main note: a crash between the two writes must leave the
     // takeover re-runnable (the main note still foreign), never a main note of
     // ours beside a stale live disambiguation note of the same record.
@@ -1633,7 +1656,7 @@ export async function processArchivedLearning(rawEntry, _lineNum, ctx) {
       if (!existsSync(path)) continue;
       const content = readFileSync(path, 'utf8');
       const fm = parseFrontmatter(content);
-      if (notOurGenerator(fm) !== null || fm['id'] !== name) continue;
+      if (notOurGenerator(fm) !== null || !fmNamesSlug(fm, name, repoNs)) continue;
       if (foreignOwnerReason(fm, writer) !== null) continue;
       const next = markArchived(content, reason);
       if (next === content) {
@@ -1817,6 +1840,12 @@ export async function processSession(rawEntry, _lineNum, ctx) {
   // (`subjectToSlug`), caps at 240 chars, or falls back to a uuid slug. A note
   // carrying either id is this record's own note.
   const renderedId = parseFrontmatter(renderedBody)?.id;
+  // #1601/#1602: a note written before the namespaced id carries the bare slug
+  // (`session_id`, or the renderer's whitespace-hyphenated slug); either form,
+  // with or without the repo prefix, names this session.
+  const legacyRenderedId = slugifyIdSafe(rawSessionId) ?? session_id;
+  const isOwnSessionId = (fm) =>
+    fm['id'] === renderedId || fmNamesSlug(fm, session_id, repoNs) || fmNamesSlug(fm, legacyRenderedId, repoNs);
 
   // Canonical filename pattern (issue #343): `<session_id>.md` where session_id
   // follows `<branch>-<YYYY-MM-DD>-<HHmm>-<slug>` per the session-id schema.
@@ -1843,14 +1872,14 @@ export async function processSession(rawEntry, _lineNum, ctx) {
     const legacyStillLeaks = legacyFm !== null && maskerWouldChange(legacyContent);
     // #1503: a flat note from a foreign record is not ours — see processLearning's
     // dual-probe. A leak in it is masked in place, keeping its owner and content.
-    const legacyMarked = Boolean(legacyFm) && legacyFm['_generator'] === GENERATOR_MARKER && legacyFm['id'] === session_id;
+    const legacyMarked = Boolean(legacyFm) && legacyFm['_generator'] === GENERATOR_MARKER && isOwnSessionId(legacyFm);
     const legacyForeign = legacyMarked && foreignOwnerReason(legacyFm, writer) !== null;
     if (legacyForeign && legacyStillLeaks) {
       healedForeignLeak = maskForeignNoteInPlace(legacyFlatPath, legacyContent, ctx);
     }
     if (legacyMarked && !legacyForeign) {
       const entryUpdated = toDate(entry.completed_at);
-      const legacyNarrativeStale = noteNarrativeChars(legacyContent) !== noteNarrativeChars(renderedBody);
+      const legacyNarrativeStale = sessionNotesStale(legacyContent, renderedBody);
       if (!force && !legacyStillLeaks && !legacyNarrativeStale && legacyFm['updated'] && legacyFm['updated'] >= entryUpdated) {
         return emitEntryAction(_lineNum, ctx, { action: 'skipped-noop', path: legacyFlatPath, id: session_id });
       }
@@ -1889,7 +1918,7 @@ export async function processSession(rawEntry, _lineNum, ctx) {
     // no disambiguation scheme. Checked before the date comparison; `--force`
     // does not bypass it. A leak in a foreign note is masked in place, never
     // rewritten from this record.
-    const sameSession = fm['id'] === session_id || fm['id'] === renderedId;
+    const sameSession = isOwnSessionId(fm);
     const foreign = foreignOwnerReason(fm, writer) ?? (sameSession ? null : 'id mismatch');
     if (foreign !== null) {
       const healed = existingLeaks && maskForeignNoteInPlace(targetPath, existingContent, ctx);
@@ -1900,7 +1929,7 @@ export async function processSession(rawEntry, _lineNum, ctx) {
     // #1513 review H2: a note rendered before narrative/summary were printed
     // carries less free text than the record — heal it once, or the pruner
     // archives it as metrics-only and the mirror re-creates it every run.
-    const narrativeStale = noteNarrativeChars(existingContent) !== noteNarrativeChars(renderedBody);
+    const narrativeStale = sessionNotesStale(existingContent, renderedBody);
     if (!force && !existingLeaks && !narrativeStale && fm['updated'] && fm['updated'] >= entryUpdated) {
       return emitEntryAction(_lineNum, ctx, { action: 'skipped-noop', path: targetPath, id: session_id });
     }

package/scripts/lib/vault-mirror/prune.mjs

@@ -54,7 +54,7 @@ import {
 import { createHash } from 'node:crypto';
 import { basename, dirname, join, resolve, sep } from 'node:path';
 
-import { parseFrontmatter, subjectToSlug } from './utils.mjs';
+import { parseFrontmatter, subjectToSlug, noteIdMatches } from './utils.mjs';
 import {
   GENERATOR_MARKER,
   ROLLUP_PREFIX,
@@ -287,7 +287,10 @@ export function planPrune({ vaultDir, today, minNarrativeChars = 400, aliases =
     const target = `${n.zone}/${n.effNs}/${n.name}`;
     if (claimed.has(target) || existingRel.has(target)) {
       const twin = notes.find((m) => m.rel === target);
-      if (twin && twin.fm.id === n.fm.id && !decided.has(twin.rel)) {
+      // #1601/#1602: the twin may already carry the namespaced id while the flat
+      // note keeps the bare pre-#1601 one — same note, either form.
+      const sameId = twin && (twin.fm.id === n.fm.id || noteIdMatches(twin.fm.id, n.fm.id, n.effNs) || noteIdMatches(n.fm.id, twin.fm.id, n.effNs));
+      if (sameId && !decided.has(twin.rel)) {
         actions.push({ path: n.rel, reason: 'duplicate', action: 'archive', target: archivePathFor(n.rel), keep: target });
       } else {
         actions.push({ path: n.rel, reason, action: 'keep', note: `relocation target taken: ${target}` });

package/scripts/lib/vault-mirror/render-learnings.mjs

@@ -5,7 +5,7 @@
  *          sourceRecordValue, learningSourceRecord, sourceRecordLine (#1503)
  */
 
-import { toDate, truncateAtWord, yamlQuoteIfNeeded, legacySubjectToSlug, isValidSlug, buildTag, resolveSourceSessionLink } from './utils.mjs';
+import { toDate, truncateAtWord, yamlQuoteIfNeeded, legacySubjectToSlug, isValidSlug, buildTag, resolveSourceSessionLink, noteIdFor, yamlNoteId } from './utils.mjs';
 
 const GENERATOR_MARKER = 'session-orchestrator-vault-mirror@1';
 
@@ -186,7 +186,7 @@ export function generateLearningNote(entry, slug, opts = {}) {
   const sourceSessionBodyLink = _srcIsLink ? `[[${_srcTarget}]]` : _srcTarget;
 
   return `---
-id: ${slug}
+id: ${yamlNoteId(noteIdFor(opts.repoNs, slug))}
 type: learning
 title: ${title}
 status: ${status}
@@ -242,7 +242,7 @@ export function generateLearningNoteV2(entry, slug, opts = {}) {
   const recordLine = sourceRecordLine(learningSourceRecord(entry));
 
   return `---
-id: ${slug}
+id: ${yamlNoteId(noteIdFor(opts.repoNs, slug))}
 type: learning
 title: ${title}
 status: ${status}