session-orchestrator 5.2.0 → 5.3.0

package/scripts/lib/command-blocker.mjs

@@ -1812,6 +1812,32 @@ export function redirectRuleMatches(rule, command, opts = {}) {
   // an existing repo-relative rule, and a repo-relative entry still cannot
   // escape the root. An unexpandable `~` (no usable `home`) matches NOTHING —
   // fail-closed for the new class, since an unexpanded `~` names no file.
+  const compiled = compileTargetDenylist(denylist, home);
+  if (compiled.relRegexes.length === 0 && compiled.absRegexes.length === 0) return false;
+
+  for (const entry of extractRedirectTargets(command)) {
+    if (entry.unresolved) continue;
+    if (!modes.has(entry.mode)) continue;
+    if (targetMatchesDenylist(entry.target, compiled, repoRoot, home)) return true;
+  }
+  return false;
+}
+
+/**
+ * Compile a rule's `target-denylist` into the two glob classes described in
+ * `redirectRuleMatches` (#1362): repo-relative entries and home-anchored (`~/…`)
+ * entries. Extracted so a SECOND rule class can reuse the exact same compilation
+ * instead of growing a third copy of the glob logic (#1401) — the file already
+ * carries that warning at `findMatchedRedirectEntry` in the consuming hook.
+ *
+ * An unexpandable `~` (no usable `home`) contributes NOTHING — fail-closed for
+ * the home-anchored class, since an unexpanded `~` names no file.
+ *
+ * @param {string[]} denylist
+ * @param {string|undefined} home
+ * @returns {{ relRegexes: RegExp[], absRegexes: RegExp[] }}
+ */
+function compileTargetDenylist(denylist, home) {
   const relRegexes = [];
   const absRegexes = [];
   for (const pattern of denylist) {
@@ -1824,38 +1850,48 @@ export function redirectRuleMatches(rule, command, opts = {}) {
       relRegexes.push(redirectGlobToRegExp(text));
     }
   }
-  if (relRegexes.length === 0 && absRegexes.length === 0) return false;
-
-  for (const entry of extractRedirectTargets(command)) {
-    if (entry.unresolved) continue;
-    if (!modes.has(entry.mode)) continue;
+  return { relRegexes, absRegexes };
+}
 
-    if (absRegexes.length > 0) {
-      // A RELATIVE target is repo-root-relative here, exactly as the repo-relative
-      // class already treats it (#994 R1) — otherwise `> ../../.claude/projects/
-      // <enc>/memory/MEMORY.md` from the repo root names the very file the `~`
-      // spelling blocks, and only the spelling would be denied (measured
-      // 2026-09-13: relative `>`/`>>` ALLOW vs tilde/absolute BLOCK on one and
-      // the same resolved path). This resolves TARGETS, never ENTRIES: a
-      // repo-relative denylist entry keeps going through
-      // `repoRelativeRedirectTarget` below and still cannot reach out of the root.
-      const expandedTarget = expandLeadingHome(entry.target, home);
-      const absTarget = path.isAbsolute(expandedTarget)
-        ? expandedTarget
-        : repoRoot && path.isAbsolute(repoRoot)
-          ? path.resolve(repoRoot, expandedTarget)
-          : null;
-      if (absTarget !== null) {
-        const folded = foldAbsoluteTarget(absTarget);
-        if (absRegexes.some((re) => re.test(folded))) return true;
-      }
+/**
+ * Test ONE resolved target text against a compiled denylist.
+ *
+ * A RELATIVE target is repo-root-relative in BOTH classes, exactly as the
+ * repo-relative class already treats it (#994 R1) — otherwise
+ * `../../.claude/projects/<enc>/memory/MEMORY.md` from the repo root names the
+ * very file the `~` spelling blocks, and only the spelling would be denied
+ * (measured 2026-09-13: relative `>`/`>>` ALLOW vs tilde/absolute BLOCK on one
+ * and the same resolved path). This resolves TARGETS, never ENTRIES: a
+ * repo-relative denylist entry still goes through `repoRelativeRedirectTarget`
+ * and still cannot reach out of the root.
+ *
+ * @param {string} rawTarget — resolved target text (quotes already stripped)
+ * @param {{ relRegexes: RegExp[], absRegexes: RegExp[] }} compiled
+ * @param {string|null} repoRoot
+ * @param {string|undefined} home
+ * @returns {boolean}
+ */
+function targetMatchesDenylist(rawTarget, compiled, repoRoot, home) {
+  const { relRegexes, absRegexes } = compiled;
+
+  if (absRegexes.length > 0) {
+    const expandedTarget = expandLeadingHome(rawTarget, home);
+    const absTarget = path.isAbsolute(expandedTarget)
+      ? expandedTarget
+      : repoRoot && path.isAbsolute(repoRoot)
+        ? path.resolve(repoRoot, expandedTarget)
+        : null;
+    if (absTarget !== null) {
+      const folded = foldAbsoluteTarget(absTarget);
+      if (absRegexes.some((re) => re.test(folded))) return true;
     }
+  }
 
-    if (relRegexes.length > 0) {
-      const target = repoRelativeRedirectTarget(entry.target, repoRoot, home);
-      if (target !== null && relRegexes.some((re) => re.test(target))) return true;
-    }
+  if (relRegexes.length > 0) {
+    const target = repoRelativeRedirectTarget(rawTarget, repoRoot, home);
+    if (target !== null && relRegexes.some((re) => re.test(target))) return true;
   }
+
   return false;
 }
 
@@ -1875,6 +1911,217 @@ function foldAbsoluteTarget(abs) {
   );
 }
 
+/**
+ * Verbs that REMOVE or RELOCATE a file named as a bare operand (#1401).
+ *
+ * `mv` is here for BOTH of its operand roles: the SOURCE disappears from its
+ * path, and the DESTINATION is overwritten when it already exists — either one
+ * loses the file that was there. So every operand of these verbs is a candidate,
+ * with no source/destination distinction to get wrong.
+ *
+ * NAMED CEILING (BV-004) — measured 2026-09-19 against `splitChainSegments` +
+ * `resolveSegmentVerb`. COVERED, because the verb resolves through the existing
+ * machinery: bare `rm`/`mv`/`unlink`; `env X=1 rm …`, `sudo rm …`, `timeout 5 rm
+ * …`, `nohup`/`nice`/`stdbuf`/`command`/`exec` (WRAPPER_UNWRAP); every chain
+ * position (`;`, `&&`, `||`, `|`, `&`, newline) and compound-statement head
+ * (`do rm …`, `{ rm …; }` — COMMAND_POSITION_KEYWORDS); and the literal payload
+ * of `bash -c '…'` / `env -S '…'` / `eval '…'` via the shared payload recursion.
+ *
+ * NOT covered, deliberately, because the deleted path is not lexically an
+ * operand of a resolvable verb:
+ *   - `find … -delete` / `find … -exec rm {} \;` — the verb is `find`; its path
+ *     operand is a SEARCH ROOT, and treating a search root as a delete target
+ *     would also flag a pure `find … -print` over the same directory.
+ *   - `… | xargs rm` — the targets arrive on stdin and do not exist as command
+ *     text at hook time. `xargs` is deliberately NOT in WRAPPER_UNWRAP (see
+ *     there: unwrapping it could only LOOSEN the guard).
+ *   - `git rm <path>` — the verb is `git`; a git-subverb grammar is a separate
+ *     table. PSA-007 already bans `git rm` for dispatched subagents.
+ *   - in-process deletion (`node -e 'fs.unlinkSync(…)'`) — not redirect- or
+ *     operand-shaped; same class boundary the `redirect-harness-memory`
+ *     rationale draws for `tee -a` and `fs.appendFileSync`.
+ * REVISIT TRIGGER: any of those four shapes showing up in a real deletion
+ * incident or a transcript census — extend this set or add the sibling grammar,
+ * never special-case one command.
+ */
+const PATH_DESTRUCTIVE_VERBS = new Set(['rm', 'mv', 'unlink']);
+
+/**
+ * Recursive collector behind {@link extractDeleteTargets}. Mirrors
+ * collectRedirectTargets' structure — same segment walk, same dual-reading
+ * union, same depth/budget caps and the same fail-VISIBLE cut-off markers.
+ *
+ * @param {Array<Array<{ text: string, quoted: boolean, redirect?: object }>>} segments
+ * @param {Array<object>} out — accumulator
+ * @param {number} depth
+ * @param {{ remaining: number }} budget
+ */
+function collectDeleteTargets(segments, out, depth, budget) {
+  for (const segment of segments) {
+    const resolved = resolveSegmentVerb(segment);
+
+    // BOTH readings of an ambiguous unknown WRAPPER flag contribute (#1000),
+    // unioned and never replaced: `env -Q x rm .orchestrator/metrics/events.jsonl`
+    // resolves to the non-destructive verb `x` in parse A and to `rm` in parse B,
+    // while `sudo -n rm <file>` is the mirror case (parse B swallows `rm` as
+    // `-n`'s operand). Picking either reading alone drops one of the two.
+    const readings = resolved.alt ? [resolved, resolved.alt] : [resolved];
+    const seen = new Set();
+
+    for (const reading of readings) {
+      if (!reading.verb || reading.index < 0) continue;
+      if (!PATH_DESTRUCTIVE_VERBS.has(reading.verb)) continue;
+      // A verb that only exists inside a quoted token is inert literal text for
+      // this segment — same rule commandHasRecursiveForceRm applies. An
+      // interpreter's quoted payload is reached through the recursion below
+      // instead, where it is re-tokenized as the command it really is.
+      if (segment[reading.index].quoted) continue;
+
+      let seenDashDash = false;
+      for (let i = reading.index + 1; i < segment.length; i++) {
+        const tok = segment[i];
+        // A redirect operand is a filename the SHELL consumes, not an operand of
+        // the verb — `rm -f x > out.log` deletes `x`, it does not delete
+        // `out.log` (the redirect surface judges that one).
+        if (tok.redirect) { i = redirectSpanEnd(segment, i); continue; }
+        if (!seenDashDash && tok.text === '--') { seenDashDash = true; continue; }
+        // FLAG SKIPPING, and why this is the UNION of both flag readings rather
+        // than a pick (#1000 applied to the VERB's own options): an option table
+        // cannot enumerate every flag `rm`/`mv` may grow, and the two possible
+        // readings of an unknown one are "boolean" (the next word is an operand)
+        // and "value-taking" (the next word is the flag's value). The
+        // value-taking reading is a strict SUBSET of the boolean one here — it
+        // can only HIDE a word, never reveal one — so collecting under the
+        // boolean reading yields exactly the union of both. That is also the
+        // fail-closed direction: `mv -t .orchestrator/metrics/ x` reports the
+        // `-t` operand as a candidate (it IS a destination that can overwrite),
+        // where a value-taking reading would have swallowed it silently.
+        if (!seenDashDash && !tok.quoted && tok.text.startsWith('-') && tok.text !== '-') continue;
+
+        const key = `${reading.verb}\u0000${tok.text}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+
+        if (/[$`]/.test(tok.text)) {
+          // Variable indirection (`rm -f "$LEDGER"`) or command substitution:
+          // fail-visible, never guess (#983 rule, same direction).
+          out.push({
+            target: null, verb: reading.verb, unresolved: true, reason: 'variable/substitution',
+          });
+          continue;
+        }
+        out.push({ target: tok.text, verb: reading.verb });
+      }
+    }
+
+    // Literal `-c` / `env -S` / `eval` payload recursion — the same deduped
+    // union helper and the same shared budget the match and redirect surfaces
+    // use, so this traversal cannot be starved any differently than those.
+    const payloads = dedupedSegmentPayloads(segment, resolved);
+    if (payloads.length === 0) continue;
+
+    // A cap that drops payloads SILENTLY is a bypass, not a cap (#988 T2) —
+    // emit a marker so the consuming hook can surface it.
+    if (depth >= MAX_PAYLOAD_DEPTH) {
+      out.push({ target: null, verb: null, unresolved: true, reason: 'depth-exceeded' });
+      continue;
+    }
+    for (const payload of payloads) {
+      if (budget.remaining <= 0) {
+        out.push({ target: null, verb: null, unresolved: true, reason: 'budget-exhausted' });
+        break;
+      }
+      budget.remaining -= 1;
+      const subTokens = tokenizeCommand(
+        normalizeShellWhitespaceExpansions(payload, { expandSingleQuoted: true }),
+      );
+      collectDeleteTargets(splitSegments(subTokens), out, depth + 1, budget);
+    }
+  }
+}
+
+/**
+ * Extract every path a command names as an operand of a file-destroying verb
+ * (`rm`, `mv`, `unlink` — see {@link PATH_DESTRUCTIVE_VERBS} for the covered and
+ * uncovered shapes), across all chain segments and literal shell payloads (#1401).
+ *
+ * This is the DELETE/RENAME sibling of `extractRedirectTargets`: that one answers
+ * "which file does this command WRITE", this one "which file does it REMOVE or
+ * MOVE". They are separate surfaces because a redirect target and a verb operand
+ * are different grammar positions — `rm -f x > out.log` names one of each, and
+ * the guard's 53,896-line telemetry loss (#1401) happened because only the write
+ * surface was ever consulted.
+ *
+ * Entry shapes:
+ *   - `{ target: string, verb: 'rm'|'mv'|'unlink' }` — resolved operand, quotes
+ *     stripped by the tokenizer.
+ *   - `{ target: null, verb, unresolved: true, reason: 'variable/substitution' }`
+ *     — the operand carries a variable or a command substitution. Reported
+ *     fail-visible; never a match candidate (#641 FP class).
+ *   - `{ target: null, verb: null, unresolved: true,
+ *      reason: 'budget-exhausted'|'depth-exceeded' }` — a payload subtree was NOT
+ *     traversed because a recursion cap cut it off (#988 T2).
+ *
+ * @param {string} command
+ * @returns {Array<{ target: string|null, verb: string|null, unresolved?: boolean, reason?: string }>}
+ */
+export function extractDeleteTargets(command) {
+  if (typeof command !== 'string' || command.length === 0) return [];
+  const out = [];
+  const segments = splitSegments(tokenizeCommand(normalizeShellWhitespaceExpansions(command)));
+  collectDeleteTargets(segments, out, 0, { remaining: MAX_PAYLOAD_EVALUATIONS });
+  return out;
+}
+
+/**
+ * Return the FIRST collected delete/rename target a `path-delete` policy rule's
+ * `target-denylist` matches, or `null` when none does (#1401).
+ *
+ * Returns the ENTRY, not a boolean, so the consuming hook can name the verb and
+ * the target in its deny reason without re-probing through a boolean matcher —
+ * the workaround `findMatchedRedirectEntry` needs, and which its own docblock
+ * flags as one copy too many.
+ *
+ * Takes pre-collected `entries` rather than the raw command so the hook
+ * tokenizes ONCE (it needs the same array for the unresolved-marker notices).
+ *
+ * PER-TARGET, never per-command: every entry is judged on its own, so a sibling
+ * operand that is NOT on the denylist can never lift the verdict for one that
+ * is. `rm -f .orchestrator/tmp/ok .orchestrator/metrics/events.jsonl` matches on
+ * the second operand — the exemption is the ABSENCE of a denylist entry for
+ * `.orchestrator/tmp/**`, never a whole-command escape clause. That shape is the
+ * #1106 hole (`guard-design.md` § "Widening a matcher without narrowing its
+ * bypass"), where an appended exempt statement lifted the verdict for the whole
+ * command; it is structurally unreachable here.
+ *
+ * Denylist semantics (globs, the two classes, `~` handling, case-folding,
+ * repo-root relativization) are IDENTICAL to `redirectRuleMatches` — both call
+ * `compileTargetDenylist` / `targetMatchesDenylist`, so the two rule classes can
+ * never drift apart on what a pattern means.
+ *
+ * @param {{ 'target-denylist'?: string[] }} rule
+ * @param {Array<{ target: string|null, verb: string|null, unresolved?: boolean }>} entries
+ * @param {{ repoRoot?: string|null, home?: string|undefined }} [opts]
+ * @returns {{ target: string, verb: string }|null}
+ */
+export function firstDeniedDeleteTarget(rule, entries, opts = {}) {
+  const { repoRoot = null, home = process.env.HOME } = opts;
+  if (!rule || !Array.isArray(entries) || entries.length === 0) return null;
+  const denylist = Array.isArray(rule['target-denylist']) ? rule['target-denylist'] : [];
+  if (denylist.length === 0) return null;
+
+  const compiled = compileTargetDenylist(denylist, home);
+  if (compiled.relRegexes.length === 0 && compiled.absRegexes.length === 0) return null;
+
+  for (const entry of entries) {
+    if (entry.unresolved || typeof entry.target !== 'string') continue;
+    if (targetMatchesDenylist(entry.target, compiled, repoRoot, home)) {
+      return { target: entry.target, verb: entry.verb };
+    }
+  }
+  return null;
+}
+
 /**
  * Test whether a command string contains a blocked pattern with shell-aware
  * boundaries AND a quoted-payload guard (#641).

package/scripts/lib/config/dialectic.mjs

@@ -14,6 +14,15 @@ import { preprocessBlockLines } from './block-preprocess.mjs';
 
 const ALLOWED_MODELS = new Set(['haiku', 'sonnet', 'opus']);
 
+/**
+ * Default `dialectic.budget-tokens` — the INPUT ceiling of one derivation call
+ * (SSOT; `scripts/dialectic-deriver.mjs` `DEFAULT_BUDGET.input` imports it).
+ * It is an upper bound the pre-dispatch estimate aborts on, not a spend: card
+ * bodies + steering alone estimated ~12k tokens here and ~30k in a consumer
+ * repo, so the former default of 8000 aborted real runs (#1380).
+ */
+export const DEFAULT_BUDGET_TOKENS = 32000;
+
 /**
  * Parse the top-level `dialectic:` YAML block from markdown content.
  * Independent of the `## Session Config` section boundary.
@@ -21,7 +30,7 @@ const ALLOWED_MODELS = new Set(['haiku', 'sonnet', 'opus']);
  * Defaults:
  *   cadence:       5 (integer ≥ 0 — session count between auto-runs; 0 = disabled)
  *   model:         'haiku'
- *   budget-tokens: 8000 (integer ≥ 0)
+ *   budget-tokens: DEFAULT_BUDGET_TOKENS (32000, integer ≥ 0)
  *
  * Throws if `model` is present but not one of haiku|sonnet|opus.
  *
@@ -29,7 +38,7 @@ const ALLOWED_MODELS = new Set(['haiku', 'sonnet', 'opus']);
  * @returns {{ cadence: number, model: string, "budget-tokens": number }}
  */
 export function _parseDialectic(content) {
-  const defaults = { cadence: 5, model: 'haiku', 'budget-tokens': 8000 };
+  const defaults = { cadence: 5, model: 'haiku', 'budget-tokens': DEFAULT_BUDGET_TOKENS };
 
   const lines = preprocessBlockLines(content);
   let inBlock = false;
@@ -49,7 +58,7 @@ export function _parseDialectic(content) {
 
   let cadence = 5;
   let model = 'haiku';
-  let budgetTokens = 8000;
+  let budgetTokens = DEFAULT_BUDGET_TOKENS;
 
   for (const rawLine of blockLines) {
     const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');

package/scripts/lib/config/gate.mjs

@@ -0,0 +1,74 @@
+import { matchBlockHeader } from './block-header.mjs';
+import { preprocessBlockLines } from './block-preprocess.mjs';
+
+/**
+ * gate.mjs — Parser for the top-level `gate:` YAML block
+ * (PRD `docs/prd/2026-09-20-prozessgruppen-kill-und-waisen-waechter.md` §4 A3,
+ * Epic #1425 / issue #1432).
+ *
+ * Holds the wall-clock ceiling for GATE PATH B — the
+ * `scripts/run-quality-gate.mjs` → `scripts/lib/gates/gate-*.mjs` route, which
+ * had NO timeout at all before #1425 A3. Path A (`scripts/lib/quality-gate.mjs`)
+ * keeps its own `SO_GATE_TIMEOUT_MS` operator override; this block sets the
+ * COMMITTED default for path B so both paths may run equally long.
+ *
+ * Precedence in `run-quality-gate.mjs`: `SO_GATE_TIMEOUT_MS` (operator, wins) >
+ * this committed value > `DEFAULT_GATE_TIMEOUT_MS` (900 000).
+ *
+ * Tolerant parser: malformed values silently fall back to the default.
+ *
+ * Returns `{ 'timeout-path-b-ms': number }`.
+ */
+
+/** 900 000 ms (15 min) — same ceiling as `GATE_TIMEOUT_MS` on path A (PRD §4). */
+const DEFAULT_TIMEOUT_PATH_B_MS = 900_000;
+
+/**
+ * Parse the top-level `gate:` YAML block from markdown content.
+ * Independent of the `## Session Config` section boundary.
+ *
+ * @param {string} content — full file contents
+ * @returns {{'timeout-path-b-ms': number}}
+ */
+export function _parseGate(content) {
+  let timeoutPathBMs = DEFAULT_TIMEOUT_PATH_B_MS;
+
+  const lines = preprocessBlockLines(content);
+  let inBlock = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      if (matchBlockHeader(line, 'gate')) inBlock = true;
+      continue;
+    }
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  for (const rawLine of blockLines) {
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
+    if (!kvMatch) continue;
+
+    const k = kvMatch[1];
+    let v = kvMatch[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+    if (k === 'timeout-path-b-ms') {
+      // A zero or negative ceiling would kill every command instantly — the
+      // failure mode is worse than the uncapped state this key exists to fix,
+      // so it falls back to the default rather than being honoured.
+      if (/^-?\d+$/.test(v)) {
+        const n = Number.parseInt(v, 10);
+        if (Number.isFinite(n) && n > 0) timeoutPathBMs = n;
+      }
+    }
+  }
+
+  return { 'timeout-path-b-ms': timeoutPathBMs };
+}

package/scripts/lib/config/reaper.mjs

@@ -0,0 +1,162 @@
+import { matchBlockHeader } from './block-header.mjs';
+import { preprocessBlockLines } from './block-preprocess.mjs';
+
+/**
+ * reaper.mjs — Parser for the top-level `reaper:` YAML block
+ * (PRD `docs/prd/2026-09-20-prozessgruppen-kill-und-waisen-waechter.md` §4,
+ * Epic #1425 / issue #1432 B4).
+ *
+ * Configures the orphan watchdog that `hooks/post-tool-batch-wave-signal.mjs`
+ * (PostToolBatch) and `hooks/on-stop.mjs` (Stop + SubagentStop) trigger as a
+ * detached fire-and-forget scan. The scan itself lives in
+ * `scripts/lib/orphan-reaper.mjs`; this module only reads the numbers.
+ *
+ * DEFAULT OFF. `enabled` defaults to `false` — unlike `loop-guard`, this signal
+ * can SEND SIGNALS to processes, so it ships inert and is armed per repo only
+ * after its firing rate has been measured (`.claude/rules/host-resources.md`
+ * HR-101: a class above ~10 % is a broken instrument; HR-105: a rule nothing
+ * records is unfalsifiable).
+ *
+ * Tolerant parser: malformed values silently fall back to defaults.
+ *
+ * Returns `{ enabled, mode, 'min-age-seconds', 'min-scan-interval-seconds',
+ * 'kill-grace-ms', 'verify-wait-ms', 'max-hook-latency-ms', 'false-alarm-window' }`.
+ */
+
+/**
+ * Startwerte für Stufe 1 — NOT calibrated. Every number carries its provenance
+ * from the PRD §4 parameter table ("keine Zahl ohne ihre Population").
+ *
+ * RUNTIME SSOT is `REAPER_DEFAULTS` in `scripts/lib/orphan-reaper.mjs`; these
+ * literals mirror it deliberately rather than importing it, because that module
+ * pulls `process-group.mjs` + `resource-probe/parsers.mjs` into the config
+ * import graph, which every `parseSessionConfig()` caller would then pay for.
+ * The parity is held by a test, not by an import
+ * (`tests/lib/config/reaper.test.mjs` § defaults mirror REAPER_DEFAULTS).
+ */
+/** 300 s — DevWatchdog's hard limit for `tsgo`; the 2026-09-20 orphans were 7–17 min old. */
+const DEFAULT_MIN_AGE_SECONDS = 300;
+/** 30 s — DevWatchdog's normal scan cadence; keeps a PostToolBatch storm from taxing every tool call. */
+const DEFAULT_MIN_SCAN_INTERVAL_SECONDS = 30;
+/** 10 000 ms — `DEFAULT_KILL_GRACE_MS` from `dispatch-common.mjs:61`; repo convention, not newly invented. */
+const DEFAULT_KILL_GRACE_MS = 10_000;
+/** 500 ms — wait before reading the effect back; without it the 2026-09-20 check falsely reported "still alive". */
+const DEFAULT_VERIFY_WAIT_MS = 500;
+/** 50 ms — ceiling a scan may delay a hook by; above that the scan counts as too expensive. */
+const DEFAULT_MAX_HOOK_LATENCY_MS = 50;
+/** 50 decisions — rolling window over the JSONL audit (B5), so the rate has a population on quiet hosts too. */
+const DEFAULT_FALSE_ALARM_WINDOW = 50;
+
+/** `report` = decide + audit only (dryRun); `kill` = send signals (PRD Stufe 2, after calibration). */
+const MODE_VALUES = new Set(['report', 'kill']);
+const DEFAULT_MODE = 'report';
+
+/**
+ * Coerce a raw string into a finite integer >= `min`, else `fallback`.
+ *
+ * @param {string} raw
+ * @param {number} fallback
+ * @param {number} min
+ * @returns {number}
+ */
+function parseBoundedInt(raw, fallback, min) {
+  if (!/^-?\d+$/.test(raw)) return fallback;
+  const n = Number.parseInt(raw, 10);
+  if (!Number.isFinite(n) || n < min) return fallback;
+  return n;
+}
+
+/**
+ * Parse the top-level `reaper:` YAML block from markdown content.
+ * Independent of the `## Session Config` section boundary.
+ *
+ * @param {string} content — full file contents
+ * @returns {{enabled: boolean, mode: string, 'min-age-seconds': number,
+ *   'min-scan-interval-seconds': number, 'kill-grace-ms': number,
+ *   'verify-wait-ms': number, 'max-hook-latency-ms': number,
+ *   'false-alarm-window': number}}
+ */
+export function _parseReaper(content) {
+  let enabled = false;
+  let mode = DEFAULT_MODE;
+  let minAgeSeconds = DEFAULT_MIN_AGE_SECONDS;
+  let minScanIntervalSeconds = DEFAULT_MIN_SCAN_INTERVAL_SECONDS;
+  let killGraceMs = DEFAULT_KILL_GRACE_MS;
+  let verifyWaitMs = DEFAULT_VERIFY_WAIT_MS;
+  let maxHookLatencyMs = DEFAULT_MAX_HOOK_LATENCY_MS;
+  let falseAlarmWindow = DEFAULT_FALSE_ALARM_WINDOW;
+
+  const lines = preprocessBlockLines(content);
+  let inBlock = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      if (matchBlockHeader(line, 'reaper')) inBlock = true;
+      continue;
+    }
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  for (const rawLine of blockLines) {
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
+    if (!kvMatch) continue;
+
+    const k = kvMatch[1];
+    let v = kvMatch[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+    switch (k) {
+      case 'enabled':
+        // Default is false → only an explicit "true" arms the watchdog.
+        enabled = v.toLowerCase() === 'true';
+        break;
+      case 'mode':
+        // An unknown mode falls back to the INERT one — never to `kill`.
+        mode = MODE_VALUES.has(v.toLowerCase()) ? v.toLowerCase() : DEFAULT_MODE;
+        break;
+      case 'min-age-seconds':
+        minAgeSeconds = parseBoundedInt(v, DEFAULT_MIN_AGE_SECONDS, 0);
+        break;
+      case 'min-scan-interval-seconds':
+        minScanIntervalSeconds = parseBoundedInt(v, DEFAULT_MIN_SCAN_INTERVAL_SECONDS, 1);
+        break;
+      case 'kill-grace-ms':
+        killGraceMs = parseBoundedInt(v, DEFAULT_KILL_GRACE_MS, 0);
+        break;
+      case 'verify-wait-ms':
+        verifyWaitMs = parseBoundedInt(v, DEFAULT_VERIFY_WAIT_MS, 0);
+        break;
+      case 'max-hook-latency-ms':
+        maxHookLatencyMs = parseBoundedInt(v, DEFAULT_MAX_HOOK_LATENCY_MS, 1);
+        break;
+      case 'false-alarm-window':
+        falseAlarmWindow = parseBoundedInt(v, DEFAULT_FALSE_ALARM_WINDOW, 1);
+        break;
+    }
+  }
+
+  // Self-healing clamp: a `min-age-seconds` below the scan interval is dead
+  // config — a process younger than one scan period can be born and reaped
+  // between two scans, so the watchdog would fire on processes it has never
+  // seen before. Widen the age floor to at least one scan period (the same
+  // shape as loop-guard's window >= threshold clamp).
+  if (minAgeSeconds < minScanIntervalSeconds) minAgeSeconds = minScanIntervalSeconds;
+
+  return {
+    enabled,
+    mode,
+    'min-age-seconds': minAgeSeconds,
+    'min-scan-interval-seconds': minScanIntervalSeconds,
+    'kill-grace-ms': killGraceMs,
+    'verify-wait-ms': verifyWaitMs,
+    'max-hook-latency-ms': maxHookLatencyMs,
+    'false-alarm-window': falseAlarmWindow,
+  };
+}

package/scripts/lib/config.mjs

@@ -65,6 +65,8 @@ import { _parseHealthEndpoints, _parseEcosystemHealthBlockEnabled } from './conf
 import { _parseBrokenWindow } from './config/broken-window.mjs';
 import { _parseSlopcheck } from './config/slopcheck.mjs';
 import { _parseDiscoveryValidator } from './config/discovery-validator.mjs';
+import { _parseReaper } from './config/reaper.mjs';
+import { _parseGate } from './config/gate.mjs';
 import { _parseTemplatesFirst } from './config/templates-first.mjs';
 import { _parseVerificationAutoFix } from './config/verification-auto-fix.mjs';
 import { _parseDialectic } from './config/dialectic.mjs';
@@ -417,6 +419,16 @@ export function parseSessionConfig(mdContent, { hostPaths } = {}) {
   // discovery-validator: parsed from full content (PSA-006 enforcement / issue #567)
   const discoveryValidator = _parseDiscoveryValidator(mdContent);
 
+  // reaper: orphan-process watchdog, default OFF (PRD 2026-09-20 Prozessgruppen-Kill
+  // und Waisen-Wächter, Epic #1425 / #1432 B4). Consumed by the two hooks that
+  // trigger the detached scan — post-tool-batch-wave-signal.mjs and on-stop.mjs.
+  const reaper = _parseReaper(mdContent);
+
+  // gate: wall-clock ceiling for gate path B (run-quality-gate.mjs →
+  // gate-*.mjs), which had no timeout at all before #1425 A3. The operator
+  // override SO_GATE_TIMEOUT_MS still wins over this committed value.
+  const gate = _parseGate(mdContent);
+
   // templates-first: parsed from full content (PRD gsd Pattern 3 / issues #517, #519)
   const templatesFirst = _parseTemplatesFirst(mdContent);
 
@@ -555,6 +567,8 @@ export function parseSessionConfig(mdContent, { hostPaths } = {}) {
     'skill-evolution': skillEvolution,
     'dispatcher-autonomy': dispatcherAutonomy,
     'discovery-validator': discoveryValidator,
+    'reaper': reaper,
+    'gate': gate,
     'templates-first': templatesFirst,
     'verification-auto-fix': verificationAutoFix,
     'dialectic': dialectic,