session-orchestrator 5.2.0 → 5.4.0

package/hooks/pre-task-scope-disjoint.mjs

@@ -76,7 +76,24 @@
  *      real background-batch collision through. Completion arrives later as a
  *      `<task-notification>` record carrying `<tool-use-id>toolu_…</tool-use-id>`
  *      and `<status>completed</status>` (measured: launch 14:14:26.768 →
- *      notification 14:24:39.360, ten minutes later).
+ *      notification 14:24:39.360, ten minutes later). Any TERMINAL status
+ *      finishes the id, not only `completed` — see {@link TERMINAL_STATUS_RE}.
+ *      #1455: a 429'd agent notified `failed`, was resumed via SendMessage
+ *      (new tool-use-id), and its original id never finished → permanent deny.
+ *      Only a HARNESS-WRITTEN carrier record counts (#1459 Pkt 2 Rest,
+ *      {@link notificationCarrierText}): a complete block inside a `tool_result`
+ *      (a `Read` of a fixture), assistant text or a typed prompt is a forgery
+ *      that would false-ALLOW an overlap with a still-running agent.
+ *   c) EXACT ID, POSITIVE PROOF, RESUME (#1480, #1459 P1). A ledger entry keeps
+ *      its dispatch's PreToolUse `tool_use_id` as `useId`, and liveness is
+ *      looked up by THAT id; the description is only the fallback for entries
+ *      without one, the ledger `id` never (B3). A dispatch finishes only on
+ *      positive evidence — a terminal carrier, `is_error`, or a result in
+ *      {@link RESULT_COMPLETION_FORMS}; any other result form is "unknown",
+ *      i.e. no evidence (B2, row 13). A `SendMessage` to the dispatch's task id
+ *      re-opens it until a terminal carrier for the dispatch, that SendMessage or
+ *      the task id follows — a resumed agent is running, not done (#1459 P1;
+ *      {@link buildLivenessIndex}).
  *
  * COST CONTAINMENT: the transcript is read ONLY when a collision has already
  * been found — i.e. on the path that is about to deny. The 99 % no-collision
@@ -84,8 +101,9 @@
  * costs 78 ms to read + 129 ms to scan; a typical one is 1–5 MB.
  *
  * BLIND FALLBACK + ITS CEILING (BV-004): when the transcript is unavailable or
- * carries no record of that agent at all, liveness falls back to the ledger
- * entry's own age, with `IN_FLIGHT_TTL_MS` = 30 min. Named ceiling: the largest
+ * carries no positive evidence for that agent (no record, or only an unknown
+ * result form), liveness falls back to the ledger entry's own age, with
+ * `IN_FLIGHT_TTL_MS` = 30 min. Named ceiling: the largest
  * MEASURED same-batch dispatch spread is 95.7 s, so 30 min is ~19× headroom
  * against the false-ALLOW direction, while both measured sequential repair gaps
  * (36 min, 49 min) sit above it. Revisit trigger: a same-batch spread above
@@ -112,11 +130,11 @@
  *   | 7 | ledger unreadable / corrupt            | WARN + ALLOW + SELF-HEAL | loss of state is not evidence of a violation; loud so it gets noticed. The verdict now CARRIES a fresh ledger, so the corruption is repaired on the spot — without it the guard stayed OFF for the whole remaining wave, visible only in one `systemMessage` |
  *   | 8 | `git ls-files` failed                  | ALLOW (degraded)    | glob-vs-glob expansion degrades, concrete collisions are still found. A git outage is not a scope violation |
  *   | 9 | `findScopeCollisions` → not evaluable   | WARN + ALLOW        | the library says "not evaluable". Denying on a verdict with no witness is an assertion without evidence |
- *   |10 | same agent id re-dispatched, same scope| ALLOW (ledger replace) | a retry after a failed agent is legitimate; treating it as a duplicate would make the guard block every retry — a self-lock vector |
- *   |10a| collision, but EVERY colliding prior agent has FINISHED | ALLOW (+ prune) | the sequential repair pass. Its ledger records are pruned, so the state cannot re-block the next one either |
+ *   |10 | same agent id re-dispatched         | ALLOW; predecessor pruned only when FINISHED | a retry after a failed agent is legitimate (a failed agent is finished), so the guard must not self-lock. #1480 B4: an unfinished predecessor is KEPT as a claim — a third agent hitting only its scope still collides. With distinct `tool_use_id`s on both it is an ordinary partner (row 11); without them it never collides with its own retry. Replaced WITHOUT a probe only where no claim is lost: the same `tool_use_id` (the same dispatch evaluated again), or — neither carrying an id — a predecessor wholly covered by the retry's scope |
+ *   |10a| collision, but EVERY colliding prior agent has FINISHED (positive evidence) | ALLOW (+ prune) | the sequential repair pass. Its ledger records are pruned, so the state cannot re-block the next one either |
  *   |11 | collision with a prior agent still IN FLIGHT | **DENY**       | the one case this hook exists for |
  *   |12 | unexpected throw                       | ALLOW + stderr      | as row 2 |
- *   |13 | liveness probe throws / no evidence at all | treat as IN FLIGHT | keeps row 11 biting; the blind case is bounded by `IN_FLIGHT_TTL_MS`, never unbounded |
+ *   |13 | liveness probe throws / no positive evidence (no record, unknown result form) | treat as IN FLIGHT | keeps row 11 biting; the blind case is bounded by `IN_FLIGHT_TTL_MS`, never unbounded. A dispatch re-opened by a SendMessage with no completion after it is in flight outright, without TTL |
  *   |14 | ledger lock not acquirable in `LEDGER_LOCK_TIMEOUT_MS` | run UNLOCKED (degraded) | the lock removes the read-modify-write race (below); failing to take it must not deny, so the cycle degrades to the pre-lock behaviour |
  *
  * Every row that reaches a verdict from `decide()` — 5–11 and 13–14 — also
@@ -288,6 +306,29 @@ const SHAPE_NONE = 'none';
 /** The per-dispatch observability record (#1092) — see § Observability. */
 const SCOPE_EVENT = 'orchestrator.wave_dispatch.scope_checked';
 
+/**
+ * The worktree-base observability record (#1413).
+ *
+ * Same `wave_dispatch` domain and same `_checked` verb as `SCOPE_EVENT`, and
+ * written for EVERY `isolation: "worktree"` dispatch rather than only the
+ * alarming one. That is HR-105 applied at the source: a numerator-only stream
+ * cannot tell "genuinely rare" from "silently broken", and the firing rate this
+ * warning must stay under is then unfalsifiable. With every outcome in one
+ * stream the rate is `stale:true / all records of this name`.
+ *
+ * #1424 widened "every outcome" from two to three: the `stale: true|false`
+ * split was already covered, but each NON-measurement (peer STATE.md, no
+ * STATE.md, no `session-start-ref`, a git failure) returned early and emitted
+ * nothing — so the gate in front of the split reproduced exactly the
+ * zero-records ambiguity the split had removed. Those now carry
+ * `stale: null` plus a `skipped` reason, and only `isolation !== "worktree"`
+ * stays silent (HR-101: it is ~90% of all dispatches).
+ */
+const WORKTREE_BASE_EVENT = 'orchestrator.wave_dispatch.worktree_base_checked';
+
+/** State-dir candidates, in the same order `waveKeyOf()` probes them. */
+const STATE_DIR_CANDIDATES = ['.pi', '.cursor', '.codex', '.claude'];
+
 /**
  * The receive-side instruction line `renderScopeEchoInstruction()` renders and
  * the coordinator appends immediately after the fenced block
@@ -335,9 +376,77 @@ const MAX_TRANSCRIPT_BYTES = 256 * 1024 * 1024;
  * a completion — see § Liveness (b). Reading it as one would let every real
  * background-batch collision through, which is the one direction this repair
  * must not take.
+ *
+ * Recognised only as the PREFIX of the result text (after trimStart): a finished
+ * sync report that merely QUOTES this sentence is not a launch receipt, and read
+ * as one it stayed "running" without TTL (R1 LOW). Census 2026-09-30, 5,881
+ * local transcripts: 4,684 of 4,684 ACK results begin with it, also in their
+ * first content part.
  */
 const ASYNC_LAUNCH_ACK = 'Async agent launched successfully';
 
+/**
+ * The `tool_result` forms that PROVE a dispatch finished (#1480 B2), one line
+ * per form. A result matching none of them is NOT a completion but "no
+ * evidence" — the entry falls back to the TTL rule (matrix row 13). `is_error`
+ * is handled beside this list (the dispatch never ran), and the ACK is tested
+ * FIRST, so a launch receipt can never read as a completion.
+ *
+ * Census 2026-09-30 (local transcripts, 14 days, counts only), Agent
+ * tool_results: ACK 4,730; sync completion carrying the `<usage>`/`total_tokens`
+ * trailer and `agentId:` 690 (690/690); `is_error` 37; neither 38. Of those 38,
+ * "This agent's report was delivered…" is a completion (35/35 without a
+ * terminal carrier before or after, 2026-09-30), "Fork started — processing in
+ * b…" is not (a start receipt without the ACK wording — before this list it was
+ * read as a completion: the B2 fail-open).
+ *
+ * Named ceiling (BV-004): any other wording reads as "unknown", so a fresh entry
+ * binds for up to IN_FLIGHT_TTL_MS although its agent may be done — a bounded
+ * false-DENY, never a false-ALLOW. Revisit-Trigger: a census re-run finds an
+ * Agent tool_result wording in neither this list nor ASYNC_LAUNCH_ACK — classify
+ * it, then add ONE line here.
+ */
+const RESULT_COMPLETION_FORMS = Object.freeze([
+  Object.freeze({ at: 'anywhere', text: '<usage>' }),                        // sync trailer, 690/690
+  Object.freeze({ at: 'anywhere', text: 'total_tokens' }),                   // sync trailer, 690/690
+  Object.freeze({ at: 'start', text: "This agent's report was delivered" }), // 35/35 without carrier
+]);
+
+/** The tool that addresses — and can RESUME — an already-dispatched agent (#1459 P1). */
+const SEND_MESSAGE_TOOL = 'SendMessage';
+
+/**
+ * A `SendMessage` result that reached nobody (`{"success":false,…"No agent
+ * named…"}`, census 2026-09-30): such a send activates nothing.
+ */
+const SEND_NO_EFFECT = '"success":false';
+
+/**
+ * The harness's `agentId:` line in an Agent tool_result (ACK or sync trailer) —
+ * the task id a `SendMessage` addresses. Only a line that BEGINS with it, id on
+ * the same line, read as the LAST match over the content parts joined with
+ * `\n`: a sync result embeds the agent's own report ahead of the harness
+ * trailer, and a report ending in `agentId:` must not swallow the trailer's
+ * line (R1 MEDIUM — a wrong task id let a resumed agent read as finished).
+ * Census 2026-09-30, 5,881 local transcripts: in 5,375 of 5,375 Agent results
+ * carrying `agentId:`, the last one starts a line and sits in the last part.
+ */
+const AGENT_ID_LINE_RE = /^agentId:[ \t]*([A-Za-z0-9_-]+)/gm;
+
+/** Per-dispatch liveness states — see {@link buildLivenessIndex}. */
+const LIVE_FINISHED = 'finished';
+const LIVE_RUNNING = 'running';
+const LIVE_UNKNOWN = 'unknown';
+
+/**
+ * `<task-notification>` statuses that mean the task is NO LONGER RUNNING (#1455).
+ * Enumerated from evidence, not guessed — census 2026-09-25 over the operator's
+ * local Claude Code transcripts (`rg "<tool-use-id>…<status>X</status>"` on
+ * `*.jsonl`): completed, failed 1430 lines, killed 609, stopped 28.
+ * `running` is deliberately absent — it is the one non-terminal spelling.
+ */
+const TERMINAL_STATUS_RE = /<status>(?:completed|failed|killed|stopped)<\/status>/;
+
 /**
  * The consequence block spliced VERBATIM into the GUARD INACTIVE banner (#993),
  * naming the enforcement this hook's outage stops applying.
@@ -727,8 +836,8 @@ export function extractScopeFromPrompt(prompt) {
 
 /**
  * The dispatch's human description — the field the liveness probe matches
- * against the transcript's `tool_use` blocks (present in 147/147 measured
- * payloads).
+ * against the transcript's `tool_use` blocks when an entry carries no exact
+ * `useId` (present in 147/147 measured payloads).
  *
  * @param {{description?: unknown}} toolInput
  * @returns {string}
@@ -754,69 +863,401 @@ export function agentIdOf(toolInput) {
   return 'unnamed-agent';
 }
 
+/**
+ * A dispatch's EXACT identity (#1480 A): the PreToolUse payload's `tool_use_id`,
+ * or a ledger entry's stored `useId`. On Claude Code it equals the transcript's
+ * `tool_use` id, so liveness becomes a lookup instead of a description match;
+ * other harnesses may omit it, and `''` then means "no exact id". Taken
+ * verbatim, never re-spelled — and dropped rather than clipped past
+ * MAX_AGENT_ID_CHARS: a clipped id could never match, two clipped ids could
+ * match wrongly.
+ *
+ * @param {unknown} value
+ * @returns {string}
+ */
+function exactUseId(value) {
+  return typeof value === 'string' && value.trim() !== '' && value.length <= MAX_AGENT_ID_CHARS ? value : '';
+}
+
 // ---------------------------------------------------------------------------
 // Liveness — has an already-recorded agent FINISHED? (§ Liveness)
 // ---------------------------------------------------------------------------
 
+const NOTIFICATION_OPEN = '<task-notification>';
+const NOTIFICATION_CLOSE = '</task-notification>';
+
+/**
+ * A notification head in the harness's own tag order: `<task-id>`,
+ * `<tool-use-id>`, optional `<output-file>`, `<status>` — anchored at the opener.
+ * Group 1 is the task id (the resume key, #1459 P1), group 2 the tool-use id,
+ * group 3 the whole `<status>` element.
+ */
+const NOTIFICATION_HEAD_RE = /^<task-notification>\s*<task-id>([^<]*)<\/task-id>\s*<tool-use-id>([^<]+)<\/tool-use-id>\s*(?:<output-file>[^<]*<\/output-file>\s*)?(<status>[^<]*<\/status>)/;
+
+/** `origin.kind` / `commandMode` value the harness stamps on a notification carrier. */
+const CARRIER_KIND = 'task-notification';
+
+/** `queue-operation` operations measured to carry a notification (dequeue carries no content). */
+const CARRIER_QUEUE_OPS = new Set(['enqueue', 'remove']);
+
+/** First line of the harness preamble some `user` carriers put before the block. */
+const SYSTEM_NOTIFICATION_MARK = '[SYSTEM NOTIFICATION - NOT USER INPUT]\n';
+
+/**
+ * The notification text of a HARNESS-WRITTEN carrier record, or `null` for any
+ * other record (#1459 Pkt 2 Rest). Census 2026-09-28 over the operator's local
+ * transcripts (11,005 files, 2026-08-06 → 2026-09-28): every terminal id the
+ * pre-fix raw-line match accepted from a real carrier came from exactly one of
+ * three record forms, each of which carries ids the other two do not:
+ *   - `user` with STRING `message.content` and `origin.kind: 'task-notification'`
+ *     (a typed prompt carries `origin.kind: 'human'`). The text begins with the
+ *     opener, or with the harness preamble ({@link SYSTEM_NOTIFICATION_MARK},
+ *     tag-free, ending in a blank line) directly followed by the opener;
+ *   - `queue-operation` with `operation` `enqueue`/`remove` and string `content`;
+ *   - `attachment` of type `queued_command` with `commandMode: 'task-notification'`.
+ * Everything else — `tool_result` content, assistant text, tool inputs, typed
+ * prompts — is a quote or a forgery and yields `null`, i.e. no finished id.
+ *
+ * The guard on the `user` form is `origin.kind`, which only the harness sets; the
+ * preamble rule merely strips a tag-free prefix and is no control on its own.
+ *
+ * Named residual (BV-004): a `queue-operation` record has no field that tells a
+ * harness notification from an operator prompt typed while the agent was busy,
+ * so an OPERATOR could forge through that one channel. An agent cannot through
+ * the one producer censused: text a subagent or peer delivers via `SendMessage`
+ * arrives wrapped by the harness, so it never begins with the opener. Measured
+ * 2026-09-28 in a second run (count only, 11,008 transcript files, three more
+ * than the census above): 7,131 records carry such a message, 1,801 of them as
+ * `queue-operation`, 2,486 as `queued_command` with `commandMode: 'prompt'`;
+ * 0 of the 7,131 begin with `<task-notification>`. Other queue producers
+ * (scheduled wake-ups, a `/loop` body) were not censused. Revisit if the harness
+ * adds a discriminator here (like `commandMode` on the attachment) or stops
+ * wrapping.
+ *
+ * @param {any} rec — one parsed transcript record
+ * @returns {string|null}
+ */
+function notificationCarrierText(rec) {
+  if (rec?.type === 'user' && rec?.origin?.kind === CARRIER_KIND && typeof rec?.message?.content === 'string') {
+    const text = rec.message.content;
+    if (!text.startsWith(SYSTEM_NOTIFICATION_MARK)) return text;
+    const open = text.indexOf('<');
+    return open !== -1 && text.startsWith(`\n\n${NOTIFICATION_OPEN}`, open - 2) ? text.slice(open) : null;
+  }
+  if (rec?.type === 'queue-operation' && CARRIER_QUEUE_OPS.has(rec?.operation) && typeof rec?.content === 'string') {
+    return rec.content;
+  }
+  const att = rec?.type === 'attachment' ? rec?.attachment : undefined;
+  if (att?.type === 'queued_command' && att?.commandMode === CARRIER_KIND && typeof att?.prompt === 'string') {
+    return att.prompt;
+  }
+  return null;
+}
+
+/**
+ * The HEAD of a carrier text's FIRST `<task-notification>` block (#1459 Pkt 2) —
+ * its task id, its tool-use id and whether its status is TERMINAL; at most one
+ * head per carrier. Only a terminal head finishes an id; a non-terminal one only
+ * contributes the task id (#1459 P1), which can open a dispatch, never close it.
+ * (Named `finishedNotificationIds` until #1480; the ceiling below is unchanged.)
+ *
+ * The text must BEGIN with the opener (a block further in is a quote) and its
+ * head must follow the harness tag order ({@link NOTIFICATION_HEAD_RE}).
+ * `<summary>` and `<result>` carry free text that can QUOTE another
+ * notification's `<tool-use-id>` and `<status>`, or even forge a whole block
+ * (R2 F1: a summary that closes itself and opens a complete fake block defeated
+ * the earlier cut-then-split approach). So nothing past the block's HEAD is read:
+ * the head runs from the opener to the earliest `<summary>`, `<result>` or
+ * `</task-notification>`. Fail-closed — the deny stays — when the text is not a
+ * carrier's, does not begin with the opener, has no closing tag (truncated
+ * block), or its head is out of order or carries no terminal status.
+ *
+ * Named ceiling (BV-004, #1467): a batch of several DIFFERENT notifications in
+ * one carrier reports only the first as finished (the rest stay running, the
+ * safe direction but a false-DENY source). Census 2026-09-30 over the operator's
+ * local transcripts of all repos (11,684 files, 2026-08-06 → 2026-09-30, at
+ * f58480e5): 23 preamble-form `user` carriers hold 2+ distinct terminal ids; 108
+ * non-first ids are finished by no other carrier, and 0 of them is an `Agent`
+ * dispatch id (105 Bash, 3 Monitor) — the only ids this index resolves, so no
+ * Agent liveness is lost today. The 2026-09-28 figures (31 / 155) were not
+ * reproduced. No split is built: it would gain nothing, and its safety is
+ * unproven. `origin` has no per-block discriminator, so a split is safe only if
+ * the harness escapes `<` in `<summary>`/`<result>` — unescaped, a block forged
+ * there is byte-identical to a genuine `\n\n`-joined batch. The census suggests
+ * escaping (12,039 of 25,031 results carry `&lt;`, 3 a raw `<` + letter) but
+ * does not establish it for every harness version. Revisit-Trigger: a re-run
+ * census finds a non-first terminal id that is an `Agent` dispatch id finished
+ * by no other carrier or `tool_result`; a split then needs escaping proven first.
+ *
+ * @param {string|null} text — a carrier's text from {@link notificationCarrierText}
+ * @returns {{taskId: string, toolUseId: string, terminal: boolean}|null}
+ */
+function notificationHead(text) {
+  if (typeof text !== 'string' || !text.startsWith(NOTIFICATION_OPEN)) return null;
+  const close = text.indexOf(NOTIFICATION_CLOSE);
+  if (close === -1) return null;
+  let headEnd = close;
+  for (const tag of ['<summary>', '<result>']) {
+    const at = text.indexOf(tag);
+    if (at !== -1 && at < headEnd) headEnd = at;
+  }
+  const head = text.slice(0, headEnd).match(NOTIFICATION_HEAD_RE);
+  if (head === null) return null;
+  return { taskId: head[1].trim(), toolUseId: head[2], terminal: TERMINAL_STATUS_RE.test(head[3]) };
+}
+
 /**
- * Index a session transcript by agent DESCRIPTION → completion state.
+ * Classify an Agent dispatch's OWN `tool_result` (#1480 B2): `done` only on
+ * positive evidence (`is_error`, or one of {@link RESULT_COMPLETION_FORMS}),
+ * `ack` for the launch acknowledgement (a text PREFIX, see
+ * {@link ASYNC_LAUNCH_ACK}), `unknown` for everything else. The ACK is tested
+ * before the forms, so no ACK wording can ever read as a completion.
+ *
+ * @param {{is_error?: unknown}} block
+ * @param {string} text — {@link resultTextOf}(block)
+ * @returns {'done'|'ack'|'unknown'}
+ */
+function dispatchResultForm(block, text) {
+  if (block?.is_error === true) return 'done';
+  const lead = text.trimStart();
+  if (lead.startsWith(ASYNC_LAUNCH_ACK)) return 'ack';
+  for (const form of RESULT_COMPLETION_FORMS) {
+    if (form.at === 'start' ? lead.startsWith(form.text) : text.includes(form.text)) return 'done';
+  }
+  return 'unknown';
+}
+
+/**
+ * The LAST line-leading `agentId:` a harness-written dispatch result names, or
+ * `''` — see {@link AGENT_ID_LINE_RE}. Parts are joined with `\n` HERE (unlike
+ * {@link resultTextOf}), so a part boundary is a line boundary and report text
+ * cannot run into the trailer's line.
  *
- * Three record shapes are read, all measured in this repo's own transcripts:
- *   - `tool_use` `{name:'Agent', id, input.description}` — the dispatch.
- *   - `tool_result` `{tool_use_id, content}` — a completion for the SYNCHRONOUS
- *     shape, but only when its text is not the {@link ASYNC_LAUNCH_ACK}.
- *   - a `<task-notification>` record carrying `<tool-use-id>` and
- *     `<status>completed</status>` — the ASYNC shape's completion.
+ * @param {{content?: unknown}} block
+ * @returns {string}
+ */
+function lastAgentIdIn(block) {
+  const c = block?.content;
+  const text = typeof c === 'string'
+    ? c
+    : Array.isArray(c) ? c.map((part) => (typeof part?.text === 'string' ? part.text : '')).join('\n') : '';
+  let last = '';
+  for (const m of text.matchAll(AGENT_ID_LINE_RE)) last = m[1];
+  return last;
+}
+
+/**
+ * Append `value` to the array stored under `key`.
  *
- * A description dispatched N times counts as finished only when EVERY one of its
- * tool_use ids is finished. Conservative on purpose: one outstanding run of the
- * same agent keeps the deny alive.
+ * @template T
+ * @param {Map<string, T[]>} map
+ * @param {string} key
+ * @param {T} value
+ */
+function pushTo(map, key, value) {
+  const list = map.get(key);
+  if (list === undefined) map.set(key, [value]);
+  else list.push(value);
+}
+
+/**
+ * Index a session transcript by DISPATCH tool-use id → liveness state, plus
+ * description → dispatch ids for ledger entries that carry no exact id.
+ *
+ * Record shapes read, all measured (census 2026-09-30 for the SendMessage half):
+ *   - `tool_use` `{name:'Agent', id, input.description}` — the dispatch U.
+ *   - `tool_use` `{name:'SendMessage', id, input.to}` — addresses a dispatch by
+ *     its task id T(U) (= agentId); 1,055 via a notification task id, 33 via the
+ *     ACK's agentId, 0 via the description.
+ *   - `tool_result` for U — classified by {@link dispatchResultForm}; for a
+ *     SendMessage only whether it reached nobody ({@link SEND_NO_EFFECT} or
+ *     `is_error`).
+ *   - a `<task-notification>` CARRIER record — only a harness-written carrier
+ *     ({@link notificationCarrierText}), only its first block's head
+ *     ({@link notificationHead}); a terminal `<status>` finishes (#1455: `failed`
+ *     too).
+ *
+ * T(U) is the last line-leading `agentId:` ({@link lastAgentIdIn}) of U's own
+ * ACK or positive result, else the task
+ * id of the first carrier head carrying U's tool-use id.
+ *
+ * RESUME (#1459 P1). U is ACTIVATED by its dispatch and by every SendMessage
+ * with `to === T(U)` whose result is not a no-effect (a send without a result
+ * yet counts — the safe direction). U is FINISHED when a completion lies AFTER
+ * its last activation, by transcript line position: a terminal carrier with
+ * tool-use id U, with the id of an activating SendMessage, or with task id T(U);
+ * when the dispatch itself is the last activation, also U's own positive
+ * result. Measured 2026-09-30: a resumed agent completes under the
+ * SendMessage's id and the same task id, never again under U (455 cases); a
+ * message queued to a running agent completes under U with the same task id
+ * (566). Activations only OPEN; closing still needs a carrier or U's own
+ * harness-written result.
+ *
+ * States: `finished`; `running` — no result, an ACK, or a SendMessage as last
+ * activation with no completion after it (no TTL); `unknown` — only a result
+ * form without positive evidence, which the probe treats as no evidence (TTL).
+ * A repeated `tool_use` record (same Agent or SendMessage id) is the SAME event,
+ * not a new activation: its position is the FIRST occurrence, so a copy after
+ * the completion cannot re-open a finished agent (R1 D4, a false-DENY). A
+ * repeated carrier still closes. Hardening without a measured case: census
+ * 2026-09-30 (5,881 local transcripts) found 0 repeated Agent and 0 repeated
+ * SendMessage `tool_use` records.
+ *
+ * Named ceiling (BV-004): `to` is matched against T(U) only — a SendMessage that
+ * addresses the agent by name or description re-opens nothing (0 of ~6,200
+ * measured 2026-09-30). Revisit-Trigger: a census re-run finds a SendMessage to
+ * a dispatch whose `to` is not its task id.
  *
  * Pure and total — a malformed line is skipped, never thrown on.
  *
  * @param {string} raw — the transcript's JSONL text
- * @returns {Map<string, boolean>} description → finished?
+ * @returns {{states: Map<string, 'finished'|'running'|'unknown'>,
+ *            idsByDesc: Map<string, string[]>}}
  */
-export function buildTranscriptIndex(raw) {
-  const out = new Map();
-  if (typeof raw !== 'string' || raw.length === 0) return out;
-
-  const dispatched = new Map(); // description → tool_use ids
-  const finishedIds = new Set();
-
-  for (const line of raw.split('\n')) {
+function buildLivenessIndex(raw) {
+  const states = new Map();
+  const idsByDesc = new Map();
+  if (typeof raw !== 'string' || raw.length === 0) return { states, idsByDesc };
+
+  const dispatchPos = new Map();     // U → FIRST line position of its tool_use
+  const results = new Map();         // U → [{pos, form, agentId}]
+  const sendsByTo = new Map();       // SendMessage `to` → [{id, pos}]
+  const sendIds = new Set();
+  const sendNoEffect = new Set();    // SendMessage ids whose result reached nobody
+  const headsByUse = new Map();      // carrier tool-use id → [{pos, taskId, terminal}]
+  const terminalByTask = new Map();  // carrier task id → [pos] of terminal heads
+
+  const lines = raw.split('\n');
+  for (let pos = 0; pos < lines.length; pos++) {
+    const line = lines[pos];
     if (line.length < 24) continue;
+    // Substring prefilter only — the verdict needs the PARSED record: a raw-line
+    // match let a forged block in any record finish an id (#1459 Pkt 2 Rest).
+    const hasNotification = line.includes('task-notification');
+    const hasToolRow = line.includes('"tool_use"') || line.includes('tool_use_id');
+    if (!hasNotification && !hasToolRow) continue;
+    let rec;
+    try { rec = JSON.parse(line); } catch { continue; }
 
-    // ASYNC completion — matched on the RAW line: the tags are plain text inside
-    // a JSON string, so no parse is needed and the `queue-operation` carrier
-    // record (which has no `message.content`) is covered too.
-    if (line.includes('task-notification') && line.includes('<status>completed</status>')) {
-      for (const m of line.matchAll(/<tool-use-id>([^<]+)<\/tool-use-id>/g)) finishedIds.add(m[1]);
+    // Completion (and the task id) — only from a harness-written carrier record.
+    if (hasNotification) {
+      const head = notificationHead(notificationCarrierText(rec));
+      if (head !== null) {
+        pushTo(headsByUse, head.toolUseId, { pos, taskId: head.taskId, terminal: head.terminal });
+        if (head.terminal && head.taskId !== '') pushTo(terminalByTask, head.taskId, pos);
+      }
     }
 
-    if (!line.includes('"tool_use"') && !line.includes('tool_use_id')) continue;
-    let rec;
-    try { rec = JSON.parse(line); } catch { continue; }
+    if (!hasToolRow) continue;
     const content = rec?.message?.content;
     if (!Array.isArray(content)) continue;
 
     for (const block of content) {
-      if (block?.type === 'tool_use' && block?.name === DISPATCH_TOOL && typeof block?.id === 'string') {
-        const desc = typeof block?.input?.description === 'string' ? block.input.description.trim() : '';
-        if (desc === '') continue;
-        const ids = dispatched.get(desc) ?? [];
-        ids.push(block.id);
-        dispatched.set(desc, ids);
+      if (block?.type === 'tool_use' && typeof block?.id === 'string') {
+        if (block.name === DISPATCH_TOOL) {
+          if (!results.has(block.id)) {   // first occurrence only — see D4 above
+            results.set(block.id, []);
+            dispatchPos.set(block.id, pos);
+            const desc = typeof block?.input?.description === 'string' ? block.input.description.trim() : '';
+            if (desc !== '') pushTo(idsByDesc, desc, block.id);
+          }
+        } else if (block.name === SEND_MESSAGE_TOOL && typeof block?.input?.to === 'string' && block.input.to !== ''
+          && !sendIds.has(block.id)) {
+          sendIds.add(block.id);
+          pushTo(sendsByTo, block.input.to, { id: block.id, pos });
+        }
         continue;
       }
       if (block?.type === 'tool_result' && typeof block?.tool_use_id === 'string') {
-        // The launch ACK is not a completion — see § Liveness (b).
-        if (!resultTextOf(block).includes(ASYNC_LAUNCH_ACK)) finishedIds.add(block.tool_use_id);
+        const own = results.get(block.tool_use_id);
+        if (own !== undefined) {
+          const text = resultTextOf(block);
+          const form = dispatchResultForm(block, text);
+          // An error text is not a harness trailer — learn T(U) from ACK/completion only.
+          const agentId = form === 'ack' || (form === 'done' && block.is_error !== true) ? lastAgentIdIn(block) : '';
+          own.push({ pos, form, agentId });
+        } else if (sendIds.has(block.tool_use_id)
+          && (block.is_error === true || resultTextOf(block).includes(SEND_NO_EFFECT))) {
+          sendNoEffect.add(block.tool_use_id);
+        }
+      }
+    }
+  }
+
+  for (const [useId, pos] of dispatchPos) {
+    const own = results.get(useId) ?? [];
+    const taskId = own.find((r) => r.agentId !== '')?.agentId
+      ?? (headsByUse.get(useId) ?? []).find((h) => h.taskId !== '')?.taskId
+      ?? '';
+
+    let lastPos = pos;
+    let lastIsSend = false;
+    const closers = [useId];
+    if (taskId !== '') {
+      for (const send of sendsByTo.get(taskId) ?? []) {
+        if (sendNoEffect.has(send.id)) continue;
+        closers.push(send.id);
+        if (send.pos > lastPos) { lastPos = send.pos; lastIsSend = true; }
       }
     }
+
+    const closedAfter = closers.some((id) => (headsByUse.get(id) ?? []).some((h) => h.terminal && h.pos > lastPos))
+      || (taskId !== '' && (terminalByTask.get(taskId) ?? []).some((p) => p > lastPos))
+      || (!lastIsSend && own.some((r) => r.form === 'done' && r.pos > lastPos));
+
+    let state;
+    if (closedAfter) state = LIVE_FINISHED;
+    else if (lastIsSend || own.length === 0 || own.some((r) => r.form === 'ack')) state = LIVE_RUNNING;
+    else state = LIVE_UNKNOWN;
+    states.set(useId, state);
   }
+  return { states, idsByDesc };
+}
 
-  for (const [desc, ids] of dispatched) out.set(desc, ids.every((id) => finishedIds.has(id)));
+/**
+ * Description-level verdict for a ledger entry WITHOUT an exact id: `false` if
+ * any of the description's dispatches is running, `true` only if every one is
+ * finished, `undefined` (no evidence → TTL) otherwise. `excludeUseId` drops the
+ * CURRENT dispatch, whose `tool_use` may already sit in the transcript at
+ * PreToolUse time and would make a finished same-named predecessor look alive.
+ *
+ * @param {{states: Map<string, string>, idsByDesc: Map<string, string[]>}} index
+ * @param {string} desc
+ * @param {string} excludeUseId
+ * @returns {boolean|undefined}
+ */
+function descFinished(index, desc, excludeUseId) {
+  let seen = false;
+  let unknown = false;
+  for (const useId of index.idsByDesc.get(desc) ?? []) {
+    if (useId === excludeUseId) continue;
+    seen = true;
+    const state = index.states.get(useId);
+    if (state === LIVE_RUNNING) return false;
+    if (state !== LIVE_FINISHED) unknown = true;
+  }
+  return seen && !unknown ? true : undefined;
+}
+
+/**
+ * Index a session transcript by agent DESCRIPTION → completion state — the
+ * description view of {@link buildLivenessIndex}.
+ *
+ * A description dispatched N times counts as finished only when EVERY one of its
+ * tool_use ids is finished, and as running as soon as one is. Conservative on
+ * purpose: one outstanding run of the same agent keeps the deny alive. A
+ * description with no running run but an `unknown` one is absent (no evidence).
+ *
+ * @param {string} raw — the transcript's JSONL text
+ * @returns {Map<string, boolean>} description → finished? (absent = no evidence)
+ */
+export function buildTranscriptIndex(raw) {
+  const index = buildLivenessIndex(raw);
+  const out = new Map();
+  for (const desc of index.idsByDesc.keys()) {
+    const finished = descFinished(index, desc, '');
+    if (finished !== undefined) out.set(desc, finished);
+  }
   return out;
 }
 
@@ -843,10 +1284,16 @@ function resultTextOf(block) {
  * been found. The no-collision path — the overwhelming majority — never touches
  * the file (§ Liveness, cost containment).
  *
- * Resolution order per ledger entry:
- *   1. transcript evidence for its description → definitive;
- *   2. no evidence → the entry's own age against `IN_FLIGHT_TTL_MS`;
- *   3. no usable timestamp either → NOT finished (matrix row 13 — keeps the
+ * Resolution order per ledger entry (#1480 A):
+ *   1. an entry WITH `useId` → that exact dispatch's state: finished / running
+ *      are definitive, `unknown` or no record is no evidence;
+ *   2. an entry WITHOUT `useId` (legacy, or a harness sending no `tool_use_id`)
+ *      → its non-empty description via {@link descFinished}, the current
+ *      dispatch (`selfUseId`) excluded. Never the ledger `id` — a
+ *      `desc (type)` string or a bare subagent type, which matched unrelated
+ *      dispatches (B3);
+ *   3. no evidence → the entry's own age against `IN_FLIGHT_TTL_MS`;
+ *   4. no usable timestamp either → NOT finished (matrix row 13 — keeps the
  *      deny biting rather than inventing a completion).
  *
  * @param {object} params
@@ -854,9 +1301,13 @@ function resultTextOf(block) {
  * @param {number} [params.now]
  * @param {number} [params.ttlMs]
  * @param {(p: string, enc: string) => string} [params.readFn]
- * @returns {(entry: {id: string, desc?: string, at?: string}) => boolean}
+ * @param {string} [params.selfUseId] the CURRENT dispatch's `tool_use_id`
+ * @returns {(entry: {id: string, desc?: string, at?: string, useId?: string}) => boolean}
  */
-export function makeFinishedProbe({ transcriptPath, now = Date.now(), ttlMs = IN_FLIGHT_TTL_MS, readFn = readFileSync } = {}) {
+export function makeFinishedProbe({
+  transcriptPath, now = Date.now(), ttlMs = IN_FLIGHT_TTL_MS, readFn = readFileSync, selfUseId,
+} = {}) {
+  const excludeUseId = exactUseId(selfUseId);
   let index; // undefined = not loaded yet, null = unavailable
   const load = () => {
     if (index !== undefined) return index;
@@ -864,7 +1315,7 @@ export function makeFinishedProbe({ transcriptPath, now = Date.now(), ttlMs = IN
     try {
       if (typeof transcriptPath === 'string' && transcriptPath.length > 0) {
         if (statSync(transcriptPath).size <= MAX_TRANSCRIPT_BYTES) {
-          index = buildTranscriptIndex(readFn(transcriptPath, 'utf8'));
+          index = buildLivenessIndex(readFn(transcriptPath, 'utf8'));
         }
       }
     } catch {
@@ -876,10 +1327,17 @@ export function makeFinishedProbe({ transcriptPath, now = Date.now(), ttlMs = IN
   return (entry) => {
     try {
       const idx = load();
-      const desc = typeof entry?.desc === 'string' && entry.desc !== '' ? entry.desc : entry?.id;
-      if (idx !== null && typeof desc === 'string') {
-        const finished = idx.get(desc);
-        if (finished !== undefined) return finished;
+      if (idx !== null) {
+        const useId = exactUseId(entry?.useId);
+        if (useId !== '') {
+          const state = idx.states.get(useId);
+          if (state === LIVE_FINISHED) return true;
+          if (state === LIVE_RUNNING) return false;
+        } else {
+          const desc = typeof entry?.desc === 'string' ? entry.desc.trim() : '';
+          const finished = desc === '' ? undefined : descFinished(idx, desc, excludeUseId);
+          if (finished !== undefined) return finished;
+        }
       }
       const at = Date.parse(entry?.at ?? '');
       if (Number.isFinite(at)) return now - at > ttlMs;
@@ -981,6 +1439,163 @@ export function listTrackedFiles(cwd) {
   }
 }
 
+// ---------------------------------------------------------------------------
+// Stale worktree base (#1413) — a WARNING, never a decision
+//
+// `isolation: "worktree"` makes the HARNESS create `<repo>/.claude/worktrees/
+// agent-<hex>`; no code in this repo creates it and the `Agent` payload carries
+// no base-ref field (the 147-dispatch key census in the module docblock). The
+// base is the SESSION-START commit, and it does not follow a mid-session commit:
+// measured 2026-09-19 (session s18), worktrees created 25 minutes AFTER commit
+// `240efda6` still stood on its parent `8f15f77b`. A fix agent then silently
+// edits the OLD code, and its test run is structurally red on top — `validate-
+// plugin` is vitest's globalSetup and `check-guard-requires-parity.mjs` compares
+// against `git show HEAD:` inside the stale worktree.
+//
+// We have no lever on the base, so the only available fix is to be LOUD. This
+// never touches the verdict: the two functions below are TOTAL (every failure
+// resolves to silence), and the caller ignores their result for the decision.
+// ---------------------------------------------------------------------------
+
+/**
+ * Facts for the worktree-base check, as a DISCRIMINATED record with three
+ * outcomes rather than two (#1424):
+ *
+ *   - `{stale: true|false, head, session_start_ref, subagent_type?}` — measured.
+ *   - `{stale: null, skipped: <reason>}` — the dispatch WAS on the `worktree`
+ *     branch, but the question could not be answered honestly. Still emitted,
+ *     because HR-105 needs the denominator: while every such case returned bare
+ *     `null` and the caller emitted nothing, "the check never had anything to
+ *     say" and "the check was silently disarmed" both read as zero records —
+ *     precisely the shape this event exists to close.
+ *   - `null` — `isolation !== 'worktree'`. SILENT by construction, and the one
+ *     outcome that must stay so: `isolation` appeared in 14 of 147 measured
+ *     dispatches, so recording the other ~90% would put the denominator on the
+ *     whole hot dispatch path (HR-101).
+ *
+ * IDENTITY GATE (`.claude/rules/identity-and-locks.md`): `session-start-ref`
+ * lives in STATE.md, a SHARED working-copy artefact that routinely belongs to a
+ * peer session. It is read only when STATE.md's own `session-id` equals this
+ * process's raw id (hook payload `session_id`, else `CLAUDE_CODE_SESSION_ID`) —
+ * a process-local witness REPLACES the shared one, never unions with it. On
+ * mismatch, absence or any read failure this reports `stale: null`: a confident
+ * warning about somebody else's session is worse than no warning at all. The
+ * test runs PER CANDIDATE (`continue`, not `break`) — see the loop below.
+ *
+ * `parseStateMd` is imported DYNAMICALLY and only on the rare `worktree` branch
+ * (14 of 147 measured dispatches carried `isolation` at all): it is a leaf module
+ * with zero imports and already inside the committed hook-import closure, so
+ * reuse costs no new edge, and binding it late keeps a load failure catchable
+ * instead of disarming the guard at ESM link time (§ #993 late-bound deps).
+ *
+ * @param {{tool_input?: unknown}} input — the raw hook payload
+ * @param {string} projectDir
+ * @param {string} sessionId — `input.session_id`, or `'no-session'`
+ * @returns {Promise<{head: string, session_start_ref: string, stale: boolean,
+ *   subagent_type?: string}|{stale: null, skipped: string}|null>}
+ */
+async function worktreeBaseFacts(input, projectDir, sessionId) {
+  // The applicability gate sits OUTSIDE the try on purpose: everything below it
+  // resolves to a `skipped` RECORD, so a throw here must not be able to mint one
+  // for a dispatch that was never on the `worktree` branch at all.
+  const toolInput = input?.tool_input;
+  if (toolInput === null || typeof toolInput !== 'object') return null;
+  if (toolInput.isolation !== 'worktree') return null;
+
+  try {
+    const ownId = sessionId && sessionId !== 'no-session'
+      ? sessionId
+      : (process.env.CLAUDE_CODE_SESSION_ID || '');
+    if (!ownId) return { stale: null, skipped: 'no-own-id' };
+
+    const { parseStateMd } = await import(
+      pathToFileURL(path.join(PLUGIN_ROOT, 'scripts', 'lib', 'state-md', 'yaml-parser.mjs')).href
+    );
+
+    // #1424: the identity test lives INSIDE the loop. Breaking at the first
+    // PARSEABLE STATE.md and testing `session-id` afterwards meant a single
+    // left-over `.pi/STATE.md` — `.pi` sorts before `.claude` in
+    // STATE_DIR_CANDIDATES — disarmed the check for a session whose own
+    // `.claude/STATE.md` sat right there, readable and matching. `sawStateMd`
+    // keeps the two silences apart afterwards: "nothing to read" is a different
+    // fact from "read, and none of it was mine".
+    let frontmatter = null;
+    let sawStateMd = false;
+    for (const dir of STATE_DIR_CANDIDATES) {
+      try {
+        const parsed = parseStateMd(readFileSync(path.join(projectDir, dir, 'STATE.md'), 'utf8'));
+        if (!parsed?.frontmatter) continue;
+        sawStateMd = true;
+        if (parsed.frontmatter['session-id'] !== ownId) continue;
+        frontmatter = parsed.frontmatter;
+        break;
+      } catch { /* try the next state dir */ }
+    }
+    if (frontmatter === null) {
+      return { stale: null, skipped: sawStateMd ? 'identity-mismatch' : 'no-state-md' };
+    }
+
+    const startRef = typeof frontmatter['session-start-ref'] === 'string'
+      ? frontmatter['session-start-ref'].trim()
+      : '';
+    if (startRef === '') return { stale: null, skipped: 'no-start-ref' };
+
+    let head = '';
+    try {
+      head = execFileSync('git', ['rev-parse', 'HEAD'], {
+        cwd: projectDir,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+      }).trim();
+    } catch {
+      return { stale: null, skipped: 'git-error' };
+    }
+    if (head === '') return { stale: null, skipped: 'git-error' };
+
+    const facts = { head, session_start_ref: startRef, stale: head !== startRef };
+    if (typeof toolInput.subagent_type === 'string' && toolInput.subagent_type !== '') {
+      facts.subagent_type = toolInput.subagent_type;
+    }
+    return facts;
+  } catch {
+    // Total by construction: no parser, an unreadable state dir, anything else.
+    // Still a RECORD rather than silence — the dispatch WAS on the `worktree`
+    // branch, and a broken probe that emits nothing is indistinguishable from a
+    // probe that had nothing to report (#1424 / HR-105).
+    return { stale: null, skipped: 'probe-error' };
+  }
+}
+
+/**
+ * The operator-facing warning. It names the ACTION, not just the condition —
+ * a warning the coordinator cannot act on is noise (HR-106).
+ *
+ * NO `⚠ ` PREFIX HERE: this text is handed to `emitWarn`, which prefixes it on
+ * both channels it writes (stderr and the `systemMessage` payload). Prefixing
+ * here too produced `⚠ ⚠ …`.
+ *
+ * @param {{head: string, session_start_ref: string}} facts
+ * @returns {string}
+ */
+function staleWorktreeWarning(facts) {
+  const head = facts.head.slice(0, 12);
+  const base = facts.session_start_ref.slice(0, 12);
+  return [
+    `${HOOK_NAME}: STALE WORKTREE BASE (#1413) — this dispatch uses `
+      + `isolation: "worktree", but HEAD (${head}) has moved past this session's `
+      + `session-start-ref (${base}).`,
+    '  The harness bases a new agent worktree on the SESSION-START commit and offers',
+    '  no base-ref field, so the agent will silently get the OLDER code — and its test',
+    '  run is structurally red on top (check-guard-requires-parity compares against',
+    '  `git show HEAD:`, and validate-plugin is vitest\'s globalSetup).',
+    '  DO ONE OF: dispatch this wave IN-PLACE (omit `isolation`) — or verify the base',
+    '  before trusting the agent\'s result:',
+    '    git worktree list --porcelain | awk -v h="$(git rev-parse HEAD)" '
+      + '\'/^worktree /{w=$2} /^HEAD /{if (w ~ /\\.claude\\/worktrees\\/agent-/ && $2 != h) '
+      + 'print "STALE " substr($2,1,12) " " w}\'',
+  ].join('\n');
+}
+
 /**
  * Clip a path for the deny reason without losing the discriminating tail.
  *
@@ -1198,7 +1813,10 @@ export function decide({ input, ledger, ledgerCorrupt, waveKey, knownFiles, coll
   }
 
   const desc = agentDescOf(toolInput);
-  const self = { id, desc, files, at };
+  // #1480 A: the exact dispatch id travels with the entry, so liveness is never
+  // guessed from a description when the harness names the dispatch itself.
+  const useId = exactUseId(input?.tool_use_id);
+  const self = useId === '' ? { id, desc, files, at } : { id, desc, files, at, useId };
 
   // Row 7: ledger existed but was unparseable. Terminal warn — decided here and
   // returned, never emitted mid-flow. SELF-HEALING since the review: the verdict
@@ -1219,13 +1837,51 @@ export function decide({ input, ledger, ledgerCorrupt, waveKey, knownFiles, coll
     ? ledger.agents.filter((a) => a !== null && typeof a === 'object' && typeof a.id === 'string')
     : [];
 
-  // Row 10: same agent re-dispatched (a retry after a failed agent is legitimate).
-  // Replace its record instead of letting it collide with its own earlier self.
-  const others = prior.filter((a) => a.id !== id);
+  // Row 10 (#1480 B4): a predecessor with the SAME agent id is no longer dropped
+  // before the check. Dropping it unconditionally erased the claim of a still
+  // RUNNING agent: [a,b] running, re-dispatched as [b,c], and a third agent on
+  // `a` was allowed while the first run still wrote it. Now:
+  //   - the same `tool_use_id` → the same dispatch evaluated again → replaced;
+  //   - FINISHED (probe true) → pruned below, so a retry after a failed agent
+  //     stays allowed — a failed agent finishes via its `failed` carrier,
+  //     `is_error` or its report;
+  //   - both dispatches carry distinct exact ids and the predecessor is NOT
+  //     finished → an ordinary collision partner (row 11);
+  //   - otherwise no exact statement is possible → it stays as a CLAIM (a third
+  //     agent hitting only its scope still collides) but never collides with
+  //     this retry.
+  // Named ceiling (BV-004): without exact ids a same-id retry cannot tell "my
+  // earlier run is still going" from "it failed", so the retry is allowed while
+  // the earlier claim is kept — the pre-#1480 behaviour for the retry itself,
+  // and a claim a third agent can hit until the earlier run finishes or its TTL
+  // lapses. Revisit-Trigger: a harness without `tool_use_id` in the PreToolUse
+  // payload dispatches a measurable share of this repo's waves.
+  // A predecessor wholly covered by this retry's scope, neither carrying an
+  // exact id, adds nothing but ledger growth — both are resolved through the
+  // same description and this entry is the younger one — so it is superseded.
+  const superseded = (a) => a.id === id && (
+    (useId !== '' && exactUseId(a.useId) === useId)
+    || (useId === '' && exactUseId(a.useId) === '' && desc !== '' && a.desc === desc
+      && Array.isArray(a.files) && a.files.every((f) => files.includes(f)))
+  );
+  const others = prior.filter((a) => !superseded(a));
+
+  // One comparison key per record, unique by construction: several records may
+  // share an agent id now, and `findScopeCollisions` reports equal ids as
+  // duplicates rather than comparing them. The readable id stays the key where
+  // it is unique, so the deny text and every single-record wave are unchanged.
+  const used = new Set([id]);
+  const partners = others.map((entry) => {
+    let key = entry.id;
+    for (let n = 2; used.has(key); n++) key = `${entry.id} #${n}`;
+    used.add(key);
+    const selfClaim = entry.id === id && !(useId !== '' && exactUseId(entry.useId) !== '');
+    return { key, entry, selfClaim };
+  });
 
   const known = new Set(Array.isArray(knownFiles) ? knownFiles : []);
   const agentScopes = [
-    ...others.map((a) => ({ id: a.id, files: promoteDirEntries(a.files, known) })),
+    ...partners.map((p) => ({ id: p.key, files: promoteDirEntries(p.entry.files, known) })),
     { id, files: promoteDirEntries(files, known) },
   ];
 
@@ -1273,28 +1929,35 @@ export function decide({ input, ledger, ledgerCorrupt, waveKey, knownFiles, coll
   // § Liveness — the review's HIGH finding. A collision with an agent that has
   // ALREADY FINISHED is a sequential repair pass, not a race. The probe is called
   // ONLY here, so the transcript is read only on the path that would deny.
-  const byId = new Map(others.map((a) => [a.id, a]));
+  const byKey = new Map(partners.map((p) => [p.key, p]));
   const probe = typeof isFinished === 'function' ? isFinished : () => false;
-  const finishedIds = new Set();
+  const finishedKeys = new Set();
   const live = [];
+  let selfClaims = 0;
   for (const c of mine) {
-    const otherId = c.a === id ? c.b : c.a;
-    const entry = byId.get(otherId);
-    if (entry !== undefined && probe(entry)) {
-      finishedIds.add(otherId);
+    const otherKey = c.a === id ? c.b : c.a;
+    const partner = byKey.get(otherKey);
+    if (partner !== undefined && probe(partner.entry)) {
+      finishedKeys.add(otherKey);
+      continue;
+    }
+    // Row 10: an unfinished same-id claim without exact ids is kept, not collided with.
+    if (partner?.selfClaim === true) {
+      selfClaims++;
       continue;
     }
     live.push(c);
   }
+  const counted = mine.length - selfClaims;
 
   // Row 10a: every colliding prior agent has finished. Allow AND prune their
   // records — leaving them would make the NEXT repair pass pay the transcript
   // scan again for a question already answered.
   if (live.length === 0) {
-    const kept = others.filter((a) => !finishedIds.has(a.id));
+    const kept = partners.filter((p) => !finishedKeys.has(p.key)).map((p) => p.entry);
     return {
       action: 'allow',
-      telemetry: telemetryFor('allow-finished', mine.length),
+      telemetry: finishedKeys.size > 0 ? telemetryFor('allow-finished', counted) : telemetryFor('allow'),
       ledger: {
         waveKey,
         updated: at,
@@ -1307,13 +1970,15 @@ export function decide({ input, ledger, ledgerCorrupt, waveKey, knownFiles, coll
   // Row 11: the one case this hook exists for.
   const shown = live.slice(0, MAX_REPORTED_COLLISIONS);
   const lines = shown.map((c) => {
-    const other = c.a === id ? c.b : c.a;
+    const otherKey = c.a === id ? c.b : c.a;
+    const other = byKey.get(otherKey)?.entry.id ?? otherKey;
+    const earlier = other === id ? ' (an earlier dispatch of the same agent)' : '';
     const ev = Array.isArray(c.evidence) ? c.evidence : [];
     const evShown = ev.slice(0, MAX_EVIDENCE_PER_COLLISION).map(clipPath).join(', ');
     const more = ev.length > MAX_EVIDENCE_PER_COLLISION
       ? ` (+${ev.length - MAX_EVIDENCE_PER_COLLISION} more)`
       : '';
-    return `  • "${id}" ↔ "${other}" [${c.kind}]: ${evShown}${more}`;
+    return `  • "${id}" ↔ "${other}"${earlier} [${c.kind}]: ${evShown}${more}`;
   });
   const omitted = live.length > shown.length ? `\n  (+${live.length - shown.length} further collisions)` : '';
 
@@ -1332,7 +1997,7 @@ export function decide({ input, ledger, ledgerCorrupt, waveKey, knownFiles, coll
 
   // Deliberately NOT persisting the ledger on deny: the dispatch did not happen,
   // so recording it would make the retry-after-fix look like a duplicate.
-  return { action: 'deny', telemetry: telemetryFor('deny', mine.length), reason, suggestion };
+  return { action: 'deny', telemetry: telemetryFor('deny', counted), reason, suggestion };
 }
 
 // ---------------------------------------------------------------------------
@@ -1354,7 +2019,9 @@ async function main() {
 
   const waveKey = waveKeyOf(projectDir, sessionId, readFileSync);
   const knownFiles = listTrackedFiles(projectDir);
-  const isFinished = makeFinishedProbe({ transcriptPath: input.transcript_path });
+  // `selfUseId`: this dispatch's own tool_use may already stand in the transcript
+  // and must not make a finished same-named predecessor look alive (#1480 A).
+  const isFinished = makeFinishedProbe({ transcriptPath: input.transcript_path, selfUseId: input.tool_use_id });
   const ledgerPath = path.join(projectDir, LEDGER_REL);
 
   // The read-modify-write CYCLE, run under the ledger lock below. Everything
@@ -1440,8 +2107,59 @@ async function main() {
     } catch { /* observability is best-effort — it never blocks the decision */ }
   }
 
-  if (verdict.action === 'deny') return emitDeny(verdict.reason, verdict.suggestion);
-  if (verdict.action === 'warn') return emitWarn(verdict.note);
+  // #1413 — the stale-worktree-base warning, also awaited BEFORE the terminal
+  // emit for the same process.exit() reason as the block above. It reads
+  // `verdict` not at all: it can never turn an allow into a deny, and a git or
+  // STATE.md failure resolves to silence rather than to a wrong accusation.
+  //
+  // ROUTED TO THE OPERATOR, not to stderr alone (w3-5): under the exit-0
+  // PreToolUse protocol stderr goes nowhere — `io.mjs:545` calls it the "Debug
+  // channel … Invisible under exit 0" — so the first cut of this check announced
+  // the s18 incident class to a log and to nobody. The visible channel is the
+  // top-level `systemMessage`, i.e. `emitWarn`, which carries NO
+  // `permissionDecision` and therefore still means ALLOW (io.mjs § "which is
+  // precisely what keeps warn non-blocking").
+  //
+  // The note is CARRIED to the single terminal emit below rather than emitted
+  // here, because `emitWarn` calls `process.exit(0)` and never returns — warning
+  // inline would terminate the process before a collision DENY could be emitted,
+  // flipping a block into an allow (§ stdout discipline, the same reason
+  // `decide()` is pure).
+  //
+  // `null` here means "not a worktree dispatch" and stays silent; ANY other
+  // shape is emitted, including the `{stale: null, skipped: …}` non-measurements
+  // (#1424). The warning still fires on `stale === true` alone — a skipped probe
+  // accuses nobody.
+  const worktreeBase = await worktreeBaseFacts(input, projectDir, sessionId);
+  let staleNote = null;
+  if (worktreeBase !== null) {
+    if (worktreeBase.stale === true) staleNote = staleWorktreeWarning(worktreeBase);
+    try {
+      const { emitEvent, sessionAttribution } = await import(
+        pathToFileURL(path.join(PLUGIN_ROOT, 'scripts', 'lib', 'events.mjs')).href
+      );
+      await emitEvent(
+        WORKTREE_BASE_EVENT,
+        { hook: HOOK_NAME, ...worktreeBase, ...sessionAttribution(projectDir) },
+        { repoRoot: projectDir }
+      );
+    } catch { /* observability is best-effort — it never blocks the decision */ }
+  }
+
+  // ONE terminal emit, with the #1413 note folded in where a visible channel is
+  // free. On DENY the dispatch does not happen and `systemMessage` already
+  // carries the ⛔ headline, so the note stays on the debug channel — a stale
+  // base is moot for a dispatch that was just blocked.
+  if (verdict.action === 'deny') {
+    if (staleNote !== null) {
+      try { console.error(`⚠ ${staleNote}`); } catch { /* stderr may be closed */ }
+    }
+    return emitDeny(verdict.reason, verdict.suggestion);
+  }
+  if (verdict.action === 'warn') {
+    return emitWarn(staleNote === null ? verdict.note : `${verdict.note}\n\n${staleNote}`);
+  }
+  if (staleNote !== null) return emitWarn(staleNote);
   return emitAllow();
 }