session-orchestrator 5.3.0 → 5.4.0

package/scripts/site-numbers.mjs

@@ -91,6 +91,13 @@
  * silent skip — a generator that quietly stops filling a surface is the exact
  * failure this file exists to end.
  *
+ * ## The sitemap `<lastmod>` (`site/sitemap.xml`, #1484)
+ *
+ * `--write` changes what `/` and `/de` SHOW, so it also dates them in the
+ * sitemap: `lastmod` becomes max(lastmod, the page's own `counted-at` cell).
+ * `--check` reports a `lastmod` older than that cell as drift. Rule, mapping and
+ * reasons: `SITEMAP_PAGES`.
+ *
  * Exit codes (`.claude/rules/cli-design.md`):
  *   0 — no drift (--check) / files updated or already current (--write)
  *   1 — drift found (--check), or a contract violation in either mode
@@ -99,7 +106,7 @@
  */
 
 import { readFileSync, writeFileSync, readdirSync, existsSync, statSync } from 'node:fs';
-import { join, resolve, relative } from 'node:path';
+import { join, resolve, relative, sep } from 'node:path';
 import { execFileSync } from 'node:child_process';
 
 import { writeStdoutLineSync, writeJsonAtomicSync } from './lib/io.mjs';
@@ -963,6 +970,118 @@ export function syncCensusBlocks(siteDir, values, { write = false } = {}) {
   return CENSUS_BLOCK_FILES.map((file) => syncCensusBlock(siteDir, values, { write, file }));
 }
 
+// ---------------------------------------------------------------------------
+// The sitemap <lastmod> in site/sitemap.xml (#1484)
+// ---------------------------------------------------------------------------
+
+/** The sitemap, relative to the SITE directory. */
+export const SITEMAP_FILE = 'sitemap.xml';
+
+/**
+ * Every page ↔ sitemap `<loc>`, explicitly.
+ *
+ * Why the sitemap is this generator's business: `--write` changes what `/` and
+ * `/de` show (version card, number cards, "Counted on … at commit …"), and the
+ * release that ran it left their `lastmod` behind. Measured 2026-10-01: `/`
+ * claimed 2026-09-08 while its content was counted 2026-09-22.
+ *
+ * The rule takes no second clock. A page's `counted-at` cell is the date this
+ * script last changed that page — `rewrite()` stamps every cell in one pass —
+ * so `lastmod` becomes max(lastmod, that cell), and never moves backwards. A
+ * page without a `counted-at` cell (the guide and the legal pages, whose only
+ * cell is the header version) is never dated: a version bump in a page header
+ * is not a content change.
+ *
+ * Unknown either way is an ERROR, never a skip (the `METRIC_IDS` rule): a
+ * sitemap `<loc>` missing here would never be dated, and a page carrying cells
+ * that is missing here would drift unseen.
+ */
+export const SITEMAP_PAGES = Object.freeze([
+  { page: 'index.html', loc: 'https://session-orchestrator.com/' },
+  { page: 'de/index.html', loc: 'https://session-orchestrator.com/de' },
+  { page: 'guide/index.html', loc: 'https://session-orchestrator.com/guide' },
+  { page: 'impressum/index.html', loc: 'https://session-orchestrator.com/impressum' },
+  { page: 'datenschutz/index.html', loc: 'https://session-orchestrator.com/datenschutz' },
+]);
+
+const URL_BLOCK_RE = /<url>([\s\S]*?)<\/url>/g;
+const ISO_DAY_RE = /^\d{4}-\d{2}-\d{2}$/;
+
+/**
+ * Judge (and optionally rewrite) the `<lastmod>` of every sitemap entry. Only the
+ * date text of an entry that moves is rewritten; the rest of the file is handed
+ * back byte-for-byte.
+ *
+ * @param {string} siteDir
+ * @param {Array<{page:string, metrics:string[], countedAt:string|null}>} pages
+ *   every HTML file under `siteDir` carrying metric cells: its site-relative path
+ *   (`/`-separated), its metric ids, and its `counted-at` cell as it stands AFTER
+ *   this run (`null` when it has none)
+ * @param {{write?: boolean}} [opts]
+ * @returns {{present:boolean, file:string, errors?:string[],
+ *            drift?:Array<{loc:string, line:number, actual:string, expected:string}>,
+ *            written?:boolean}}
+ */
+export function syncSitemapLastmod(siteDir, pages, { write = false } = {}) {
+  const abs = join(siteDir, SITEMAP_FILE);
+  // Absent file: like the census blocks, not this generator's to create.
+  if (!existsSync(abs) || !statSync(abs).isFile()) return { present: false, file: abs };
+
+  const errors = [];
+  const dated = new Map(); // loc → the counting date its page carries
+  for (const p of pages) {
+    const entry = SITEMAP_PAGES.find((e) => e.page === p.page);
+    if (!entry) {
+      errors.push(
+        `${p.page} carries metric cells but has no sitemap mapping — known pages: ` +
+          SITEMAP_PAGES.map((e) => e.page).join(', '),
+      );
+    } else if (p.countedAt !== null) {
+      if (ISO_DAY_RE.test(p.countedAt)) dated.set(entry.loc, p.countedAt);
+      else errors.push(`${p.page}: counted-at cell "${p.countedAt}" is not a YYYY-MM-DD date`);
+    } else if (p.metrics.some((m) => m !== 'version')) {
+      // Counted cells with no stamp to date them by: their changes would never
+      // reach the sitemap.
+      errors.push(`${p.page} carries counted cells but no counted-at cell — its lastmod cannot be dated`);
+    }
+  }
+
+  const text = readFileSync(abs, 'utf8');
+  const drift = [];
+  const seen = new Set();
+  const next = text.replace(URL_BLOCK_RE, (block, inner, offset) => {
+    const loc = /<loc>([^<]*)<\/loc>/.exec(inner)?.[1].trim();
+    if (loc === undefined || !SITEMAP_PAGES.some((e) => e.loc === loc)) {
+      errors.push(
+        `unknown sitemap <loc> "${loc ?? '(none)'}" — known: ${SITEMAP_PAGES.map((e) => e.loc).join(', ')}`,
+      );
+      return block;
+    }
+    seen.add(loc);
+    const lm = /<lastmod>([^<]*)<\/lastmod>/.exec(block);
+    if (!lm || !ISO_DAY_RE.test(lm[1])) {
+      errors.push(`<lastmod> of ${loc} is missing or not a YYYY-MM-DD date`);
+      return block;
+    }
+    const date = dated.get(loc);
+    // ISO days compare as strings. Never backwards: a lastmod a hand edit dated
+    // after the count stays.
+    if (date === undefined || date <= lm[1]) return block;
+    drift.push({ loc, line: lineOf(text, offset + lm.index), actual: lm[1], expected: date });
+    return `${block.slice(0, lm.index)}<lastmod>${date}</lastmod>${block.slice(lm.index + lm[0].length)}`;
+  });
+  for (const loc of dated.keys()) {
+    if (!seen.has(loc)) errors.push(`${loc} carries a counted-at cell but has no sitemap <url> entry`);
+  }
+
+  const out = { present: true, file: abs, errors, drift, written: false };
+  if (write && errors.length === 0 && next !== text) {
+    writeFileSync(abs, next, 'utf8');
+    out.written = true;
+  }
+  return out;
+}
+
 // ---------------------------------------------------------------------------
 // Markup
 // ---------------------------------------------------------------------------
@@ -1134,6 +1253,7 @@ function printHelp() {
   writeStdoutLineSync('  --check        (default) report drift, change nothing; exit 1 on drift');
   writeStdoutLineSync(`  --write        rewrite the cells in place; also refreshes ${CENSUS_FILE.join('/')}`);
   writeStdoutLineSync('                 (skipped when --site points outside the repo\'s own site/)');
+  writeStdoutLineSync(`                 and dates each counted page's <lastmod> in <site>/${SITEMAP_FILE}`);
   writeStdoutLineSync('  --json         machine-readable envelope on stdout');
   writeStdoutLineSync('  --site <dir>   site directory (default <repo-root>/site)');
   writeStdoutLineSync('  --version      print the package version');
@@ -1208,12 +1328,18 @@ export function main(argv = process.argv.slice(2), env = {}) {
   // the source producing it is corrupt, and writing the rest would be a
   // partial write reported as success.
   let rejectedTotal = 0;
+  // Every page carrying cells, for the sitemap's <lastmod> (syncSitemapLastmod).
+  const pages = [];
 
-  for (const abs of files) {
-    // Repo-relative when the file is inside the repo; absolute otherwise (a
-    // `--site` fixture in $TMPDIR would otherwise render as ../../../../var/...).
+  // Repo-relative when the file is inside the repo; absolute otherwise (a
+  // `--site` fixture in $TMPDIR would otherwise render as ../../../../var/...).
+  const display = (abs) => {
     const r = relative(root, abs);
-    const rel = r && !r.startsWith('..') ? r : abs;
+    return r && !r.startsWith('..') ? r : abs;
+  };
+
+  for (const abs of files) {
+    const rel = display(abs);
     const html = readFileSync(abs, 'utf8');
     const spans = inspectHtml(html, values);
     spanTotal += spans.length;
@@ -1250,6 +1376,16 @@ export function main(argv = process.argv.slice(2), env = {}) {
       }
     }
 
+    if (spans.length > 0) {
+      const stamp = spans.find((s) => s.metric === 'counted-at');
+      pages.push({
+        page: relative(siteDir, abs).split(sep).join('/'),
+        metrics: spans.map((s) => s.metric),
+        // As the page stands AFTER this run: a written file carries every value.
+        countedAt: stamp ? (written > 0 ? values['counted-at'] : stamp.actual.trim()) : null,
+      });
+    }
+
     report.push({
       file: rel,
       spans: spans.length,
@@ -1294,6 +1430,17 @@ export function main(argv = process.argv.slice(2), env = {}) {
   // read `llmsFull`; `censusBlocks` below carries all of them.
   const llms = censusBlocks[CENSUS_BLOCK_FILES.indexOf(LLMS_FULL_FILE)];
 
+  // The sitemap <lastmod>: a date older than the counting stamp on its page is
+  // drift, like a stale number. Written from the pages as they stand after the
+  // loop above, so page and sitemap come from the same run.
+  const sitemap = syncSitemapLastmod(siteDir, pages, { write: args.write });
+  const sitemapRel = display(sitemap.file);
+  for (const e of sitemap.errors ?? []) {
+    stderr(`Error: ${sitemapRel}: ${e}`);
+    contractTotal += 1;
+  }
+  driftTotal += sitemap.drift?.length ?? 0;
+
   // The named silent-failure class: a generator that matches nothing, changes
   // nothing, and reports success. Zero spans means the markup contract is not in
   // the page — that is a defect, in BOTH modes, never a no-op.
@@ -1390,6 +1537,13 @@ export function main(argv = process.argv.slice(2), env = {}) {
             stale: b.stale === true,
             written: b.written === true,
           })),
+          sitemap: {
+            file: sitemap.present ? sitemapRel : null,
+            present: sitemap.present,
+            errors: sitemap.errors ?? [],
+            drift: sitemap.drift ?? [],
+            written: sitemap.written === true,
+          },
           censusWritten,
           ok,
         },
@@ -1404,6 +1558,7 @@ export function main(argv = process.argv.slice(2), env = {}) {
         censusBlocks
           .map((b, i) => (b.written ? ` + ${CENSUS_BLOCK_FILES[i]}` : ''))
           .join('') +
+        (sitemap.written ? ` + ${SITEMAP_FILE}` : '') +
         (censusWritten ? ` + ${CENSUS_FILE.join('/')}` : ''),
     );
   } else {
@@ -1416,6 +1571,9 @@ export function main(argv = process.argv.slice(2), env = {}) {
       }
     }
     for (const l of censusDriftLines) stdout(l);
+    for (const d of sitemap.drift ?? []) {
+      stdout(`DRIFT ${sitemapRel}:${d.line} lastmod ${d.loc}: sitemap says "${d.actual}", page counted "${d.expected}"`);
+    }
     stdout(
       driftTotal === 0 && !noSpans && contractTotal === 0
         ? `site-numbers: ${spanTotal} metric cell(s) current across ${files.length} file(s)`

package/scripts/sweep-expired-learnings.mjs

@@ -37,6 +37,9 @@
  *   --entries PATH    JSONL sidecar holding the caller's next store generation.
  *                      PRUNE ONLY. Must exist, parse cleanly, and hold at least
  *                      one record — absent/malformed/empty all exit 1 untouched.
+ *                      A NEW record (its `id` not in the store) must pass strict
+ *                      `validateLearning()`, else exit 1 untouched (GH#69);
+ *                      records already in the store keep the tolerant path.
  *                      Omitted ⇒ a pure prune+consolidate pass over the on-disk
  *                      store.
  *   --file PATH       Learnings store (default: .orchestrator/metrics/learnings.jsonl)
@@ -61,14 +64,18 @@
  *
  * Exit codes:
  *   0  Success (including no-op when nothing is archive-eligible)
- *   1  Usage/input error (bad flag/value, flag used in the wrong mode, or an
- *      absent/malformed/empty `--entries` sidecar)
+ *   1  Usage/input error (bad flag/value, flag used in the wrong mode, an
+ *      absent/malformed/empty `--entries` sidecar, or a NEW `--entries` record
+ *      that fails strict schema validation — dry run and apply alike)
  *   2  Sweep/prune error (I/O or validation failure inside the lib)
  */
 
 import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { isDeepStrictEqual } from 'node:util';
 import { sweepExpiredLearnings, pruneLearnings } from './lib/learnings/expiry-sweep.mjs';
 import { readLearnings } from './lib/learnings/io.mjs';
+import { validateLearning } from './lib/learnings/schema.mjs';
 import { emitEvolveCompleted } from './lib/learnings/evolve-telemetry.mjs';
 
 const DEFAULT_FILE = '.orchestrator/metrics/learnings.jsonl';
@@ -91,11 +98,14 @@ Options:
   --json            Emit a single machine-parseable JSON summary line
   --grace-days N    Days past expiry before archiving (default: ${DEFAULT_GRACE_DAYS}); sweep only
   --entries PATH    JSONL sidecar with the next store generation; prune only.
-                    Must exist, parse cleanly, and hold >= 1 record
+                    Must exist, parse cleanly, and hold >= 1 record; a NEW
+                    record (id not in the store) must pass strict schema
+                    validation, else exit 1 with nothing written
   --file PATH       Learnings store (default: ${DEFAULT_FILE})
   --archive PATH    Archive sidecar (default: ${DEFAULT_ARCHIVE})
 
-Exit codes:  0 success  1 usage/input error  2 sweep/prune error
+Exit codes:  0 success  1 usage/input error (incl. an invalid new --entries record)
+             2 sweep/prune error
 `
   );
 }
@@ -184,7 +194,8 @@ function parseArgs(argv) {
       args.skipped = typeof raw === 'string' ? raw.split(',').filter((s) => s.length > 0) : [];
       args.telemetryExplicit = true;
     } else if (a === '--repo-root') {
-      args.repoRoot = argv[++i];
+      // Absolute on purpose: emitEvent refuses a relative root (#1468).
+      args.repoRoot = path.resolve(argv[++i]);
       args.telemetryExplicit = true;
     } else if (a === '--help' || a === '-h') {
       printHelp();
@@ -308,6 +319,45 @@ async function loadEntriesSidecar(entriesPath) {
   return read.entries;
 }
 
+/**
+ * Strict-validate every `--entries` record the store does not already hold.
+ *
+ * `pruneLearnings()` rewrites through `rewriteLearnings()`, which runs
+ * `legacyTolerant` so records ALREADY in the store (legacy shapes, EventDrop
+ * #386) survive a round-trip. Without this gate the same tolerance admitted
+ * NEW records too — a sidecar record with `scope: "src/app/x.tsx"` and no
+ * `created_at`/`expires_at` was written (GH#69). New = its `id` is absent from
+ * the store; an id-less record counts as known only when an id-less store
+ * record is deep-equal to it (the carry-through case — linear scan over the
+ * id-less subset, fine while such records stay rare; revisit if a store holds
+ * hundreds of them). Runs before any write, in dry run and apply alike.
+ *
+ * @param {object[]} entries - the parsed `--entries` generation
+ * @param {string} filePath - the learnings store
+ */
+async function rejectInvalidNewRecords(entries, filePath) {
+  let store;
+  try {
+    ({ entries: store } = await readLearnings(filePath));
+  } catch (err) {
+    process.stderr.write(`sweep-expired-learnings: prune failed: cannot read ${filePath}: ${err.message}\n`);
+    process.exit(2);
+  }
+  const idOf = (e) => (typeof e?.id === 'string' && e.id.length > 0 ? e.id : null);
+  const storeIds = new Set(store.map(idOf).filter((id) => id !== null));
+  const storeIdless = store.filter((e) => idOf(e) === null);
+  for (const entry of entries) {
+    const id = idOf(entry);
+    const known = id !== null ? storeIds.has(id) : storeIdless.some((s) => isDeepStrictEqual(s, entry));
+    if (known) continue;
+    try {
+      validateLearning(entry);
+    } catch (err) {
+      usageError(`--entries: new record ${id ?? '(no id)'} is invalid: ${err.message} — nothing written`);
+    }
+  }
+}
+
 /**
  * Decision-driven prune + consolidate + rewrite (issue #1017).
  *
@@ -315,6 +365,7 @@ async function loadEntriesSidecar(entriesPath) {
  */
 async function runPrune(args) {
   const entries = args.entries === null ? undefined : await loadEntriesSidecar(args.entries);
+  if (entries !== undefined) await rejectInvalidNewRecords(entries, args.file);
 
   let result;
   try {

package/scripts/sweep-expired-rules.mjs

@@ -29,6 +29,7 @@
  *      per-file error on the `--apply` path)
  */
 
+import path from 'node:path';
 import { emitEvent } from './lib/events.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
 import {
@@ -100,7 +101,7 @@ export function parseArgs(argv) {
     } else if (a === '--repo-root') {
       const raw = argv[++i];
       if (typeof raw !== 'string' || raw.length === 0) usageError('--repo-root requires a path');
-      args.repoRoot = raw;
+      args.repoRoot = path.resolve(raw);
     } else if (a === '--learnings') {
       const raw = argv[++i];
       if (typeof raw !== 'string' || raw.length === 0) usageError('--learnings requires a path');

package/scripts/validate-plugin.mjs

@@ -513,6 +513,13 @@ runStrictShAdvisory();
 // session-end tail phases from their dispatcher.
 if (runCheck('check-skill-links.mjs') !== 0) checkFailed = 1;
 
+// BLOCKING (#1446 / GH#69): instruction prose that tells an agent to write
+// `learnings.jsonl` with a shell `>` / `>>`. The store is gitignored, so a bad
+// write has no VCS restore; the sanctioned writers (`apply-session-learnings.mjs`,
+// `sweep-expired-learnings.mjs --prune`) validate, snapshot `.bak` and archive.
+process.stdout.write('\n');
+if (runCheck('check-learnings-shell-writes.mjs') !== 0) checkFailed = 1;
+
 // WARN-only: a state-mutating `git` call in tests/ that names no target resolves
 // its destination from the ambient cwd (or an inherited GIT_DIR) — the 2026-08-19
 // incident, where fixture commits, a fixture remote and a fixture identity landed

package/scripts/vault-integration-watcher.mjs

@@ -35,6 +35,7 @@ import { getCrossRepoProjects, getConfinementRoot } from './lib/config/cross-rep
 import { validatePathInsideProject } from './lib/path-utils.mjs';
 import { resolveRepoSpec, redactUrlCredentials } from './lib/vcs-repo-spec.mjs';
 import { expandTilde } from './lib/common.mjs';
+import { shellQuote } from './lib/sh-quote.mjs';
 
 // ── Argument parsing ──────────────────────────────────────────────────────────
 
@@ -285,7 +286,7 @@ function buildTickBody(issueMap, depIds, verdict, streak, date) {
 function buildFlipBody(repos) {
   // Defense-in-depth: regex+confinement upstream already filter, but shell-quote here
   // makes the embedded bash safe under any future bypass.
-  const repoList = repos.map(r => `'${r.replace(/'/g, "'\\''")}'`).join(' ');
+  const repoList = repos.map(shellQuote).join(' ');
   // The sed/add/commit one-liner targets the project-instruction file. Most
   // ecosystem repos use CLAUDE.md, but Codex-CLI repos use AGENTS.md as a
   // transparent alias — see skills/_shared/instruction-file-resolution.md.

package/scripts/vault-mirror.mjs

@@ -18,7 +18,7 @@
  *   2 — filesystem error
  *
  * Output: one JSON line per action on stdout:
- *   {"action":"created|updated|skipped-noop|skipped-handwritten|skipped-collision-resolved|skipped-invalid|skipped-quality-low","path":"...","kind":"...","id":"..."}
+ *   {"action":"created|updated|skipped-noop|skipped-handwritten|skipped-collision-resolved|skipped-invalid|skipped-quality-low|skipped-abandoned|skipped-duplicate-session","path":"...","kind":"...","id":"..."}
  *
  * Idempotency rules:
  *   1. File does not exist → create.
@@ -48,22 +48,27 @@
  * Part of session-orchestrator vault-mirror (Issue #14).
  */
 
-import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { basename, resolve } from 'node:path';
 import { createInterface } from 'node:readline';
 import { createReadStream } from 'node:fs';
 
-import { processLearning, processSession, getMaskerStats } from './lib/vault-mirror/process.mjs';
+import {
+  processLearning,
+  processSession,
+  getMaskerStats,
+  emitAction,
+} from './lib/vault-mirror/process.mjs';
 import { emitMirrorEvent, emitMirrorRunEvent } from './lib/vault-mirror/telemetry.mjs';
 import { emitEvent } from './lib/events.mjs';
 import { autoCommitVaultMirror } from './lib/vault-mirror/auto-commit.mjs';
 import { parseColumnFlags, CliFlagError } from './lib/cli-flags.mjs';
 import { resolveRepoNamespace } from './lib/vault-mirror/namespace.mjs';
-import { resolveCanonicalSuffixes } from './lib/named-vault-resolver.mjs';
+import { checkCanonicalVault, describeOriginForLog, normalizeRemote } from './lib/named-vault-resolver.mjs';
 import { loadOwnerConfig } from './lib/owner-yaml.mjs';
 import { canonicalizeSessions } from './lib/sessions-canonical.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
+import { expandTilde } from './lib/common.mjs';
 
 // ── Canonical-vault helpers (#600 D2 / #607 D2) ────────────────────────────────
 // These are module-level (above the CLI bootstrap) so the module is import-safe
@@ -85,7 +90,7 @@ export function _resolveCanonicalSuffix(envValue) {
   return envValue && envValue.trim() ? envValue.trim() : '/agents/vault';
 }
 
-// Kept for documentation; the guard now uses resolveCanonicalSuffixes() which
+// Kept for documentation; the guard now uses checkCanonicalVault() which
 // generalises this to N suffixes. The `_` prefix satisfies the no-unused-vars rule.
 const _CANONICAL_VAULT_SUFFIX = _resolveCanonicalSuffix(
   process.env.VAULT_MIRROR_CANONICAL_SUFFIX,
@@ -93,18 +98,14 @@ const _CANONICAL_VAULT_SUFFIX = _resolveCanonicalSuffix(
 
 /**
  * Normalize a git remote URL to a host/path tail for canonical-suffix matching
- * (#607 D2 — exported for unit tests). Strips `.git`, the `git@host:` / scheme
- * prefixes, and trailing slashes.
+ * (#607 D2 — exported for unit tests). Since #1450 the ONE implementation is
+ * `normalizeRemote` in lib/named-vault-resolver.mjs, shared with the board
+ * writer's guard; this name is kept for the existing test imports.
  * @param {string} url
  * @returns {string}
  */
 export function _normalizeRemote(url) {
-  return String(url ?? '')
-    .trim()
-    .replace(/\.git$/, '')
-    .replace(/^git@([^:]+):/, '$1/')
-    .replace(/^[a-z]+:\/\//, '')
-    .replace(/\/+$/, '');
+  return normalizeRemote(url);
 }
 
 // ── Mirror telemetry (#1116) ──────────────────────────────────────────────────
@@ -235,7 +236,11 @@ if (flagValues.help === true) {
   process.exit(0);
 }
 
-const vaultDir = flagValues['vault-dir'];
+// Expand a leading `~` before anything touches the path: owner.yaml `vault-dirs:` /
+// `paths.vault-dir` and the committed Session Config all accept `~/…`, and a quoted
+// `--vault-dir "~/…"` reaches us literally. `resolve('~/x')` would yield `<cwd>/~/x`
+// and the existsSync check below would abort with `missing-vault-dir` (agents/vault#319).
+const vaultDir = expandTilde(flagValues['vault-dir']);
 const source = flagValues.source;
 const kind = flagValues.kind;
 const dryRun = flagValues['dry-run'] === true;
@@ -323,6 +328,21 @@ if (kind !== 'learning' && kind !== 'session') {
 // imports) so they are import-safe and unit-testable; see _resolveCanonicalSuffix
 // / _normalizeRemote there (#607 D2).
 
+/**
+ * Render a CLI path flag for a stderr line as its basename only (#1479).
+ *
+ * This CLI's stderr lands in CI logs and session transcripts, and an absolute
+ * `--vault-dir` / `--source` carries the operator's home directory — the
+ * owner-leakage class `.claude/rules/security.md` § Owner-Privacy guards. The
+ * basename still says WHICH value was wrong; the caller passed the full path
+ * and already knows it.
+ * @param {string} p
+ * @returns {string}
+ */
+function pathForLog(p) {
+  return `.../${basename(String(p ?? ''))}`;
+}
+
 // ── Run-level accounting + run close-out (#1147) ──────────────────────────────
 //
 // Deliberately OUTSIDE main(): the run event's whole contract is that it is
@@ -430,32 +450,29 @@ async function main() {
   // are all `0`, and `aborted` is what makes that zero readable as "never
   // started" rather than "ran over an empty source".
   if (!existsSync(resolve(vaultDir))) {
-    process.stderr.write(`vault-mirror: vault-dir not found: ${vaultDir}\n`);
+    process.stderr.write(`vault-mirror: vault-dir not found: ${pathForLog(vaultDir)}\n`);
     await finishRun('missing-vault-dir');
     process.exit(2);
   }
 
-  if (process.env.VAULT_MIRROR_SKIP_CANONICAL_CHECK !== '1') {
-    const res = spawnSync('git', ['-C', resolve(vaultDir), 'remote', 'get-url', 'origin'], {
-      encoding: 'utf8',
-    });
-    const canonicalSuffixes = resolveCanonicalSuffixes({
-      ownerConfig: loadOwnerConfig().config,
-      env: process.env,
-    });
-    const ok = res.status === 0 && canonicalSuffixes.some((s) => _normalizeRemote(res.stdout).endsWith(s));
-    if (!ok) {
-      const got = res.status === 0 ? res.stdout.trim() : 'no git origin';
-      process.stderr.write(
-        `vault-mirror: refusing to mirror — "${vaultDir}" is not the canonical Meta-Vault (expected git origin ending in one of: ${canonicalSuffixes.join(', ')}; got ${got})\n`,
-      );
-      await finishRun('vault-not-canonical');
-      process.exit(2);
-    }
+  // The check itself — origin probe, suffix match, the SKIP_CANONICAL_CHECK
+  // escape hatch — is the shared `checkCanonicalVault` (#1450), the same one the
+  // board writer applies, so the two vault writers cannot drift apart again.
+  const canonical = checkCanonicalVault({
+    vaultDir: resolve(vaultDir),
+    ownerConfig: loadOwnerConfig().config,
+    env: process.env,
+  });
+  if (!canonical.ok) {
+    process.stderr.write(
+      `vault-mirror: refusing to mirror — vault is not the canonical Meta-Vault (expected git origin ending in one of: ${canonical.expected.join(', ')}; got ${describeOriginForLog(canonical.got) || 'no git origin'})\n`,
+    );
+    await finishRun('vault-not-canonical');
+    process.exit(2);
   }
 
   if (!existsSync(resolve(source))) {
-    process.stderr.write(`vault-mirror: source file not found: ${source}\n`);
+    process.stderr.write(`vault-mirror: source file not found: ${pathForLog(source)}\n`);
     await finishRun('missing-source');
     process.exit(2);
   }
@@ -654,18 +671,27 @@ async function main() {
       if (isIdentifiable(entry) && !survivors.has(entry)) {
         // A losing duplicate: an earlier line whose `session_id` a LATER line
         // in this same batch supersedes or overwrites (crash-recovery
-        // re-append, #1068 stub/supersede pair). No dispatch, no stdout line,
-        // no tally for it — the winning occurrence (dispatched below, at its
-        // own position) already produces the ONE note this physical session
-        // gets. BV-004 ceiling: `runState.total` still counts this raw line,
-        // so `created+updated+skipped+failed` no longer partitions `total`
-        // for a `--kind session` run that collapsed at least one duplicate —
-        // no test pins that invariant for session kind (only for `learning`,
-        // where duplicates are not collapsed), and a partially-written vault
-        // from a batch that could not be fully deduped is the worse failure
-        // mode. Revisit with a dedicated telemetry action if an operator ever
-        // needs to name WHICH lines were collapsed, not just how many notes
-        // were written.
+        // re-append, #1068 stub/supersede pair). Never dispatched — the winning
+        // occurrence (dispatched below, at its own position) produces the ONE
+        // note this physical session gets. It is still ACCOUNTED for (#1291):
+        // `skipped-duplicate-session` goes through the same per-entry path as
+        // every other skip (stdout line + per-entry ledger record, no `path`
+        // because no target file exists for it) and into the tally, so
+        // `created+updated+skipped+failed === total` partitions a `--kind
+        // session` run that collapsed duplicates, and the ledger names WHICH
+        // lines were collapsed, not just how many notes were written.
+        tally(
+          await emitAction({
+            action: 'skipped-duplicate-session',
+            path: null,
+            kind,
+            id: entry.session_id,
+            vaultDir: ctx.vaultDir,
+            meta: { line: sessionLineNums[i] },
+            line: sessionLineNums[i],
+            dryRun,
+          }),
+        );
         continue;
       }
       await dispatchEntry(entry, sessionLineNums[i]);

package/scripts/wave-scope-binding.mjs

@@ -37,6 +37,7 @@
  */
 
 import { parseArgs } from 'node:util';
+import path from 'node:path';
 import { attributionForRecord, emitEvent } from './lib/events.mjs';
 import { MANIFEST_SESSION_KEYS } from './lib/session-identity/own-session.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
@@ -109,7 +110,7 @@ async function main(argv) {
     return;
   }
 
-  const repoRoot = parsed.values['repo-root'] ?? process.cwd();
+  const repoRoot = path.resolve(parsed.values['repo-root'] ?? process.cwd());
   const binding = resolveBinding(repoRoot);
 
   if (Object.keys(binding).length === 0) {

package/skills/_shared/config-reading.md

@@ -133,14 +133,14 @@ Learnings live exclusively in `.orchestrator/metrics/learnings.jsonl`. The pre-`
 
 The learning lifecycle states are:
 
-- **Created**: `confidence: 0.5`, `expires_at`: current date + `learning-expiry-days` (default: 30)
-- **Confirmed** (same type+subject seen again): `confidence += 0.15` (cap 1.0), `expires_at` reset
+- **Created**: `confidence: 0.5`, `expires_at` = `created_at` + a per-TYPE TTL — `deriveExpiresAt(created_at, type)` with `LEARNING_TTL_DAYS[type] ?? LEARNING_TTL_DAYS.default` (`scripts/lib/learnings/schema.mjs`; 30–90 days per type, 60 for an unknown type). A caller-supplied `expires_at` is kept. `learning-expiry-days` does NOT set it: `scripts/lib/config.mjs` still parses that key (default 30), but no script or hook reads the parsed value — it survives only in skill prose (the `/evolve` Review-mode *Extend* action).
+- **Confirmed** (same type+subject seen again): `confidence += 0.15` (cap 1.0), `expires_at` reset to `deriveExpiresAt(now, type)`
 - **Contradicted** (evidence against): `confidence -= 0.2` — do NOT reset `expires_at` (let the learning decay naturally if contradicted)
 - **Decayed** (untouched this session): `confidence -= learning-decay-rate` (from Session Config, default `0.05`). Applied at session-end after touched-set update, before prune. Clamped to 0.0. Does NOT reset `expires_at`.
 - **Expired**: `expires_at < current date` — removed on next write
 - **Dead**: `confidence <= 0.0` — removed on next write
 
-**Expiration check semantics:** Compare `expires_at` by date portion only (ignore time-of-day) to avoid intra-day jitter. When writing `expires_at`, set it to `<current_date>T00:00:00Z + learning-expiry-days` (midnight UTC).
+**Expiration check semantics:** The code compares full timestamps, not dates: `pruneLearnings()` (`scripts/lib/learnings/expiry-sweep.mjs`) archives when `expires_at < now`; the time-driven sweep archives only after a 14-day grace window past `expires_at`. When writing `expires_at`, derive it with `deriveExpiresAt()` (full ISO timestamp, no midnight rounding) — never from `learning-expiry-days`.
 
 **Confidence bounds enforcement:** After EVERY increment or decrement, clamp confidence to [0.0, 1.0]. A learning at 0.95 confirmed becomes 1.0 (not 1.10). A learning at 0.1 contradicted becomes 0.0 and is pruned.