session-orchestrator 5.3.0 → 5.5.0

package/hooks/pre-task-scope-disjoint.mjs

@@ -76,7 +76,24 @@
  *      real background-batch collision through. Completion arrives later as a
  *      `<task-notification>` record carrying `<tool-use-id>toolu_…</tool-use-id>`
  *      and `<status>completed</status>` (measured: launch 14:14:26.768 →
- *      notification 14:24:39.360, ten minutes later).
+ *      notification 14:24:39.360, ten minutes later). Any TERMINAL status
+ *      finishes the id, not only `completed` — see {@link TERMINAL_STATUS_RE}.
+ *      #1455: a 429'd agent notified `failed`, was resumed via SendMessage
+ *      (new tool-use-id), and its original id never finished → permanent deny.
+ *      Only a HARNESS-WRITTEN carrier record counts (#1459 Pkt 2 Rest,
+ *      {@link notificationCarrierText}): a complete block inside a `tool_result`
+ *      (a `Read` of a fixture), assistant text or a typed prompt is a forgery
+ *      that would false-ALLOW an overlap with a still-running agent.
+ *   c) EXACT ID, POSITIVE PROOF, RESUME (#1480, #1459 P1). A ledger entry keeps
+ *      its dispatch's PreToolUse `tool_use_id` as `useId`, and liveness is
+ *      looked up by THAT id; the description is only the fallback for entries
+ *      without one, the ledger `id` never (B3). A dispatch finishes only on
+ *      positive evidence — a terminal carrier, `is_error`, or a result in
+ *      {@link RESULT_COMPLETION_FORMS}; any other result form is "unknown",
+ *      i.e. no evidence (B2, row 13). A `SendMessage` to the dispatch's task id
+ *      re-opens it until a terminal carrier for the dispatch, that SendMessage or
+ *      the task id follows — a resumed agent is running, not done (#1459 P1;
+ *      {@link buildLivenessIndex}).
  *
  * COST CONTAINMENT: the transcript is read ONLY when a collision has already
  * been found — i.e. on the path that is about to deny. The 99 % no-collision
@@ -84,8 +101,9 @@
  * costs 78 ms to read + 129 ms to scan; a typical one is 1–5 MB.
  *
  * BLIND FALLBACK + ITS CEILING (BV-004): when the transcript is unavailable or
- * carries no record of that agent at all, liveness falls back to the ledger
- * entry's own age, with `IN_FLIGHT_TTL_MS` = 30 min. Named ceiling: the largest
+ * carries no positive evidence for that agent (no record, or only an unknown
+ * result form), liveness falls back to the ledger entry's own age, with
+ * `IN_FLIGHT_TTL_MS` = 30 min. Named ceiling: the largest
  * MEASURED same-batch dispatch spread is 95.7 s, so 30 min is ~19× headroom
  * against the false-ALLOW direction, while both measured sequential repair gaps
  * (36 min, 49 min) sit above it. Revisit trigger: a same-batch spread above
@@ -96,10 +114,14 @@
  *
  * A deny-capable hook on the DISPATCH path has an asymmetric blast radius: a
  * false positive blocks every agent of the session (the guard becomes a session
- * outage), while a false negative is a double-assignment that three later gates
- * still catch (`validate-wave-scope.mjs`, `enforce-scope.mjs` at write time, and
- * the W5 verification pass). Fail-closed is right for a WRITE guard; it is wrong
- * here. Each row below is a deliberate choice, not an oversight:
+ * outage), while a false negative of the COLLISION check is a double-assignment
+ * that three later gates still catch (`validate-wave-scope.mjs`,
+ * `enforce-scope.mjs` at write time, and the W5 verification pass). The #1485
+ * stale-base check (row 15) has no such later gate — a missed stale base is an
+ * agent editing old code — so it is kept fail-open by a different rule: it
+ * denies only on a MEASUREMENT, and every unknown is ALLOW plus a record.
+ * Fail-closed is right for a WRITE guard; it is wrong here. Each row below is a
+ * deliberate choice, not an oversight:
  *
  *   | # | Condition                              | Decision            | Why |
  *   |---|----------------------------------------|---------------------|-----|
@@ -110,18 +132,21 @@
  *   | 5 | prompt carries no scope marker         | ALLOW + COUNT       | 105 of 147 real prompts (71.4 %) have none. Non-extractable ≠ violation; denying these would deny 7 dispatches in 10. #1092: the allow now carries a counter-only record, so it is no longer byte-identical to "the guard never ran" |
  *   | 6 | scope block present but unparseable    | ALLOW + COUNT       | same reason as 5 — the parser is the fragile part, so its failures must resolve to the harmless side. Counted under a DISTINCT class from row 5 |
  *   | 7 | ledger unreadable / corrupt            | WARN + ALLOW + SELF-HEAL | loss of state is not evidence of a violation; loud so it gets noticed. The verdict now CARRIES a fresh ledger, so the corruption is repaired on the spot — without it the guard stayed OFF for the whole remaining wave, visible only in one `systemMessage` |
- *   | 8 | `git ls-files` failed                  | ALLOW (degraded)    | glob-vs-glob expansion degrades, concrete collisions are still found. A git outage is not a scope violation |
+ *   | 8 | `git ls-files` failed, or the shared git budget (`GIT_BUDGET_MS`) ran out | ALLOW (degraded) + `known_files_skipped` in the record | glob-vs-glob expansion degrades, concrete collisions are still found. A git outage is not a scope violation. #1489 Pkt 7: a HANGING git used to outlive the 5 s harness timeout, which killed the hook — the verdict lost with no record |
  *   | 9 | `findScopeCollisions` → not evaluable   | WARN + ALLOW        | the library says "not evaluable". Denying on a verdict with no witness is an assertion without evidence |
- *   |10 | same agent id re-dispatched, same scope| ALLOW (ledger replace) | a retry after a failed agent is legitimate; treating it as a duplicate would make the guard block every retry — a self-lock vector |
- *   |10a| collision, but EVERY colliding prior agent has FINISHED | ALLOW (+ prune) | the sequential repair pass. Its ledger records are pruned, so the state cannot re-block the next one either |
- *   |11 | collision with a prior agent still IN FLIGHT | **DENY**       | the one case this hook exists for |
+ *   |10 | same agent id re-dispatched         | ALLOW; predecessor pruned only when FINISHED | a retry after a failed agent is legitimate (a failed agent is finished), so the guard must not self-lock. #1480 B4: an unfinished predecessor is KEPT as a claim — a third agent hitting only its scope still collides. With distinct `tool_use_id`s on both it is an ordinary partner (row 11); without them it never collides with its own retry. Replaced WITHOUT a probe only where no claim is lost: the same `tool_use_id` (the same dispatch evaluated again), or — neither carrying an id — a predecessor wholly covered by the retry's scope |
+ *   |10a| collision, but EVERY colliding prior agent has FINISHED (positive evidence) | ALLOW (+ prune) | the sequential repair pass. Its ledger records are pruned, so the state cannot re-block the next one either |
+ *   |11 | collision with a prior agent still IN FLIGHT | **DENY**       | the case this hook was built for (#1020) |
  *   |12 | unexpected throw                       | ALLOW + stderr      | as row 2 |
- *   |13 | liveness probe throws / no evidence at all | treat as IN FLIGHT | keeps row 11 biting; the blind case is bounded by `IN_FLIGHT_TTL_MS`, never unbounded |
+ *   |13 | liveness probe throws / no positive evidence (no record, unknown result form) | treat as IN FLIGHT | keeps row 11 biting; the blind case is bounded by `IN_FLIGHT_TTL_MS`, never unbounded. A dispatch re-opened by a SendMessage with no completion after it is in flight outright, without TTL |
  *   |14 | ledger lock not acquirable in `LEDGER_LOCK_TIMEOUT_MS` | run UNLOCKED (degraded) | the lock removes the read-modify-write race (below); failing to take it must not deny, so the cycle degrades to the pre-lock behaviour |
+ *   |15 | `isolation: "worktree"`, `worktree.baseRef` not `"head"`, `merge-base --is-ancestor HEAD origin/HEAD` exits 1 in a full-history repo whose FETCH_HEAD is < 24 h old | **DENY**, no ledger write | #1485: the agent would branch from a base missing commits of HEAD and edit OLD code. Every non-measurement — no origin/HEAD, shallow, `stale-remote-ref`, git error, git budget spent (`git-budget`) — is ALLOW + a `skipped` record. No ledger write, so the in-place re-dispatch the deny advises meets no phantom claim. A collision DENY (row 11) wins the terminal emit; this one then goes to stderr. Otherwise the `scope_checked` record carries `ledger_result: 'deny-stale-base'`, never the collision verdict's allow (#1489 Pkt 8) |
  *
  * Every row that reaches a verdict from `decide()` — 5–11 and 13–14 — also
  * leaves an event record (§ Observability), so "which row fired" is answerable
- * after the fact and not only in the moment. Rows 1–4 emit nothing (no decision
+ * after the fact and not only in the moment. Row 15 is decided outside
+ * `decide()` and leaves its own `worktree_base_checked` record for EVERY
+ * worktree dispatch, allow and skip included. Rows 1–4 emit nothing (no decision
  * was made), and neither do the two crash rows 2 and 12: a hook that fell over
  * cannot describe itself, which is precisely why the GUARD INACTIVE banner on
  * stderr is the signal there.
@@ -147,13 +172,21 @@
  * ## Observability — the ledger half of #1092
  *
  * Every dispatch DECISION also appends one `orchestrator.wave_dispatch.scope_checked`
- * record to `<projectDir>/.orchestrator/metrics/events.jsonl`. The reason it
+ * record to `<session root>/.orchestrator/metrics/events.jsonl` — the root
+ * `resolveSessionRoot()` resolves (`scripts/lib/platform.mjs`: the git toplevel
+ * of the payload `cwd` — its nearest `.git` ancestor when git cannot answer —
+ * but never above a launch dir inside it; so neither the subdirectory a `cd`
+ * moved to, #1489 Pkt 6, nor the launch dir a worktree session left), which is
+ * also where the ledger and its lock live. The reason it
  * exists is matrix rows 5/6: the no-signal ALLOW used to be byte-identical to
  * "the guard never ran", and the in-ledger counter added first is a WAVE tally —
  * it cannot say WHICH dispatch carried a scope. Payload: `wave` (omitted, never
  * `0`, when unknown), `agent_id`, `declared_path_count`, `injected`, `shape`,
- * `signal`, `ledger_result`, `collision_count`, `hook`, plus `session_id` /
- * `semantic_session_id` when a session lock is readable.
+ * `signal`, `ledger_result`, `collision_count`, `hook`, `known_files_skipped`
+ * (only when the tracked-file listing degraded, matrix row 8), `collision_result`
+ * (only beside `ledger_result: 'deny-stale-base'` — the collision verdict it
+ * replaced), plus `session_id` / `semantic_session_id` when a session lock is
+ * readable.
  *
  * WHAT IT PROVES: this hook SAW (or did not see) a `FILE-SCOPE` declaration in
  * the prompt the coordinator handed to the dispatch tool, and what the guard
@@ -211,6 +244,7 @@ import path from 'node:path';
 import { pathToFileURL, fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
 import { mkdirSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
 
 import { shouldRunHook } from './_lib/profile-gate.mjs';
 
@@ -231,7 +265,11 @@ import { shouldRunHook } from './_lib/profile-gate.mjs';
 /** @type {typeof import('../scripts/lib/io.mjs').writeJsonAtomicSync} */ let writeJsonAtomicSync;
 /** @type {typeof import('../scripts/lib/file-lock.mjs').withFileLock} */ let withFileLock;
 /** @type {typeof import('../scripts/lib/scope-echo.mjs').scopeDigest} */ let scopeDigest;
+/** @type {typeof import('../scripts/lib/platform.mjs').resolveSessionRoot} */ let resolveSessionRoot;
 let findScopeCollisions;
+let findOwnScopeFile;
+let readProcessLocalSessionIds;
+let classifyManifestSession;
 
 const PLUGIN_ROOT = path.resolve(import.meta.dirname, '..');
 
@@ -245,11 +283,43 @@ const HOOK_NAME = 'pre-task-scope-disjoint';
  */
 const DISPATCH_TOOL = 'Agent';
 
-/** Ledger location, relative to the project dir. */
-const LEDGER_REL = path.join('.orchestrator', 'wave-dispatch-scopes.json');
+/**
+ * Ledger location (#1493.3): ONE FILE PER SESSION,
+ * `.orchestrator/wave-dispatch-scopes.<session>.json`, each with its own lock
+ * `.orchestrator/wave-dispatch-scopes.<session>.lock` (§ Ledger concurrency).
+ *
+ * Until #1493 every session of the working copy shared ONE file holding ONE
+ * `waveKey`, and `decide()` keeps prior agents only under the same key — whose
+ * first segment IS the session id. So cross-session claims were never compared
+ * (nothing is lost by splitting), but a peer session's dispatch reset the file
+ * and erased this session's live claims, and the deny's "delete the ledger"
+ * remedy erased the peer's. One file per session removes both.
+ *
+ * A flat sibling, not a directory, on purpose: bootstrap's `store-lock-ignore`
+ * step (#1495) ignores `.orchestrator/wave-dispatch-scopes.*` in consumer repos,
+ * which covers this name; a directory would surface untracked in each of them.
+ */
+const LEDGER_DIR_REL = '.orchestrator';
+const LEDGER_STEM = 'wave-dispatch-scopes';
 
-/** Mutex for the ledger's read-modify-write cycle — see § Ledger concurrency. */
-const LEDGER_LOCK_REL = path.join('.orchestrator', 'wave-dispatch-scopes.lock');
+/**
+ * The pre-#1493 single shared ledger. READ only, for migration: adopted when
+ * this session has no file yet AND its `waveKey` names this session; never
+ * written and never deleted — it may still be a peer's live state.
+ * Revisit-Trigger: remove this read one minor release after the split ships,
+ * when no session that recorded claims in the old file can still be running.
+ */
+const LEGACY_LEDGER_REL = path.join(LEDGER_DIR_REL, `${LEDGER_STEM}.json`);
+
+/**
+ * Longest session token a ledger file name carries. Harness session ids are
+ * UUIDs (36 chars) and pass through unchanged; the cap only keeps a pathological
+ * id below the 255-byte file-name limit. Two ids that sanitise to ONE token
+ * share a file again — degraded to the pre-#1493 behaviour, never worse, since
+ * `waveKey` still carries the raw id. Revisit if a harness ships ids that are
+ * not path-safe.
+ */
+const MAX_SESSION_TOKEN_CHARS = 128;
 
 /**
  * Ledger-lock budget. Short on purpose: the whole locked region is a read, a
@@ -260,6 +330,28 @@ const LEDGER_LOCK_REL = path.join('.orchestrator', 'wave-dispatch-scopes.lock');
 const LEDGER_LOCK_TIMEOUT_MS = 2000;
 const LEDGER_LOCK_POLL_MS = 25;
 
+/**
+ * ONE deadline for ALL git work of one hook fire (#1489 Pkt 7). Every spawn
+ * gets at most what is LEFT of it, so the git work as a whole — never a single
+ * call — is what is bounded.
+ *
+ * The number is arithmetic, not taste: `hooks/hooks.json` gives this hook
+ * `"timeout": 5` (seconds) for the WHOLE process. The git work runs first; after
+ * it the ledger lock may wait up to `LEDGER_LOCK_TIMEOUT_MS` (2000). 5000 − 2000
+ * − 1500 leaves 1500 ms for node start, the late-bound imports, the transcript
+ * scan (≤ ~210 ms at the largest measured 70 MB) and the two awaited event
+ * appends — ~20× the 69 ms full path measured idle (§ Measured cost). The git
+ * work itself measured 27.8 ms together with lock, ledger and compare, so 1500
+ * binds only a git that hangs (a stuck lock file, a network-backed `HEAD`, a
+ * frozen filesystem). Before, each worktree call had its own 5 s and
+ * `listTrackedFiles` none: one hanging git outlived the harness, which killed
+ * the hook — a silent fail-open with no record of the lost verdict.
+ *
+ * Revisit-Trigger: a change of this hook's `timeout` in `hooks/hooks.json` or of
+ * `LEDGER_LOCK_TIMEOUT_MS` — the three numbers must keep summing below 5000.
+ */
+const GIT_BUDGET_MS = 1500;
+
 /** Payload bounds — see § stdout discipline. */
 const MAX_REPORTED_COLLISIONS = 5;
 const MAX_EVIDENCE_PER_COLLISION = 4;
@@ -289,14 +381,14 @@ const SHAPE_NONE = 'none';
 const SCOPE_EVENT = 'orchestrator.wave_dispatch.scope_checked';
 
 /**
- * The worktree-base observability record (#1413).
+ * The worktree-base observability record (#1413; carries the #1485 `decision`).
  *
  * Same `wave_dispatch` domain and same `_checked` verb as `SCOPE_EVENT`, and
  * written for EVERY `isolation: "worktree"` dispatch rather than only the
  * alarming one. That is HR-105 applied at the source: a numerator-only stream
- * cannot tell "genuinely rare" from "silently broken", and the firing rate this
- * warning must stay under is then unfalsifiable. With every outcome in one
- * stream the rate is `stale:true / all records of this name`.
+ * cannot tell "genuinely rare" from "silently broken", and the firing rate of
+ * the #1485 deny is then unfalsifiable. With every outcome in one stream the
+ * rate is `decision:"deny" / all records of this name`.
  *
  * #1424 widened "every outcome" from two to three: the `stale: true|false`
  * split was already covered, but each NON-measurement (peer STATE.md, no
@@ -308,9 +400,6 @@ const SCOPE_EVENT = 'orchestrator.wave_dispatch.scope_checked';
  */
 const WORKTREE_BASE_EVENT = 'orchestrator.wave_dispatch.worktree_base_checked';
 
-/** State-dir candidates, in the same order `waveKeyOf()` probes them. */
-const STATE_DIR_CANDIDATES = ['.pi', '.cursor', '.codex', '.claude'];
-
 /**
  * The receive-side instruction line `renderScopeEchoInstruction()` renders and
  * the coordinator appends immediately after the fenced block
@@ -358,9 +447,77 @@ const MAX_TRANSCRIPT_BYTES = 256 * 1024 * 1024;
  * a completion — see § Liveness (b). Reading it as one would let every real
  * background-batch collision through, which is the one direction this repair
  * must not take.
+ *
+ * Recognised only as the PREFIX of the result text (after trimStart): a finished
+ * sync report that merely QUOTES this sentence is not a launch receipt, and read
+ * as one it stayed "running" without TTL (R1 LOW). Census 2026-09-30, 5,881
+ * local transcripts: 4,684 of 4,684 ACK results begin with it, also in their
+ * first content part.
  */
 const ASYNC_LAUNCH_ACK = 'Async agent launched successfully';
 
+/**
+ * The `tool_result` forms that PROVE a dispatch finished (#1480 B2), one line
+ * per form. A result matching none of them is NOT a completion but "no
+ * evidence" — the entry falls back to the TTL rule (matrix row 13). `is_error`
+ * is handled beside this list (the dispatch never ran), and the ACK is tested
+ * FIRST, so a launch receipt can never read as a completion.
+ *
+ * Census 2026-09-30 (local transcripts, 14 days, counts only), Agent
+ * tool_results: ACK 4,730; sync completion carrying the `<usage>`/`total_tokens`
+ * trailer and `agentId:` 690 (690/690); `is_error` 37; neither 38. Of those 38,
+ * "This agent's report was delivered…" is a completion (35/35 without a
+ * terminal carrier before or after, 2026-09-30), "Fork started — processing in
+ * b…" is not (a start receipt without the ACK wording — before this list it was
+ * read as a completion: the B2 fail-open).
+ *
+ * Named ceiling (BV-004): any other wording reads as "unknown", so a fresh entry
+ * binds for up to IN_FLIGHT_TTL_MS although its agent may be done — a bounded
+ * false-DENY, never a false-ALLOW. Revisit-Trigger: a census re-run finds an
+ * Agent tool_result wording in neither this list nor ASYNC_LAUNCH_ACK — classify
+ * it, then add ONE line here.
+ */
+const RESULT_COMPLETION_FORMS = Object.freeze([
+  Object.freeze({ at: 'anywhere', text: '<usage>' }),                        // sync trailer, 690/690
+  Object.freeze({ at: 'anywhere', text: 'total_tokens' }),                   // sync trailer, 690/690
+  Object.freeze({ at: 'start', text: "This agent's report was delivered" }), // 35/35 without carrier
+]);
+
+/** The tool that addresses — and can RESUME — an already-dispatched agent (#1459 P1). */
+const SEND_MESSAGE_TOOL = 'SendMessage';
+
+/**
+ * A `SendMessage` result that reached nobody (`{"success":false,…"No agent
+ * named…"}`, census 2026-09-30): such a send activates nothing.
+ */
+const SEND_NO_EFFECT = '"success":false';
+
+/**
+ * The harness's `agentId:` line in an Agent tool_result (ACK or sync trailer) —
+ * the task id a `SendMessage` addresses. Only a line that BEGINS with it, id on
+ * the same line, read as the LAST match over the content parts joined with
+ * `\n`: a sync result embeds the agent's own report ahead of the harness
+ * trailer, and a report ending in `agentId:` must not swallow the trailer's
+ * line (R1 MEDIUM — a wrong task id let a resumed agent read as finished).
+ * Census 2026-09-30, 5,881 local transcripts: in 5,375 of 5,375 Agent results
+ * carrying `agentId:`, the last one starts a line and sits in the last part.
+ */
+const AGENT_ID_LINE_RE = /^agentId:[ \t]*([A-Za-z0-9_-]+)/gm;
+
+/** Per-dispatch liveness states — see {@link buildLivenessIndex}. */
+const LIVE_FINISHED = 'finished';
+const LIVE_RUNNING = 'running';
+const LIVE_UNKNOWN = 'unknown';
+
+/**
+ * `<task-notification>` statuses that mean the task is NO LONGER RUNNING (#1455).
+ * Enumerated from evidence, not guessed — census 2026-09-25 over the operator's
+ * local Claude Code transcripts (`rg "<tool-use-id>…<status>X</status>"` on
+ * `*.jsonl`): completed, failed 1430 lines, killed 609, stopped 28.
+ * `running` is deliberately absent — it is the one non-terminal spelling.
+ */
+const TERMINAL_STATUS_RE = /<status>(?:completed|failed|killed|stopped)<\/status>/;
+
 /**
  * The consequence block spliced VERBATIM into the GUARD INACTIVE banner (#993),
  * naming the enforcement this hook's outage stops applying.
@@ -400,6 +557,7 @@ async function bootstrap() {
     {
       io: { specifier: lib('io.mjs') },
       scopeGate: { specifier: lib('scope-gate.mjs') },
+      sessionIdentity: { specifier: lib('session-identity', 'own-session.mjs') },
       fileLock: { specifier: lib('file-lock.mjs') },
       // ONE normalization for the digest, shared with the receive side (#1092):
       // `scope-echo.mjs` is pure (stdlib + `crypto-digest-utils.mjs`) and its
@@ -409,6 +567,10 @@ async function bootstrap() {
       // names. Late-bound like every other repo module so a load failure
       // banners instead of disarming the guard silently (#993).
       scopeEcho: { specifier: lib('scope-echo.mjs') },
+      // #1492: ONE session-root resolver for every hook that reads the
+      // session's control files — this ledger, and `wave-scope.json` in
+      // enforce-scope / enforce-commands / post-bash-write-verify.
+      platform: { specifier: lib('platform.mjs') },
     },
     {
       hookName: HOOK_NAME,
@@ -419,9 +581,11 @@ async function bootstrap() {
   );
 
   ({ readStdin, emitAllow, emitDeny, emitWarn, writeJsonAtomicSync } = modules.io);
-  ({ findScopeCollisions } = modules.scopeGate);
+  ({ findScopeCollisions, findOwnScopeFile } = modules.scopeGate);
+  ({ readProcessLocalSessionIds, classifyManifestSession } = modules.sessionIdentity);
   ({ withFileLock } = modules.fileLock);
   ({ scopeDigest } = modules.scopeEcho);
+  ({ resolveSessionRoot } = modules.platform);
 }
 
 // ---------------------------------------------------------------------------
@@ -750,8 +914,8 @@ export function extractScopeFromPrompt(prompt) {
 
 /**
  * The dispatch's human description — the field the liveness probe matches
- * against the transcript's `tool_use` blocks (present in 147/147 measured
- * payloads).
+ * against the transcript's `tool_use` blocks when an entry carries no exact
+ * `useId` (present in 147/147 measured payloads).
  *
  * @param {{description?: unknown}} toolInput
  * @returns {string}
@@ -777,69 +941,401 @@ export function agentIdOf(toolInput) {
   return 'unnamed-agent';
 }
 
+/**
+ * A dispatch's EXACT identity (#1480 A): the PreToolUse payload's `tool_use_id`,
+ * or a ledger entry's stored `useId`. On Claude Code it equals the transcript's
+ * `tool_use` id, so liveness becomes a lookup instead of a description match;
+ * other harnesses may omit it, and `''` then means "no exact id". Taken
+ * verbatim, never re-spelled — and dropped rather than clipped past
+ * MAX_AGENT_ID_CHARS: a clipped id could never match, two clipped ids could
+ * match wrongly.
+ *
+ * @param {unknown} value
+ * @returns {string}
+ */
+function exactUseId(value) {
+  return typeof value === 'string' && value.trim() !== '' && value.length <= MAX_AGENT_ID_CHARS ? value : '';
+}
+
 // ---------------------------------------------------------------------------
 // Liveness — has an already-recorded agent FINISHED? (§ Liveness)
 // ---------------------------------------------------------------------------
 
+const NOTIFICATION_OPEN = '<task-notification>';
+const NOTIFICATION_CLOSE = '</task-notification>';
+
+/**
+ * A notification head in the harness's own tag order: `<task-id>`,
+ * `<tool-use-id>`, optional `<output-file>`, `<status>` — anchored at the opener.
+ * Group 1 is the task id (the resume key, #1459 P1), group 2 the tool-use id,
+ * group 3 the whole `<status>` element.
+ */
+const NOTIFICATION_HEAD_RE = /^<task-notification>\s*<task-id>([^<]*)<\/task-id>\s*<tool-use-id>([^<]+)<\/tool-use-id>\s*(?:<output-file>[^<]*<\/output-file>\s*)?(<status>[^<]*<\/status>)/;
+
+/** `origin.kind` / `commandMode` value the harness stamps on a notification carrier. */
+const CARRIER_KIND = 'task-notification';
+
+/** `queue-operation` operations measured to carry a notification (dequeue carries no content). */
+const CARRIER_QUEUE_OPS = new Set(['enqueue', 'remove']);
+
+/** First line of the harness preamble some `user` carriers put before the block. */
+const SYSTEM_NOTIFICATION_MARK = '[SYSTEM NOTIFICATION - NOT USER INPUT]\n';
+
+/**
+ * The notification text of a HARNESS-WRITTEN carrier record, or `null` for any
+ * other record (#1459 Pkt 2 Rest). Census 2026-09-28 over the operator's local
+ * transcripts (11,005 files, 2026-08-06 → 2026-09-28): every terminal id the
+ * pre-fix raw-line match accepted from a real carrier came from exactly one of
+ * three record forms, each of which carries ids the other two do not:
+ *   - `user` with STRING `message.content` and `origin.kind: 'task-notification'`
+ *     (a typed prompt carries `origin.kind: 'human'`). The text begins with the
+ *     opener, or with the harness preamble ({@link SYSTEM_NOTIFICATION_MARK},
+ *     tag-free, ending in a blank line) directly followed by the opener;
+ *   - `queue-operation` with `operation` `enqueue`/`remove` and string `content`;
+ *   - `attachment` of type `queued_command` with `commandMode: 'task-notification'`.
+ * Everything else — `tool_result` content, assistant text, tool inputs, typed
+ * prompts — is a quote or a forgery and yields `null`, i.e. no finished id.
+ *
+ * The guard on the `user` form is `origin.kind`, which only the harness sets; the
+ * preamble rule merely strips a tag-free prefix and is no control on its own.
+ *
+ * Named residual (BV-004): a `queue-operation` record has no field that tells a
+ * harness notification from an operator prompt typed while the agent was busy,
+ * so an OPERATOR could forge through that one channel. An agent cannot through
+ * the one producer censused: text a subagent or peer delivers via `SendMessage`
+ * arrives wrapped by the harness, so it never begins with the opener. Measured
+ * 2026-09-28 in a second run (count only, 11,008 transcript files, three more
+ * than the census above): 7,131 records carry such a message, 1,801 of them as
+ * `queue-operation`, 2,486 as `queued_command` with `commandMode: 'prompt'`;
+ * 0 of the 7,131 begin with `<task-notification>`. Other queue producers
+ * (scheduled wake-ups, a `/loop` body) were not censused. Revisit if the harness
+ * adds a discriminator here (like `commandMode` on the attachment) or stops
+ * wrapping.
+ *
+ * @param {any} rec — one parsed transcript record
+ * @returns {string|null}
+ */
+function notificationCarrierText(rec) {
+  if (rec?.type === 'user' && rec?.origin?.kind === CARRIER_KIND && typeof rec?.message?.content === 'string') {
+    const text = rec.message.content;
+    if (!text.startsWith(SYSTEM_NOTIFICATION_MARK)) return text;
+    const open = text.indexOf('<');
+    return open !== -1 && text.startsWith(`\n\n${NOTIFICATION_OPEN}`, open - 2) ? text.slice(open) : null;
+  }
+  if (rec?.type === 'queue-operation' && CARRIER_QUEUE_OPS.has(rec?.operation) && typeof rec?.content === 'string') {
+    return rec.content;
+  }
+  const att = rec?.type === 'attachment' ? rec?.attachment : undefined;
+  if (att?.type === 'queued_command' && att?.commandMode === CARRIER_KIND && typeof att?.prompt === 'string') {
+    return att.prompt;
+  }
+  return null;
+}
+
 /**
- * Index a session transcript by agent DESCRIPTION → completion state.
+ * The HEAD of a carrier text's FIRST `<task-notification>` block (#1459 Pkt 2) —
+ * its task id, its tool-use id and whether its status is TERMINAL; at most one
+ * head per carrier. Only a terminal head finishes an id; a non-terminal one only
+ * contributes the task id (#1459 P1), which can open a dispatch, never close it.
+ * (Named `finishedNotificationIds` until #1480; the ceiling below is unchanged.)
+ *
+ * The text must BEGIN with the opener (a block further in is a quote) and its
+ * head must follow the harness tag order ({@link NOTIFICATION_HEAD_RE}).
+ * `<summary>` and `<result>` carry free text that can QUOTE another
+ * notification's `<tool-use-id>` and `<status>`, or even forge a whole block
+ * (R2 F1: a summary that closes itself and opens a complete fake block defeated
+ * the earlier cut-then-split approach). So nothing past the block's HEAD is read:
+ * the head runs from the opener to the earliest `<summary>`, `<result>` or
+ * `</task-notification>`. Fail-closed — the deny stays — when the text is not a
+ * carrier's, does not begin with the opener, has no closing tag (truncated
+ * block), or its head is out of order or carries no terminal status.
+ *
+ * Named ceiling (BV-004, #1467): a batch of several DIFFERENT notifications in
+ * one carrier reports only the first as finished (the rest stay running, the
+ * safe direction but a false-DENY source). Census 2026-09-30 over the operator's
+ * local transcripts of all repos (11,684 files, 2026-08-06 → 2026-09-30, at
+ * f58480e5): 23 preamble-form `user` carriers hold 2+ distinct terminal ids; 108
+ * non-first ids are finished by no other carrier, and 0 of them is an `Agent`
+ * dispatch id (105 Bash, 3 Monitor) — the only ids this index resolves, so no
+ * Agent liveness is lost today. The 2026-09-28 figures (31 / 155) were not
+ * reproduced. No split is built: it would gain nothing, and its safety is
+ * unproven. `origin` has no per-block discriminator, so a split is safe only if
+ * the harness escapes `<` in `<summary>`/`<result>` — unescaped, a block forged
+ * there is byte-identical to a genuine `\n\n`-joined batch. The census suggests
+ * escaping (12,039 of 25,031 results carry `&lt;`, 3 a raw `<` + letter) but
+ * does not establish it for every harness version. Revisit-Trigger: a re-run
+ * census finds a non-first terminal id that is an `Agent` dispatch id finished
+ * by no other carrier or `tool_result`; a split then needs escaping proven first.
+ *
+ * @param {string|null} text — a carrier's text from {@link notificationCarrierText}
+ * @returns {{taskId: string, toolUseId: string, terminal: boolean}|null}
+ */
+function notificationHead(text) {
+  if (typeof text !== 'string' || !text.startsWith(NOTIFICATION_OPEN)) return null;
+  const close = text.indexOf(NOTIFICATION_CLOSE);
+  if (close === -1) return null;
+  let headEnd = close;
+  for (const tag of ['<summary>', '<result>']) {
+    const at = text.indexOf(tag);
+    if (at !== -1 && at < headEnd) headEnd = at;
+  }
+  const head = text.slice(0, headEnd).match(NOTIFICATION_HEAD_RE);
+  if (head === null) return null;
+  return { taskId: head[1].trim(), toolUseId: head[2], terminal: TERMINAL_STATUS_RE.test(head[3]) };
+}
+
+/**
+ * Classify an Agent dispatch's OWN `tool_result` (#1480 B2): `done` only on
+ * positive evidence (`is_error`, or one of {@link RESULT_COMPLETION_FORMS}),
+ * `ack` for the launch acknowledgement (a text PREFIX, see
+ * {@link ASYNC_LAUNCH_ACK}), `unknown` for everything else. The ACK is tested
+ * before the forms, so no ACK wording can ever read as a completion.
+ *
+ * @param {{is_error?: unknown}} block
+ * @param {string} text — {@link resultTextOf}(block)
+ * @returns {'done'|'ack'|'unknown'}
+ */
+function dispatchResultForm(block, text) {
+  if (block?.is_error === true) return 'done';
+  const lead = text.trimStart();
+  if (lead.startsWith(ASYNC_LAUNCH_ACK)) return 'ack';
+  for (const form of RESULT_COMPLETION_FORMS) {
+    if (form.at === 'start' ? lead.startsWith(form.text) : text.includes(form.text)) return 'done';
+  }
+  return 'unknown';
+}
+
+/**
+ * The LAST line-leading `agentId:` a harness-written dispatch result names, or
+ * `''` — see {@link AGENT_ID_LINE_RE}. Parts are joined with `\n` HERE (unlike
+ * {@link resultTextOf}), so a part boundary is a line boundary and report text
+ * cannot run into the trailer's line.
  *
- * Three record shapes are read, all measured in this repo's own transcripts:
- *   - `tool_use` `{name:'Agent', id, input.description}` — the dispatch.
- *   - `tool_result` `{tool_use_id, content}` — a completion for the SYNCHRONOUS
- *     shape, but only when its text is not the {@link ASYNC_LAUNCH_ACK}.
- *   - a `<task-notification>` record carrying `<tool-use-id>` and
- *     `<status>completed</status>` — the ASYNC shape's completion.
+ * @param {{content?: unknown}} block
+ * @returns {string}
+ */
+function lastAgentIdIn(block) {
+  const c = block?.content;
+  const text = typeof c === 'string'
+    ? c
+    : Array.isArray(c) ? c.map((part) => (typeof part?.text === 'string' ? part.text : '')).join('\n') : '';
+  let last = '';
+  for (const m of text.matchAll(AGENT_ID_LINE_RE)) last = m[1];
+  return last;
+}
+
+/**
+ * Append `value` to the array stored under `key`.
  *
- * A description dispatched N times counts as finished only when EVERY one of its
- * tool_use ids is finished. Conservative on purpose: one outstanding run of the
- * same agent keeps the deny alive.
+ * @template T
+ * @param {Map<string, T[]>} map
+ * @param {string} key
+ * @param {T} value
+ */
+function pushTo(map, key, value) {
+  const list = map.get(key);
+  if (list === undefined) map.set(key, [value]);
+  else list.push(value);
+}
+
+/**
+ * Index a session transcript by DISPATCH tool-use id → liveness state, plus
+ * description → dispatch ids for ledger entries that carry no exact id.
+ *
+ * Record shapes read, all measured (census 2026-09-30 for the SendMessage half):
+ *   - `tool_use` `{name:'Agent', id, input.description}` — the dispatch U.
+ *   - `tool_use` `{name:'SendMessage', id, input.to}` — addresses a dispatch by
+ *     its task id T(U) (= agentId); 1,055 via a notification task id, 33 via the
+ *     ACK's agentId, 0 via the description.
+ *   - `tool_result` for U — classified by {@link dispatchResultForm}; for a
+ *     SendMessage only whether it reached nobody ({@link SEND_NO_EFFECT} or
+ *     `is_error`).
+ *   - a `<task-notification>` CARRIER record — only a harness-written carrier
+ *     ({@link notificationCarrierText}), only its first block's head
+ *     ({@link notificationHead}); a terminal `<status>` finishes (#1455: `failed`
+ *     too).
+ *
+ * T(U) is the last line-leading `agentId:` ({@link lastAgentIdIn}) of U's own
+ * ACK or positive result, else the task
+ * id of the first carrier head carrying U's tool-use id.
+ *
+ * RESUME (#1459 P1). U is ACTIVATED by its dispatch and by every SendMessage
+ * with `to === T(U)` whose result is not a no-effect (a send without a result
+ * yet counts — the safe direction). U is FINISHED when a completion lies AFTER
+ * its last activation, by transcript line position: a terminal carrier with
+ * tool-use id U, with the id of an activating SendMessage, or with task id T(U);
+ * when the dispatch itself is the last activation, also U's own positive
+ * result. Measured 2026-09-30: a resumed agent completes under the
+ * SendMessage's id and the same task id, never again under U (455 cases); a
+ * message queued to a running agent completes under U with the same task id
+ * (566). Activations only OPEN; closing still needs a carrier or U's own
+ * harness-written result.
+ *
+ * States: `finished`; `running` — no result, an ACK, or a SendMessage as last
+ * activation with no completion after it (no TTL); `unknown` — only a result
+ * form without positive evidence, which the probe treats as no evidence (TTL).
+ * A repeated `tool_use` record (same Agent or SendMessage id) is the SAME event,
+ * not a new activation: its position is the FIRST occurrence, so a copy after
+ * the completion cannot re-open a finished agent (R1 D4, a false-DENY). A
+ * repeated carrier still closes. Hardening without a measured case: census
+ * 2026-09-30 (5,881 local transcripts) found 0 repeated Agent and 0 repeated
+ * SendMessage `tool_use` records.
+ *
+ * Named ceiling (BV-004): `to` is matched against T(U) only — a SendMessage that
+ * addresses the agent by name or description re-opens nothing (0 of ~6,200
+ * measured 2026-09-30). Revisit-Trigger: a census re-run finds a SendMessage to
+ * a dispatch whose `to` is not its task id.
  *
  * Pure and total — a malformed line is skipped, never thrown on.
  *
  * @param {string} raw — the transcript's JSONL text
- * @returns {Map<string, boolean>} description → finished?
+ * @returns {{states: Map<string, 'finished'|'running'|'unknown'>,
+ *            idsByDesc: Map<string, string[]>}}
  */
-export function buildTranscriptIndex(raw) {
-  const out = new Map();
-  if (typeof raw !== 'string' || raw.length === 0) return out;
-
-  const dispatched = new Map(); // description → tool_use ids
-  const finishedIds = new Set();
-
-  for (const line of raw.split('\n')) {
+function buildLivenessIndex(raw) {
+  const states = new Map();
+  const idsByDesc = new Map();
+  if (typeof raw !== 'string' || raw.length === 0) return { states, idsByDesc };
+
+  const dispatchPos = new Map();     // U → FIRST line position of its tool_use
+  const results = new Map();         // U → [{pos, form, agentId}]
+  const sendsByTo = new Map();       // SendMessage `to` → [{id, pos}]
+  const sendIds = new Set();
+  const sendNoEffect = new Set();    // SendMessage ids whose result reached nobody
+  const headsByUse = new Map();      // carrier tool-use id → [{pos, taskId, terminal}]
+  const terminalByTask = new Map();  // carrier task id → [pos] of terminal heads
+
+  const lines = raw.split('\n');
+  for (let pos = 0; pos < lines.length; pos++) {
+    const line = lines[pos];
     if (line.length < 24) continue;
+    // Substring prefilter only — the verdict needs the PARSED record: a raw-line
+    // match let a forged block in any record finish an id (#1459 Pkt 2 Rest).
+    const hasNotification = line.includes('task-notification');
+    const hasToolRow = line.includes('"tool_use"') || line.includes('tool_use_id');
+    if (!hasNotification && !hasToolRow) continue;
+    let rec;
+    try { rec = JSON.parse(line); } catch { continue; }
 
-    // ASYNC completion — matched on the RAW line: the tags are plain text inside
-    // a JSON string, so no parse is needed and the `queue-operation` carrier
-    // record (which has no `message.content`) is covered too.
-    if (line.includes('task-notification') && line.includes('<status>completed</status>')) {
-      for (const m of line.matchAll(/<tool-use-id>([^<]+)<\/tool-use-id>/g)) finishedIds.add(m[1]);
+    // Completion (and the task id) — only from a harness-written carrier record.
+    if (hasNotification) {
+      const head = notificationHead(notificationCarrierText(rec));
+      if (head !== null) {
+        pushTo(headsByUse, head.toolUseId, { pos, taskId: head.taskId, terminal: head.terminal });
+        if (head.terminal && head.taskId !== '') pushTo(terminalByTask, head.taskId, pos);
+      }
     }
 
-    if (!line.includes('"tool_use"') && !line.includes('tool_use_id')) continue;
-    let rec;
-    try { rec = JSON.parse(line); } catch { continue; }
+    if (!hasToolRow) continue;
     const content = rec?.message?.content;
     if (!Array.isArray(content)) continue;
 
     for (const block of content) {
-      if (block?.type === 'tool_use' && block?.name === DISPATCH_TOOL && typeof block?.id === 'string') {
-        const desc = typeof block?.input?.description === 'string' ? block.input.description.trim() : '';
-        if (desc === '') continue;
-        const ids = dispatched.get(desc) ?? [];
-        ids.push(block.id);
-        dispatched.set(desc, ids);
+      if (block?.type === 'tool_use' && typeof block?.id === 'string') {
+        if (block.name === DISPATCH_TOOL) {
+          if (!results.has(block.id)) {   // first occurrence only — see D4 above
+            results.set(block.id, []);
+            dispatchPos.set(block.id, pos);
+            const desc = typeof block?.input?.description === 'string' ? block.input.description.trim() : '';
+            if (desc !== '') pushTo(idsByDesc, desc, block.id);
+          }
+        } else if (block.name === SEND_MESSAGE_TOOL && typeof block?.input?.to === 'string' && block.input.to !== ''
+          && !sendIds.has(block.id)) {
+          sendIds.add(block.id);
+          pushTo(sendsByTo, block.input.to, { id: block.id, pos });
+        }
         continue;
       }
       if (block?.type === 'tool_result' && typeof block?.tool_use_id === 'string') {
-        // The launch ACK is not a completion — see § Liveness (b).
-        if (!resultTextOf(block).includes(ASYNC_LAUNCH_ACK)) finishedIds.add(block.tool_use_id);
+        const own = results.get(block.tool_use_id);
+        if (own !== undefined) {
+          const text = resultTextOf(block);
+          const form = dispatchResultForm(block, text);
+          // An error text is not a harness trailer — learn T(U) from ACK/completion only.
+          const agentId = form === 'ack' || (form === 'done' && block.is_error !== true) ? lastAgentIdIn(block) : '';
+          own.push({ pos, form, agentId });
+        } else if (sendIds.has(block.tool_use_id)
+          && (block.is_error === true || resultTextOf(block).includes(SEND_NO_EFFECT))) {
+          sendNoEffect.add(block.tool_use_id);
+        }
+      }
+    }
+  }
+
+  for (const [useId, pos] of dispatchPos) {
+    const own = results.get(useId) ?? [];
+    const taskId = own.find((r) => r.agentId !== '')?.agentId
+      ?? (headsByUse.get(useId) ?? []).find((h) => h.taskId !== '')?.taskId
+      ?? '';
+
+    let lastPos = pos;
+    let lastIsSend = false;
+    const closers = [useId];
+    if (taskId !== '') {
+      for (const send of sendsByTo.get(taskId) ?? []) {
+        if (sendNoEffect.has(send.id)) continue;
+        closers.push(send.id);
+        if (send.pos > lastPos) { lastPos = send.pos; lastIsSend = true; }
       }
     }
+
+    const closedAfter = closers.some((id) => (headsByUse.get(id) ?? []).some((h) => h.terminal && h.pos > lastPos))
+      || (taskId !== '' && (terminalByTask.get(taskId) ?? []).some((p) => p > lastPos))
+      || (!lastIsSend && own.some((r) => r.form === 'done' && r.pos > lastPos));
+
+    let state;
+    if (closedAfter) state = LIVE_FINISHED;
+    else if (lastIsSend || own.length === 0 || own.some((r) => r.form === 'ack')) state = LIVE_RUNNING;
+    else state = LIVE_UNKNOWN;
+    states.set(useId, state);
   }
+  return { states, idsByDesc };
+}
+
+/**
+ * Description-level verdict for a ledger entry WITHOUT an exact id: `false` if
+ * any of the description's dispatches is running, `true` only if every one is
+ * finished, `undefined` (no evidence → TTL) otherwise. `excludeUseId` drops the
+ * CURRENT dispatch, whose `tool_use` may already sit in the transcript at
+ * PreToolUse time and would make a finished same-named predecessor look alive.
+ *
+ * @param {{states: Map<string, string>, idsByDesc: Map<string, string[]>}} index
+ * @param {string} desc
+ * @param {string} excludeUseId
+ * @returns {boolean|undefined}
+ */
+function descFinished(index, desc, excludeUseId) {
+  let seen = false;
+  let unknown = false;
+  for (const useId of index.idsByDesc.get(desc) ?? []) {
+    if (useId === excludeUseId) continue;
+    seen = true;
+    const state = index.states.get(useId);
+    if (state === LIVE_RUNNING) return false;
+    if (state !== LIVE_FINISHED) unknown = true;
+  }
+  return seen && !unknown ? true : undefined;
+}
 
-  for (const [desc, ids] of dispatched) out.set(desc, ids.every((id) => finishedIds.has(id)));
+/**
+ * Index a session transcript by agent DESCRIPTION → completion state — the
+ * description view of {@link buildLivenessIndex}.
+ *
+ * A description dispatched N times counts as finished only when EVERY one of its
+ * tool_use ids is finished, and as running as soon as one is. Conservative on
+ * purpose: one outstanding run of the same agent keeps the deny alive. A
+ * description with no running run but an `unknown` one is absent (no evidence).
+ *
+ * @param {string} raw — the transcript's JSONL text
+ * @returns {Map<string, boolean>} description → finished? (absent = no evidence)
+ */
+export function buildTranscriptIndex(raw) {
+  const index = buildLivenessIndex(raw);
+  const out = new Map();
+  for (const desc of index.idsByDesc.keys()) {
+    const finished = descFinished(index, desc, '');
+    if (finished !== undefined) out.set(desc, finished);
+  }
   return out;
 }
 
@@ -866,10 +1362,16 @@ function resultTextOf(block) {
  * been found. The no-collision path — the overwhelming majority — never touches
  * the file (§ Liveness, cost containment).
  *
- * Resolution order per ledger entry:
- *   1. transcript evidence for its description → definitive;
- *   2. no evidence → the entry's own age against `IN_FLIGHT_TTL_MS`;
- *   3. no usable timestamp either → NOT finished (matrix row 13 — keeps the
+ * Resolution order per ledger entry (#1480 A):
+ *   1. an entry WITH `useId` → that exact dispatch's state: finished / running
+ *      are definitive, `unknown` or no record is no evidence;
+ *   2. an entry WITHOUT `useId` (legacy, or a harness sending no `tool_use_id`)
+ *      → its non-empty description via {@link descFinished}, the current
+ *      dispatch (`selfUseId`) excluded. Never the ledger `id` — a
+ *      `desc (type)` string or a bare subagent type, which matched unrelated
+ *      dispatches (B3);
+ *   3. no evidence → the entry's own age against `IN_FLIGHT_TTL_MS`;
+ *   4. no usable timestamp either → NOT finished (matrix row 13 — keeps the
  *      deny biting rather than inventing a completion).
  *
  * @param {object} params
@@ -877,9 +1379,13 @@ function resultTextOf(block) {
  * @param {number} [params.now]
  * @param {number} [params.ttlMs]
  * @param {(p: string, enc: string) => string} [params.readFn]
- * @returns {(entry: {id: string, desc?: string, at?: string}) => boolean}
+ * @param {string} [params.selfUseId] the CURRENT dispatch's `tool_use_id`
+ * @returns {(entry: {id: string, desc?: string, at?: string, useId?: string}) => boolean}
  */
-export function makeFinishedProbe({ transcriptPath, now = Date.now(), ttlMs = IN_FLIGHT_TTL_MS, readFn = readFileSync } = {}) {
+export function makeFinishedProbe({
+  transcriptPath, now = Date.now(), ttlMs = IN_FLIGHT_TTL_MS, readFn = readFileSync, selfUseId,
+} = {}) {
+  const excludeUseId = exactUseId(selfUseId);
   let index; // undefined = not loaded yet, null = unavailable
   const load = () => {
     if (index !== undefined) return index;
@@ -887,7 +1393,7 @@ export function makeFinishedProbe({ transcriptPath, now = Date.now(), ttlMs = IN
     try {
       if (typeof transcriptPath === 'string' && transcriptPath.length > 0) {
         if (statSync(transcriptPath).size <= MAX_TRANSCRIPT_BYTES) {
-          index = buildTranscriptIndex(readFn(transcriptPath, 'utf8'));
+          index = buildLivenessIndex(readFn(transcriptPath, 'utf8'));
         }
       }
     } catch {
@@ -899,10 +1405,17 @@ export function makeFinishedProbe({ transcriptPath, now = Date.now(), ttlMs = IN
   return (entry) => {
     try {
       const idx = load();
-      const desc = typeof entry?.desc === 'string' && entry.desc !== '' ? entry.desc : entry?.id;
-      if (idx !== null && typeof desc === 'string') {
-        const finished = idx.get(desc);
-        if (finished !== undefined) return finished;
+      if (idx !== null) {
+        const useId = exactUseId(entry?.useId);
+        if (useId !== '') {
+          const state = idx.states.get(useId);
+          if (state === LIVE_FINISHED) return true;
+          if (state === LIVE_RUNNING) return false;
+        } else {
+          const desc = typeof entry?.desc === 'string' ? entry.desc.trim() : '';
+          const finished = desc === '' ? undefined : descFinished(idx, desc, excludeUseId);
+          if (finished !== undefined) return finished;
+        }
       }
       const at = Date.parse(entry?.at ?? '');
       if (Number.isFinite(at)) return now - at > ttlMs;
@@ -920,7 +1433,8 @@ export function makeFinishedProbe({ transcriptPath, now = Date.now(), ttlMs = IN
 /**
  * Identify the wave this dispatch belongs to. Derived from the coordinator's
  * own scope file so a wave transition resets the ledger without anyone having to
- * remember to clear it.
+ * remember to clear it. `findOwnScopeFile` skips provably foreign manifests;
+ * unbound or corrupt manifests still decide under the ENFORCE contract.
  *
  * FALLBACK, stated honestly (review MED): with no readable `wave-scope.json` the
  * key degrades to `<session>|w?|?`, so the ledger spans the whole SESSION and a
@@ -935,22 +1449,75 @@ export function makeFinishedProbe({ transcriptPath, now = Date.now(), ttlMs = IN
  * @param {string} projectDir
  * @param {string} sessionId
  * @param {(p: string, enc: string) => string} readFn — injected `readFileSync`
- *   (the module is late-bound, so it cannot be imported at the top level here)
+ * @param {Set<string>} [ownIds] — process-local ids; repo helpers are late-bound
+ *   by bootstrap, as for the other guard dependencies.
  * @returns {string}
  */
-export function waveKeyOf(projectDir, sessionId, readFn) {
-  for (const dir of ['.pi', '.cursor', '.codex', '.claude']) {
+export function waveKeyOf(projectDir, sessionId, readFn,
+  ownIds = new Set(readProcessLocalSessionIds({ hookInput: { session_id: sessionId } }))) {
+  const { path: scopeFile } = findOwnScopeFile(projectDir, ownIds, classifyManifestSession);
+  if (scopeFile) {
     try {
-      const raw = readFn(path.join(projectDir, dir, 'wave-scope.json'), 'utf8');
+      const raw = readFn(scopeFile, 'utf8');
       const data = JSON.parse(raw);
       const wave = data?.wave ?? '?';
       const role = data?.role ?? '?';
       return `${sessionId}|w${wave}|${role}`;
-    } catch { /* try next location */ }
+    } catch { /* corrupt / unreadable own-or-unknown manifest → no wave */ }
   }
   return `${sessionId}|w?|?`;
 }
 
+/**
+ * The session id this dispatch is keyed under — the payload's own, never a
+ * lock or env read (§ 6 limit 10 of `docs/scope-collision-guard.md`).
+ *
+ * @param {object} input parsed PreToolUse payload
+ * @returns {string}
+ */
+function sessionIdOf(input) {
+  return typeof input?.session_id === 'string' ? input.session_id : 'no-session';
+}
+
+/**
+ * The repo-relative paths of THIS session's ledger and its lock (#1493.3).
+ * The session id is reduced to a path-safe token (`[A-Za-z0-9._-]`, capped at
+ * `MAX_SESSION_TOKEN_CHARS`), so no id can name a file outside `.orchestrator/`;
+ * an id with no usable character falls back to `no-session`.
+ *
+ * @param {string} sessionId
+ * @returns {{ ledgerRel: string, lockRel: string }}
+ */
+export function ledgerPathsFor(sessionId) {
+  const token = String(sessionId).replace(/[^A-Za-z0-9._-]/g, '_').slice(0, MAX_SESSION_TOKEN_CHARS);
+  const safe = /[A-Za-z0-9]/.test(token) ? token : 'no-session';
+  const base = path.join(LEDGER_DIR_REL, `${LEDGER_STEM}.${safe}`);
+  return { ledgerRel: `${base}.json`, lockRel: `${base}.lock` };
+}
+
+/**
+ * Migration read of the pre-#1493 shared ledger: the parsed legacy ledger when
+ * its `waveKey` belongs to THIS session (first `|` segment equals the id), else
+ * `null`. An unparseable or foreign legacy file is not this session's state —
+ * it is neither adopted nor reported as corruption (row 7 is about OUR file).
+ *
+ * @param {string|null} raw legacy file contents (`null` = absent)
+ * @param {string} sessionId
+ * @returns {object|null}
+ */
+function adoptLegacyLedger(raw, sessionId) {
+  if (typeof raw !== 'string') return null;
+  try {
+    const legacy = JSON.parse(raw);
+    return legacy !== null && typeof legacy === 'object' && typeof legacy.waveKey === 'string'
+      && legacy.waveKey.startsWith(`${sessionId}|`)
+      ? legacy
+      : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * The wave NUMBER out of a `waveKeyOf()` key, for the telemetry record (#1092).
  *
@@ -971,6 +1538,88 @@ function waveNumberOf(waveKey) {
   return Number.isSafeInteger(n) && n > 0 ? n : null;
 }
 
+/** Thrown instead of spawning once the shared git deadline has passed. */
+class GitBudgetExhausted extends Error {
+  /** @param {string} subcommand */
+  constructor(subcommand) {
+    super(`git ${subcommand}: shared git budget (${GIT_BUDGET_MS} ms) exhausted`);
+    this.name = 'GitBudgetExhausted';
+  }
+}
+
+/**
+ * A git runner bound to ONE deadline shared by every call of this hook fire
+ * (see `GIT_BUDGET_MS`). Each call gets `timeout` = what is left; once nothing
+ * is left it throws without spawning. `exhausted()` turns sticky the moment a
+ * call is refused or timed out, so a caller can tell "git said no" from "git
+ * never got to answer" — the second is a skip, never evidence (§ matrix rows 8,
+ * 15). `SIGKILL`, not the default SIGTERM: a child that ignores SIGTERM keeps
+ * `execFileSync` blocked past its timeout. Safe here — every call is read-only
+ * plumbing that takes no index lock (§ PSA).
+ *
+ * @param {number} deadline — epoch ms
+ * @returns {{run: (args: string[], cwd: string, opts?: {maxBuffer?: number}) => string,
+ *   exhausted: () => boolean}}
+ */
+function makeGitRunner(deadline) {
+  let exhausted = false;
+  const run = (args, cwd, { maxBuffer } = {}) => {
+    const remaining = Math.floor(deadline - Date.now());
+    if (remaining <= 0) {
+      exhausted = true;
+      throw new GitBudgetExhausted(args[0]);
+    }
+    try {
+      return execFileSync('git', args, {
+        cwd,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'ignore'],
+        timeout: remaining,
+        killSignal: 'SIGKILL',
+        ...(maxBuffer === undefined ? {} : { maxBuffer }),
+      });
+    } catch (e) {
+      if (e?.code === 'ETIMEDOUT') exhausted = true;
+      throw e;
+    }
+  };
+  return { run, exhausted: () => exhausted };
+}
+
+/**
+ * `git rev-parse --show-toplevel` of `cwd`, or `''` when git cannot say.
+ *
+ * @param {string} cwd
+ * @param {ReturnType<typeof makeGitRunner>} git
+ * @returns {string}
+ */
+function gitToplevel(cwd, git) {
+  try {
+    return git.run(['rev-parse', '--show-toplevel'], cwd).trim();
+  } catch {
+    return '';
+  }
+}
+
+/**
+ * Tracked files of the repo rooted at `root`, plus WHY the list is empty when
+ * it had to be (matrix row 8 — degrade, never deny, but leave a reason).
+ *
+ * @param {string} root — a git toplevel, or `''` when none could be resolved
+ * @param {ReturnType<typeof makeGitRunner>} git
+ * @returns {{files: string[], skipped?: 'budget-exhausted'|'git-error'}}
+ */
+function trackedFilesIn(root, git) {
+  const failed = () => ({ files: [], skipped: git.exhausted() ? 'budget-exhausted' : 'git-error' });
+  if (root === '') return failed();
+  try {
+    const stdout = git.run(['ls-files', '-z'], root, { maxBuffer: 32 * 1024 * 1024 });
+    return { files: stdout.split('\0').filter((f) => f.length > 0) };
+  } catch {
+    return failed();
+  }
+}
+
 /**
  * Tracked files, for glob expansion inside `findScopeCollisions`. The library is
  * pure and must not spawn — supplying this is precisely the hook's job.
@@ -984,82 +1633,181 @@ function waveNumberOf(waveKey) {
  * That is the dangerous direction, because the hook is the last gate before the
  * write.
  *
+ * Standalone entry with its own `GIT_BUDGET_MS`; `main()` composes the same two
+ * steps under the deadline it shares with the worktree-base check.
+ *
  * @param {string} cwd
  * @returns {string[]}
  */
 export function listTrackedFiles(cwd) {
-  const opts = {
-    cwd,
-    encoding: 'utf8',
-    maxBuffer: 32 * 1024 * 1024,
-    stdio: ['ignore', 'pipe', 'ignore'],
-  };
-  try {
-    const root = execFileSync('git', ['rev-parse', '--show-toplevel'], opts).trim();
-    if (!root) return [];
-    const stdout = execFileSync('git', ['ls-files', '-z'], { ...opts, cwd: root });
-    return stdout.split('\0').filter((f) => f.length > 0);
-  } catch {
-    return [];
-  }
+  const git = makeGitRunner(Date.now() + GIT_BUDGET_MS);
+  return trackedFilesIn(gitToplevel(cwd, git), git).files;
+}
+
+/**
+ * The SETTINGS ROOT (#1485) — where `harnessBaseRef()` reads the project's
+ * `.claude/settings{,.local}.json`: `$CLAUDE_PROJECT_DIR`, else the git toplevel
+ * of `cwd`, else `cwd`. The launch dir FIRST, unlike `resolveSessionRoot()`: it is the
+ * root the harness applies project settings from, and after entering a worktree
+ * the gitignored `settings.local.json` exists only there.
+ *
+ * @param {string} cwd — the payload `cwd`
+ * @param {string} cwdToplevel — `gitToplevel(cwd)`, `''` when git could not say
+ * @returns {string}
+ */
+function settingsRootOf(cwd, cwdToplevel) {
+  return (process.env.CLAUDE_PROJECT_DIR || '').trim() || cwdToplevel || cwd;
 }
 
 // ---------------------------------------------------------------------------
-// Stale worktree base (#1413) — a WARNING, never a decision
+// Stale worktree base (#1413 → #1485) — a MEASURED mismatch DENIES the dispatch
 //
 // `isolation: "worktree"` makes the HARNESS create `<repo>/.claude/worktrees/
 // agent-<hex>`; no code in this repo creates it and the `Agent` payload carries
-// no base-ref field (the 147-dispatch key census in the module docblock). The
-// base is the SESSION-START commit, and it does not follow a mid-session commit:
-// measured 2026-09-19 (session s18), worktrees created 25 minutes AFTER commit
-// `240efda6` still stood on its parent `8f15f77b`. A fix agent then silently
-// edits the OLD code, and its test run is structurally red on top — `validate-
-// plugin` is vitest's globalSetup and `check-guard-requires-parity.mjs` compares
-// against `git show HEAD:` inside the stale worktree.
+// no base-ref field (the 147-dispatch key census in the module docblock). Which
+// commit it branches from is documented harness behaviour (code.claude.com/docs
+// /en/worktrees § "Choose the base branch", read 2026-10-02): "Subagent worktrees
+// use the same base branch as `--worktree`, so they branch from your repository's
+// default branch unless `worktree.baseRef` is set to `"head"`" — `"fresh"` (the
+// default) is `origin/HEAD`, `"head"` is the current local HEAD.
+//
+// That REPLACES the #1413 model ("the base is the session-start commit"): it fit
+// s18 only because that session ran on `main`, where origin/main WAS the start
+// commit. #1485 measured the general case on a feature branch — agent worktrees
+// stood on `main` (`0efb3e97`), six commits behind the branch HEAD (`47c49652`),
+// so the agents silently edited old code. Owner decision 2026-10-02, option (a):
+// check with `git merge-base --is-ancestor` before dispatch and stop on mismatch.
 //
-// We have no lever on the base, so the only available fix is to be LOUD. This
-// never touches the verdict: the two functions below are TOTAL (every failure
-// resolves to silence), and the caller ignores their result for the decision.
+// ONLY A MEASURED MISMATCH DENIES (`is-ancestor` exit 1 in a full-history repo,
+// against a cached origin ref the harness will branch from as-is). Every
+// non-measurement — no origin/HEAD, a shallow clone, a cached ref the harness
+// refetches first (`stale-remote-ref`), a git failure, an exit code other than
+// 0/1, a throw — is `stale: null` + `skipped`, recorded and ALLOWED: unknown is
+// not mismatch, and this hook guards the dispatch path, where a wrong deny is a
+// session outage (§ the fail-open note at the bottom of this file).
+//
+// Where the hook's base and the harness's can still DIVERGE (Claude Code
+// 2.1.287 bundle, read 2026-10-02):
+//   - a settings layer this hook cannot read (`harnessBaseRef()`) — either way,
+//     wrong deny or missed mismatch, from any `base_ref_source`;
+//   - no `refs/remotes/origin/HEAD` symref: the harness falls back to
+//     `origin/main|master`, the hook skips `no-origin-head` — a missed mismatch
+//     only, never a wrong deny (measured 2026-10-02: 0 of 28 local repos lack
+//     the symref);
+//   - a stale FETCH_HEAD whose refetch then FAILS (offline): the harness keeps
+//     the cached ref, so the skipped deny would have been right — the price of
+//     not knowing in advance whether a fetch will succeed.
 // ---------------------------------------------------------------------------
 
+/** `worktree.baseRef` values the docs define; anything else sets nothing here. */
+const BASE_REF_VALUES = new Set(['head', 'fresh']);
+
+/**
+ * The harness refetches origin before branching a `"fresh"` worktree when
+ * FETCH_HEAD is older than this (Claude Code 2.1.287 bundle, read 2026-10-02:
+ * `Date.now() - mtimeMs > 86400000`, then `git fetch origin <default>` with a
+ * 5 s timeout). Revisit when the harness changes that constant — a mismatch
+ * either skips a real deny or lets a refetched base be denied again.
+ */
+const FETCH_REFRESH_MS = 24 * 60 * 60 * 1000;
+
+/**
+ * The harness's effective `worktree.baseRef`, as far as this hook can see it,
+ * and WHICH layer decided it — read in the documented precedence order (code.
+ * claude.com/docs/en/settings § "Settings precedence", read 2026-10-02): local
+ * → project → user, the FIRST file that sets the key to a defined value wins.
+ * No file sets it → `'fresh'` from `'default'`.
+ *
+ * `settingsRoot` is the SESSION ROOT, not the hook payload's `cwd`: that `cwd`
+ * follows the session's `cd` (docs/en/hooks § "cwd follows Claude"), while the
+ * project settings the harness applies belong to the root it started in.
+ *
+ * Read only on the rare `worktree` branch (14 of 147 measured dispatches carried
+ * `isolation` at all), so the hot dispatch path never pays these reads.
+ *
+ * NAMED CEILING (BV-004): blind to the two layers ABOVE local — managed settings
+ * and the `--settings` CLI flag. The error points BOTH ways: a `"head"` there
+ * with no visible file setting the key reads as `default` → `fresh` → a WRONG
+ * DENY when HEAD is ahead of origin/HEAD; a `"fresh"` there shadowing a visible
+ * `"head"` → a MISSED mismatch. Not read on purpose: `--settings` reaches no
+ * hook, and managed settings arrive through several delivery mechanisms (a
+ * `managed-settings.json` in a system dir, MDM/OS policy, server-managed settings
+ * from the claude.ai console, an embedding host's SDK option — docs settings
+ * § "Managed settings"), combined by their own intra-tier rules; reading the one
+ * file among them would turn an honest "invisible" into a partial view that
+ * still decides. The wrong-deny population is countable instead (HR-105): a
+ * hidden `"head"` with no visible file setting the key yields `decision:"deny"`
+ * records with `base_ref_source:"default"`; a hidden `"head"` shadowed by a
+ * visible `"fresh"` yields them under that file's source instead. Revisit if
+ * such a deny is reported in a session whose `/status` names a managed or
+ * `--settings` source carrying `worktree.baseRef`.
+ *
+ * @param {string} settingsRoot
+ * @returns {{baseRef: 'head'|'fresh', source: 'local'|'project'|'user'|'default'}}
+ */
+function harnessBaseRef(settingsRoot) {
+  const userDir = (process.env.CLAUDE_CONFIG_DIR || '').trim() || path.join(homedir(), '.claude');
+  for (const [source, file] of [
+    ['local', path.join(settingsRoot, '.claude', 'settings.local.json')],
+    ['project', path.join(settingsRoot, '.claude', 'settings.json')],
+    ['user', path.join(userDir, 'settings.json')],
+  ]) {
+    try {
+      const value = JSON.parse(readFileSync(file, 'utf8'))?.worktree?.baseRef;
+      if (BASE_REF_VALUES.has(value)) return { baseRef: value, source };
+    } catch { /* absent or unparseable — the next layer decides */ }
+  }
+  return { baseRef: 'fresh', source: 'default' };
+}
+
+/** Where each `base_ref_source` lives, for the operator-facing deny text. */
+const BASE_REF_SOURCE_LABEL = {
+  local: '.claude/settings.local.json',
+  project: '.claude/settings.json',
+  user: 'user settings.json',
+  default: 'the default — no settings file this hook can read sets it',
+};
+
 /**
  * Facts for the worktree-base check, as a DISCRIMINATED record with three
  * outcomes rather than two (#1424):
  *
- *   - `{stale: true|false, head, session_start_ref, subagent_type?}` — measured.
+ *   - `{stale: true|false, head, base, base_ref, base_ref_source, missing_commits?,
+ *     subagent_type?}` — measured. `stale` means "the worktree would MISS commits
+ *     of HEAD": `git merge-base --is-ancestor HEAD <base>` exited 1 in a repo
+ *     with full history and a FETCH_HEAD younger than `FETCH_REFRESH_MS` (so
+ *     the harness branches from that cached ref without refetching it first).
+ *     A base AHEAD of HEAD (origin moved on, HEAD contained)
+ *     is not stale — nothing of HEAD is lost. `base_ref_source` names the
+ *     settings layer that decided `base_ref` (`harnessBaseRef()`), so a wrong
+ *     deny from a layer this hook cannot read stays countable (HR-105).
  *   - `{stale: null, skipped: <reason>}` — the dispatch WAS on the `worktree`
  *     branch, but the question could not be answered honestly. Still emitted,
- *     because HR-105 needs the denominator: while every such case returned bare
- *     `null` and the caller emitted nothing, "the check never had anything to
- *     say" and "the check was silently disarmed" both read as zero records —
- *     precisely the shape this event exists to close.
- *   - `null` — `isolation !== 'worktree'`. SILENT by construction, and the one
- *     outcome that must stay so: `isolation` appeared in 14 of 147 measured
- *     dispatches, so recording the other ~90% would put the denominator on the
- *     whole hot dispatch path (HR-101).
- *
- * IDENTITY GATE (`.claude/rules/identity-and-locks.md`): `session-start-ref`
- * lives in STATE.md, a SHARED working-copy artefact that routinely belongs to a
- * peer session. It is read only when STATE.md's own `session-id` equals this
- * process's raw id (hook payload `session_id`, else `CLAUDE_CODE_SESSION_ID`) —
- * a process-local witness REPLACES the shared one, never unions with it. On
- * mismatch, absence or any read failure this reports `stale: null`: a confident
- * warning about somebody else's session is worse than no warning at all. The
- * test runs PER CANDIDATE (`continue`, not `break`) — see the loop below.
- *
- * `parseStateMd` is imported DYNAMICALLY and only on the rare `worktree` branch
- * (14 of 147 measured dispatches carried `isolation` at all): it is a leaf module
- * with zero imports and already inside the committed hook-import closure, so
- * reuse costs no new edge, and binding it late keeps a load failure catchable
- * instead of disarming the guard at ESM link time (§ #993 late-bound deps).
+ *     because HR-105 needs the denominator, and never denied (unknown ≠ mismatch).
+ *   - `null` — `isolation !== 'worktree'`. SILENT by construction: recording the
+ *     other ~90% of dispatches would put the denominator on the hot path (HR-101).
+ *
+ * TWO DIRECTORIES, deliberately different: git measures in `cwd` (the payload's,
+ * which follows the session's `cd` — git finds the enclosing repo from any
+ * subdirectory, and inside an entered worktree `"head"` means THAT worktree's
+ * HEAD); settings are read at `settingsRoot` (`settingsRootOf()` — the root the
+ * harness applies project settings from, which is NOT where the record lands:
+ * that is `resolveSessionRoot()`).
+ *
+ * Every git call draws on the hook fire's ONE shared deadline (`GIT_BUDGET_MS`).
+ * A call the budget cut short is no measurement: each skip then reads
+ * `git-budget`, whichever reason the cut call would otherwise have produced — a
+ * timed-out `origin/HEAD` lookup is not evidence that there is none.
  *
  * @param {{tool_input?: unknown}} input — the raw hook payload
- * @param {string} projectDir
- * @param {string} sessionId — `input.session_id`, or `'no-session'`
- * @returns {Promise<{head: string, session_start_ref: string, stale: boolean,
- *   subagent_type?: string}|{stale: null, skipped: string}|null>}
+ * @param {string} cwd — the hook payload's `cwd`
+ * @param {string} settingsRoot — `settingsRootOf()`
+ * @param {ReturnType<typeof makeGitRunner>} gitRunner — the fire's shared runner
+ * @returns {{head: string, base: string, base_ref: 'head'|'fresh',
+ *   base_ref_source: 'local'|'project'|'user'|'default', stale: boolean,
+ *   missing_commits?: number, subagent_type?: string}|{stale: null, skipped: string}|null}
  */
-async function worktreeBaseFacts(input, projectDir, sessionId) {
+function worktreeBaseFacts(input, cwd, settingsRoot, gitRunner) {
   // The applicability gate sits OUTSIDE the try on purpose: everything below it
   // resolves to a `skipped` RECORD, so a throw here must not be able to mint one
   // for a dispatch that was never on the `worktree` branch at all.
@@ -1067,98 +1815,106 @@ async function worktreeBaseFacts(input, projectDir, sessionId) {
   if (toolInput === null || typeof toolInput !== 'object') return null;
   if (toolInput.isolation !== 'worktree') return null;
 
+  /** @param {string} reason */
+  const skip = (reason) => ({ stale: null, skipped: gitRunner.exhausted() ? 'git-budget' : reason });
   try {
-    const ownId = sessionId && sessionId !== 'no-session'
-      ? sessionId
-      : (process.env.CLAUDE_CODE_SESSION_ID || '');
-    if (!ownId) return { stale: null, skipped: 'no-own-id' };
-
-    const { parseStateMd } = await import(
-      pathToFileURL(path.join(PLUGIN_ROOT, 'scripts', 'lib', 'state-md', 'yaml-parser.mjs')).href
-    );
-
-    // #1424: the identity test lives INSIDE the loop. Breaking at the first
-    // PARSEABLE STATE.md and testing `session-id` afterwards meant a single
-    // left-over `.pi/STATE.md` — `.pi` sorts before `.claude` in
-    // STATE_DIR_CANDIDATES — disarmed the check for a session whose own
-    // `.claude/STATE.md` sat right there, readable and matching. `sawStateMd`
-    // keeps the two silences apart afterwards: "nothing to read" is a different
-    // fact from "read, and none of it was mine".
-    let frontmatter = null;
-    let sawStateMd = false;
-    for (const dir of STATE_DIR_CANDIDATES) {
-      try {
-        const parsed = parseStateMd(readFileSync(path.join(projectDir, dir, 'STATE.md'), 'utf8'));
-        if (!parsed?.frontmatter) continue;
-        sawStateMd = true;
-        if (parsed.frontmatter['session-id'] !== ownId) continue;
-        frontmatter = parsed.frontmatter;
-        break;
-      } catch { /* try the next state dir */ }
-    }
-    if (frontmatter === null) {
-      return { stale: null, skipped: sawStateMd ? 'identity-mismatch' : 'no-state-md' };
-    }
-
-    const startRef = typeof frontmatter['session-start-ref'] === 'string'
-      ? frontmatter['session-start-ref'].trim()
-      : '';
-    if (startRef === '') return { stale: null, skipped: 'no-start-ref' };
+    /** @param {string[]} args */
+    const git = (args) => gitRunner.run(args, cwd).trim();
 
     let head = '';
-    try {
-      head = execFileSync('git', ['rev-parse', 'HEAD'], {
-        cwd: projectDir,
-        encoding: 'utf8',
-        stdio: ['ignore', 'pipe', 'ignore'],
-      }).trim();
-    } catch {
-      return { stale: null, skipped: 'git-error' };
-    }
-    if (head === '') return { stale: null, skipped: 'git-error' };
+    try { head = git(['rev-parse', '--verify', 'HEAD^{commit}']); } catch { /* below */ }
+    if (head === '') return skip('git-error');
 
-    const facts = { head, session_start_ref: startRef, stale: head !== startRef };
+    const { baseRef, source } = harnessBaseRef(settingsRoot);
+    const facts = { head, base_ref: baseRef, base_ref_source: source };
     if (typeof toolInput.subagent_type === 'string' && toolInput.subagent_type !== '') {
       facts.subagent_type = toolInput.subagent_type;
     }
-    return facts;
+    // `"head"` inside a worktree resolves to THAT worktree's HEAD (docs, same
+    // section) — the very `git rev-parse HEAD` above, run in `cwd`.
+    if (baseRef === 'head') return { ...facts, base: head, stale: false };
+
+    // `"fresh"`: origin/HEAD. Not cached locally → the harness fetches, or
+    // falls back to HEAD; neither outcome is knowable here → skip, not deny.
+    let base = '';
+    try { base = git(['rev-parse', '--verify', '--quiet', 'refs/remotes/origin/HEAD^{commit}']); } catch { /* below */ }
+    if (base === '') return skip('no-origin-head');
+    if (base === head) return { ...facts, base, stale: false };
+
+    try {
+      git(['merge-base', '--is-ancestor', head, base]);
+      return { ...facts, base, stale: false };
+    } catch (e) {
+      // Exit 1 is the ONE candidate "no"; 128 (bad object), a timeout or a
+      // signal is a non-measurement and must not accuse anybody.
+      if (e?.status !== 1) return skip('git-error');
+    }
+    // ...and exit 1 is a MEASUREMENT only over full history. A shallow clone's
+    // cut-off graph answers "no" for a HEAD that IS an ancestor (measured
+    // 2026-10-02: `clone --depth 1` + `fetch --depth 1` → exit 1, the full source
+    // → exit 0). Probed only here, on the rare "no": an exit 0, which no missing
+    // history can fake, never pays for it. A failed probe cannot rule shallow
+    // out, so it skips as well. ONE spawn answers both questions below (two
+    // lines, in argument order) — the deny path is the one that must finish
+    // inside the shared budget.
+    let shallow = '';
+    let fetchHeadPath = '';
+    try {
+      [shallow = '', fetchHeadPath = ''] = git(['rev-parse', '--is-shallow-repository', '--git-path', 'FETCH_HEAD'])
+        .split('\n')
+        .map((line) => line.trim());
+    } catch { /* below */ }
+    if (shallow !== 'false') return skip(shallow === 'true' ? 'shallow' : 'git-error');
+
+    // ...and only over a ref the harness will actually branch from. With
+    // FETCH_HEAD older than `FETCH_REFRESH_MS` (or absent — the harness reads
+    // that as mtime 0) it first fetches origin and branches from the FETCHED
+    // tip, which may well contain HEAD by now; this hook never fetches (network
+    // inside a 5 s PreToolUse budget), so the cached ref decides nothing here.
+    let fetchedMs = 0;
+    try { if (fetchHeadPath !== '') fetchedMs = statSync(path.resolve(cwd, fetchHeadPath)).mtimeMs; } catch { /* absent → stale */ }
+    if (Date.now() - fetchedMs > FETCH_REFRESH_MS) return { stale: null, skipped: 'stale-remote-ref' };
+
+    let missing = Number.NaN;
+    try { missing = Number.parseInt(git(['rev-list', '--count', `${base}..${head}`]), 10); } catch { /* optional */ }
+    return { ...facts, base, stale: true, ...(Number.isInteger(missing) ? { missing_commits: missing } : {}) };
   } catch {
-    // Total by construction: no parser, an unreadable state dir, anything else.
-    // Still a RECORD rather than silence — the dispatch WAS on the `worktree`
-    // branch, and a broken probe that emits nothing is indistinguishable from a
-    // probe that had nothing to report (#1424 / HR-105).
+    // Total by construction. Still a RECORD rather than silence (#1424 / HR-105).
     return { stale: null, skipped: 'probe-error' };
   }
 }
 
 /**
- * The operator-facing warning. It names the ACTION, not just the condition —
- * a warning the coordinator cannot act on is noise (HR-106).
- *
- * NO `⚠ ` PREFIX HERE: this text is handed to `emitWarn`, which prefixes it on
- * both channels it writes (stderr and the `systemMessage` payload). Prefixing
- * here too produced `⚠ ⚠ …`.
- *
- * @param {{head: string, session_start_ref: string}} facts
- * @returns {string}
+ * The deny reason + suggestion for a measured stale base. Names the ACTION, not
+ * just the condition (HR-106), and the settings layer that chose `"fresh"`: an
+ * operator whose `"head"` lives where this hook cannot read (managed settings,
+ * `--settings`) then reads "the default" and knows the deny rests on that blind
+ * spot. The reason stays ONE line: `emitDeny` lifts the first line into the
+ * operator-visible `systemMessage` headline.
+ *
+ * @param {{head: string, base: string, base_ref_source?: string, missing_commits?: number}} facts
+ * @returns {{reason: string, suggestion: string}}
  */
-function staleWorktreeWarning(facts) {
-  const head = facts.head.slice(0, 12);
-  const base = facts.session_start_ref.slice(0, 12);
-  return [
-    `${HOOK_NAME}: STALE WORKTREE BASE (#1413) — this dispatch uses `
-      + `isolation: "worktree", but HEAD (${head}) has moved past this session's `
-      + `session-start-ref (${base}).`,
-    '  The harness bases a new agent worktree on the SESSION-START commit and offers',
-    '  no base-ref field, so the agent will silently get the OLDER code — and its test',
-    '  run is structurally red on top (check-guard-requires-parity compares against',
-    '  `git show HEAD:`, and validate-plugin is vitest\'s globalSetup).',
-    '  DO ONE OF: dispatch this wave IN-PLACE (omit `isolation`) — or verify the base',
-    '  before trusting the agent\'s result:',
-    '    git worktree list --porcelain | awk -v h="$(git rev-parse HEAD)" '
-      + '\'/^worktree /{w=$2} /^HEAD /{if (w ~ /\\.claude\\/worktrees\\/agent-/ && $2 != h) '
-      + 'print "STALE " substr($2,1,12) " " w}\'',
-  ].join('\n');
+function staleWorktreeDeny(facts) {
+  const missing = Number.isInteger(facts.missing_commits)
+    ? `${facts.missing_commits} commit(s)`
+    : 'commits';
+  const from = BASE_REF_SOURCE_LABEL[facts.base_ref_source] ?? BASE_REF_SOURCE_LABEL.default;
+  return {
+    reason:
+      `${HOOK_NAME}: STALE WORKTREE BASE (#1485) — isolation: "worktree" would branch this `
+      + `agent from origin/HEAD ${facts.base.slice(0, 12)} (worktree.baseRef "fresh" from ${from}), `
+      + `which is missing ${missing} of HEAD ${facts.head.slice(0, 12)}; the agent would silently edit OLD code.`,
+    suggestion: [
+      'DO ONE OF:',
+      '  1. re-dispatch IN-PLACE — omit `isolation` (isolation "none");',
+      '  2. set `"worktree": {"baseRef": "head"}` in .claude/settings.json so agent',
+      '     worktrees branch from your local HEAD (code.claude.com/docs/en/worktrees) —',
+      '     a higher layer setting "fresh" (local settings, --settings, managed) overrides it;',
+      '  3. get HEAD into the default branch on origin and fetch, then re-dispatch.',
+      'Uncommitted changes reach no worktree under any base — commit first or go in-place.',
+    ].join('\n'),
+  };
 }
 
 /**
@@ -1378,7 +2134,10 @@ export function decide({ input, ledger, ledgerCorrupt, waveKey, knownFiles, coll
   }
 
   const desc = agentDescOf(toolInput);
-  const self = { id, desc, files, at };
+  // #1480 A: the exact dispatch id travels with the entry, so liveness is never
+  // guessed from a description when the harness names the dispatch itself.
+  const useId = exactUseId(input?.tool_use_id);
+  const self = useId === '' ? { id, desc, files, at } : { id, desc, files, at, useId };
 
   // Row 7: ledger existed but was unparseable. Terminal warn — decided here and
   // returned, never emitted mid-flow. SELF-HEALING since the review: the verdict
@@ -1399,13 +2158,51 @@ export function decide({ input, ledger, ledgerCorrupt, waveKey, knownFiles, coll
     ? ledger.agents.filter((a) => a !== null && typeof a === 'object' && typeof a.id === 'string')
     : [];
 
-  // Row 10: same agent re-dispatched (a retry after a failed agent is legitimate).
-  // Replace its record instead of letting it collide with its own earlier self.
-  const others = prior.filter((a) => a.id !== id);
+  // Row 10 (#1480 B4): a predecessor with the SAME agent id is no longer dropped
+  // before the check. Dropping it unconditionally erased the claim of a still
+  // RUNNING agent: [a,b] running, re-dispatched as [b,c], and a third agent on
+  // `a` was allowed while the first run still wrote it. Now:
+  //   - the same `tool_use_id` → the same dispatch evaluated again → replaced;
+  //   - FINISHED (probe true) → pruned below, so a retry after a failed agent
+  //     stays allowed — a failed agent finishes via its `failed` carrier,
+  //     `is_error` or its report;
+  //   - both dispatches carry distinct exact ids and the predecessor is NOT
+  //     finished → an ordinary collision partner (row 11);
+  //   - otherwise no exact statement is possible → it stays as a CLAIM (a third
+  //     agent hitting only its scope still collides) but never collides with
+  //     this retry.
+  // Named ceiling (BV-004): without exact ids a same-id retry cannot tell "my
+  // earlier run is still going" from "it failed", so the retry is allowed while
+  // the earlier claim is kept — the pre-#1480 behaviour for the retry itself,
+  // and a claim a third agent can hit until the earlier run finishes or its TTL
+  // lapses. Revisit-Trigger: a harness without `tool_use_id` in the PreToolUse
+  // payload dispatches a measurable share of this repo's waves.
+  // A predecessor wholly covered by this retry's scope, neither carrying an
+  // exact id, adds nothing but ledger growth — both are resolved through the
+  // same description and this entry is the younger one — so it is superseded.
+  const superseded = (a) => a.id === id && (
+    (useId !== '' && exactUseId(a.useId) === useId)
+    || (useId === '' && exactUseId(a.useId) === '' && desc !== '' && a.desc === desc
+      && Array.isArray(a.files) && a.files.every((f) => files.includes(f)))
+  );
+  const others = prior.filter((a) => !superseded(a));
+
+  // One comparison key per record, unique by construction: several records may
+  // share an agent id now, and `findScopeCollisions` reports equal ids as
+  // duplicates rather than comparing them. The readable id stays the key where
+  // it is unique, so the deny text and every single-record wave are unchanged.
+  const used = new Set([id]);
+  const partners = others.map((entry) => {
+    let key = entry.id;
+    for (let n = 2; used.has(key); n++) key = `${entry.id} #${n}`;
+    used.add(key);
+    const selfClaim = entry.id === id && !(useId !== '' && exactUseId(entry.useId) !== '');
+    return { key, entry, selfClaim };
+  });
 
   const known = new Set(Array.isArray(knownFiles) ? knownFiles : []);
   const agentScopes = [
-    ...others.map((a) => ({ id: a.id, files: promoteDirEntries(a.files, known) })),
+    ...partners.map((p) => ({ id: p.key, files: promoteDirEntries(p.entry.files, known) })),
     { id, files: promoteDirEntries(files, known) },
   ];
 
@@ -1453,28 +2250,35 @@ export function decide({ input, ledger, ledgerCorrupt, waveKey, knownFiles, coll
   // § Liveness — the review's HIGH finding. A collision with an agent that has
   // ALREADY FINISHED is a sequential repair pass, not a race. The probe is called
   // ONLY here, so the transcript is read only on the path that would deny.
-  const byId = new Map(others.map((a) => [a.id, a]));
+  const byKey = new Map(partners.map((p) => [p.key, p]));
   const probe = typeof isFinished === 'function' ? isFinished : () => false;
-  const finishedIds = new Set();
+  const finishedKeys = new Set();
   const live = [];
+  let selfClaims = 0;
   for (const c of mine) {
-    const otherId = c.a === id ? c.b : c.a;
-    const entry = byId.get(otherId);
-    if (entry !== undefined && probe(entry)) {
-      finishedIds.add(otherId);
+    const otherKey = c.a === id ? c.b : c.a;
+    const partner = byKey.get(otherKey);
+    if (partner !== undefined && probe(partner.entry)) {
+      finishedKeys.add(otherKey);
+      continue;
+    }
+    // Row 10: an unfinished same-id claim without exact ids is kept, not collided with.
+    if (partner?.selfClaim === true) {
+      selfClaims++;
       continue;
     }
     live.push(c);
   }
+  const counted = mine.length - selfClaims;
 
   // Row 10a: every colliding prior agent has finished. Allow AND prune their
   // records — leaving them would make the NEXT repair pass pay the transcript
   // scan again for a question already answered.
   if (live.length === 0) {
-    const kept = others.filter((a) => !finishedIds.has(a.id));
+    const kept = partners.filter((p) => !finishedKeys.has(p.key)).map((p) => p.entry);
     return {
       action: 'allow',
-      telemetry: telemetryFor('allow-finished', mine.length),
+      telemetry: finishedKeys.size > 0 ? telemetryFor('allow-finished', counted) : telemetryFor('allow'),
       ledger: {
         waveKey,
         updated: at,
@@ -1487,13 +2291,15 @@ export function decide({ input, ledger, ledgerCorrupt, waveKey, knownFiles, coll
   // Row 11: the one case this hook exists for.
   const shown = live.slice(0, MAX_REPORTED_COLLISIONS);
   const lines = shown.map((c) => {
-    const other = c.a === id ? c.b : c.a;
+    const otherKey = c.a === id ? c.b : c.a;
+    const other = byKey.get(otherKey)?.entry.id ?? otherKey;
+    const earlier = other === id ? ' (an earlier dispatch of the same agent)' : '';
     const ev = Array.isArray(c.evidence) ? c.evidence : [];
     const evShown = ev.slice(0, MAX_EVIDENCE_PER_COLLISION).map(clipPath).join(', ');
     const more = ev.length > MAX_EVIDENCE_PER_COLLISION
       ? ` (+${ev.length - MAX_EVIDENCE_PER_COLLISION} more)`
       : '';
-    return `  • "${id}" ↔ "${other}" [${c.kind}]: ${evShown}${more}`;
+    return `  • "${id}" ↔ "${other}"${earlier} [${c.kind}]: ${evShown}${more}`;
   });
   const omitted = live.length > shown.length ? `\n  (+${live.length - shown.length} further collisions)` : '';
 
@@ -1508,11 +2314,12 @@ export function decide({ input, ledger, ledgerCorrupt, waveKey, knownFiles, coll
     'Two agents editing one file at the same time race each other (PSA-002). ' +
     'Give the file exactly ONE owner in the wave plan, or wait for the named ' +
     `agent(s) to finish and re-dispatch — a finished agent no longer blocks. ` +
-    `If the ledger is stale, delete ${LEDGER_REL}.`;
+    `If the ledger is stale, delete this session's ${ledgerPathsFor(sessionIdOf(input)).ledgerRel} ` +
+    '— never another session\'s file beside it, which holds that session\'s live claims.';
 
   // Deliberately NOT persisting the ledger on deny: the dispatch did not happen,
   // so recording it would make the retry-after-fix look like a duplicate.
-  return { action: 'deny', telemetry: telemetryFor('deny', mine.length), reason, suggestion };
+  return { action: 'deny', telemetry: telemetryFor('deny', counted), reason, suggestion };
 }
 
 // ---------------------------------------------------------------------------
@@ -1524,18 +2331,61 @@ async function main() {
   const input = await readStdin();
   if (!input) return emitAllow();
 
-  const projectDir = typeof input.cwd === 'string' && input.cwd !== ''
+  // The payload `cwd` follows the session's `cd`; it names the repo git measures
+  // in, and only through its git toplevel where this session's state lives
+  // (`resolveSessionRoot()`) — a `cd sub` must not move the ledger.
+  const cwd = typeof input.cwd === 'string' && input.cwd !== ''
     ? input.cwd
     : bannerProjectDir();
-  const sessionId = typeof input.session_id === 'string' ? input.session_id : 'no-session';
+  const sessionId = sessionIdOf(input);
 
   // Cheap pre-check: skip all I/O for the overwhelmingly common non-dispatch call.
   if (input.tool_name !== DISPATCH_TOOL) return emitAllow();
 
-  const waveKey = waveKeyOf(projectDir, sessionId, readFileSync);
-  const knownFiles = listTrackedFiles(projectDir);
-  const isFinished = makeFinishedProbe({ transcriptPath: input.transcript_path });
-  const ledgerPath = path.join(projectDir, LEDGER_REL);
+  // ONE git deadline for this whole fire (`GIT_BUDGET_MS`). Worst case 7 spawns
+  // against it: the toplevel below, up to 5 in `worktreeBaseFacts` (HEAD,
+  // origin/HEAD, is-ancestor, shallow+FETCH_HEAD, rev-list) and `ls-files`.
+  const git = makeGitRunner(Date.now() + GIT_BUDGET_MS);
+  const cwdToplevel = gitToplevel(cwd, git);
+  const sessionRoot = resolveSessionRoot(cwd, cwdToplevel);
+
+  const ownIds = new Set(readProcessLocalSessionIds({ hookInput: input }));
+  const waveKey = waveKeyOf(sessionRoot, sessionId, readFileSync, ownIds);
+  // `selfUseId`: this dispatch's own tool_use may already stand in the transcript
+  // and must not make a finished same-named predecessor look alive (#1480 A).
+  const isFinished = makeFinishedProbe({ transcriptPath: input.transcript_path, selfUseId: input.tool_use_id });
+  const { ledgerRel, lockRel } = ledgerPathsFor(sessionId);
+  const ledgerPath = path.join(sessionRoot, ledgerRel);
+
+  // #1485 — the stale-worktree-base verdict, computed BEFORE the ledger cycle
+  // (and outside the lock: its git spawns hold nobody up there). It never
+  // reads the collision verdict and a collision DENY always wins; on its own it
+  // denies ONLY a measured mismatch (`stale === true`). Every skip is allowed.
+  // It must be known before the cycle because a dispatch this check will deny
+  // never happens, so the cycle must not persist it: a phantom claim would make
+  // the deny's own remedy — the same agent re-dispatched in place under a new
+  // tool_use_id — collide with it for up to `IN_FLIGHT_TTL_MS`.
+  //
+  // It draws on the shared budget BEFORE the tracked-file listing: a missed
+  // stale base has no later gate (matrix row 15), a missed listing only
+  // degrades glob expansion, and three later gates still see a collision.
+  const worktreeBase = worktreeBaseFacts(input, cwd, settingsRootOf(cwd, cwdToplevel), git);
+  const staleDeny = worktreeBase?.stale === true ? staleWorktreeDeny(worktreeBase) : null;
+
+  // Listed at `cwd`'s toplevel ONLY: the declared paths are repo-relative to the
+  // repo the agents edit, which is the one the session works in (after entering
+  // a worktree: that worktree). Whenever git resolved it, it IS `sessionRoot` —
+  // except inside a harness agent worktree, which `sessionRoot` lifts to its
+  // parent (#1492) and which lists the same repo's files from its own HEAD, and
+  // in a session launched in a repo SUBDIRECTORY, where `sessionRoot` is that
+  // launch dir and the listing stays at the toplevel above it;
+  // when git could not, `sessionRoot` falls back to a `.git` ancestor (git just
+  // failed there), `$CLAUDE_PROJECT_DIR` or a bare `cwd` — another repo, or a
+  // subdirectory from which `ls-files` answers subdir-relative (the review-MED
+  // class above) — so the listing degrades (matrix row 8) instead of following
+  // it there.
+  const known = trackedFilesIn(cwdToplevel, git);
+  const knownFiles = known.files;
 
   // The read-modify-write CYCLE, run under the ledger lock below. Everything
   // inside is synchronous and emits NOTHING — an emit here would `process.exit()`
@@ -1549,7 +2399,15 @@ async function main() {
     } catch (err) {
       // Absent ledger is the normal first-dispatch case, NOT corruption (row 7
       // must not fire on every wave's first agent).
-      if (err?.code !== 'ENOENT') ledgerCorrupt = true;
+      if (err?.code !== 'ENOENT') {
+        ledgerCorrupt = true;
+      } else {
+        // #1493.3 migration: claims this session recorded in the shared
+        // pre-#1493 file before the split still bind. Read, never touched.
+        let legacyRaw = null;
+        try { legacyRaw = readFileSync(path.join(sessionRoot, LEGACY_LEDGER_REL), 'utf8'); } catch { /* absent */ }
+        ledger = adoptLegacyLedger(legacyRaw, sessionId);
+      }
     }
 
     const verdict = decide({
@@ -1562,7 +2420,9 @@ async function main() {
       isFinished,
     });
 
-    if (verdict.ledger) {
+    // Not on a stale-base deny — the same rule as the collision deny path
+    // (`decide()`, "Deliberately NOT persisting the ledger on deny").
+    if (verdict.ledger && staleDeny === null) {
       try {
         writeJsonAtomicSync(ledgerPath, verdict.ledger);
       } catch {
@@ -1574,7 +2434,7 @@ async function main() {
   };
 
   let verdict;
-  const lockPath = path.join(projectDir, LEDGER_LOCK_REL);
+  const lockPath = path.join(sessionRoot, lockRel);
   try {
     mkdirSync(path.dirname(lockPath), { recursive: true });
   } catch { /* the unlocked fallback below still works */ }
@@ -1607,72 +2467,75 @@ async function main() {
   // import is dynamic so a checkout without `scripts/lib/events.mjs` degrades to
   // silence instead of crashing (§ Import safety), and the catch guarantees a
   // failed write cannot change the verdict or the exit code.
+  //
+  // `decide()` never sees the stale-base check, so its `ledger_result` describes
+  // the COLLISION verdict alone. When the stale base is what actually blocks the
+  // dispatch (no collision deny beside it — that one keeps `deny`), the record
+  // says so (#1489 Pkt 8): recorded as `allow`, a refused dispatch counted as a
+  // dispatched one in every later query. The replaced value survives as
+  // `collision_result`, so a `warn-ledger-corrupt` / `warn-not-evaluable` behind
+  // a stale-base deny is not reported on stderr alone.
   if (verdict.telemetry) {
+    const telemetry = {
+      ...verdict.telemetry,
+      ...(staleDeny !== null && verdict.action !== 'deny'
+        ? { ledger_result: 'deny-stale-base', collision_result: verdict.telemetry.ledger_result }
+        : {}),
+      ...(known.skipped === undefined ? {} : { known_files_skipped: known.skipped }),
+    };
     try {
       const { emitEvent, sessionAttribution } = await import(
         pathToFileURL(path.join(PLUGIN_ROOT, 'scripts', 'lib', 'events.mjs')).href
       );
       await emitEvent(
         SCOPE_EVENT,
-        { hook: HOOK_NAME, ...verdict.telemetry, ...sessionAttribution(projectDir) },
-        { repoRoot: projectDir }
+        { hook: HOOK_NAME, ...telemetry, ...sessionAttribution(sessionRoot) },
+        { repoRoot: sessionRoot }
       );
     } catch { /* observability is best-effort — it never blocks the decision */ }
   }
 
-  // #1413 — the stale-worktree-base warning, also awaited BEFORE the terminal
-  // emit for the same process.exit() reason as the block above. It reads
-  // `verdict` not at all: it can never turn an allow into a deny, and a git or
-  // STATE.md failure resolves to silence rather than to a wrong accusation.
-  //
-  // ROUTED TO THE OPERATOR, not to stderr alone (w3-5): under the exit-0
-  // PreToolUse protocol stderr goes nowhere — `io.mjs:545` calls it the "Debug
-  // channel … Invisible under exit 0" — so the first cut of this check announced
-  // the s18 incident class to a log and to nobody. The visible channel is the
-  // top-level `systemMessage`, i.e. `emitWarn`, which carries NO
-  // `permissionDecision` and therefore still means ALLOW (io.mjs § "which is
-  // precisely what keeps warn non-blocking").
-  //
-  // The note is CARRIED to the single terminal emit below rather than emitted
-  // here, because `emitWarn` calls `process.exit(0)` and never returns — warning
-  // inline would terminate the process before a collision DENY could be emitted,
-  // flipping a block into an allow (§ stdout discipline, the same reason
-  // `decide()` is pure).
+  // #1485 — the stale-worktree-base record (verdict computed above, before the
+  // cycle), awaited BEFORE the terminal emit for the same process.exit() reason
+  // as the block above.
   //
   // `null` here means "not a worktree dispatch" and stays silent; ANY other
   // shape is emitted, including the `{stale: null, skipped: …}` non-measurements
-  // (#1424). The warning still fires on `stale === true` alone — a skipped probe
-  // accuses nobody.
-  const worktreeBase = await worktreeBaseFacts(input, projectDir, sessionId);
-  let staleNote = null;
+  // (#1424), with this check's own `decision` folded into the SAME record
+  // rather than a second event.
   if (worktreeBase !== null) {
-    if (worktreeBase.stale === true) staleNote = staleWorktreeWarning(worktreeBase);
     try {
       const { emitEvent, sessionAttribution } = await import(
         pathToFileURL(path.join(PLUGIN_ROOT, 'scripts', 'lib', 'events.mjs')).href
       );
       await emitEvent(
         WORKTREE_BASE_EVENT,
-        { hook: HOOK_NAME, ...worktreeBase, ...sessionAttribution(projectDir) },
-        { repoRoot: projectDir }
+        {
+          hook: HOOK_NAME,
+          ...worktreeBase,
+          decision: staleDeny === null ? 'allow' : 'deny',
+          ...sessionAttribution(sessionRoot),
+        },
+        { repoRoot: sessionRoot }
       );
     } catch { /* observability is best-effort — it never blocks the decision */ }
   }
 
-  // ONE terminal emit, with the #1413 note folded in where a visible channel is
-  // free. On DENY the dispatch does not happen and `systemMessage` already
-  // carries the ⛔ headline, so the note stays on the debug channel — a stale
-  // base is moot for a dispatch that was just blocked.
+  // ONE terminal emit. A collision DENY keeps its own reason — the dispatch is
+  // blocked either way — and the stale base goes to the debug channel beside it.
   if (verdict.action === 'deny') {
-    if (staleNote !== null) {
-      try { console.error(`⚠ ${staleNote}`); } catch { /* stderr may be closed */ }
+    if (staleDeny !== null) {
+      try { console.error(`⚠ ${staleDeny.reason}`); } catch { /* stderr may be closed */ }
     }
     return emitDeny(verdict.reason, verdict.suggestion);
   }
-  if (verdict.action === 'warn') {
-    return emitWarn(staleNote === null ? verdict.note : `${verdict.note}\n\n${staleNote}`);
+  if (staleDeny !== null) {
+    if (verdict.action === 'warn') {
+      try { console.error(`⚠ ${verdict.note}`); } catch { /* stderr may be closed */ }
+    }
+    return emitDeny(staleDeny.reason, staleDeny.suggestion);
   }
-  if (staleNote !== null) return emitWarn(staleNote);
+  if (verdict.action === 'warn') return emitWarn(verdict.note);
   return emitAllow();
 }
 
@@ -1720,9 +2583,10 @@ if (invokedAsScript()) {
   //      `enforce-scope`'s fail-closed handler — and the reason is the asymmetry
   //      named in the matrix header: enforce-scope guards a WRITE (denying one
   //      write is cheap), this guards the DISPATCH path (denying every dispatch
-  //      is a session outage). The bug this could hide is caught downstream by
+  //      is a session outage). A hidden COLLISION is caught downstream by
   //      `validate-wave-scope.mjs` and by `enforce-scope` at write time; a
-  //      wrongly-denied dispatch is caught by nothing.
+  //      hidden #1485 stale base is not (matrix row 15) — the accepted cost of
+  //      the same asymmetry; a wrongly-denied dispatch is caught by nothing.
   // -------------------------------------------------------------------------
   try {
     await bootstrap();