session-orchestrator 5.3.0 → 5.5.0

package/scripts/lib/vault-mirror/render-learnings.mjs

@@ -1,7 +1,8 @@
 /**
  * render-learnings.mjs — Learning markdown generators for vault-mirror (Issue #283 split).
  *
- * Exports: detectLearningSchema, normalizeLearningEntry, generateLearningNote, generateLearningNoteV2
+ * Exports: detectLearningSchema, normalizeLearningEntry, generateLearningNote, generateLearningNoteV2,
+ *          sourceRecordValue, learningSourceRecord, sourceRecordLine (#1503)
  */
 
 import { toDate, truncateAtWord, yamlQuoteIfNeeded, subjectToSlug, isValidSlug, buildTag, resolveSourceSessionLink } from './utils.mjs';
@@ -18,6 +19,63 @@ export function detectLearningSchema(entry) {
   return entry && typeof entry.text === 'string' ? 'v2' : 'v1';
 }
 
+/**
+ * Characters a `source-record:` value may carry (#1503). The value is always
+ * written double-quoted, and BOTH readers of it — the vault-sync YAML loader and
+ * the line-based `parseFrontmatter` in utils.mjs, which only strips the
+ * surrounding quotes and never unescapes — must read back exactly the string
+ * that was rendered. Excluding `"`, `\`, whitespace and anything non-ASCII is
+ * what makes that round trip lossless without an escaping scheme. Record uuids,
+ * kebab ids, session uuids and ISO timestamps all fit.
+ */
+const SOURCE_RECORD_RE = /^[A-Za-z0-9][A-Za-z0-9._:+@/-]{0,199}$/;
+
+/**
+ * Normalise one candidate `source-record` value (#1503): the identity of the
+ * JSONL record a vault note was rendered from. Returns `null` for anything that
+ * cannot round-trip through the frontmatter (see {@link SOURCE_RECORD_RE}) — the
+ * line is then omitted and the record-level ownership check is skipped for that
+ * entry, which is the same "absent = allow" reading an old note gets.
+ *
+ * Shared by both renderers so the rendered value and the value process.mjs
+ * compares against come from ONE derivation.
+ *
+ * @param {unknown} value
+ * @returns {string|null}
+ */
+export function sourceRecordValue(value) {
+  if (typeof value !== 'string') return null;
+  const trimmed = value.trim();
+  return SOURCE_RECORD_RE.test(trimmed) ? trimmed : null;
+}
+
+/**
+ * The `source-record` of a learning note: the record's own `id` (a uuid for v1
+ * producers, the kebab id for v2 and for alias producers whose id was derived
+ * from the subject by {@link normalizeLearningEntry}).
+ *
+ * Named ceiling: a derived id IS the subject slug, so two repos holding the same
+ * subject under derived ids render the same `source-record` and this field
+ * cannot tell them apart — `source-repo` and the CLI's repo-root resolution are
+ * what separate those.
+ *
+ * @param {object} entry - normalized learning entry.
+ * @returns {string|null}
+ */
+export function learningSourceRecord(entry) {
+  return sourceRecordValue(entry?.id);
+}
+
+/**
+ * Render the `source-record:` frontmatter line, or `''` when the entry has no
+ * representable record key.
+ * @param {string|null} value - output of {@link sourceRecordValue}.
+ * @returns {string}
+ */
+export function sourceRecordLine(value) {
+  return value === null ? '' : `source-record: "${value}"\n`;
+}
+
 const firstString = (...vals) => vals.find((v) => typeof v === 'string' && v.length > 0);
 
 const joinList = (v) =>
@@ -112,6 +170,9 @@ export function generateLearningNote(entry, slug, opts = {}) {
   // vault-sync schema declares source-repo OPTIONAL).
   const sourceRepoLine =
     typeof opts.repoNs === 'string' && opts.repoNs.length > 0 ? `source-repo: ${opts.repoNs}\n` : '';
+  // #1503: the record this note was rendered from — process.mjs refuses to
+  // overwrite a note whose `source-record` names a different record.
+  const recordLine = sourceRecordLine(learningSourceRecord(entry));
 
   // source_session is emitted as an Obsidian wikilink ONLY when source_session
   // resolves to a real, mirror-able session id (semantic or UUID-v4). Anything
@@ -132,7 +193,7 @@ created: ${created}
 updated: ${updated}
 tags: ${tags}
 source_session: ${sourceSessionLink}
-${expiresLine}${sourceRepoLine}_generator: ${GENERATOR_MARKER}
+${expiresLine}${sourceRepoLine}${recordLine}_generator: ${GENERATOR_MARKER}
 ---
 
 # ${titleRaw}
@@ -176,6 +237,8 @@ export function generateLearningNoteV2(entry, slug, opts = {}) {
   // opts.repoNs (see generateLearningNote for the full contract). Backward-compatible.
   const sourceRepoLine =
     typeof opts.repoNs === 'string' && opts.repoNs.length > 0 ? `source-repo: ${opts.repoNs}\n` : '';
+  // #1503: see generateLearningNote.
+  const recordLine = sourceRecordLine(learningSourceRecord(entry));
 
   return `---
 id: ${slug}
@@ -185,7 +248,7 @@ status: ${status}
 created: ${created}
 updated: ${updated}
 tags: ${tags}
-${sourceRepoLine}_generator: ${GENERATOR_MARKER}
+${sourceRepoLine}${recordLine}_generator: ${GENERATOR_MARKER}
 ---
 
 # ${titleRaw}

package/scripts/lib/vault-mirror/render-sessions.mjs

@@ -1,7 +1,8 @@
 /**
  * render-sessions.mjs — Session markdown generators for vault-mirror (Issue #283 split).
  *
- * Exports: detectSessionSchema, normalizeSessionEntry, generateSessionNote, generateSessionNoteV2, generateSessionNoteV3
+ * Exports: detectSessionSchema, normalizeSessionEntry, generateSessionNote, generateSessionNoteV2, generateSessionNoteV3,
+ *          sessionSourceRecord (#1503)
  *
  * #732: all three generators accept `options.repoNs` (the leak-guarded /
  * pseudonym-mapped namespace segment from resolveRepoNamespace(), threaded
@@ -15,6 +16,7 @@
  */
 
 import { toDate, buildTag, slugifyIdSafe } from './utils.mjs';
+import { sourceRecordValue, sourceRecordLine } from './render-learnings.mjs';
 
 const GENERATOR_MARKER = 'session-orchestrator-vault-mirror@1';
 
@@ -282,6 +284,28 @@ function fmLine(key, value) {
   return `${key}: ${value}\n`;
 }
 
+/**
+ * The `source-record` of a session note (#1503): the physical session the note
+ * was rendered from — `raw_session_id` (the harness's session uuid) when the
+ * record carries one, else `started_at`. `session_id` itself cannot serve: it is
+ * the FILENAME, and semantic ids such as `main-2026-10-02-session-1` recur across
+ * repos by construction, which is exactly the collision this field exists to
+ * detect. All three generators require `started_at`, so every renderable record
+ * has a key.
+ *
+ * Named ceiling: a record whose key changes between runs — a later backfill
+ * adding `raw_session_id` to a record first mirrored under its `started_at` —
+ * reads as a different record, and process.mjs then refuses the rewrite
+ * (`skipped-foreign-owner`, visible on stdout). Revisit if that is ever observed
+ * on a same-repo record.
+ *
+ * @param {object} entry - normalized session entry.
+ * @returns {string|null}
+ */
+export function sessionSourceRecord(entry) {
+  return sourceRecordValue(entry?.raw_session_id) ?? sourceRecordValue(entry?.started_at);
+}
+
 /**
  * Session JSONL has three producer schemas in production:
  *   v1 (legacy):  total_waves, total_agents, total_files_changed, agent_summary, waves[{agent_count, files_changed, quality}]
@@ -521,7 +545,7 @@ status: ${vaultStatus}
 created: ${created}
 updated: ${updated}
 tags: ${tags}
-${fmLine('source-repo', repoNs)}_generator: ${GENERATOR_MARKER}
+${fmLine('source-repo', repoNs)}${sourceRecordLine(sessionSourceRecord(entry))}_generator: ${GENERATOR_MARKER}
 ---
 
 # Session ${session_id}
@@ -606,7 +630,7 @@ status: ${vaultStatus}
 created: ${created}
 updated: ${updated}
 tags: ${tags}
-${fmLine('source-repo', repoNs)}_generator: ${GENERATOR_MARKER}
+${fmLine('source-repo', repoNs)}${sourceRecordLine(sessionSourceRecord(entry))}_generator: ${GENERATOR_MARKER}
 ---
 
 # Session ${session_id}
@@ -731,7 +755,7 @@ status: ${vaultStatus}
 created: ${created}
 updated: ${updated}
 tags: ${tags}
-${fmLine('source-repo', repoNs)}_generator: ${GENERATOR_MARKER}
+${fmLine('source-repo', repoNs)}${sourceRecordLine(sessionSourceRecord(entry))}_generator: ${GENERATOR_MARKER}
 ---
 
 # Session ${session_id}

package/scripts/lib/vault-mirror/telemetry.mjs

@@ -11,6 +11,16 @@
  *     records that between them said nothing happened (#1151). Its count is
  *     carried by the run event's `skipped` total and `action_breakdown`, so the
  *     class stays measured — only its per-line locators are gone.
+ *     `skipped-duplicate-session` (#1291) is one of these per-entry records:
+ *     a `--kind session` line whose `session_id` a later line in the same
+ *     source superseded, so it was never dispatched. It carries `record_id`
+ *     and `line` and never `path` — no target file exists for it.
+ *     `skipped-foreign-owner` (#1503) is another: the generator note at the
+ *     target path names a different owner (a `source-record` the writer's
+ *     ledger does not carry, or a different session id), so it was left
+ *     untouched — unless it still leaks a secret, which is healed over the
+ *     guard. It carries the refused note's `path` and a constant `reason`
+ *     (`source-record mismatch` / `id mismatch`).
  *   - `orchestrator.vault.mirror_run_completed` — ONE record per CLI run,
  *     carrying the DENOMINATOR (`total` plus the per-class counts).
  *
@@ -21,8 +31,8 @@
  * "a rule you cannot falsify is not a rule"). The run event is emitted
  * unconditionally — including on every abort path, where it carries an
  * `aborted` discriminator (`missing-vault-dir` | `vault-not-canonical` |
- * `missing-source` | `malformed-json` | `filesystem-error` |
- * `unexpected-error`). So `total: 0` is a MEASURED zero, a partial count is a
+ * `missing-source` | `source-repo-mismatch` | `malformed-json` |
+ * `filesystem-error` | `unexpected-error`). So `total: 0` is a MEASURED zero, a partial count is a
  * LABELLED partial rather than a silent one, and the record's absence — and
  * nothing else — is the broken-emitter signal.
  *
@@ -32,9 +42,10 @@
  *
  * Ledger destination: `emitEvent` is called 2-arg, so every event from one run
  * resolves the SAME destination (`SO_PROJECT_DIR`, i.e. `CLAUDE_PROJECT_DIR` or
- * the CWD walk-up) as the masker emit. This CLI has no repo-root flag and
- * deriving one from `--source` would split a single run's telemetry across two
- * ledgers.
+ * the CWD walk-up) as the masker emit. The repo root that decides the vault
+ * NAMESPACE (#1503: `--repo-root`, else the git repo containing `--source`) is
+ * deliberately NOT used for the ledger — routing telemetry by it would split a
+ * single run's records across two ledgers.
  */
 
 import { emitEvent, sessionAttribution } from '../events.mjs';
@@ -162,20 +173,23 @@ export async function emitMirrorEvent({
  * @param {number} opts.updated — entries whose action was `updated`.
  * @param {number} opts.skipped — entries skipped for a NON-failure reason
  *   (`skipped-noop`, `skipped-handwritten`, `skipped-quality-low`,
- *   `skipped-collision-resolved`, `skipped-abandoned`).
+ *   `skipped-collision-resolved`, `skipped-foreign-owner`, `skipped-abandoned`,
+ *   `skipped-duplicate-session`). The last one (#1291) is what keeps
+ *   `created + updated + skipped + failed === total` true for a `--kind
+ *   session` run whose dedup pass collapsed a duplicate `session_id` line.
  * @param {number} opts.failed — entries that produced `skipped-invalid`
  *   (validation error or mapper crash). Split out from `skipped` because these
  *   are the runs where a session silently ends up WITHOUT its vault note.
  * @param {Record<string, number>} [opts.actionBreakdown] — per-action counts;
  *   only actions observed at least once appear.
  * @param {boolean} opts.dryRun — whether this run wrote anything at all.
- * @param {'missing-vault-dir'|'vault-not-canonical'|'missing-source'|'malformed-json'|'filesystem-error'|'unexpected-error'} [opts.aborted]
+ * @param {'missing-vault-dir'|'vault-not-canonical'|'missing-source'|'source-repo-mismatch'|'malformed-json'|'filesystem-error'|'unexpected-error'} [opts.aborted]
  *   Present ONLY when the run exited before its normal tail. OMITTED on a
  *   complete run — absent means "ran to the end", never "unknown". The first
- *   three values are PRE-LOOP aborts (#1151): the run never reached its first
- *   entry, so all five counters are `0` and that zero is the point — without a
- *   record, a mirror that never started is indistinguishable from one that was
- *   never invoked.
+ *   four values are PRE-LOOP aborts (#1151, #1503): the run never reached its
+ *   first entry, so all five counters are `0` and that zero is the point —
+ *   without a record, a mirror that never started is indistinguishable from one
+ *   that was never invoked.
  * @returns {Promise<void>}
  */
 export async function emitMirrorRunEvent({

package/scripts/lib/vault-status/board-writer.mjs

@@ -12,8 +12,9 @@
  *
  * Telemetry: every {@link mirrorBoard} call — and therefore every
  * {@link sweepBoard} call — emits exactly ONE {@link BOARD_EVENT} record,
- * including the no-op paths (`skipped-vault-disabled`, `skipped-handwritten`,
- * `skipped-noop`, `skipped-write-failed`). Those are the states that previously
+ * including the no-op paths (`skipped-vault-disabled`,
+ * `skipped-vault-not-canonical`, `skipped-handwritten`, `skipped-noop`,
+ * `skipped-write-failed`). Those are the states that previously
  * looked identical to a healthy write from outside the process. Emission is
  * best-effort and can never fail a board write.
  *
@@ -43,7 +44,8 @@
  *   2. Defense-in-depth: writeBoard hard-refuses to touch `_overview.md`
  *      (sven-owned, must NEVER be written by this generator).
  *
- * No console noise — library code. Plain Node ESM. No external deps.
+ * No console noise — library code — except the one stderr line on a
+ * canonical-vault refusal (#1450). Plain Node ESM. No external deps.
  */
 
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
@@ -60,6 +62,8 @@ import { enumerateCandidates } from '../dispatcher/enumerate.mjs';
 import { atomicWriteWithBackup } from '../io.mjs';
 import { withBoardLock } from './board-lock.mjs';
 import { expandTilde } from '../common.mjs';
+import { checkCanonicalVault, describeOriginForLog } from '../named-vault-resolver.mjs';
+import { loadHostPaths } from '../config/host-paths.mjs';
 
 /** Frontmatter sentinel that identifies generator-owned board files. */
 export const GENERATOR_MARKER = 'session-orchestrator-active-sessions@1';
@@ -356,8 +360,12 @@ export async function collectRows({ repos, now = new Date(), registry, priorStat
       ? lock.mode
       : (registryEntry && registryEntry.mode ? registryEntry.mode : null);
 
+    // The "Last heartbeat" column shows a heartbeat or nothing: a lock without
+    // `last_heartbeat` renders '—', never its `started_at` under that label
+    // (#595 sunset, 2026-10-02 — `isLockLive()` already calls it not live, so
+    // the status derivation below treats it as a dead lease).
     const heartbeat = lock
-      ? (lock.last_heartbeat ?? lock.started_at ?? null)
+      ? (lock.last_heartbeat ?? null)
       : (registryEntry ? (registryEntry.last_heartbeat ?? null) : null);
 
     // ── Status derivation ──
@@ -825,6 +833,8 @@ async function emitBoardEvent({ repoRoot, caller, action, path: outputPath, rows
  * Vault path assertion (Epic #673 safety): the resolved vault dir MUST live
  * under $HOME — a vault outside the home tree is refused as `skipped-vault-disabled`
  * so a misconfigured path can never drive a write into an arbitrary location.
+ * It must also be a canonical Meta-Vault ({@link checkCanonicalVault}, #1450):
+ * otherwise `skipped-vault-not-canonical`, nothing written, no lock, dry-run included.
  *
  * @param {object} opts
  * @param {string} opts.repoRoot — the repo whose row is being updated.
@@ -840,11 +850,14 @@ async function emitBoardEvent({ repoRoot, caller, action, path: outputPath, rows
  * @param {Date} [opts.now]
  * @param {boolean} [opts.dryRun]
  * @param {object} [opts.fs] — injectable fs for tests.
- * @param {{ env?: Record<string, string|undefined>, ownerConfig?: object }} [opts.hostPaths]
+ * @param {{ env?: Record<string, string|undefined>, ownerConfig?: object,
+ *   readOriginUrl?: (vaultDir: string) => string }} [opts.hostPaths]
  *   — forwarded verbatim to {@link parseSessionConfig}'s `hostPaths` DI seam (issue #653).
+ *   The same ctx feeds {@link checkCanonicalVault}; `readOriginUrl` replaces its
+ *   `git remote get-url origin` read (tests only — tmp vaults have no origin).
  *   Tests MUST pass a hermetic ctx (e.g. `{ env: {}, ownerConfig: undefined }`) when
  *   asserting a fixture's committed `vault-dir` — omitting it reads the REAL host
- *   `owner.yaml`, whose `paths.vault-dir` override (if set) wins over the fixture value
+ *   `owner.yaml`, whose `vault-dirs:` cwd match or `paths.vault-dir` override (if set) wins over the fixture value
  *   and bleeds into the assertion (issue #783). Production callers omit this — the
  *   default (real owner.yaml resolution) is the correct host-local behavior there.
  * @returns {Promise<{ result: { action: string, path?: string }, rows?: number,
@@ -861,10 +874,19 @@ async function mirrorBoardInner({ repoRoot, repos, explicitStatus, now = new Dat
   }
 
   // Read + parse Session Config. Any failure → silent no-op.
+  // The host context is resolved ONCE here and reused by the canonical-vault
+  // guard below: loadOwnerConfig() has no cache and its section-drop WARNs are
+  // not rate-limited, so a second load would print every WARN of a broken
+  // owner.yaml twice per board write (#1450 follow-up). The config file is read
+  // BEFORE owner.yaml — the order narrative-mirror.mjs shares (#1479); vault-dir
+  // precedence is applied in parseSessionConfig, so the order changes only
+  // whether a repo without a config file reads owner.yaml at all.
   let config;
+  let hostCtx;
   try {
     const text = await readConfigFile(repoRoot);
-    config = parseSessionConfig(text, { hostPaths });
+    hostCtx = hostPaths ?? loadHostPaths();
+    config = parseSessionConfig(text, { hostPaths: hostCtx });
   } catch {
     return { result: { action: 'skipped-vault-disabled' } };
   }
@@ -886,6 +908,24 @@ async function mirrorBoardInner({ repoRoot, repos, explicitStatus, now = new Dat
     return { result: { action: 'skipped-vault-disabled' } };
   }
 
+  // Safety: the vault must be a canonical Meta-Vault (#1450) — the same guard
+  // vault-mirror applies, so a vault-dir that resolved to a FOREIGN vault can
+  // never receive the board. Reuses the `hostCtx` the config parse used, so a
+  // hermetic ctx never reads the real owner.yaml and owner.yaml is loaded at
+  // most once. Runs before the dry-run branch and the lock: fail-closed.
+  const canonical = checkCanonicalVault({
+    vaultDir: expandedVault,
+    ownerConfig: hostCtx.ownerConfig,
+    env: hostCtx.env ?? process.env,
+    readOriginUrl: hostCtx.readOriginUrl,
+  });
+  if (!canonical.ok) {
+    process.stderr.write(
+      `vault-status board: refusing to write — vault is not the canonical Meta-Vault (expected git origin ending in one of: ${canonical.expected.join(', ')}; got ${describeOriginForLog(canonical.got) || 'no git origin'})\n`,
+    );
+    return { result: { action: 'skipped-vault-not-canonical' } };
+  }
+
   // `vault-name` (#660) overrides the git-derived repo slug for per-project
   // vault namespacing. Without it `collectRows` falls back to
   // `path.basename(repoRoot)`, so a repo whose directory name differs from its
@@ -1112,10 +1152,10 @@ async function mirrorBoardInner({ repoRoot, repos, explicitStatus, now = new Dat
  * Public {@link mirrorBoardInner} wrapper that emits exactly ONE
  * {@link BOARD_EVENT} per call — on EVERY path, no-ops included.
  *
- * The wrapper exists so the emit cannot be forgotten: the six return points
- * inside {@link mirrorBoardInner} (five `skipped-vault-disabled` guards plus
- * whatever {@link writeBoard} decides) all funnel through here, and so does the
- * seventh someone adds next. Emitting per-return instead would leave each new
+ * The wrapper exists so the emit cannot be forgotten: the seven return points
+ * inside {@link mirrorBoardInner} (five `skipped-vault-disabled` guards, the
+ * `skipped-vault-not-canonical` guard, plus whatever {@link writeBoard}
+ * decides) all funnel through here, and so does the eighth someone adds next. Emitting per-return instead would leave each new
  * early return silent by default — which is the exact defect being fixed.
  *
  * A THROW from the inner function is deliberately NOT converted into an event:
@@ -1276,7 +1316,8 @@ export function buildSweepRepos(candidates, { thisRepoRoot } = {}) {
  * @param {object} [opts.deps] — injectable deps for {@link enumerateCandidates}
  *   (test seam: `readdirSync`, `existsSync`, `readLock`, `isLockLive`,
  *   `getCrossRepoProjects`, `validatePathInsideProject`, `now`).
- * @param {{ env?: Record<string, string|undefined>, ownerConfig?: object }} [opts.hostPaths]
+ * @param {{ env?: Record<string, string|undefined>, ownerConfig?: object,
+ *   readOriginUrl?: (vaultDir: string) => string }} [opts.hostPaths]
  *   — forwarded verbatim to every {@link mirrorBoard} call below (both the happy-path
  *   and the enumeration-failure-fallback path), which in turn forwards it to
  *   {@link parseSessionConfig}'s `hostPaths` DI seam (issue #653/#783). See

package/scripts/lib/vault-status/narrative-mirror.mjs

@@ -44,6 +44,8 @@ import { validatePathInsideProject } from '../path-utils.mjs';
 import { createSecretValueMasker } from '../secret-masker.mjs';
 import { expandTilde } from '../common.mjs';
 import { readVaultSlug } from '../vault-yaml.mjs';
+import { checkCanonicalVault, describeOriginForLog } from '../named-vault-resolver.mjs';
+import { loadHostPaths } from '../config/host-paths.mjs';
 
 /** Frontmatter sentinel that identifies generator-owned narrative files. */
 export const GENERATOR_MARKER = 'session-orchestrator-vault-status-narrative@1';
@@ -763,9 +765,10 @@ async function emitMaskerEvent({ repoRoot, needleCount, hits, dryRun }) {
  * before any write.
  *
  * THIS FUNCTION WRITES TO THE OPERATOR'S REAL VAULT UNLESS YOU STOP IT. `vault-dir`
- * resolves HOST-LOCALLY — `SO_VAULT_DIR` > `owner.yaml` `paths.vault-dir` >
- * committed Session Config (`scripts/lib/config/host-paths.mjs`) — so the literal
- * value in a CLAUDE.md you just wrote into a tmp dir LOSES to both overrides. A
+ * resolves HOST-LOCALLY — `SO_VAULT_DIR` > `owner.yaml` `vault-dirs:` cwd match >
+ * `owner.yaml` `paths.vault-dir` > committed Session Config (`resolveVaultDir` in
+ * `scripts/lib/config.mjs`) — so the literal value in a CLAUDE.md you just wrote
+ * into a tmp dir LOSES to every override. A
  * probe that passes a synthetic `repoRoot` and nothing else has already written
  * into the live vault once (#1025 review). Any caller that must not touch the real
  * vault passes `hostPaths: { env: {}, ownerConfig: undefined }` (see below),
@@ -777,13 +780,16 @@ async function emitMaskerEvent({ repoRoot, needleCount, hits, dryRun }) {
  *   now?: Date,
  *   dryRun?: boolean,
  *   fs?: object,
- *   hostPaths?: { env?: Record<string, string|undefined>, ownerConfig?: object },
+ *   hostPaths?: { env?: Record<string, string|undefined>, ownerConfig?: object,
+ *     readOriginUrl?: (vaultDir: string) => string },
  * }} opts
  *   `hostPaths` is forwarded verbatim to {@link parseSessionConfig}'s `hostPaths` DI
- *   seam (issue #653). Tests MUST pass a hermetic ctx (e.g. `{ env: {}, ownerConfig:
+ *   seam (issue #653). The same ctx feeds {@link checkCanonicalVault} (#1450);
+ *   `readOriginUrl` replaces its `git remote get-url origin` read (tests only —
+ *   tmp vaults have no origin). Tests MUST pass a hermetic ctx (e.g. `{ env: {}, ownerConfig:
  *   undefined }`) when asserting a fixture's committed `vault-dir` — omitting it reads
- *   the REAL host `owner.yaml`, whose `paths.vault-dir` override (if set) wins over the
- *   fixture value and bleeds into the assertion (issue #783). Production callers omit
+ *   the REAL host `owner.yaml`, whose `vault-dirs:` cwd match or `paths.vault-dir`
+ *   override (if set) wins over the fixture value and bleeds into the assertion (issue #783). Production callers omit
  *   this — the default (real owner.yaml resolution) is the correct host-local behavior.
  * @returns {Promise<{ action: string, path?: string }>}
  */
@@ -829,7 +835,7 @@ export async function mirrorNarrative(opts) {
  * Split out so that the two emit sites in `mirrorNarrative` (the narrative
  * event AND, since #1028, the masker event) each cover EVERY outcome from
  * ONE call: a future early return added inside this function is telemetered
- * by construction, whereas hand-placing an emit beside each of the seven
+ * by construction, whereas hand-placing an emit beside each of the eight
  * `return`s makes "forgot the new one" the default failure. The `chars` companion travels beside the result
  * rather than inside it because the returned object is a PUBLIC shape that
  * callers (and tests) compare with `toEqual` — adding a key there would be an
@@ -855,10 +861,19 @@ async function runNarrativeMirror(opts) {
   const masker = createSecretValueMasker(process.env);
 
   // Read Session Config (CLAUDE.md / AGENTS.md) and resolve vault settings.
+  // The host context is loaded ONCE and shared by the Session Config parse and
+  // the canonical-vault guard below, so owner.yaml is read a single time per run.
+  // Order (#1479, same as board-writer.mjs): config file first, owner.yaml
+  // second. The `vault-dir` precedence (SO_VAULT_DIR > owner.yaml > committed)
+  // is applied inside parseSessionConfig, after both are in hand, so the order
+  // cannot change the resolved dir; it only spares a repo without a config file
+  // the owner.yaml read and its section-drop WARNs on a run that skips anyway.
   let config;
+  let hostCtx;
   try {
     const configText = await readConfigFile(repoRoot);
-    config = parseSessionConfig(configText, { hostPaths });
+    hostCtx = hostPaths ?? loadHostPaths();
+    config = parseSessionConfig(configText, { hostPaths: hostCtx });
   } catch {
     return { result: { action: 'skipped-vault-disabled' }, needleCount: masker.needleCount, hits: 0, dryRun };
   }
@@ -900,6 +915,22 @@ async function runNarrativeMirror(opts) {
   }
 
   const vaultDir = path.resolve(expandTilde(rawVaultDir));
+
+  // #1450: same shared guard as board-writer.mjs and scripts/vault-mirror.mjs —
+  // refuse a vault-dir whose git origin is not a canonical Meta-Vault. The
+  // stderr line names the expected suffixes and the origin, never the vault
+  // path itself.
+  const canonical = checkCanonicalVault({
+    vaultDir,
+    ownerConfig: hostCtx.ownerConfig,
+    env: hostCtx.env ?? process.env,
+    readOriginUrl: hostCtx.readOriginUrl,
+  });
+  if (!canonical.ok) {
+    process.stderr.write(`narrative-mirror: refusing to write — vault is not the canonical Meta-Vault (expected git origin ending in one of: ${canonical.expected.join(', ')}; got ${describeOriginForLog(canonical.got) || 'no git origin'})\n`);
+    return { result: { action: 'skipped-vault-not-canonical' }, needleCount: masker.needleCount, hits: 0, dryRun };
+  }
+
   const candidateSlug = subjectToSlug(repoName) || 'unknown';
   // A declared `.vault.yaml` slug needs no healing — it IS the canonical folder
   // name, so resolveLooseSlug is SKIPPED for it. Running the healer over it

package/scripts/lib/vcs-repo-spec.mjs

@@ -160,6 +160,14 @@ export function stripUrlCredentials(url) {
  * `--repo <spec>` override path, which bypasses the source-level strip in
  * {@link resolveRawRemoteUrl}. Never throws; a non-string returns unchanged.
  *
+ * Scope is CREDENTIALS only, as {@link userinfoIsCredential} classifies them.
+ * A bare login on a non-HTTP scheme (`ssh://alice@host/…`) is left verbatim,
+ * the URL path is never touched (`ssh://***@host/home/alice/vault` keeps the
+ * remote home dir), and the scp-like `user@host:path` form is not matched at
+ * all. So this is NOT the scp-consistent origin renderer: `describeOriginForLog`
+ * (`named-vault-resolver.mjs`) redacts every non-`git` login in both forms and
+ * hides a home-dir path (#1490) — use that for a git origin in a log line.
+ *
  * @param {string} text
  * @returns {string}
  */

package/scripts/lib/wave-executor/dispatch-common.mjs

@@ -21,6 +21,14 @@
  * exists to be.
  */
 
+/**
+ * Re-exported, not re-declared: the value lives in `process-group.mjs` since
+ * 773a994b, but this module exported it in 5.3.x and the package ships
+ * `scripts/` with no `exports` map — so a deep importer still links against
+ * this name. One definition, two import paths.
+ */
+export { DEFAULT_KILL_GRACE_MS } from '../process-group.mjs';
+
 /**
  * Roles that may NEVER run on a foreign model. Copied verbatim from
  * account-switch `tools/routing/routing.yaml` § never_foreign (read 2026-08-25).
@@ -44,22 +52,6 @@ export const NEVER_FOREIGN_ROLES = Object.freeze([
  * manufactures timeouts and reads as model failure. */
 export const DEFAULT_TIMEOUT_SEC = 900;
 
-/**
- * Grace period between SIGTERM and SIGKILL, in ms.
- *
- * `child.kill('SIGTERM')` is a REQUEST: a child that installs a handler and
- * ignores it never emits `close`, and this module's only resolve paths are
- * `close` and `error` — so without escalation a wedged `cursor-agent` hangs
- * `dispatchForeign` forever and takes the whole wave with it. SIGKILL is not
- * catchable, so the escalation always terminates.
- *
- * Named ceiling (BV-004): 10 s is enough for a cooperative child to flush its
- * stream-json tail and exit. Revisit if a well-behaved `cursor-agent` is ever
- * measured needing longer than that to shut down — raise the constant, never
- * drop the escalation.
- */
-export const DEFAULT_KILL_GRACE_MS = 10_000;
-
 /** A runId names a directory and a log file. Anything outside this alphabet —
  * or the two relative-path literals the alphabet happens to admit — can escape
  * the parent it is joined to. */
@@ -90,8 +82,8 @@ export function isNeverForeignRole(role) {
  *
  * The escalation is the difference between a bounded dispatch and a hung wave:
  * this function's only resolve paths are the child's `close` and `error`
- * events, so a child that ignores SIGTERM never lets the promise settle. See
- * {@link DEFAULT_KILL_GRACE_MS}.
+ * events, so a child that ignores SIGTERM never lets the promise settle. The
+ * callers pass `DEFAULT_KILL_GRACE_MS` from `process-group.mjs`.
  *
  * @returns {Promise<{capture: string, exitCode: number|null, signal: string|null,
  *   timerFired: boolean, killSignals: string[], errorCode: string|null}>}

package/scripts/lib/wave-executor/foreign-dispatch.mjs

@@ -54,8 +54,8 @@ import path from 'node:path';
 
 import { emitEvent, sessionAttribution } from '../events.mjs';
 import { isPathInside } from '../path-utils.mjs';
+import { DEFAULT_KILL_GRACE_MS } from '../process-group.mjs';
 import {
-  DEFAULT_KILL_GRACE_MS,
   DEFAULT_TIMEOUT_SEC,
   isNeverForeignRole,
   isSafeRunId,

package/scripts/lib/wave-executor/remote-dispatch.mjs

@@ -34,8 +34,8 @@ import path from 'node:path';
 
 import { emitEvent, sessionAttribution } from '../events.mjs';
 import { isPathInside } from '../path-utils.mjs';
+import { DEFAULT_KILL_GRACE_MS } from '../process-group.mjs';
 import {
-  DEFAULT_KILL_GRACE_MS,
   DEFAULT_TIMEOUT_SEC,
   isNeverForeignRole,
   isSafeRunId,