session-orchestrator 5.3.0 → 5.5.0

package/scripts/vault-mirror.mjs

@@ -8,23 +8,40 @@
  * CLI usage:
  *   node vault-mirror.mjs --vault-dir <path> --source <jsonl-path> --kind <learning|session>
  *                         [--dry-run] [--strict-schema] [--no-commit] [--force]
- *                         [--session-id <id>]
+ *                         [--session-id <id>] [--repo-root <path>] [--vault-name <name>]
  *                         [--quality-min-narrative-chars <int>]  (sessions only; default 400)
  *                         [--quality-min-confidence <float>]     (learnings only; default 0.5)
  *
  * Exit codes:
  *   0 — success (including idempotent no-op)
  *   1 — validation error (malformed JSON line, bad slug, etc.)
- *   2 — filesystem error
+ *   2 — filesystem error, or a pre-loop refusal (missing vault-dir / source,
+ *       non-canonical vault, `--source` belonging to a different repo than
+ *       `--repo-root` — #1503)
  *
  * Output: one JSON line per action on stdout:
- *   {"action":"created|updated|skipped-noop|skipped-handwritten|skipped-collision-resolved|skipped-invalid|skipped-quality-low","path":"...","kind":"...","id":"..."}
+ *   {"action":"created|updated|skipped-noop|skipped-handwritten|skipped-collision-resolved|skipped-foreign-owner|skipped-invalid|skipped-quality-low|skipped-abandoned|skipped-duplicate-session","path":"...","kind":"...","id":"..."}
  *
  * Idempotency rules:
  *   1. File does not exist → create.
  *   2. File exists, has _generator marker, id matches → overwrite only if updated would advance; else skipped-noop.
  *   3. File exists, lacks _generator → skip (hand-written). Log to stderr.
  *   4. File exists, has _generator, id differs → collision-disambiguate by appending -<first8 of uuid>.
+ *      (Sessions have no disambiguation: a different-id note is skipped-foreign-owner.)
+ *   5. File exists, has _generator, but its `source-record` names a different record
+ *      than this write (#1503): learnings → collision-disambiguate as in rule 4;
+ *      sessions → skipped-foreign-owner unless the key occurs in this --source ledger.
+ *      A leak in such a foreign note is masked IN PLACE (owner, content and
+ *      source-record kept; `healed_leak: true` on the action) — never rewritten
+ *      from this record. If the masked frontmatter would not parse, it is left
+ *      unchanged with a stderr WARN.
+ *
+ * Repo root (#1503): the namespace is the identity of the repo the --source
+ * ledger belongs to — `--repo-root` when given, else the project holding
+ * --source (`<root>/.orchestrator/metrics/`), else the git repo containing it,
+ * else the cwd (a loose source outside any git repo). It is never the cwd
+ * when the source sits in a repo: running from another repo's checkout used to
+ * write one project's records over another project's notes.
  *
  * Quality gate (PRD F1.2):
  *   Learnings with confidence < --quality-min-confidence emit `skipped-quality-low`.
@@ -48,22 +65,28 @@
  * Part of session-orchestrator vault-mirror (Issue #14).
  */
 
-import { spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { existsSync, realpathSync } from 'node:fs';
+import { basename, dirname, resolve } from 'node:path';
 import { createInterface } from 'node:readline';
 import { createReadStream } from 'node:fs';
 
-import { processLearning, processSession, getMaskerStats } from './lib/vault-mirror/process.mjs';
+import {
+  processLearning,
+  processSession,
+  getMaskerStats,
+  emitAction,
+} from './lib/vault-mirror/process.mjs';
 import { emitMirrorEvent, emitMirrorRunEvent } from './lib/vault-mirror/telemetry.mjs';
 import { emitEvent } from './lib/events.mjs';
 import { autoCommitVaultMirror } from './lib/vault-mirror/auto-commit.mjs';
 import { parseColumnFlags, CliFlagError } from './lib/cli-flags.mjs';
 import { resolveRepoNamespace } from './lib/vault-mirror/namespace.mjs';
-import { resolveCanonicalSuffixes } from './lib/named-vault-resolver.mjs';
+import { sessionSourceRecord } from './lib/vault-mirror/render-sessions.mjs';
+import { checkCanonicalVault, describeOriginForLog, findRepoRoot, normalizeRemote } from './lib/named-vault-resolver.mjs';
 import { loadOwnerConfig } from './lib/owner-yaml.mjs';
 import { canonicalizeSessions } from './lib/sessions-canonical.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
+import { expandTilde, redactHomeDir } from './lib/common.mjs';
 
 // ── Canonical-vault helpers (#600 D2 / #607 D2) ────────────────────────────────
 // These are module-level (above the CLI bootstrap) so the module is import-safe
@@ -85,7 +108,7 @@ export function _resolveCanonicalSuffix(envValue) {
   return envValue && envValue.trim() ? envValue.trim() : '/agents/vault';
 }
 
-// Kept for documentation; the guard now uses resolveCanonicalSuffixes() which
+// Kept for documentation; the guard now uses checkCanonicalVault() which
 // generalises this to N suffixes. The `_` prefix satisfies the no-unused-vars rule.
 const _CANONICAL_VAULT_SUFFIX = _resolveCanonicalSuffix(
   process.env.VAULT_MIRROR_CANONICAL_SUFFIX,
@@ -93,18 +116,14 @@ const _CANONICAL_VAULT_SUFFIX = _resolveCanonicalSuffix(
 
 /**
  * Normalize a git remote URL to a host/path tail for canonical-suffix matching
- * (#607 D2 — exported for unit tests). Strips `.git`, the `git@host:` / scheme
- * prefixes, and trailing slashes.
+ * (#607 D2 — exported for unit tests). Since #1450 the ONE implementation is
+ * `normalizeRemote` in lib/named-vault-resolver.mjs, shared with the board
+ * writer's guard; this name is kept for the existing test imports.
  * @param {string} url
  * @returns {string}
  */
 export function _normalizeRemote(url) {
-  return String(url ?? '')
-    .trim()
-    .replace(/\.git$/, '')
-    .replace(/^git@([^:]+):/, '$1/')
-    .replace(/^[a-z]+:\/\//, '')
-    .replace(/\/+$/, '');
+  return normalizeRemote(url);
 }
 
 // ── Mirror telemetry (#1116) ──────────────────────────────────────────────────
@@ -130,9 +149,10 @@ export function _normalizeRemote(url) {
 //     is always measured.
 //   - Same ledger as the masker emit: `emitEvent` is called 2-arg so both events
 //     from one run resolve the SAME destination (`SO_PROJECT_DIR`, i.e.
-//     `CLAUDE_PROJECT_DIR` or the CWD walk-up). This CLI has no repo-root flag
-//     and deriving one from `--source` would split a single run's telemetry
-//     across two ledgers.
+//     `CLAUDE_PROJECT_DIR` or the CWD walk-up). The repo root that decides the
+//     vault NAMESPACE (#1503: `--repo-root`, else derived from `--source`) is
+//     deliberately NOT used for the ledger — routing telemetry by it would split
+//     a single run's records across two ledgers.
 //
 // #1147 moved both emitters into `scripts/lib/vault-mirror/telemetry.mjs` and
 // widened the coverage from "the two skipped-invalid branches" to "every entry,
@@ -185,13 +205,14 @@ if (_isDirectInvocation) {
       kind: null,
       'session-id': null,
       'vault-name': null,
+      'repo-root': null,
       'quality-min-narrative-chars': null,
       'quality-min-confidence': null,
     },
   });
 } catch (err) {
   if (err instanceof CliFlagError) {
-    process.stderr.write(`vault-mirror: ${err.message}\n`);
+    process.stderr.write(`vault-mirror: ${redactHomeDir(err.message)}\n`);
     process.exit(1);
   }
   throw err;
@@ -205,7 +226,7 @@ if (flagValues.help === true) {
     [
       'Usage: node vault-mirror.mjs --vault-dir <path> --source <jsonl-path> --kind <learning|session>',
       '                              [--dry-run] [--strict-schema] [--no-commit] [--force]',
-      '                              [--session-id <id>]',
+      '                              [--session-id <id>] [--repo-root <path>] [--vault-name <name>]',
       '                              [--quality-min-narrative-chars <int>]',
       '                              [--quality-min-confidence <float>]',
       '',
@@ -223,6 +244,11 @@ if (flagValues.help === true) {
       '                                        When set, mirrors write under <vault-name>/ instead of the',
       '                                        git-derived repo identifier. Maps to vault-integration.vault-name',
       '                                        in Session Config. Sanitised to a lowercase kebab slug.',
+      '  --repo-root <path>                    The repo whose ledger --source is (#1503). Its .vault.yaml',
+      '                                        slug / git remote decides the vault namespace. Default: the',
+      '                                        project holding --source (<root>/.orchestrator/metrics/), else',
+      '                                        the git repo containing it, else the cwd. Refused (exit 2,',
+      '                                        "source-repo-mismatch") when --source lies in a different repo.',
       '  --quality-min-narrative-chars <int>   Sessions: minimum rendered-narrative length (default 400).',
       '                                        Entries below the threshold emit "skipped-quality-low".',
       '  --quality-min-confidence <float>      Learnings: minimum confidence threshold (default 0.5).',
@@ -235,7 +261,11 @@ if (flagValues.help === true) {
   process.exit(0);
 }
 
-const vaultDir = flagValues['vault-dir'];
+// Expand a leading `~` before anything touches the path: owner.yaml `vault-dirs:` /
+// `paths.vault-dir` and the committed Session Config all accept `~/…`, and a quoted
+// `--vault-dir "~/…"` reaches us literally. `resolve('~/x')` would yield `<cwd>/~/x`
+// and the existsSync check below would abort with `missing-vault-dir` (agents/vault#319).
+const vaultDir = expandTilde(flagValues['vault-dir']);
 const source = flagValues.source;
 const kind = flagValues.kind;
 const dryRun = flagValues['dry-run'] === true;
@@ -244,6 +274,7 @@ const noCommit = flagValues['no-commit'] === true;
 const force = flagValues.force === true;
 const sessionIdArg = flagValues['session-id'];
 const vaultName = flagValues['vault-name'] ?? null;
+const repoRootArg = flagValues['repo-root'] ?? null;
 
 // Quality-gate thresholds (PRD F1.2). Parse as numbers; reject malformed input
 // loudly so CI cannot accidentally pass a string ("400px") and silently fall
@@ -284,7 +315,7 @@ const qualityMinConfidence = parseFloatFlag(
 
 if (!vaultDir || !source || !kind) {
   process.stderr.write(
-    'Usage: node vault-mirror.mjs --vault-dir <path> --source <jsonl-path> --kind <learning|session> [--dry-run] [--strict-schema] [--no-commit] [--force] [--session-id <id>] [--quality-min-narrative-chars <int>] [--quality-min-confidence <float>]\n',
+    'Usage: node vault-mirror.mjs --vault-dir <path> --source <jsonl-path> --kind <learning|session> [--dry-run] [--strict-schema] [--no-commit] [--force] [--session-id <id>] [--repo-root <path>] [--vault-name <name>] [--quality-min-narrative-chars <int>] [--quality-min-confidence <float>]\n',
   );
   process.exit(1);
 }
@@ -323,16 +354,62 @@ if (kind !== 'learning' && kind !== 'session') {
 // imports) so they are import-safe and unit-testable; see _resolveCanonicalSuffix
 // / _normalizeRemote there (#607 D2).
 
+/**
+ * Render a CLI path flag for a stderr line as its basename only (#1479).
+ *
+ * This CLI's stderr lands in CI logs and session transcripts, and an absolute
+ * `--vault-dir` / `--source` carries the operator's home directory — the
+ * owner-leakage class `.claude/rules/security.md` § Owner-Privacy guards. The
+ * basename still says WHICH value was wrong; the caller passed the full path
+ * and already knows it.
+ * @param {string} p
+ * @returns {string}
+ */
+function pathForLog(p) {
+  return `.../${basename(String(p ?? ''))}`;
+}
+
+/**
+ * The project a ledger belongs to (#1503): the directory that holds it under
+ * the `.orchestrator/metrics/` convention, else the git repo containing it,
+ * else `null`.
+ *
+ * The convention comes FIRST because the git toplevel is the wrong answer for
+ * a project nested inside a repo — a monorepo package with its own
+ * `.orchestrator/` and `.vault.yaml` (measured: `--repo-root <package>` was
+ * refused against the monorepo's namespace, and without the flag the package's
+ * notes moved to the monorepo's folder). Every producer writes the ledgers to
+ * `<project>/.orchestrator/metrics/`, which is also exactly the directory whose
+ * `.vault.yaml` named the namespace before #1503 (callers ran from it).
+ *
+ * Named ceiling: a ledger stored under some project's `.orchestrator/metrics/`
+ * is attributed to that project whoever wrote its records — a foreign ledger
+ * COPIED there is not detected here; the session `source-record` guard in
+ * process.mjs is the remaining defence for that shape.
+ *
+ * @param {string} realSource - the source path after `realpathSync`.
+ * @returns {string|null}
+ */
+function ledgerOwnerRoot(realSource) {
+  const metricsDir = dirname(realSource);
+  const orchestratorDir = dirname(metricsDir);
+  if (basename(metricsDir) === 'metrics' && basename(orchestratorDir) === '.orchestrator') {
+    return dirname(orchestratorDir);
+  }
+  return findRepoRoot(dirname(realSource));
+}
+
 // ── Run-level accounting + run close-out (#1147) ──────────────────────────────
 //
 // Deliberately OUTSIDE main(): the run event's whole contract is that it is
 // written ONCE PER RUN and that its ABSENCE is the broken-emitter signal
-// (HR-105). Six exits bypass main's normal tail — the three PRE-LOOP aborts at
-// the top of main (missing vault-dir, non-canonical vault, missing source), the
-// malformed-JSON abort and the filesystem-error abort inside the loop (all five
-// `process.exit`, which no `finally` and no `catch` can intercept), and the
-// top-level `main().catch`, which runs in a scope where main's locals no longer
-// exist. Keeping the counters and the emitter out here is what lets all six
+// (HR-105). Seven exits bypass main's normal tail — the four PRE-LOOP aborts at
+// the top of main (missing vault-dir, non-canonical vault, missing source,
+// source/repo-root mismatch), the malformed-JSON abort and the filesystem-error
+// abort inside the loop (all six `process.exit`, which no `finally` and no
+// `catch` can intercept), and the top-level `main().catch`, which runs in a
+// scope where main's locals no longer exist. Keeping the counters and the
+// emitter out here is what lets all seven
 // close the run out through ONE function instead of each re-deriving the
 // payload.
 const runState = {
@@ -361,10 +438,10 @@ const tally = (action) => {
  * counted were the ones that vanished from the ledger, in the one shape
  * ("no record") that the docstring reserves for a broken emitter.
  *
- * @param {'missing-vault-dir'|'vault-not-canonical'|'missing-source'|'malformed-json'|'filesystem-error'|'unexpected-error'} [aborted]
+ * @param {'missing-vault-dir'|'vault-not-canonical'|'missing-source'|'source-repo-mismatch'|'malformed-json'|'filesystem-error'|'unexpected-error'} [aborted]
  *   Omitted on a complete run. When present it LABELS the counters as partial:
  *   every line after the abort was never attempted, so the classes no longer
- *   partition `total`. On the three PRE-LOOP values (#1151) nothing was
+ *   partition `total`. On the PRE-LOOP values (#1151, #1503) nothing was
  *   attempted at all — `total` is a measured 0 and the label is what separates
  *   "never started" from "ran over an empty source".
  * @returns {Promise<void>}
@@ -422,7 +499,7 @@ async function finishRun(aborted) {
 // ── Main ──────────────────────────────────────────────────────────────────────
 
 async function main() {
-  // The three PRE-LOOP aborts below (#1151) close the run out through the same
+  // The PRE-LOOP aborts below (#1151, #1503) close the run out through the same
   // `finishRun` every other exit uses. They are the runs that never reached
   // their first entry — a bad vault-dir, a wrong vault, a missing source — and
   // until now they were the only outcomes that left NO record at all, which is
@@ -430,36 +507,107 @@ async function main() {
   // are all `0`, and `aborted` is what makes that zero readable as "never
   // started" rather than "ran over an empty source".
   if (!existsSync(resolve(vaultDir))) {
-    process.stderr.write(`vault-mirror: vault-dir not found: ${vaultDir}\n`);
+    process.stderr.write(`vault-mirror: vault-dir not found: ${pathForLog(vaultDir)}\n`);
     await finishRun('missing-vault-dir');
     process.exit(2);
   }
 
-  if (process.env.VAULT_MIRROR_SKIP_CANONICAL_CHECK !== '1') {
-    const res = spawnSync('git', ['-C', resolve(vaultDir), 'remote', 'get-url', 'origin'], {
-      encoding: 'utf8',
-    });
-    const canonicalSuffixes = resolveCanonicalSuffixes({
-      ownerConfig: loadOwnerConfig().config,
-      env: process.env,
-    });
-    const ok = res.status === 0 && canonicalSuffixes.some((s) => _normalizeRemote(res.stdout).endsWith(s));
-    if (!ok) {
-      const got = res.status === 0 ? res.stdout.trim() : 'no git origin';
-      process.stderr.write(
-        `vault-mirror: refusing to mirror — "${vaultDir}" is not the canonical Meta-Vault (expected git origin ending in one of: ${canonicalSuffixes.join(', ')}; got ${got})\n`,
-      );
-      await finishRun('vault-not-canonical');
-      process.exit(2);
-    }
+  // The check itself — origin probe, suffix match, the SKIP_CANONICAL_CHECK
+  // escape hatch — is the shared `checkCanonicalVault` (#1450), the same one the
+  // board writer applies, so the two vault writers cannot drift apart again.
+  const canonical = checkCanonicalVault({
+    vaultDir: resolve(vaultDir),
+    ownerConfig: loadOwnerConfig().config,
+    env: process.env,
+  });
+  if (!canonical.ok) {
+    process.stderr.write(
+      `vault-mirror: refusing to mirror — vault is not the canonical Meta-Vault (expected git origin ending in one of: ${canonical.expected.join(', ')}; got ${describeOriginForLog(canonical.got) || 'no git origin'})\n`,
+    );
+    await finishRun('vault-not-canonical');
+    process.exit(2);
   }
 
   if (!existsSync(resolve(source))) {
-    process.stderr.write(`vault-mirror: source file not found: ${source}\n`);
+    process.stderr.write(`vault-mirror: source file not found: ${pathForLog(source)}\n`);
     await finishRun('missing-source');
     process.exit(2);
   }
 
+  // ── Repo root + source/repo-root agreement (#1503) ──────────────────────────
+  //
+  // The namespace every note is written under is the identity of `repoRoot`.
+  // Until #1503 that was hard-wired to the invocation cwd, while `--source` was
+  // free to name ANY ledger: a session that ran this CLI from another repo's
+  // checkout with `--source <ThisRepo>/.orchestrator/metrics/sessions.jsonl`
+  // wrote 130 of this repo's records under the OTHER repo's namespace and
+  // overwrote 3 of its notes — slug and session-id collisions are routine across
+  // repos. The fix is to stop asking the cwd:
+  //   1. `--repo-root` when given — the caller states which repo it mirrors;
+  //   2. else the ledger's own project — see {@link ledgerOwnerRoot};
+  //   3. else the cwd — only for a source that is neither a project ledger nor
+  //      inside a git repo (a copied ledger, the test suites' mkdtemp sources),
+  //      where nothing better is knowable.
+  // Step 2's answer is also what an explicit `--repo-root` is checked against.
+  //
+  // The ledger's REAL path decides, not the path it was handed under: a symlink
+  // inside repo A that points at repo B's ledger is B's ledger. `realpathSync`
+  // falls back to the lexical path only when it throws (the file was just
+  // proven to exist, so that is a race or a permission edge, not a normal case).
+  // The same holds for `--repo-root`: a remote-less, slug-less repo is named by
+  // its directory, so a root reached through a symlink would otherwise carry the
+  // LINK's name and be refused against its own ledger.
+  const realOrLexical = (p) => {
+    try {
+      return realpathSync(p);
+    } catch {
+      return p;
+    }
+  };
+  const sourceRealPath = realOrLexical(resolve(source));
+  const sourceRepoRoot = ledgerOwnerRoot(sourceRealPath);
+  const repoRoot = repoRootArg
+    ? realOrLexical(resolve(expandTilde(repoRootArg)))
+    : (sourceRepoRoot ?? process.cwd());
+
+  // A source with no owning project cannot be checked against anything: the
+  // namespace then rests on the cwd or on an unverifiable `--repo-root`, and a
+  // ledger copied out of ANOTHER repo would be written over this repo's notes
+  // without a refusal. Say so once — the run proceeds, because a loose ledger
+  // (a copy, a test fixture) is a legitimate input.
+  if (sourceRepoRoot === null) {
+    const ns = resolveRepoNamespace({ vaultName, repoRoot });
+    process.stderr.write(
+      repoRootArg
+        ? `WARN vault-mirror: --source ${pathForLog(source)} is neither a project ledger (.orchestrator/metrics/) nor inside a git repo, so --repo-root cannot be checked against it; writing under namespace '${ns}'\n`
+        : `WARN vault-mirror: --source ${pathForLog(source)} is neither a project ledger (.orchestrator/metrics/) nor inside a git repo; the namespace '${ns}' comes from the cwd — pass --repo-root to state which repo this ledger belongs to\n`,
+    );
+  }
+
+  // Fail closed when the two disagree: an explicit `--repo-root` whose identity
+  // differs from the repo the ledger lives in is exactly the incident shape
+  // (callers pass `--repo-root "$PWD"`, so a run from the wrong checkout lands
+  // here instead of in another project's notes). NAMESPACES are compared, not
+  // paths — a worktree and its main checkout are different directories that
+  // share one `.vault.yaml` slug and one remote. `vaultName` is left out on
+  // purpose: it overrides the FOLDER, and the question here is whether the
+  // ledger belongs to the repo being mirrored. Named ceiling: two owner-leaky
+  // repos without a pseudonym-map entry both resolve to `redacted-repo` and pass
+  // this check — they already share that one folder (#725 D5), so the refusal
+  // could not keep them apart anyway.
+  if (repoRootArg && sourceRepoRoot !== null) {
+    const repoNs = resolveRepoNamespace({ repoRoot });
+    const sourceNs = resolveRepoNamespace({ repoRoot: sourceRepoRoot });
+    if (repoNs !== sourceNs) {
+      // Both values are leak-guarded namespaces — safe for logs, unlike the paths.
+      process.stderr.write(
+        `vault-mirror: refusing to mirror — --source ${pathForLog(source)} belongs to repo namespace '${sourceNs}', but --repo-root resolves to '${repoNs}'. Run with the repo root the ledger belongs to.\n`,
+      );
+      await finishRun('source-repo-mismatch');
+      process.exit(2);
+    }
+  }
+
   const rl = createInterface({
     input: createReadStream(resolve(source), 'utf8'),
     crlfDelay: Infinity,
@@ -485,10 +633,14 @@ async function main() {
     kind,
     force,
     vaultName,
-    // #1389: the repo whose `.vault.yaml` declares the namespace slug. This CLI
-    // has no repo-root flag, so it is the invocation cwd — bound ONCE here and
-    // shared by every processor call and the auto-commit below.
-    repoRoot: process.cwd(),
+    // #1389/#1503: the repo whose identity (`.vault.yaml` slug, else git remote)
+    // is the namespace — resolved ONCE above from `--repo-root` / `--source`,
+    // and shared by every processor call and the auto-commit below.
+    repoRoot,
+    // #1503: every `source-record` key the `--kind session` source carries,
+    // superseded duplicates included — filled while buffering below, read by
+    // processSession's owner guard (a key from this ledger is never foreign).
+    sourceRecordKeys: new Set(),
     qualityMinNarrativeChars,
     qualityMinConfidence,
   };
@@ -524,7 +676,7 @@ async function main() {
     } catch (err) {
       // Validation errors (missing required fields) → per-entry skip, not a global failure
       if (err.message.startsWith('vault-mirror:')) {
-        process.stderr.write(`${err.message}\n`);
+        process.stderr.write(`${redactHomeDir(err.message)}\n`);
         const entryId = entry?.id ?? entry?.session_id ?? null;
         process.stdout.write(
           JSON.stringify({ action: 'skipped-invalid', path: null, kind, id: entryId }) + '\n',
@@ -537,7 +689,7 @@ async function main() {
           line: entryLineNum,
           recordId: entryId,
           skipClass: 'validation',
-          reason: err.message,
+          reason: redactHomeDir(err.message),
           dryRun,
         });
         return;
@@ -556,7 +708,7 @@ async function main() {
         (typeof err.code === 'string' && err.code.length > 0) || Boolean(err.syscall);
       if (!isSystemError) {
         process.stderr.write(
-          `vault-mirror: mapper crash on line ${entryLineNum} (${err.message}) — record skipped\n`,
+          `vault-mirror: mapper crash on line ${entryLineNum} (${redactHomeDir(err.message)}) — record skipped\n`,
         );
         const entryId = entry?.id ?? entry?.session_id ?? null;
         process.stdout.write(
@@ -576,13 +728,13 @@ async function main() {
           line: entryLineNum,
           recordId: entryId,
           skipClass: 'mapper-crash',
-          reason: err.message,
+          reason: redactHomeDir(err.message),
           dryRun,
         });
         return;
       }
       // Unexpected filesystem errors → fatal
-      process.stderr.write(`vault-mirror: filesystem error on line ${entryLineNum}: ${err.message}\n`);
+      process.stderr.write(`vault-mirror: filesystem error on line ${entryLineNum}: ${redactHomeDir(err.message)}\n`);
       await finishRun('filesystem-error');
       process.exit(2);
     }
@@ -608,7 +760,7 @@ async function main() {
     try {
       entry = JSON.parse(trimmed);
     } catch (err) {
-      process.stderr.write(`vault-mirror: malformed JSON on line ${lineNum}: ${err.message}\n`);
+      process.stderr.write(`vault-mirror: malformed JSON on line ${lineNum}: ${redactHomeDir(err.message)}\n`);
       // Close the run out BEFORE exiting: `process.exit` runs no `finally`, so
       // without this the abort is the one outcome that leaves no run record —
       // exactly the shape reserved for a broken emitter.
@@ -618,6 +770,8 @@ async function main() {
 
     if (kind === 'session') {
       sessionEntries.push(entry);
+      const recordKey = sessionSourceRecord(entry);
+      if (recordKey !== null) ctx.sourceRecordKeys.add(recordKey);
       sessionLineNums.push(lineNum);
       continue;
     }
@@ -654,18 +808,27 @@ async function main() {
       if (isIdentifiable(entry) && !survivors.has(entry)) {
         // A losing duplicate: an earlier line whose `session_id` a LATER line
         // in this same batch supersedes or overwrites (crash-recovery
-        // re-append, #1068 stub/supersede pair). No dispatch, no stdout line,
-        // no tally for it — the winning occurrence (dispatched below, at its
-        // own position) already produces the ONE note this physical session
-        // gets. BV-004 ceiling: `runState.total` still counts this raw line,
-        // so `created+updated+skipped+failed` no longer partitions `total`
-        // for a `--kind session` run that collapsed at least one duplicate —
-        // no test pins that invariant for session kind (only for `learning`,
-        // where duplicates are not collapsed), and a partially-written vault
-        // from a batch that could not be fully deduped is the worse failure
-        // mode. Revisit with a dedicated telemetry action if an operator ever
-        // needs to name WHICH lines were collapsed, not just how many notes
-        // were written.
+        // re-append, #1068 stub/supersede pair). Never dispatched — the winning
+        // occurrence (dispatched below, at its own position) produces the ONE
+        // note this physical session gets. It is still ACCOUNTED for (#1291):
+        // `skipped-duplicate-session` goes through the same per-entry path as
+        // every other skip (stdout line + per-entry ledger record, no `path`
+        // because no target file exists for it) and into the tally, so
+        // `created+updated+skipped+failed === total` partitions a `--kind
+        // session` run that collapsed duplicates, and the ledger names WHICH
+        // lines were collapsed, not just how many notes were written.
+        tally(
+          await emitAction({
+            action: 'skipped-duplicate-session',
+            path: null,
+            kind,
+            id: entry.session_id,
+            vaultDir: ctx.vaultDir,
+            meta: { line: sessionLineNums[i] },
+            line: sessionLineNums[i],
+            dryRun,
+          }),
+        );
         continue;
       }
       await dispatchEntry(entry, sessionLineNums[i]);
@@ -706,7 +869,7 @@ async function main() {
 }
 
   main().catch(async (err) => {
-    process.stderr.write(`vault-mirror: unexpected error: ${err.message}\n`);
+    process.stderr.write(`vault-mirror: unexpected error: ${redactHomeDir(err.message)}\n`);
     // Same reason as the two in-loop aborts: an unexpected throw is a run that
     // ENDED, and the ledger has to say so. `finishRun` never throws, so this
     // cannot turn a diagnosable crash into a silent one.

package/scripts/wave-scope-binding.mjs

@@ -37,6 +37,7 @@
  */
 
 import { parseArgs } from 'node:util';
+import path from 'node:path';
 import { attributionForRecord, emitEvent } from './lib/events.mjs';
 import { MANIFEST_SESSION_KEYS } from './lib/session-identity/own-session.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
@@ -109,7 +110,7 @@ async function main(argv) {
     return;
   }
 
-  const repoRoot = parsed.values['repo-root'] ?? process.cwd();
+  const repoRoot = path.resolve(parsed.values['repo-root'] ?? process.cwd());
   const binding = resolveBinding(repoRoot);
 
   if (Object.keys(binding).length === 0) {

package/skills/_shared/config-reading.md

@@ -133,14 +133,14 @@ Learnings live exclusively in `.orchestrator/metrics/learnings.jsonl`. The pre-`
 
 The learning lifecycle states are:
 
-- **Created**: `confidence: 0.5`, `expires_at`: current date + `learning-expiry-days` (default: 30)
-- **Confirmed** (same type+subject seen again): `confidence += 0.15` (cap 1.0), `expires_at` reset
+- **Created**: `confidence: 0.5`, `expires_at` = `created_at` + a per-TYPE TTL — `deriveExpiresAt(created_at, type)` with `LEARNING_TTL_DAYS[type] ?? LEARNING_TTL_DAYS.default` (`scripts/lib/learnings/schema.mjs`; 30–90 days per type, 60 for an unknown type). A caller-supplied `expires_at` is kept. `learning-expiry-days` does NOT set it: `scripts/lib/config.mjs` still parses that key (default 30), but no script or hook reads the parsed value — it survives only in skill prose (the `/evolve` Review-mode *Extend* action).
+- **Confirmed** (same type+subject seen again): `confidence += 0.15` (cap 1.0), `expires_at` reset to `deriveExpiresAt(now, type)`
 - **Contradicted** (evidence against): `confidence -= 0.2` — do NOT reset `expires_at` (let the learning decay naturally if contradicted)
 - **Decayed** (untouched this session): `confidence -= learning-decay-rate` (from Session Config, default `0.05`). Applied at session-end after touched-set update, before prune. Clamped to 0.0. Does NOT reset `expires_at`.
 - **Expired**: `expires_at < current date` — removed on next write
 - **Dead**: `confidence <= 0.0` — removed on next write
 
-**Expiration check semantics:** Compare `expires_at` by date portion only (ignore time-of-day) to avoid intra-day jitter. When writing `expires_at`, set it to `<current_date>T00:00:00Z + learning-expiry-days` (midnight UTC).
+**Expiration check semantics:** The code compares full timestamps, not dates: `pruneLearnings()` (`scripts/lib/learnings/expiry-sweep.mjs`) archives when `expires_at < now`; the time-driven sweep archives only after a 14-day grace window past `expires_at`. When writing `expires_at`, derive it with `deriveExpiresAt()` (full ISO timestamp, no midnight rounding) — never from `learning-expiry-days`.
 
 **Confidence bounds enforcement:** After EVERY increment or decrement, clamp confidence to [0.0, 1.0]. A learning at 0.95 confirmed becomes 1.0 (not 1.10). A learning at 0.1 contradicted becomes 0.0 and is pruned.