session-orchestrator 5.4.0 → 5.5.0

package/scripts/validate-wave-scope.mjs

@@ -35,6 +35,9 @@
  *                           `git ls-files` — spawned HERE, in the CLI layer,
  *                           because scripts/lib/scope-gate.mjs is hook-safe and
  *                           must not spawn a process (see its module header).
+ *                           Runs even when the manifest fails schema validation
+ *                           (#1026.4): it reads only the sidecar, so schema
+ *                           errors and collisions are reported together (exit 1).
  *   --union <path>          #1020. QUERY MODE. Read the same sidecar, compute
  *                           `expandTestSiblings(unionFileScopes(scopes), {role})`
  *                           using the MANIFEST'S OWN `role`, and print the
@@ -638,11 +641,24 @@ function knownRepoFiles() {
  * @param {string} sidecarPath
  */
 function assertDisjointOrDie(sidecarPath) {
+  if (!reportScopeCollisions(sidecarPath)) process.exit(1);
+}
+
+/**
+ * Run the #1020 collision check and write one stderr line per finding.
+ * Reads ONLY the sidecar, never the manifest — which is why {@link validate}
+ * can still run it when the manifest fails schema validation (#1026.4).
+ * Sidecar I/O and shape defects exit via {@link readAgentScopesOrDie}.
+ *
+ * @param {string} sidecarPath
+ * @returns {boolean} true when the wave is disjoint
+ */
+function reportScopeCollisions(sidecarPath) {
   const agentScopes = readAgentScopesOrDie(sidecarPath, '--assert-disjoint');
   const { ok, collisions, duplicateIds } = findScopeCollisions(agentScopes, {
     knownFiles: knownRepoFiles(),
   });
-  if (ok) return;
+  if (ok) return true;
 
   // Duplicate ids FIRST: they are a malformed plan, and a reader who fixes them
   // may well change which collisions remain.
@@ -659,7 +675,7 @@ function assertDisjointOrDie(sidecarPath) {
   process.stderr.write(
     `ERROR: ${collisions.length} scope collision(s), ${duplicateIds.length} duplicate id(s) — every file must belong to exactly ONE agent per wave (#1020; .claude/rules/parallel-sessions.md § Decision Tree)\n`,
   );
-  process.exit(1);
+  return false;
 }
 
 /**
@@ -709,6 +725,9 @@ function validate(
     for (const e of errors) {
       process.stderr.write(`ERROR: ${e}\n`);
     }
+    // #1026.4 — the collision check reads only the sidecar, so a schema error
+    // must not hide its findings: report both, exit 1 either way.
+    if (assertDisjointPath) reportScopeCollisions(assertDisjointPath);
     process.exit(1);
   }
 

package/scripts/vault-backfill.mjs

@@ -38,6 +38,10 @@ import {
 } from './lib/vault-backfill/template.mjs';
 
 import { validateManifest, SLUG_RE } from './lib/vault-backfill/manifest.mjs';
+import { _parseVaultIntegration } from './lib/config/vault-integration.mjs';
+import { loadHostPaths, resolveVaultIntegrationHost } from './lib/config/host-paths.mjs';
+import { resolveVaultDir } from './lib/config.mjs';
+import { expandTilde } from './lib/common.mjs';
 
 // ── CLI argument parsing ──────────────────────────────────────────────────────
 
@@ -85,9 +89,29 @@ let hadWriteError = false;
 
 if (flagVerbose) setGlabVerbose(true);
 
-// ── Session Config reader (inline) ───────────────────────────────────────────
+// ── Session Config reader ─────────────────────────────────────────────────────
 
-/** Read vault-integration.{gitlab-groups,vault-dir} from CLAUDE.md / AGENTS.md in CWD. */
+/**
+ * Read vault-integration.{gitlab-groups,vault-dir} from CLAUDE.md / AGENTS.md in
+ * CWD through the canonical Session Config parser (#1094), so every form it
+ * accepts (block, inline object, dash/bold bullet) reaches this CLI too.
+ *
+ * `vault-dir` resolves HOST-LOCALLY like every other vault writer:
+ * SO_VAULT_DIR > owner.yaml `vault-dirs:` cwd match > owner.yaml
+ * `paths.vault-dir` > the committed value (`resolveVaultDir`). The committed
+ * value alone would put `--apply` stubs into whatever vault the committed file
+ * names, even on a host whose owner.yaml points elsewhere. Not
+ * `parseSessionConfig`: it throws on an invalid value in any unrelated block.
+ *
+ * `enabled` is the switch the other vault writers obey (board-writer,
+ * narrative-mirror: `enabled !== true` → skip), after the same host-local
+ * lowering `parseSessionConfig` applies — env `SO_VAULT_INTEGRATION` >
+ * owner.yaml `vault-integration:` > committed (#1496: stubs were created with
+ * the integration off, from an owner.yaml `paths.vault-dir` alone).
+ *
+ * @returns {{'gitlab-groups': string[]|null, 'vault-dir': string|null, enabled: boolean,
+ *   'host-override': string|null}}
+ */
 function readVaultIntegrationConfig() {
   const candidates = [join(process.cwd(), 'CLAUDE.md'), join(process.cwd(), 'AGENTS.md')];
 
@@ -98,45 +122,24 @@ function readVaultIntegrationConfig() {
     }
   }
 
-  if (!content) return { 'gitlab-groups': null, 'vault-dir': null };
-
-  let inBlock = false;
-  let gitlabGroups = null;
-  let vaultDir = null;
-
-  for (const rawLine of content.split(/\r?\n/)) {
-    const line = rawLine.replace(/\r$/, '');
-
-    if (!inBlock && /^vault-integration:\s*$/.test(line)) { inBlock = true; continue; }
-    if (inBlock) {
-      if (line.length > 0 && !/^\s/.test(line)) break;
-
-      const m = line.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
-      if (!m) continue;
-
-      const k = m[1].trim();
-      let v = m[2].trim().replace(/\s*#.*$/, '').trim();
-      if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) {
-        v = v.slice(1, -1);
-      }
-
-      if (k === 'gitlab-groups' && v) {
-        gitlabGroups = v.replace(/^\[/, '').replace(/\]$/, '').trim() || null;
-      }
-      if (k === 'vault-dir' && v && v !== 'none' && v !== 'null') {
-        vaultDir = v;
-      }
-    }
-  }
-
-  return { 'gitlab-groups': gitlabGroups, 'vault-dir': vaultDir };
+  const hostCtx = loadHostPaths();
+  const vi = resolveVaultIntegrationHost(_parseVaultIntegration(content ?? ''), hostCtx);
+  const vaultDir = resolveVaultDir(vi['vault-dir'], hostCtx).value ?? null;
+  return {
+    'gitlab-groups': vi['gitlab-groups'],
+    'vault-dir': vaultDir,
+    enabled: vi.enabled === true,
+    'host-override': vi['host-override'],
+  };
 }
 
 // ── Vault-dir folder stub ─────────────────────────────────────────────────────
 
 function createVaultFolderStub(vaultDir, slug) {
   if (!vaultDir) return;
-  const stubDir = join(resolve(vaultDir), '01-projects', slug);
+  // `~/…` is the documented vault-dir shape; resolve() alone does not expand it
+  // and would put the stub under `<cwd>/~/…`.
+  const stubDir = join(resolve(expandTilde(vaultDir)), '01-projects', slug);
   try {
     if (!existsSync(stubDir)) {
       if (applyWrites) {
@@ -399,10 +402,20 @@ async function main() {
   if (flagGroups) {
     groups = flagGroups.split(',').map((g) => g.trim()).filter(Boolean);
   } else if (cfgConfig['gitlab-groups']) {
-    groups = cfgConfig['gitlab-groups'].split(',').map((g) => g.trim()).filter(Boolean);
+    groups = cfgConfig['gitlab-groups'];
   }
 
-  const vaultDir = flagVaultDir ?? cfgConfig['vault-dir'] ?? null;
+  // The configured vault-dir counts only while vault-integration is on; an
+  // explicit --vault-dir is this run's own request and still wins.
+  let vaultDir = flagVaultDir ?? null;
+  if (vaultDir === null && cfgConfig['vault-dir'] !== null) {
+    if (cfgConfig.enabled) {
+      vaultDir = cfgConfig['vault-dir'];
+    } else {
+      const why = cfgConfig['host-override'] ? `switched off by ${cfgConfig['host-override']}` : 'not enabled';
+      log(`vault-integration is ${why} — no vault folder stubs (pass --vault-dir to create them anyway)`);
+    }
+  }
 
   if (!flagYes && (!groups || groups.length === 0)) {
     die(1, 'no GitLab groups specified — pass --groups <CSV> or set vault-integration.gitlab-groups in CLAUDE.md');

package/scripts/vault-mirror.mjs

@@ -8,23 +8,40 @@
  * CLI usage:
  *   node vault-mirror.mjs --vault-dir <path> --source <jsonl-path> --kind <learning|session>
  *                         [--dry-run] [--strict-schema] [--no-commit] [--force]
- *                         [--session-id <id>]
+ *                         [--session-id <id>] [--repo-root <path>] [--vault-name <name>]
  *                         [--quality-min-narrative-chars <int>]  (sessions only; default 400)
  *                         [--quality-min-confidence <float>]     (learnings only; default 0.5)
  *
  * Exit codes:
  *   0 — success (including idempotent no-op)
  *   1 — validation error (malformed JSON line, bad slug, etc.)
- *   2 — filesystem error
+ *   2 — filesystem error, or a pre-loop refusal (missing vault-dir / source,
+ *       non-canonical vault, `--source` belonging to a different repo than
+ *       `--repo-root` — #1503)
  *
  * Output: one JSON line per action on stdout:
- *   {"action":"created|updated|skipped-noop|skipped-handwritten|skipped-collision-resolved|skipped-invalid|skipped-quality-low|skipped-abandoned|skipped-duplicate-session","path":"...","kind":"...","id":"..."}
+ *   {"action":"created|updated|skipped-noop|skipped-handwritten|skipped-collision-resolved|skipped-foreign-owner|skipped-invalid|skipped-quality-low|skipped-abandoned|skipped-duplicate-session","path":"...","kind":"...","id":"..."}
  *
  * Idempotency rules:
  *   1. File does not exist → create.
  *   2. File exists, has _generator marker, id matches → overwrite only if updated would advance; else skipped-noop.
  *   3. File exists, lacks _generator → skip (hand-written). Log to stderr.
  *   4. File exists, has _generator, id differs → collision-disambiguate by appending -<first8 of uuid>.
+ *      (Sessions have no disambiguation: a different-id note is skipped-foreign-owner.)
+ *   5. File exists, has _generator, but its `source-record` names a different record
+ *      than this write (#1503): learnings → collision-disambiguate as in rule 4;
+ *      sessions → skipped-foreign-owner unless the key occurs in this --source ledger.
+ *      A leak in such a foreign note is masked IN PLACE (owner, content and
+ *      source-record kept; `healed_leak: true` on the action) — never rewritten
+ *      from this record. If the masked frontmatter would not parse, it is left
+ *      unchanged with a stderr WARN.
+ *
+ * Repo root (#1503): the namespace is the identity of the repo the --source
+ * ledger belongs to — `--repo-root` when given, else the project holding
+ * --source (`<root>/.orchestrator/metrics/`), else the git repo containing it,
+ * else the cwd (a loose source outside any git repo). It is never the cwd
+ * when the source sits in a repo: running from another repo's checkout used to
+ * write one project's records over another project's notes.
  *
  * Quality gate (PRD F1.2):
  *   Learnings with confidence < --quality-min-confidence emit `skipped-quality-low`.
@@ -48,8 +65,8 @@
  * Part of session-orchestrator vault-mirror (Issue #14).
  */
 
-import { existsSync } from 'node:fs';
-import { basename, resolve } from 'node:path';
+import { existsSync, realpathSync } from 'node:fs';
+import { basename, dirname, resolve } from 'node:path';
 import { createInterface } from 'node:readline';
 import { createReadStream } from 'node:fs';
 
@@ -64,11 +81,12 @@ import { emitEvent } from './lib/events.mjs';
 import { autoCommitVaultMirror } from './lib/vault-mirror/auto-commit.mjs';
 import { parseColumnFlags, CliFlagError } from './lib/cli-flags.mjs';
 import { resolveRepoNamespace } from './lib/vault-mirror/namespace.mjs';
-import { checkCanonicalVault, describeOriginForLog, normalizeRemote } from './lib/named-vault-resolver.mjs';
+import { sessionSourceRecord } from './lib/vault-mirror/render-sessions.mjs';
+import { checkCanonicalVault, describeOriginForLog, findRepoRoot, normalizeRemote } from './lib/named-vault-resolver.mjs';
 import { loadOwnerConfig } from './lib/owner-yaml.mjs';
 import { canonicalizeSessions } from './lib/sessions-canonical.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
-import { expandTilde } from './lib/common.mjs';
+import { expandTilde, redactHomeDir } from './lib/common.mjs';
 
 // ── Canonical-vault helpers (#600 D2 / #607 D2) ────────────────────────────────
 // These are module-level (above the CLI bootstrap) so the module is import-safe
@@ -131,9 +149,10 @@ export function _normalizeRemote(url) {
 //     is always measured.
 //   - Same ledger as the masker emit: `emitEvent` is called 2-arg so both events
 //     from one run resolve the SAME destination (`SO_PROJECT_DIR`, i.e.
-//     `CLAUDE_PROJECT_DIR` or the CWD walk-up). This CLI has no repo-root flag
-//     and deriving one from `--source` would split a single run's telemetry
-//     across two ledgers.
+//     `CLAUDE_PROJECT_DIR` or the CWD walk-up). The repo root that decides the
+//     vault NAMESPACE (#1503: `--repo-root`, else derived from `--source`) is
+//     deliberately NOT used for the ledger — routing telemetry by it would split
+//     a single run's records across two ledgers.
 //
 // #1147 moved both emitters into `scripts/lib/vault-mirror/telemetry.mjs` and
 // widened the coverage from "the two skipped-invalid branches" to "every entry,
@@ -186,13 +205,14 @@ if (_isDirectInvocation) {
       kind: null,
       'session-id': null,
       'vault-name': null,
+      'repo-root': null,
       'quality-min-narrative-chars': null,
       'quality-min-confidence': null,
     },
   });
 } catch (err) {
   if (err instanceof CliFlagError) {
-    process.stderr.write(`vault-mirror: ${err.message}\n`);
+    process.stderr.write(`vault-mirror: ${redactHomeDir(err.message)}\n`);
     process.exit(1);
   }
   throw err;
@@ -206,7 +226,7 @@ if (flagValues.help === true) {
     [
       'Usage: node vault-mirror.mjs --vault-dir <path> --source <jsonl-path> --kind <learning|session>',
       '                              [--dry-run] [--strict-schema] [--no-commit] [--force]',
-      '                              [--session-id <id>]',
+      '                              [--session-id <id>] [--repo-root <path>] [--vault-name <name>]',
       '                              [--quality-min-narrative-chars <int>]',
       '                              [--quality-min-confidence <float>]',
       '',
@@ -224,6 +244,11 @@ if (flagValues.help === true) {
       '                                        When set, mirrors write under <vault-name>/ instead of the',
       '                                        git-derived repo identifier. Maps to vault-integration.vault-name',
       '                                        in Session Config. Sanitised to a lowercase kebab slug.',
+      '  --repo-root <path>                    The repo whose ledger --source is (#1503). Its .vault.yaml',
+      '                                        slug / git remote decides the vault namespace. Default: the',
+      '                                        project holding --source (<root>/.orchestrator/metrics/), else',
+      '                                        the git repo containing it, else the cwd. Refused (exit 2,',
+      '                                        "source-repo-mismatch") when --source lies in a different repo.',
       '  --quality-min-narrative-chars <int>   Sessions: minimum rendered-narrative length (default 400).',
       '                                        Entries below the threshold emit "skipped-quality-low".',
       '  --quality-min-confidence <float>      Learnings: minimum confidence threshold (default 0.5).',
@@ -249,6 +274,7 @@ const noCommit = flagValues['no-commit'] === true;
 const force = flagValues.force === true;
 const sessionIdArg = flagValues['session-id'];
 const vaultName = flagValues['vault-name'] ?? null;
+const repoRootArg = flagValues['repo-root'] ?? null;
 
 // Quality-gate thresholds (PRD F1.2). Parse as numbers; reject malformed input
 // loudly so CI cannot accidentally pass a string ("400px") and silently fall
@@ -289,7 +315,7 @@ const qualityMinConfidence = parseFloatFlag(
 
 if (!vaultDir || !source || !kind) {
   process.stderr.write(
-    'Usage: node vault-mirror.mjs --vault-dir <path> --source <jsonl-path> --kind <learning|session> [--dry-run] [--strict-schema] [--no-commit] [--force] [--session-id <id>] [--quality-min-narrative-chars <int>] [--quality-min-confidence <float>]\n',
+    'Usage: node vault-mirror.mjs --vault-dir <path> --source <jsonl-path> --kind <learning|session> [--dry-run] [--strict-schema] [--no-commit] [--force] [--session-id <id>] [--repo-root <path>] [--vault-name <name>] [--quality-min-narrative-chars <int>] [--quality-min-confidence <float>]\n',
   );
   process.exit(1);
 }
@@ -343,16 +369,47 @@ function pathForLog(p) {
   return `.../${basename(String(p ?? ''))}`;
 }
 
+/**
+ * The project a ledger belongs to (#1503): the directory that holds it under
+ * the `.orchestrator/metrics/` convention, else the git repo containing it,
+ * else `null`.
+ *
+ * The convention comes FIRST because the git toplevel is the wrong answer for
+ * a project nested inside a repo — a monorepo package with its own
+ * `.orchestrator/` and `.vault.yaml` (measured: `--repo-root <package>` was
+ * refused against the monorepo's namespace, and without the flag the package's
+ * notes moved to the monorepo's folder). Every producer writes the ledgers to
+ * `<project>/.orchestrator/metrics/`, which is also exactly the directory whose
+ * `.vault.yaml` named the namespace before #1503 (callers ran from it).
+ *
+ * Named ceiling: a ledger stored under some project's `.orchestrator/metrics/`
+ * is attributed to that project whoever wrote its records — a foreign ledger
+ * COPIED there is not detected here; the session `source-record` guard in
+ * process.mjs is the remaining defence for that shape.
+ *
+ * @param {string} realSource - the source path after `realpathSync`.
+ * @returns {string|null}
+ */
+function ledgerOwnerRoot(realSource) {
+  const metricsDir = dirname(realSource);
+  const orchestratorDir = dirname(metricsDir);
+  if (basename(metricsDir) === 'metrics' && basename(orchestratorDir) === '.orchestrator') {
+    return dirname(orchestratorDir);
+  }
+  return findRepoRoot(dirname(realSource));
+}
+
 // ── Run-level accounting + run close-out (#1147) ──────────────────────────────
 //
 // Deliberately OUTSIDE main(): the run event's whole contract is that it is
 // written ONCE PER RUN and that its ABSENCE is the broken-emitter signal
-// (HR-105). Six exits bypass main's normal tail — the three PRE-LOOP aborts at
-// the top of main (missing vault-dir, non-canonical vault, missing source), the
-// malformed-JSON abort and the filesystem-error abort inside the loop (all five
-// `process.exit`, which no `finally` and no `catch` can intercept), and the
-// top-level `main().catch`, which runs in a scope where main's locals no longer
-// exist. Keeping the counters and the emitter out here is what lets all six
+// (HR-105). Seven exits bypass main's normal tail — the four PRE-LOOP aborts at
+// the top of main (missing vault-dir, non-canonical vault, missing source,
+// source/repo-root mismatch), the malformed-JSON abort and the filesystem-error
+// abort inside the loop (all six `process.exit`, which no `finally` and no
+// `catch` can intercept), and the top-level `main().catch`, which runs in a
+// scope where main's locals no longer exist. Keeping the counters and the
+// emitter out here is what lets all seven
 // close the run out through ONE function instead of each re-deriving the
 // payload.
 const runState = {
@@ -381,10 +438,10 @@ const tally = (action) => {
  * counted were the ones that vanished from the ledger, in the one shape
  * ("no record") that the docstring reserves for a broken emitter.
  *
- * @param {'missing-vault-dir'|'vault-not-canonical'|'missing-source'|'malformed-json'|'filesystem-error'|'unexpected-error'} [aborted]
+ * @param {'missing-vault-dir'|'vault-not-canonical'|'missing-source'|'source-repo-mismatch'|'malformed-json'|'filesystem-error'|'unexpected-error'} [aborted]
  *   Omitted on a complete run. When present it LABELS the counters as partial:
  *   every line after the abort was never attempted, so the classes no longer
- *   partition `total`. On the three PRE-LOOP values (#1151) nothing was
+ *   partition `total`. On the PRE-LOOP values (#1151, #1503) nothing was
  *   attempted at all — `total` is a measured 0 and the label is what separates
  *   "never started" from "ran over an empty source".
  * @returns {Promise<void>}
@@ -442,7 +499,7 @@ async function finishRun(aborted) {
 // ── Main ──────────────────────────────────────────────────────────────────────
 
 async function main() {
-  // The three PRE-LOOP aborts below (#1151) close the run out through the same
+  // The PRE-LOOP aborts below (#1151, #1503) close the run out through the same
   // `finishRun` every other exit uses. They are the runs that never reached
   // their first entry — a bad vault-dir, a wrong vault, a missing source — and
   // until now they were the only outcomes that left NO record at all, which is
@@ -477,6 +534,80 @@ async function main() {
     process.exit(2);
   }
 
+  // ── Repo root + source/repo-root agreement (#1503) ──────────────────────────
+  //
+  // The namespace every note is written under is the identity of `repoRoot`.
+  // Until #1503 that was hard-wired to the invocation cwd, while `--source` was
+  // free to name ANY ledger: a session that ran this CLI from another repo's
+  // checkout with `--source <ThisRepo>/.orchestrator/metrics/sessions.jsonl`
+  // wrote 130 of this repo's records under the OTHER repo's namespace and
+  // overwrote 3 of its notes — slug and session-id collisions are routine across
+  // repos. The fix is to stop asking the cwd:
+  //   1. `--repo-root` when given — the caller states which repo it mirrors;
+  //   2. else the ledger's own project — see {@link ledgerOwnerRoot};
+  //   3. else the cwd — only for a source that is neither a project ledger nor
+  //      inside a git repo (a copied ledger, the test suites' mkdtemp sources),
+  //      where nothing better is knowable.
+  // Step 2's answer is also what an explicit `--repo-root` is checked against.
+  //
+  // The ledger's REAL path decides, not the path it was handed under: a symlink
+  // inside repo A that points at repo B's ledger is B's ledger. `realpathSync`
+  // falls back to the lexical path only when it throws (the file was just
+  // proven to exist, so that is a race or a permission edge, not a normal case).
+  // The same holds for `--repo-root`: a remote-less, slug-less repo is named by
+  // its directory, so a root reached through a symlink would otherwise carry the
+  // LINK's name and be refused against its own ledger.
+  const realOrLexical = (p) => {
+    try {
+      return realpathSync(p);
+    } catch {
+      return p;
+    }
+  };
+  const sourceRealPath = realOrLexical(resolve(source));
+  const sourceRepoRoot = ledgerOwnerRoot(sourceRealPath);
+  const repoRoot = repoRootArg
+    ? realOrLexical(resolve(expandTilde(repoRootArg)))
+    : (sourceRepoRoot ?? process.cwd());
+
+  // A source with no owning project cannot be checked against anything: the
+  // namespace then rests on the cwd or on an unverifiable `--repo-root`, and a
+  // ledger copied out of ANOTHER repo would be written over this repo's notes
+  // without a refusal. Say so once — the run proceeds, because a loose ledger
+  // (a copy, a test fixture) is a legitimate input.
+  if (sourceRepoRoot === null) {
+    const ns = resolveRepoNamespace({ vaultName, repoRoot });
+    process.stderr.write(
+      repoRootArg
+        ? `WARN vault-mirror: --source ${pathForLog(source)} is neither a project ledger (.orchestrator/metrics/) nor inside a git repo, so --repo-root cannot be checked against it; writing under namespace '${ns}'\n`
+        : `WARN vault-mirror: --source ${pathForLog(source)} is neither a project ledger (.orchestrator/metrics/) nor inside a git repo; the namespace '${ns}' comes from the cwd — pass --repo-root to state which repo this ledger belongs to\n`,
+    );
+  }
+
+  // Fail closed when the two disagree: an explicit `--repo-root` whose identity
+  // differs from the repo the ledger lives in is exactly the incident shape
+  // (callers pass `--repo-root "$PWD"`, so a run from the wrong checkout lands
+  // here instead of in another project's notes). NAMESPACES are compared, not
+  // paths — a worktree and its main checkout are different directories that
+  // share one `.vault.yaml` slug and one remote. `vaultName` is left out on
+  // purpose: it overrides the FOLDER, and the question here is whether the
+  // ledger belongs to the repo being mirrored. Named ceiling: two owner-leaky
+  // repos without a pseudonym-map entry both resolve to `redacted-repo` and pass
+  // this check — they already share that one folder (#725 D5), so the refusal
+  // could not keep them apart anyway.
+  if (repoRootArg && sourceRepoRoot !== null) {
+    const repoNs = resolveRepoNamespace({ repoRoot });
+    const sourceNs = resolveRepoNamespace({ repoRoot: sourceRepoRoot });
+    if (repoNs !== sourceNs) {
+      // Both values are leak-guarded namespaces — safe for logs, unlike the paths.
+      process.stderr.write(
+        `vault-mirror: refusing to mirror — --source ${pathForLog(source)} belongs to repo namespace '${sourceNs}', but --repo-root resolves to '${repoNs}'. Run with the repo root the ledger belongs to.\n`,
+      );
+      await finishRun('source-repo-mismatch');
+      process.exit(2);
+    }
+  }
+
   const rl = createInterface({
     input: createReadStream(resolve(source), 'utf8'),
     crlfDelay: Infinity,
@@ -502,10 +633,14 @@ async function main() {
     kind,
     force,
     vaultName,
-    // #1389: the repo whose `.vault.yaml` declares the namespace slug. This CLI
-    // has no repo-root flag, so it is the invocation cwd — bound ONCE here and
-    // shared by every processor call and the auto-commit below.
-    repoRoot: process.cwd(),
+    // #1389/#1503: the repo whose identity (`.vault.yaml` slug, else git remote)
+    // is the namespace — resolved ONCE above from `--repo-root` / `--source`,
+    // and shared by every processor call and the auto-commit below.
+    repoRoot,
+    // #1503: every `source-record` key the `--kind session` source carries,
+    // superseded duplicates included — filled while buffering below, read by
+    // processSession's owner guard (a key from this ledger is never foreign).
+    sourceRecordKeys: new Set(),
     qualityMinNarrativeChars,
     qualityMinConfidence,
   };
@@ -541,7 +676,7 @@ async function main() {
     } catch (err) {
       // Validation errors (missing required fields) → per-entry skip, not a global failure
       if (err.message.startsWith('vault-mirror:')) {
-        process.stderr.write(`${err.message}\n`);
+        process.stderr.write(`${redactHomeDir(err.message)}\n`);
         const entryId = entry?.id ?? entry?.session_id ?? null;
         process.stdout.write(
           JSON.stringify({ action: 'skipped-invalid', path: null, kind, id: entryId }) + '\n',
@@ -554,7 +689,7 @@ async function main() {
           line: entryLineNum,
           recordId: entryId,
           skipClass: 'validation',
-          reason: err.message,
+          reason: redactHomeDir(err.message),
           dryRun,
         });
         return;
@@ -573,7 +708,7 @@ async function main() {
         (typeof err.code === 'string' && err.code.length > 0) || Boolean(err.syscall);
       if (!isSystemError) {
         process.stderr.write(
-          `vault-mirror: mapper crash on line ${entryLineNum} (${err.message}) — record skipped\n`,
+          `vault-mirror: mapper crash on line ${entryLineNum} (${redactHomeDir(err.message)}) — record skipped\n`,
         );
         const entryId = entry?.id ?? entry?.session_id ?? null;
         process.stdout.write(
@@ -593,13 +728,13 @@ async function main() {
           line: entryLineNum,
           recordId: entryId,
           skipClass: 'mapper-crash',
-          reason: err.message,
+          reason: redactHomeDir(err.message),
           dryRun,
         });
         return;
       }
       // Unexpected filesystem errors → fatal
-      process.stderr.write(`vault-mirror: filesystem error on line ${entryLineNum}: ${err.message}\n`);
+      process.stderr.write(`vault-mirror: filesystem error on line ${entryLineNum}: ${redactHomeDir(err.message)}\n`);
       await finishRun('filesystem-error');
       process.exit(2);
     }
@@ -625,7 +760,7 @@ async function main() {
     try {
       entry = JSON.parse(trimmed);
     } catch (err) {
-      process.stderr.write(`vault-mirror: malformed JSON on line ${lineNum}: ${err.message}\n`);
+      process.stderr.write(`vault-mirror: malformed JSON on line ${lineNum}: ${redactHomeDir(err.message)}\n`);
       // Close the run out BEFORE exiting: `process.exit` runs no `finally`, so
       // without this the abort is the one outcome that leaves no run record —
       // exactly the shape reserved for a broken emitter.
@@ -635,6 +770,8 @@ async function main() {
 
     if (kind === 'session') {
       sessionEntries.push(entry);
+      const recordKey = sessionSourceRecord(entry);
+      if (recordKey !== null) ctx.sourceRecordKeys.add(recordKey);
       sessionLineNums.push(lineNum);
       continue;
     }
@@ -732,7 +869,7 @@ async function main() {
 }
 
   main().catch(async (err) => {
-    process.stderr.write(`vault-mirror: unexpected error: ${err.message}\n`);
+    process.stderr.write(`vault-mirror: unexpected error: ${redactHomeDir(err.message)}\n`);
     // Same reason as the two in-loop aborts: an unexpected throw is a run that
     // ENDED, and the ledger has to say so. `finishRun` never throws, so this
     // cannot turn a diagnosable crash into a silent one.