session-orchestrator 5.4.0 → 5.6.0

package/scripts/lib/validate/check-test-value-bans.mjs

@@ -94,11 +94,26 @@
  *                     construction rather than by exception list.
  *
  *                     NOT flagged: blocks that control the clock (`now:`, `{ now }`
- *                     or a positional `now` — wider than the seam proof, #1478 —
- *                     `vi.useFakeTimers` / `vi.setSystemTime`); date literals in
- *                     INPUT position (only `.toBe`/`.toEqual`/`.toStrictEqual`
- *                     expected values are read), which leaves the passthrough
- *                     class (input date === output date) untouched.
+ *                     or a positional `now` — wider than the seam proof, #1478;
+ *                     SCREAMING_CASE `NOW` / `FIXED_NOW` / `NOW_MS` count as
+ *                     clock names too, #1499 item 7 — or a fake timer that pins
+ *                     the DATE: `vi.setSystemTime(<date>)`,
+ *                     `vi.useFakeTimers({ now: <date> })`, also when called in
+ *                     the setup at module level or in a `describe` that
+ *                     encloses the block; a bare `vi.useFakeTimers()` installs
+ *                     at the real clock and pins nothing, #1499 item 8). A
+ *                     handover whose value IS the real clock is no control
+ *                     (#1487): inline (`{ now: Date.now() }`) or through a
+ *                     binding in the same block (`const now = new Date();
+ *                     fn(now)`) or in the shared setup — module level,
+ *                     `describe` body, `beforeEach` (#1489 item 16). A freeze
+ *                     does not exempt a block that hands over a real clock bound
+ *                     at collection time (module level, `describe` body): that
+ *                     value was read before any hook ran (#1499 item 9). Date
+ *                     literals in INPUT position (only `.toBe`/`.toEqual`/
+ *                     `.toStrictEqual` expected values are read), which leaves
+ *                     the passthrough class (input date === output date)
+ *                     untouched.
  *
  * Per-file opt-out: `// @test-value-bans-allowed` in the first 5 lines skips
  * the file entirely (same convention as check-test-fixture-shapes.mjs's
@@ -353,13 +368,25 @@ const keyLiteralRe = (key) => new RegExp(`["'\\\\]+${key}["'\\\\]+\\s*:`);
 const DATE_EXPECTATION =
   /\.(?:toBe|toEqual|toStrictEqual)\(\s*(['"`])(\d{4}-\d{2}-\d{2}(?:[T ][^'"`]*)?)\1\s*\)/;
 
-/** A clock-named token not read off an object (`Date.now`, `opts.now`) — shared head of the two below. */
-const CLOCK_NAME = String.raw`(?<![.\w$])(?:now|nowMs|nowIso|clock|currentDate)\s*`;
+/**
+ * A clock-named token not read off an object (`Date.now`, `opts.now`) — shared
+ * head of the patterns below. Group 1 is the name.
+ *
+ * SCREAMING_CASE module constants are clock names too (#1499 item 7): `NOW`,
+ * `NOW_MS`, `NOW_ISO`, and any `<WORD>_`-prefixed form (`FIXED_NOW`,
+ * `FROZEN_NOW`). An `i` flag would not reach them — `_` is a `\w`, so the
+ * lookbehind and the terminators below never see a `FIXED_NOW` boundary.
+ * Measured 2026-10-02 over 722 test files: `NOW` is handed over in 29 files,
+ * `FIXED_NOW` in 10, `NOW_MS` in 5, `NOW_ISO` in 2.
+ */
+const CLOCK_NAME = String.raw`(?<![.\w$])(now|nowMs|nowIso|clock|currentDate|(?:[A-Z][A-Z0-9]*_)*(?:NOW(?:_MS|_ISO)?|CLOCK|CURRENT_DATE))\s*`;
 
 /**
  * Pass 1, the seam PROOF: a NAMED clock key (`{ now: … }`) — only that shape says
- * the callee's API takes a clock. Every line it matches also matches
- * CONTROL_CLOCK_ARG, so a block that proves a seam is never flagged itself.
+ * the callee's API takes a clock, whatever value it is handed. Every line it
+ * matches also matches CONTROL_CLOCK_ARG, so a block that proves a seam is never
+ * flagged itself — UNLESS the value it hands over is the real clock (#1487):
+ * then the block proves the seam and is a bomb in the same breath.
  */
 const SEAM_CLOCK_ARG = new RegExp(`${CLOCK_NAME}:`);
 
@@ -367,7 +394,10 @@ const SEAM_CLOCK_ARG = new RegExp(`${CLOCK_NAME}:`);
  * Pass 2, is this block clock-CONTROLLED: any clock handover. Property shorthand
  * (`{ now }`, `{ repoRoot, now }`) and a positional `now` count too; `Date.now()`
  * and `const now =` do not. Wider is the safe direction here — it can only
- * remove findings.
+ * remove findings. Group 2 is the terminator: `:` means the name is a KEY and
+ * the handed-over value follows it; any other terminator means the name IS the
+ * value. A handover only counts when that value is not the real clock — see
+ * {@link handsOverControlledClock}.
  *
  * CEILING (#1478): pass 1 reads only the named form, because the wide form also
  * turns helpers into seams — +20 seamed (file, id) pairs in 15 files
@@ -377,10 +407,25 @@ const SEAM_CLOCK_ARG = new RegExp(`${CLOCK_NAME}:`);
  * REVISIT on the first B5 finding whose subject is a helper, or the first CI
  * `test-value-bans` B5 finding the ±days clock-shift probe shows to be false.
  */
-const CONTROL_CLOCK_ARG = new RegExp(String.raw`${CLOCK_NAME}(?::|,|\}|\))`);
+const CONTROL_CLOCK_ARG = new RegExp(String.raw`${CLOCK_NAME}(:|,|\}|\))`, 'g');
+
+/** A read of the real wall clock: `Date.now()`, an argument-less `new Date()`, `performance.now()`. */
+const REAL_CLOCK_READ = /\bDate\.now\(\)|\bnew Date\(\s*\)|\bperformance\.now\(\)/;
+
+/**
+ * `const now = <rhs>` / `now = <rhs>` — a clock-named binding (not `==`, not an
+ * arrow `now =>`). Group 1 is the name, group 2 the right-hand side.
+ */
+const CLOCK_BINDING = new RegExp(String.raw`${CLOCK_NAME}=(?![=>])(.*)`);
 
-/** Freezing the global clock — equally valid control, but not a seam PROOF. */
-const FAKE_TIMER = /\b(?:useFakeTimers|setSystemTime|advanceTimersByTime|runAllTimers)\b/;
+/**
+ * Freezing the global clock — equally valid control, but not a seam PROOF. Only
+ * the INSTALLERS count: `advanceTimersByTime` / `runAllTimers` move a clock some
+ * installer already faked and freeze nothing on their own, so a block that only
+ * advances timers is controlled exactly when an installer reaches it. Whether an
+ * installer pins the DATE is {@link pinsDate}'s call. Group 1 is the installer.
+ */
+const DATE_PIN_CALL = /\b(useFakeTimers|setSystemTime)\s*\(/g;
 
 /**
  * Vitest aliases that resolve to the repo's own modules — source of truth is
@@ -615,16 +660,46 @@ function declaredHookSubjects(lines) {
  * @returns {Array<{start: number, end: number}>} half-open [start, end) indices
  */
 function testBlocks(lines) {
-  const OPENER = /^(\s*)(?:it|test)(?:\.\w+)*\s*\(/;
-  const SIBLING = /^\s*(?:it|test|describe)(?:\.\w+)*\s*\(/;
+  return callRanges(lines, /^(\s*)(?:it|test)(?:\.\w+)*\s*\(/, /^\s*(?:it|test|describe)(?:\.\w+)*\s*\(/);
+}
+
+/**
+ * Split a file into `describe(` blocks, segmented like {@link testBlocks} but
+ * with no sibling fallback: a `describe` without its own same-indentation `});`
+ * runs to the end of the file. For its one consumer (B5's setup fake-timer
+ * scope) over-inclusion is NOT safe: a wider `describe` exempts more blocks, so
+ * a fake timer in it hides a sibling describe's time bomb — the false negative
+ * this scoping exists to remove. Ceiling (BV-004): two shapes still widen —
+ * a `describe` closed with options (`}, 10_000);`) runs to end of file, and a
+ * tagged-template `describe.each\`…\`` never matches the opener, so its timer
+ * reads as module level. Measured 2026-10-02 over 722 test files: 0 of the 13
+ * fake-timer files use either shape. Revisit when one appears in a fake-timer
+ * file, or when a B5 miss traces to one.
+ * @param {string[]} lines
+ * @returns {Array<{start: number, end: number}>} half-open [start, end) indices
+ */
+function describeBlocks(lines) {
+  return callRanges(lines, /^(\s*)describe(?:\.\w+)*\s*\(/, null);
+}
+
+/**
+ * Shared segmenter: every line matching `opener` (group 1 = its indentation)
+ * opens a range that ends after the first later line closing at the SAME
+ * indentation (`});`), or before the first `sibling` line, or at end of file.
+ * @param {string[]} lines
+ * @param {RegExp} opener
+ * @param {RegExp|null} sibling
+ * @returns {Array<{start: number, end: number}>} half-open [start, end) indices
+ */
+function callRanges(lines, opener, sibling) {
   const out = [];
   for (let i = 0; i < lines.length; i++) {
-    const m = OPENER.exec(lines[i]);
+    const m = opener.exec(lines[i]);
     if (!m) continue;
     const closer = new RegExp(`^${m[1]}\\}\\)`);
     let end = lines.length;
     for (let j = i + 1; j < lines.length; j++) {
-      if (SIBLING.test(lines[j])) {
+      if (sibling?.test(lines[j])) {
         end = j;
         break;
       }
@@ -663,6 +738,144 @@ function importedLocalIdentifiers(content) {
   return [...ids];
 }
 
+/**
+ * The clock-named bindings in these lines (`const now = Date.now()`,
+ * `now = new Date('2026-01-01')`): per name, whether ANY binding reads the REAL
+ * clock and whether ANY binding does not. Handing a real-clock binding over is
+ * reading the wall clock with an extra step, not controlling it.
+ *
+ * CEILING (#1487): a real-clock value laundered through a non-clock name
+ * (`const t = Date.now(); fn({ now: t })`) still counts as control. REVISIT
+ * when a clock-shift run of the suite finds a bomb fed by that route.
+ * @param {string[]} live non-comment lines
+ * @returns {Map<string, {real: boolean, other: boolean}>}
+ */
+function clockBindings(live) {
+  /** @type {Map<string, {real: boolean, other: boolean}>} */
+  const out = new Map();
+  for (const line of live) {
+    const m = CLOCK_BINDING.exec(line);
+    if (!m) continue;
+    const seen = out.get(m[1]) ?? { real: false, other: false };
+    if (REAL_CLOCK_READ.test(m[2])) seen.real = true;
+    else seen.other = true;
+    out.set(m[1], seen);
+  }
+  return out;
+}
+
+/**
+ * The clock-named names a block hands over as the REAL clock: its own real-clock
+ * bindings, plus the shared setup's (module level, `describe` body,
+ * `beforeEach`) for every name the block does not rebind itself (#1489 item 16:
+ * read block-wise only, `const now = Date.now()` at module level counted as
+ * control and kept a genuine bomb silent).
+ *
+ * A setup name counts only when EVERY setup binding of it reads the real clock.
+ * Setup is file-wide, not per-`describe`, so a name bound to the real clock in
+ * one `beforeEach` and to a fixed date in another is ambiguous for any given
+ * block — read as control, the scan's precision-first direction.
+ * @param {Map<string, {real: boolean, other: boolean}>} own the block's bindings
+ * @param {Map<string, {real: boolean, other: boolean}>} setup the shared setup's bindings
+ * @returns {Set<string>}
+ */
+function realClockNames(own, setup) {
+  /** @type {Set<string>} */
+  const names = new Set();
+  for (const [name, b] of own) if (b.real) names.add(name);
+  for (const [name, b] of setup) if (b.real && !b.other && !own.has(name)) names.add(name);
+  return names;
+}
+
+/**
+ * The value expression starting at `from`, up to the first `,` or closing
+ * bracket at nesting depth 0 (`now: new Date(x), other` → `new Date(x)`).
+ * Brackets inside string literals are not tracked; a cut-short value can only
+ * hide a real-clock read, which leaves the block counted as controlled — the
+ * pre-#1487 behaviour, never a new finding.
+ */
+function valueExpressionAt(line, from) {
+  let depth = 0;
+  for (let i = from; i < line.length; i++) {
+    const c = line[i];
+    if (c === '(' || c === '[' || c === '{') depth++;
+    else if (c === ')' || c === ']' || c === '}') {
+      if (depth === 0) return line.slice(from, i);
+      depth--;
+    } else if (c === ',' && depth === 0) return line.slice(from, i);
+  }
+  return line.slice(from);
+}
+
+/**
+ * True when this line hands over a clock that is NOT the real one: a clock-named
+ * handover (CONTROL_CLOCK_ARG) whose value neither reads the wall clock inline
+ * (`{ now: Date.now() }`) nor names a real-clock binding in the block's scope
+ * (`const now = Date.now(); fn(now)`, see `realClockNames`). #1487: before this,
+ * both shapes counted as control and kept a genuine time bomb silent.
+ * @param {string} line
+ * @param {Set<string>} realClock names bound to the real clock in this block's scope
+ */
+function handsOverControlledClock(line, realClock) {
+  return handoverValues(line).some((v) => !REAL_CLOCK_READ.test(v) && !namesAny(v, realClock));
+}
+
+/**
+ * The values this line hands over as a clock (CONTROL_CLOCK_ARG): after a
+ * `name:` key the expression that follows it, otherwise the name itself.
+ * @param {string} line
+ * @returns {string[]}
+ */
+function handoverValues(line) {
+  return [...line.matchAll(CONTROL_CLOCK_ARG)].map((m) =>
+    m[2] === ':' ? valueExpressionAt(line, m.index + m[0].length) : m[1],
+  );
+}
+
+/**
+ * True when `value` names one of `names` as a whole identifier.
+ * @param {string} value
+ * @param {Iterable<string>} names
+ */
+function namesAny(value, names) {
+  return [...names].some((n) => new RegExp(String.raw`(?<![.\w$])${n}(?![\w$])`).test(value));
+}
+
+/**
+ * True when this line freezes the calendar DATE, not just the timers (#1499
+ * item 8). vitest 4.1 installs `useFakeTimers()` at `this._fakingDate ||
+ * Date.now()` — the real clock unless a date was set first — so only
+ * `setSystemTime(<date>)` or a `useFakeTimers` config naming `now` pins a day;
+ * `{ toFake: ['setTimeout'] }` leaves Date real. A pin whose value reads the wall
+ * clock pins nothing: inline (`setSystemTime(new Date())`, `{ now: Date.now() }`)
+ * or through a clock-named binding the scanner knows reads it
+ * (`const now = new Date(); vi.setSystemTime(now)`, `useFakeTimers({ now })` —
+ * review of ac3ded47). An argument the line cannot read — a variable, a config
+ * spread over lines, a quoted key — counts as a pin: precision first, as
+ * everywhere in B5. CEILING: a pin value laundered through a NON-clock name
+ * (`const t = new Date(); vi.setSystemTime(t)`) still counts — the
+ * {@link clockBindings} ceiling.
+ * @param {string} line
+ * @param {Set<string>} realClock names bound to the real clock in this line's scope
+ */
+function pinsDate(line, realClock) {
+  for (const m of line.matchAll(DATE_PIN_CALL)) {
+    const arg = valueExpressionAt(line, m.index + m[0].length).trim();
+    let value = arg;
+    if (m[1] === 'useFakeTimers') {
+      if (arg === '') continue;
+      if (!arg.startsWith('{') || !arg.endsWith('}')) return true;
+      const key = /(?<![\w$])now(?![\w$])\s*([:,}])?/.exec(arg);
+      if (!key) continue;
+      if (!key[1]) return true;
+      // `now:` hands over the expression after it; shorthand `{ now }` hands over the binding `now`.
+      value = key[1] === ':' ? valueExpressionAt(arg, key.index + key[0].length) : 'now';
+    }
+    if (!REAL_CLOCK_READ.test(value) && !namesAny(value, realClock)) return true;
+  }
+  return false;
+}
+
 /** True when `id` is invoked anywhere in these lines. */
 function callsIdentifier(lines, id) {
   const re = new RegExp(`\\b${id}\\s*\\(`);
@@ -694,15 +907,101 @@ function scanClockBombs(relPath, content, lines) {
   const sutIds = importedLocalIdentifiers(content);
   if (sutIds.length === 0) return findings;
 
-  const blocks = testBlocks(lines).map(({ start, end }) => {
+  const ranges = testBlocks(lines);
+
+  // The setup every block shares (helpers, constants, `describe` bodies,
+  // beforeEach): where an echo may come from, and where a clock may be bound or
+  // frozen for the blocks below it. Never a sibling test — its assertions,
+  // titles and clock literals say nothing about this block's inputs.
+  // CEILING (BV-004): a block without its own same-indentation `});` (a
+  // `}, 10_000);` close, an expression-bodied arrow) runs on to the next sibling
+  // and takes the setup lines in between out of sharedSetup. Both directions
+  // follow: a swallowed `now = Date.now()` hides a finding, a swallowed fake
+  // timer adds one. Measured 2026-10-02 @ 46e6695b over 722 test files: 221 of
+  // 15,644 blocks lack the closer, 1 of them swallows a beforeAll/beforeEach,
+  // none a fake-timer install; 0 blocks are one-line its. REVISIT when a
+  // swallowed setup line binds or freezes a clock — then end such blocks on
+  // their own close instead of the sibling (testBlocks() also feeds B2/B3).
+  /** @type {Set<number>} */
+  const inBlock = new Set();
+  for (const { start, end } of ranges) for (let q = start; q < end; q++) inBlock.add(q);
+  const sharedSetup = lines.filter((_, q) => !inBlock.has(q));
+  const setupLive = sharedSetup.filter((l) => !isCommentLine(l));
+  const setupBindings = clockBindings(setupLive);
+  // A clock frozen in setup (`beforeEach(() => vi.setSystemTime(…))`) controls
+  // every block it reaches, including a `now = Date.now()` bound after it — and
+  // it reaches only the blocks vitest runs it for: all of them from module level,
+  // only its own `describe`'s from inside one. A fake timer in a SIBLING
+  // `describe` exempted every block in the file until 2026-10-02 and kept a
+  // genuine bomb silent (review of 3206ab24). `null` = module level.
+  const describes = describeBlocks(lines);
+  /**
+   * Innermost `describe` holding line q — ranges nest, so the latest start that
+   * still holds it — or `null` at module level.
+   * @param {number} q
+   */
+  const innermostDescribe = (q) => {
+    const holders = describes.filter((d) => d.start <= q && q < d.end);
+    return holders.length > 0 ? holders[holders.length - 1] : null;
+  };
+  const setupRealClock = realClockNames(new Map(), setupBindings);
+  /** @type {Array<{start: number, end: number}|null>} */
+  const setupTimerScopes = [];
+  lines.forEach((l, q) => {
+    if (inBlock.has(q) || isCommentLine(l) || !pinsDate(l, setupRealClock)) return;
+    setupTimerScopes.push(innermostDescribe(q));
+  });
+  /** @param {number} start */
+  const setupFreezes = (start) =>
+    setupTimerScopes.some((d) => d === null || (d.start < start && start < d.end));
+  // A real-clock name bound by a statement of the module itself or of a
+  // `describe` body is read at COLLECTION time, before vitest runs any hook
+  // (#1499 item 9). No freeze, in the setup or in the block, reaches that value,
+  // so a block handing it over is not exempted by one. Every other setup binding
+  // is DEFERRED — a hook callback, or a helper function's body (`validRecord()`,
+  // `writeLock()`), which runs when called, after any freeze: 12 of the 13 setup
+  // real-clock bindings outside a hook were such helper locals (measured
+  // 2026-10-02 over 722 test files, review of ac3ded47). A name qualifies only
+  // with no deferred binding at all — anything else reads as control, the
+  // precision-first direction. "Statement of" is read from indentation: column 0
+  // at module level, the enclosing `describe`'s column + 2 inside one (the
+  // prettier indent of this repo). A misread only moves names OUT of the set: a
+  // deeper or other indent style counts as deferred, and a hook range that
+  // over-extends (a one-line `beforeEach(…);`) does the same. CEILINGS: a
+  // one-line helper (`function f() { const now = Date.now(); … }`) at
+  // `describe`-body indent counts as collection time; a freeze that itself runs
+  // at collection time (a module-level `vi.setSystemTime` above the binding) is
+  // not read. Measured 2026-10-02 over 722 test files: 1 collection-time binding
+  // (tests/hooks/lock-reconcile.test.mjs:24), 0 installers outside a hook or test
+  // block. REVISIT on the first B5 finding traced to either shape.
+  const hooks = callRanges(lines, /^(\s*)(?:before|after)(?:Each|All)\s*\(/, null);
+  const indentOf = (/** @type {string} */ l) => /^\s*/.exec(l)[0].length;
+  /** @param {number} q */
+  const atCollection = (q) => {
+    if (hooks.some((h) => h.start <= q && q < h.end)) return false;
+    const d = innermostDescribe(q);
+    return indentOf(lines[q]) === (d ? indentOf(lines[d.start]) + 2 : 0);
+  };
+  const deferredBindings = clockBindings(
+    lines.filter((l, q) => !inBlock.has(q) && !isCommentLine(l) && !atCollection(q)),
+  );
+  const collectionClock = [...setupBindings]
+    .filter(([name, b]) => b.real && !b.other && !deferredBindings.has(name))
+    .map(([name]) => name);
+
+  const blocks = ranges.map(({ start, end }) => {
     const body = lines.slice(start, end);
     const live = body.filter((l) => !isCommentLine(l));
+    const own = clockBindings(live);
+    const realClock = realClockNames(own, setupBindings);
+    const unfrozen = collectionClock.filter((name) => !own.has(name));
+    const handsOverUnfrozen = live.some((l) => handoverValues(l).some((v) => namesAny(v, unfrozen)));
     return {
       start,
       body,
       provesSeam: live.some((l) => SEAM_CLOCK_ARG.test(l)),
-      hasClockArg: live.some((l) => CONTROL_CLOCK_ARG.test(l)),
-      hasFakeTimer: live.some((l) => FAKE_TIMER.test(l)),
+      hasClockArg: live.some((l) => handsOverControlledClock(l, realClock)),
+      freezesDate: !handsOverUnfrozen && (setupFreezes(start) || live.some((l) => pinsDate(l, realClock))),
     };
   });
 
@@ -714,19 +1013,8 @@ function scanClockBombs(relPath, content, lines) {
   }
   if (seamed.size === 0) return findings;
 
-  // Where an echo may come from: the finding's own block, or the setup every
-  // block shares (helpers, constants, beforeEach). Never a sibling test — its
-  // assertions, titles and clock literals say nothing about this block's inputs.
-  // A block without its own `});` (a one-line it) runs on to the next sibling
-  // and takes the setup lines in between out of sharedSetup — that direction can
-  // only add a finding, never hide one (1.4% of blocks, measured 2026-09-30).
-  /** @type {Set<number>} */
-  const inBlock = new Set();
-  for (const b of blocks) for (let q = b.start; q < b.start + b.body.length; q++) inBlock.add(q);
-  const sharedSetup = lines.filter((_, q) => !inBlock.has(q));
-
   for (const b of blocks) {
-    if (b.hasClockArg || b.hasFakeTimer) continue;
+    if (b.hasClockArg || b.freezesDate) continue;
     const subject = [...seamed].find((id) => callsIdentifier(b.body, id));
     if (!subject) continue;
     const echoSources = [...b.body, ...sharedSetup].filter(

package/scripts/lib/validate/check-vcs-repo-flag.mjs

@@ -41,7 +41,7 @@
  *     a string literal counts only when the command STARTS the literal (after
  *     optional whitespace) AND the literal carries no `${` interpolation. That
  *     second half is what separates
- *     `'  glab ci status --pipeline-id LATEST'` (a real command handed to a
+ *     `'  glab ci status --branch main'` (a real command handed to a
  *     shell) from `` `glab note add spawn error: ${err}` `` (a log message).
  *  4. **The first token after the CLI must be a REAL top-level subcommand** of
  *     that CLI, measured from `gh --help` / `glab --help` (gh 2.86.0,

package/scripts/lib/vault-mirror/auto-commit.mjs

@@ -11,6 +11,8 @@ import { readFileSync, existsSync } from 'node:fs';
 import { resolve, sep } from 'node:path';
 import { spawnSync } from 'node:child_process';
 
+import { redactHomeDir } from '../common.mjs';
+
 const GENERATOR_MARKER = 'session-orchestrator-vault-mirror@1';
 const MIRROR_DIRS = ['40-learnings', '50-sessions'];
 
@@ -79,7 +81,7 @@ export function autoCommitVaultMirror(vaultDirPath, sessionId, repo) {
 
   const addResult = git(vaultDirPath, ['add', '--', ...stagingTargets]);
   if (addResult.status !== 0) {
-    process.stderr.write(`vault-mirror: auto-commit git-add failed: ${addResult.stderr}\n`);
+    process.stderr.write(`vault-mirror: auto-commit git-add failed: ${redactHomeDir(addResult.stderr)}\n`);
     process.stdout.write(
       JSON.stringify({ action: 'auto-commit-skipped', reason: 'git-add-failed' }) + '\n',
     );
@@ -88,7 +90,7 @@ export function autoCommitVaultMirror(vaultDirPath, sessionId, repo) {
 
   const diff = git(vaultDirPath, ['diff', '--cached', '--name-only', '--', ...stagingTargets]);
   if (diff.status !== 0) {
-    process.stderr.write(`vault-mirror: auto-commit git-diff failed: ${diff.stderr}\n`);
+    process.stderr.write(`vault-mirror: auto-commit git-diff failed: ${redactHomeDir(diff.stderr)}\n`);
     process.stdout.write(
       JSON.stringify({ action: 'auto-commit-skipped', reason: 'git-diff-failed' }) + '\n',
     );
@@ -182,7 +184,7 @@ export function autoCommitVaultMirror(vaultDirPath, sessionId, repo) {
   //      committed content is already validated. See SKILL.md § "Pre-commit hook bypass (--no-verify)".
   const commit = git(vaultDirPath, ['commit', '-m', subject, '--no-verify']);
   if (commit.status !== 0) {
-    process.stderr.write(`vault-mirror: auto-commit git-commit failed: ${commit.stderr}\n`);
+    process.stderr.write(`vault-mirror: auto-commit git-commit failed: ${redactHomeDir(commit.stderr)}\n`);
     process.stdout.write(
       JSON.stringify({ action: 'auto-commit-skipped', reason: 'git-commit-failed' }) + '\n',
     );

package/scripts/lib/vault-mirror/namespace.mjs

@@ -10,13 +10,18 @@
  *   - Pure + deterministic (given the same vaultName, the same `.vault.yaml`
  *     under `repoRoot`, the same git remote, and the same host-local pseudonym
  *     map).
- *   - `repoRoot` (#1389) selects the directory whose `.vault.yaml` is read;
- *     it defaults to `process.cwd()`. Named limit: it scopes ONLY that lookup —
- *     the {@link deriveRepo} fallback still resolves from the process cwd and
- *     is cached per process, so a `repoRoot` that differs from the cwd AND has
- *     no declared slug falls back to the cwd's git identity. Every production
- *     caller passes its own cwd today; revisit if a caller ever mirrors a repo
- *     other than the one it runs in.
+ *   - `repoRoot` (#1389, #1503) selects the repo whose identity is resolved —
+ *     BOTH the `.vault.yaml` lookup and the {@link deriveRepo} fallback (its
+ *     preferred git remote, else its directory name). It defaults to
+ *     `process.cwd()`. Until #1503 only the `.vault.yaml` half honoured it: the
+ *     git fallback still read the process cwd, cached once per process, so a
+ *     caller mirroring a repo other than the one it ran in got the CWD's
+ *     namespace — which is how one repo's ledger overwrote another repo's vault
+ *     notes. The revisit trigger this comment used to name ("a caller mirrors a
+ *     repo other than the one it runs in") fired; the cache is now keyed per
+ *     root. Remaining ceiling: a caller that passes NO `repoRoot` still gets the
+ *     cwd's identity — `scripts/vault-mirror.mjs` derives a root from
+ *     `--source` precisely so that it never relies on that default.
  *   - Returns a lowercase kebab slug safe for use as a filesystem path segment.
  *   - Host-local pseudonym mapping (Epic #725 D5): consulted ONLY at the redaction
  *     site (only when a segment is owner-leaky). If such a repo (raw or sanitised)
@@ -48,7 +53,7 @@
  * (itself a leaf — `node:child_process` only) — never the pipeline.
  */
 
-import { basename } from 'node:path';
+import { basename, resolve } from 'node:path';
 
 import { subjectToSlug } from './utils.mjs';
 import { isOwnerLeakySegment } from '../../lib/validate/check-owner-leakage.mjs';
@@ -97,7 +102,13 @@ function currentMapPath() {
 
 // ── Repo identity (issue #343; moved here from process.mjs for #734b) ────────
 
-let _cachedRepo = null;
+/**
+ * Resolved repo root → derived identity. Keyed per root (#1503): a single
+ * process-wide slot answered every later caller with the FIRST root's identity,
+ * whichever root that caller asked about.
+ * @type {Map<string, string>}
+ */
+const _cachedRepos = new Map();
 
 /** scp-like SSH remote: `git@host:org/name.git` (no `://`, an `@` before any `/`). */
 const SCP_LIKE_REMOTE_RE = /^[^@/\s]+@[^:/\s]+:(.+)$/;
@@ -177,7 +188,7 @@ function repoIdentifierFromRemoteUrl(url) {
  *      {@link resolveRepoNamespace} returned `'unknown-repo'`. Measured
  *      2026-08-19; it turned a namespace assertion red and blocked a push.
  *
- * Fallback: `path.basename(process.cwd())`, as before — but the two reasons for
+ * Fallback: `path.basename(<root>)` — but the two reasons for
  * reaching it are no longer indistinguishable. A QUERY FAILURE (not a git repo,
  * git not on PATH, git errored — {@link isQueryFailure}) emits a stderr WARN,
  * because the identity under which vault notes are written was GUESSED. A real
@@ -186,8 +197,11 @@ function repoIdentifierFromRemoteUrl(url) {
  * An `ok` resolution whose URL yields no usable identifier also falls back
  * silently — the query succeeded and the answer was simply unusable.
  *
- * Cached per-process — repo identity does not change mid-run, and the cache also
- * keeps the WARN to at most one line per process.
+ * `<root>` is `repoRoot` when given, else `process.cwd()` (#1503: the remote is
+ * read with `git -C <root>`, so the identity is the root's, never the cwd's).
+ *
+ * Cached per resolved root — repo identity does not change mid-run, and the
+ * cache also keeps the WARN to at most one line per root.
  *
  * NOTE — this is the RAW identifier and is NOT leak-guarded. Never write its
  * output to the vault directly; route it through {@link resolveRepoNamespace}
@@ -198,18 +212,25 @@ function repoIdentifierFromRemoteUrl(url) {
  * until the #734b cycle break, and the module-level cache means there must remain
  * exactly ONE definition.
  *
+ * @param {object} [opts]
+ * @param {string|null} [opts.repoRoot] - Repo whose identity to derive;
+ *   `undefined`/`null` → `process.cwd()`.
  * @returns {string} e.g. 'Kanevry/session-orchestrator' or a bare directory name.
  */
-export function deriveRepo() {
-  if (_cachedRepo !== null) return _cachedRepo;
+export function deriveRepo({ repoRoot = null } = {}) {
+  const root = resolve(repoRoot ?? process.cwd());
+  const cached = _cachedRepos.get(root);
+  if (cached !== undefined) return cached;
+
+  const remember = (identity) => {
+    _cachedRepos.set(root, identity);
+    return identity;
+  };
 
-  const resolved = resolvePreferredRemote({});
+  const resolved = resolvePreferredRemote({ repoRoot: root });
   if (resolved.ok) {
     const identifier = repoIdentifierFromRemoteUrl(resolved.url);
-    if (identifier !== '') {
-      _cachedRepo = identifier;
-      return _cachedRepo;
-    }
+    if (identifier !== '') return remember(identifier);
   } else if (isQueryFailure(resolved.reason)) {
     process.stderr.write(
       `WARN vault-mirror/namespace: could not query git remotes (${resolved.reason}); ` +
@@ -218,8 +239,7 @@ export function deriveRepo() {
     );
   }
 
-  _cachedRepo = basename(process.cwd());
-  return _cachedRepo;
+  return remember(basename(root));
 }
 
 /**
@@ -249,9 +269,9 @@ function lookupPseudonym(base, seg) {
  *   When non-empty and non-whitespace, used in place of the declared/git-derived
  *   repo name. When absent, the base is the repo's declared `.vault.yaml`
  *   `metadata.slug` (#1131), else the git origin via deriveRepo().
- * @param {string|null} [opts.repoRoot] - Directory whose `.vault.yaml` supplies
- *   the declared slug (#1389). `undefined`/`null` → `process.cwd()`. Does NOT
- *   redirect the deriveRepo() fallback (see the module header's named limit).
+ * @param {string|null} [opts.repoRoot] - Repo whose identity is resolved: its
+ *   `.vault.yaml` supplies the declared slug (#1389), and its git remote feeds
+ *   the deriveRepo() fallback (#1503). `undefined`/`null` → `process.cwd()`.
  * @returns {string} A single kebab-slug path segment, e.g. 'session-orchestrator'.
  *   Special returns:
  *   - 'unknown-repo'  — slug derivation produced an empty string.
@@ -284,10 +304,11 @@ export function resolveRepoNamespace({ vaultName = null, repoRoot = null } = {})
   // guard below deliberately — a declared slug is operator data flowing into a
   // written path and is checked by CP1/CP6/CP10 and the pseudonym map exactly
   // like any git-derived identifier.
-  const declaredSlug = readVaultSlug(repoRoot ?? process.cwd());
+  const root = repoRoot ?? process.cwd();
+  const declaredSlug = readVaultSlug(root);
   const base = (vaultName && typeof vaultName === 'string' && vaultName.trim())
     ? vaultName.trim()
-    : (declaredSlug ?? deriveRepo());
+    : (declaredSlug ?? deriveRepo({ repoRoot: root }));
 
   // Sanitise: collapse to last path segment, lowercase, strip non-[a-z0-9-].
   const seg = subjectToSlug(base);