session-orchestrator 5.4.0 → 5.6.0

package/docs/scope-collision-guard.md

@@ -21,9 +21,9 @@ Two things follow, and both are the point of #1020:
 | 2 | Assert disjointness | the materialized sidecar array `[{id, files}, …]` | `validate-wave-scope.mjs --assert-disjoint` → `findScopeCollisions()` |
 | 3 | Compute the union | stdout of `--union` → `allowedPaths` | `expandTestSiblings(unionFileScopes(scopes), { role })` |
 | 4 | Inject | `FILE-SCOPE — exactly these:` + a fenced block in each agent prompt | the per-agent file from step 1 |
-| 5 | Dispatch | `.orchestrator/wave-dispatch-scopes.json` (ledger) | `hooks/pre-task-scope-disjoint.mjs`, `PreToolUse` matcher `Agent` |
+| 5 | Dispatch | `.orchestrator/wave-dispatch-scopes.<session>.json` (ledger, one per session) | `hooks/pre-task-scope-disjoint.mjs`, `PreToolUse` matcher `Agent` |
 
-`<state-dir>` is the first of `.pi` / `.cursor` / `.codex` / `.claude` that carries a `wave-scope.json` — the same precedence `findScopeFile()` and the hook's `waveKeyOf()` use.
+`<state-dir>` is the first of `.pi` / `.cursor` / `.codex` / `.claude` that carries a `wave-scope.json` not provably owned by a peer session — `findOwnScopeFile()` resolves it using process-local session ids, including for the hook's `waveKeyOf()`. Unbound or corrupt manifests still decide under the ENFORCE contract; when only peer manifests exist, the wave key is `<session>|w?|?`.
 
 Step 1 also offers an opt-in path diagnostic: run `materialize-wave-scope.mjs` from the project root with `--warn-missing` to name absent concrete paths and their agents on stderr (#1235). Relative paths resolve from the working directory, not `<state-dir>`. A warning does not fail the command or change its stdout or either declaration shape. For a file the wave deliberately creates, repeat `--new-file PATH` as needed; every exception must exactly match a declared path and pass scope validation before any writes begin. Grants containing `*` or ending in `/` are skipped under the existing glob/prefix grammar; `?` and braces are literal. The canonical invocation and handling steps are in `skills/wave-executor/references/wave-loop-scope-manifest.md` § 3.1.
 
@@ -35,7 +35,9 @@ The same ordering argument applies one level up: step 2 runs on the **declared**
 
 ### 2.2 Why the scope files are not temp files
 
-Steps 1, 2, 3, 4 and the `--assert-subset` assertion all read the *same* file, addressed by wave and agent id. A `$TMPDIR` copy is the one failure in this chain that **costs no error**: the injector finds nothing, no `FILE-SCOPE` block reaches the prompt, `extractScopeFromPrompt()` returns `[]`, and the hook allows the dispatch exactly as it did before #1020 — signal-free (matrix rows 5/6 below). The scope files are control state like `wave-scope.json` itself, never a wave territory; writing them legitimately trips `bash-write-verify` once per wave rollover, and widening `allowedPaths` to silence that would grant agents write access to the deconfliction record.
+Steps 1, 2, 3, 4 and the `--assert-subset` assertion all read the *same* file, addressed by wave and agent id. A `$TMPDIR` copy is the one failure in this chain that **costs no error**: the injector finds nothing, no `FILE-SCOPE` block reaches the prompt, `extractScopeFromPrompt()` returns `[]`, and the hook allows the dispatch exactly as it did before #1020 — signal-free (matrix rows 5/6 below). The scope files are control state like `wave-scope.json` itself, never a wave territory, so they never enter `allowedPaths` — that would grant agents write access to the deconfliction record. Until #1027 Pkt 5 writing them tripped `bash-write-verify` once per wave rollover; its `computeReport` now drops `<state-dir>/filescopes/**` from the violation set beside the manifest itself (`isScopeDeclarationPath()` in `scope-gate.mjs`, keyed on the ACTIVE manifest's state dir, so another harness dir's `filescopes/` still reports). The cost, named: a Bash rewrite of a scope file after dispatch is no longer reported there. For the per-agent files `filescopes/wave-<N>/<agent-id>.json` what it can change is bounded — the dispatch already read the file, `wave-scope.json` (and with it `allowedPaths`) keeps its content-hash control notice, and `scope-echo --verify` turns a rewritten file into `digest-unknown`. The aggregate sidecar `filescopes/wave-<N>.scopes.json` is re-read on every call (`readPeerScopeRecords()`), and a `peer-session-*` record there downgrades the matching violations to a "peer write" notice — so since #1504 point 5 its hash is BOUND to the manifest in the hook's trusted snapshot (`bindPeerSidecar()`): bound whenever the `wave-scope.json` hash changes, which fits the materialize → assert → union → write-manifest order. A sidecar that changes while the same manifest stands is untrusted: no peer record is honoured (those writes report as violations) until the manifest is rewritten, and a ⚠ notice names the file once per mismatching sidecar hash (HR-101 — not on every call). Named ceilings: a sidecar changed before the hook first observes the manifest is bound as found; one rewritten together with the manifest is covered only by the control-file notice; re-materializing the SAME wave without rewriting the manifest raises the notice once and leaves every peer record disabled until the manifest is rewritten — and because `--union` excludes `peer-session-*` records, a mid-wave Peer-Scope-Union changes the sidecar but not `allowedPaths`, so only the § 3.3 skeleton→final manifest rewrite changes the manifest hash and re-binds (the re-binding DEPENDS on that rewrite; `skills/_shared/parallel-aware-auq.md` § Peer-Scope-Union step 2 requires it); a forged complete snapshot record is believed (`trustedScopeState()`'s residual). No digest is written into any file the coordinator controls — a digest beside the sidecar sits where the same Bash line can rewrite it.
+
+**A peer session's real manifest is reported once (#1511 e, named ceiling).** `.codex/wave-scope.json` or `<other-harness>/filescopes/**` written by a live peer appears once in this session's out-of-scope report (the report-once snapshot then holds it). The obvious exemption — "the manifest's binding names another session" — was shipped and withdrawn (e52bd786): the binding is what the file says about itself, so one Bash line could write a foreign-looking manifest and silence everything under that `filescopes/`. The hook cannot attribute a write to a caller either: as a `PostToolUse` hook it sees only the tree after the call and the PREVIOUS call's snapshot, so a peer's write between two calls and this call's own write land in the same window. Every other candidate signal is forgeable from inside this session as well: mtime (`touch -d`), a registry-live peer id (readable, so writable into the file), the harness directory. Until a signal exists that this session cannot produce, the one-time report stands.
 
 The coordinator's **own** planned direct edits belong in `coordinator.json` in the identical form. They are not dispatches, so the hook can never see them (§ 6); the CLI check is the only gate that covers them.
 
@@ -54,6 +56,8 @@ The reader is `hooks/enforce-scope.mjs` **Gate 3b**, between the manifest parse
 | ids present, none matching, own identity resolvable | `foreign` | **ALLOW** + one `orchestrator.scope.foreign_session_ignored` event |
 | ids present, own identity unresolvable (empty id set) | `unknown` | ENFORCE |
 
+**Which manifest Gate 3 reads (#1504 point 6).** Up to four candidates can exist (`.pi` > `.cursor` > `.codex` > `.claude`). Gate 3 takes the first one whose verdict is NOT `foreign` (`findOwnScopeFile()`, `scripts/lib/scope-gate.mjs`; identity checked per candidate inside the loop) — `unknown` included, so an unbound, legacy or corrupt manifest still decides exactly as before. Only when EVERY candidate is foreign does the first of them reach Gate 3b and its ALLOW + event above. Before, the first EXISTING file decided: a peer's `.pi`/`.cursor` manifest made Gate 3b stand down and this session's own `.claude/wave-scope.json` was never read. `enforce-commands`, `post-bash-write-verify` and `wave-scope-commit-guard` resolve the same way.
+
 Five properties are choices, not omissions — and every one of them points the fail-**closed** way, the deliberate inverse of § 4.1's posture for the dispatch hook:
 
 - **Only what is PROVABLY foreign is foreign.** `readProcessLocalSessionIds()` returns the ids that are PROCESS-LOCAL — hook input (`session_id`/`sessionId`/`parent_session_id`) and `CLAUDE_CODE_SESSION_ID` — and an EMPTY set when neither yields an id, which can only produce `unknown`. The repo-global `session.lock` is deliberately NOT a tier here (#1194): it is ONE file shared by every session in the checkout, so unioning it let a peer's manifest match a peer-written lock id, classify `own`, and have Gate 7 deny the second session's legitimate writes — the exact lockout G3b exists to end. A better signal REPLACES a worse one (`.claude/rules/host-resources.md` § HR-102). A gate that guessed would turn "cannot tell" into a silent enforcement-off on every harness exporting no session id. Every value is trimmed on the way in, so a whitespace-only env var cannot enter as a phantom id that matches nothing (`.claude/rules/development.md` § env-var whitespace trap).
@@ -107,10 +111,10 @@ Both globs match `scripts/lib/x.mjs`, yet the direct comparison says `false`. Fo
 
 It cannot compare a batch of siblings directly — the header records why, measured against 12 archived transcripts of this repo (147 dispatch `tool_use` blocks, 51 batches, measured 2026-08-14): the dispatch tool is named `Agent` and not `Task`; the payload carries **no** structured file scope (`files` / `file_scope` / `scope` → 441 probes, zero hits), so the scope exists only as prose inside `prompt`; and the not-yet-dispatched siblings of a batch are not visible in the transcript at dispatch time. What remains is a **ledger**: each dispatch records its scope under a wave key, and the next dispatch is checked against everything already recorded.
 
-- **Ledger:** `.orchestrator/wave-dispatch-scopes.json` (gitignored), keyed `<session-id>|w<wave>|<role>` from `<state-dir>/wave-scope.json`.
-- **Lock:** `.orchestrator/wave-dispatch-scopes.lock` — the read-modify-write cycle runs under `withFileLock()` (the primitive behind the PSA-005 STATE.md lock). `writeJsonAtomicSync` makes the write atomic, never the *cycle*.
-- **Scope extraction:** `extractScopeFromPrompt()` finds a scope marker line and takes the FIRST fenced block after it, accepting only lines that survive a deliberately strict `looksLikeRepoPath()`. `normalizeScopeEntry()` then folds `./`, `//` and `/./` spellings together, and `promoteDirEntries()` rewrites `scripts/lib` → `scripts/lib/` **on evidence** (not a tracked file itself, at least one tracked file beneath it) — both because two spellings of one path previously compared as disjoint.
-- **DENY** fires on exactly one condition: a collision involving THIS dispatch with a prior agent of the same wave that is **still in flight** (§ 5). The reason names the agent pair, the collision kind and the evidence paths; the suggestion is "give the file exactly ONE owner, or wait for the named agent(s) and re-dispatch", plus the ledger path to delete if the state is stale. The ledger is deliberately **not** persisted on a deny — the dispatch did not happen, so recording it would make the retry-after-fix look like a duplicate.
+- **Ledger:** `.orchestrator/wave-dispatch-scopes.<session>.json` — ONE FILE PER SESSION since #1493, `<session>` being the payload's `session_id` reduced to `[A-Za-z0-9._-]` (`ledgerPathsFor()`). Before, every session of the working copy shared one file holding one `waveKey`: claims of two sessions were never compared (the key's first segment is the session id), but a peer's dispatch reset the file and erased this session's live claims. The pre-split `.orchestrator/wave-dispatch-scopes.json` is read once for migration — adopted only while this session has no file yet and its `waveKey` names this session — and never written or deleted, since it may be a peer's live state. (Gitignored in this repo; consumer repos get the ignore line from bootstrap's `store-lock-ignore` step since #1495 — a repo bootstrapped earlier gets it on its next `--upgrade` or `--refresh-lock`), keyed `<session-id>|w<wave>|<role>` from `<state-dir>/wave-scope.json`.
+- **Lock:** `.orchestrator/wave-dispatch-scopes.<session>.lock`, one per ledger file — the read-modify-write cycle runs under `withFileLock()` (the primitive behind the PSA-005 STATE.md lock). `writeJsonAtomicSync` makes the write atomic, never the *cycle*.
+- **Scope extraction:** `extractScopeFromPrompt()` finds a scope marker line and takes the FIRST fenced block after it, accepting only lines that survive a deliberately strict `looksLikeRepoPath()`. `decide()` then folds `./`, `//` and `/./` spellings together with `scopeEntrySpelling()` — the same rule `findScopeCollisions()` and `unionFileScopes()` apply, exported from `scope-gate.mjs` so no second copy can drift (#1510 g), and `promoteDirEntries()` rewrites `scripts/lib` → `scripts/lib/` **on evidence** (not a tracked file itself, at least one tracked file beneath it) — both because two spellings of one path previously compared as disjoint.
+- **DENY** fires on exactly one condition: a collision involving THIS dispatch with a prior agent of the same wave that is **still in flight** (§ 5). The reason names the agent pair, the collision kind and the evidence paths; the suggestion is "give the file exactly ONE owner, or wait for the named agent(s) and re-dispatch", plus this session's ledger path to delete if the state is stale (never a peer's). The ledger is deliberately **not** persisted on a deny — the dispatch did not happen, so recording it would make the retry-after-fix look like a duplicate.
 
 ### 4.1 Error-class matrix — deliberately fail-**open**
 
@@ -157,7 +161,7 @@ Why it exists: the in-ledger `scopeSignals` counter (§ 4.1, rows 5/6) is a **wa
 
 A cryptographic proof still needs that platform boundary: no mechanism inside this repo can distinguish a copied digest from a read one.
 
-**The digest now JOINS the two halves (#1092, 2026-09-16).** Everything above stays true — what changed is that the halves became joinable at all. `scope_checked` carries `scope_digest` (`scopeDigest()` over the paths extracted from the prompt, omitted for an empty scope rather than defaulted to the empty-string digest), `echo_instruction_present`, `instructed_digest` and `digest_consistent`; `scope_echo_checked` already carried `expected_digest` / `actual_digest`; and `materialize-wave-scope` writes one `scope_materialized` record per wave carrying `transport_observable`. `node scripts/lib/scope-echo.mjs --verify --wave <N> --state-dir <dir>` joins all three **on the digest, never on `agent_id`** — measured 2026-09-16 over this host's ledger, 609 send-side against 51 receive-side records whose agent-id sets overlap in ZERO elements (send records the dispatch `description` + `subagent_type`, receive the coordinator's short handle), so before the digest the two halves could not be paired even in principle. Its closed verdict enum — `matched` · `injected-not-echoed` · `echoed-not-injected` · `injection-missing` · `digest-unknown` · `duplicate-claim`, all degrading to `echo-only` when the transport is unobservable — is what makes the issue's AC-2 (an omitted injection turning an end-to-end probe red) a measurable state rather than an unfalsifiable absence. `digest_consistent: false` additionally catches agent A's fenced block beside agent B's echo line **at dispatch time**, from the prompt alone. None of this raises the ceiling above: a joined digest still proves transport of a LINE, never obedience.
+**The digest now JOINS the two halves (#1092, 2026-09-16).** Everything above stays true — what changed is that the halves became joinable at all. `scope_checked` carries `scope_digest` (`scopeDigest()` over the paths extracted from the prompt, omitted for an empty scope rather than defaulted to the empty-string digest), `echo_instruction_present`, `instructed_digest` and `digest_consistent`; `scope_echo_checked` already carried `expected_digest` / `actual_digest`; and `materialize-wave-scope` writes one `scope_materialized` record per wave carrying `transport_observable`. `node scripts/lib/scope-echo.mjs --verify --wave <N> --state-dir <dir>` joins all three **on the digest, never on `agent_id`** — measured 2026-09-16 over this host's ledger, 609 send-side against 51 receive-side records whose agent-id sets overlap in ZERO elements (send records the dispatch `description` + `subagent_type`, receive the coordinator's short handle), so before the digest the two halves could not be paired even in principle. Its closed verdict enum — `matched` · `injected-not-echoed` · `echoed-not-injected` · `injection-missing` · `digest-unknown` · `duplicate-claim`, all degrading to `echo-only` when the transport is unobservable — is what makes the issue's AC-2 (an omitted injection turning an end-to-end probe red) a measurable state rather than an unfalsifiable absence. `digest_consistent: false` additionally catches agent A's fenced block beside agent B's echo line **at dispatch time**, from the prompt alone. The coordinator's own `coordinator.json` takes no part in the join, and `scope_materialized` counts no agent for it (`isCoordinatorRecordId()`, #1493.2): it is a declaration, never a dispatch, so nothing can claim its digest and it used to read `injection-missing` on every wave where the coordinator planned an edit. None of this raises the ceiling above: a joined digest still proves transport of a LINE, never obedience.
 
 **Revisit-Trigger** (verbatim from issue #1092, for the transport half this section deliberately does NOT close):
 
@@ -186,7 +190,7 @@ The discriminator is therefore neither time nor the agent's name, but whether th
 
 Complete list of what this guard does **not** see, or sees only approximately:
 
-1. **The blind TTL window.** Without transcript evidence the only liveness signal is the 30-minute TTL above. Inside that window a finished agent still blocks (false deny, recoverable by deleting the ledger); outside it a running agent no longer blocks (false allow). Revisit trigger as stated in § 5.
+1. **The blind TTL window.** Without transcript evidence the only liveness signal is the 30-minute TTL above. Inside that window a finished agent still blocks (false deny, recoverable by deleting this session's ledger); outside it a running agent no longer blocks (false allow). Revisit trigger as stated in § 5.
 2. **Test-sibling collisions.** Disjointness is asserted on the **declared** scopes (step 2), before `expandTestSiblings()` runs (step 3). Two agents whose production files share a basename receive the *same* emitted sibling glob (`tests/**/{basename}*.test.mjs`), which a declared-scope check cannot see. Revisit if a wave is ever scoped by basename family instead of by directory.
 3. **Prose extraction fails only toward ALLOW.** The hook's only channel is the `FILE-SCOPE` prose block. A missing marker, a missing fence, a decorated path that fails `looksLikeRepoPath()` — all resolve to allow (rows 5/6). Measured: 42 of 147 archived prompts (28.6 %) carried a scope marker at all, so denying the non-extractable case would have denied ~7 dispatches in 10. The CLI check (step 2) is the gate that does not depend on prose.
 4. **Coordinator-direct edits are invisible to the hook.** They are not dispatches, so no ledger entry exists for them. They participate in the CLI check via `coordinator.json` only — and 2 of the 5 divergences that motivated #1020 were coordinator-direct edits.
@@ -195,16 +199,16 @@ Complete list of what this guard does **not** see, or sees only approximately:
 7. **Only collisions involving the current dispatch are actionable.** A pair among already-dispatched agents was either denied at its own dispatch or predates the guard; re-denying it would block an innocent third agent.
 8. **Lock loss reopens the race.** On lock timeout the cycle runs unlocked (row 14) — two dispatches starting together can then read the same ledger state and one record is lost. That is the pre-lock behaviour, chosen over denying on a lock-file problem.
 9. **The session binding is self-declared** (§ 2.3). `session` is a plain field in a file any process in this working copy can write, so writing a foreign id into it turns the write gate off for that manifest. Named rather than hidden: it is the SAME power `enforcement: "off"` already grants in the same file, so Gate 3b adds no new authority — the manifest is the coordinator's own artefact either way.
-10. **Only the WRITE gate is session-bound.** The dispatch ledger of § 4 takes its session component from the harness's own `input.session_id` (`waveKeyOf(projectDir, sessionId, …)`), and reads only `wave` and `role` out of `wave-scope.json` — the `session` field is not consulted there at all. So a peer session's manifest cannot bind this session's writes since #1123, but the two hooks reach that property by different routes, and a change to one does not carry to the other.
+10. **The manifest binding is read by the WRITE gates, not by the dispatch hook.** `enforce-scope`, `enforce-commands`, `post-bash-write-verify` and — since #1493.1 — the git pre-commit `wave-scope-commit-guard` (env-tier identity only, it has no hook payload) classify the manifest via `classifyManifestSession()` and stand down on a foreign one. The dispatch ledger of § 4 takes its session from the harness's own `input.session_id` instead — in its file name since #1493 and in `waveKeyOf(projectDir, sessionId, …)` — and reads only `wave` and `role` out of `wave-scope.json`; the `session` field is not consulted there at all. So a peer session's manifest cannot bind this session's writes or commits, but the hooks reach that property by different routes, and a change to one does not carry to the other.
 11. **A session that published a peer's id reads its OWN manifest as `foreign` (#1194) — the writer's defense is now mechanical (#1207).** Dropping the lock tier (§ 2.3) moved the cost to the other side of the trade: with a raw `sessionAttribution()` read, a session that lost the `bootstrapLock()` race could get the peer's id and write it into its own manifest, and Gate 3b would then classify the manifest `foreign`, standing its own write guard down. Since #1207 the writer calls `attributionForRecord(repoRoot)` instead — `skills/wave-executor/wave-loop.md` § Scope Manifest 1 — which confirms the lock's raw `session_id` against `readProcessLocalSessionIds()` before returning anything and yields `{}` on any mismatch, so the coordinator performs no manual comparison and STATE.md plays no part in it (a shared working-copy artefact written by whichever session holds the lock, not a process-local witness). A filled binding is therefore provably this session's own; unbound (`{}`) = ENFORCE. CEILING (BV-004): on a harness that exports no session env var and puts no `session_id` in the hook payload (Codex CLI, Cursor today) both tiers are empty, so G3b is permanently `unknown` = enforce = pre-#1123 behaviour there. Revisit when Codex/Cursor hook payloads carry a session id.
 
 ## 7. Debugging
 
-**A dispatch was denied and you do not believe it.** Read `.orchestrator/wave-dispatch-scopes.json`: it carries `waveKey`, `updated`, and one `{id, desc, useId, files, at}` record per already-dispatched agent (`useId` absent when the harness sent no `tool_use_id`). The deny reason names the other agent — find its record and compare its `files` to the ones in your prompt's `FILE-SCOPE` block. Three outcomes:
+**A dispatch was denied and you do not believe it.** Read this session's `.orchestrator/wave-dispatch-scopes.<session>.json` (the deny suggestion names the exact file): it carries `waveKey`, `updated`, and one `{id, desc, useId, files, at}` record per already-dispatched agent (`useId` absent when the harness sent no `tool_use_id`). The deny reason names the other agent — find its record and compare its `files` to the ones in your prompt's `FILE-SCOPE` block. Three outcomes:
 
 - The other agent is genuinely running and the overlap is real → fix the ownership in the session plan (one file, one agent), rewrite the affected `filescopes/wave-<N>/*.json`, re-assert, re-dispatch.
-- The other agent has finished, but the ledger still binds it → the transcript carried no evidence (§ 5) and you are inside the TTL window. Delete `.orchestrator/wave-dispatch-scopes.json`; the next dispatch rebuilds it.
-- The `waveKey` names an older wave → the `<session>|w?|?` fallback (limit 5). Check that `<state-dir>/wave-scope.json` exists and is readable, then delete the ledger.
+- The other agent has finished, but the ledger still binds it → the transcript carried no evidence (§ 5) and you are inside the TTL window. Delete this session's `.orchestrator/wave-dispatch-scopes.<session>.json`; the next dispatch rebuilds it. Never delete another session's file beside it — that erases its live claims.
+- The `waveKey` names an older wave → the `<session>|w?|?` fallback (limit 5). Check that `<state-dir>/wave-scope.json` exists and is readable, then delete this session's ledger file.
 
 **A dispatch was NOT denied and should have been.** Start at the ledger line, which now says which row fired without re-running anything: `jq -c 'select(.event=="orchestrator.wave_dispatch.scope_checked")' .orchestrator/metrics/events.jsonl | tail` — `injected:false` with `signal:"marker-absent"` is row 5 (no declaration in the prompt at all, i.e. the injection step, not the guard), `signal:"unparseable"` is row 6 (a declaration the parser could not use), `ledger_result:"allow-finished"` is row 10a (the collision was real but its partner had finished), and NO record at all for a dispatch you watched happen means the hook never ran or crashed before deciding (§ 4.2). Then work down the allow rows: is `FILE-SCOPE` present in the prompt with a fenced block right after it (rows 5/6)? Is the hook armed at all (`GUARD INACTIVE` on stderr = row 2)? Did a `systemMessage` warning appear (rows 7/9)? Cross-check the same scopes through the CLI, which does not depend on prose:
 
@@ -212,9 +216,9 @@ Complete list of what this guard does **not** see, or sees only approximately:
 node scripts/validate-wave-scope.mjs --assert-disjoint "$WAVE_SCOPES_SIDECAR" < <state-dir>/wave-scope.json
 ```
 
-Exit 1 prints one `ERROR:` line per collision (`agents "A" and "B" both claim [...]`) and one per duplicate id. Exit 0 — nothing on stderr, the manifest echoed back on stdout — means the declared scopes really are disjoint and the hook was right to allow; the divergence is then in the prompt, not in the plan.
+Exit 1 prints one `ERROR:` line per collision (`agents "A" and "B" both claim [...]`) and one per duplicate id. Exit 0 — nothing on stderr, the manifest echoed back on stdout — means the declared scopes really are disjoint and the hook was right to allow; the divergence is then in the prompt, not in the plan. No manifest yet (e.g. `/plan`, before any `wave-scope.json` exists)? Add `--no-manifest` and drop the stdin redirect: the sidecar is checked alone and stdout stays empty — without the flag an empty stdin is still an error, and the flag refuses `--union` / `--assert-subset`, which need the manifest (#1510 f).
 
-**Reset.** Delete `.orchestrator/wave-dispatch-scopes.json` (and `.orchestrator/wave-dispatch-scopes.lock` if a dead holder is suspected). Both are gitignored, both are rebuilt on the next dispatch, and neither is shared with any other mechanism. After the final wave, `<state-dir>/filescopes/` is deleted along with `wave-scope.json` — a stale `wave-<N>/` directory left behind is a scope claim nobody re-verified.
+**Reset.** Delete this session's `.orchestrator/wave-dispatch-scopes.<session>.json` (and its `.lock` if a dead holder is suspected) — never a peer's. Both are gitignored here (in a consumer repo only once bootstrap's `store-lock-ignore` step has run, #1495), both are rebuilt on the next dispatch, and neither is shared with any other mechanism or session. After the final wave, `<state-dir>/filescopes/` is deleted along with `wave-scope.json` and this session's ledger file (`skills/wave-executor/references/wave-loop-scope-manifest.md` step 7, session-end 3.0); a crashed session's file stays behind, inert — no other session reads it — a stale `wave-<N>/` directory left behind is a scope claim nobody re-verified.
 
 **Disable.** The hook honours the repo's profile gate (`shouldRunHook('pre-task-scope-disjoint')`, row 1) — a silent exit 0, no decision at all.
 

package/docs/session-config-reference.md

@@ -793,7 +793,7 @@ vault-integration:
 >
 > A leading `~` is expanded to the home directory: `path-prefix` when matching, and the `path` / `paths.vault-dir` value the two owner.yaml tiers return (`match`, `owner`). The `env` and `committed` tiers pass through unexpanded; `scripts/vault-mirror.mjs` expands its `--vault-dir` at entry, so a `~/…` from any tier reaches the vault rather than `<cwd>/~/…`.
 >
-> The parsed config reports which tier won as `vault-integration.vault-dir-source` (`env`, `match`, `owner`, `committed`). This keeps maintainer-specific absolute paths out of version control. Resolvers: `scripts/lib/config.mjs` (`resolveVaultDir`, module-private), `scripts/lib/config/host-paths.mjs` (`resolveHostPath`, used for `plan-baseline-path`) and `scripts/lib/named-baseline-resolver.mjs` (the `baselines:` / `vault-dirs:` match tier).
+> The parsed config reports which tier won as `vault-integration.vault-dir-source` (`env`, `match`, `owner`, `committed`). This keeps maintainer-specific absolute paths out of version control. Resolvers: `scripts/lib/config.mjs` (`resolveVaultDir`, exported; `scripts/vault-backfill.mjs` resolves its stub root through it, #1094), `scripts/lib/config/host-paths.mjs` (`resolveHostPath`, used for `plan-baseline-path`) and `scripts/lib/named-baseline-resolver.mjs` (the `baselines:` / `vault-dirs:` match tier).
 >
 > **Fake-repoRoot trap (moved from CLAUDE.md Critical Gotchas, 2026-09-25).** A throwaway invocation of a vault writer (`mirrorNarrative()`, `vault-mirror.mjs`, the board writer) with a synthetic `repoRoot` does **not** land in a sandbox — the fake repo path only fakes the SOURCE, never the DESTINATION. A reviewer in this repo walked into exactly that.
 > Export `SO_VAULT_DIR=<tmpdir>` before ANY manual invocation of vault-writing code. <!-- consistency:exempt:runtime-only -->
@@ -810,7 +810,7 @@ vault-integration:
 | `vault-integration.vault-dir` | string or null | `null` | Absolute path to the vault repository. Host-local tiers override it (see the note above). If it is still empty after them, only the bash snippet in session-end and evolve falls back to the `$VAULT_DIR` env variable. Required when `enabled` is true. |
 | `vault-integration.mode` | string | `warn` | Mirror error handling. `strict` blocks session close if the mirror exits non-zero. `warn` reports errors but does not block. `off` bypasses mirror invocation entirely (useful when transitioning). |
 | `vault-integration.vault-name` | string or null | `null` | Optional override for the per-project vault namespace segment (#660). When set (or via CLI `--vault-name`), vault writes go to `40-learnings/<vault-name>/` and `50-sessions/<vault-name>/`, sanitised to a kebab slug. When null/absent, the namespace is derived from the git origin via `deriveRepo()`. Owner-privacy leaks (personal home path / private slug / personal name) are redacted to `redacted-repo`. NOT a filesystem path → NOT host-path-resolved. **Coverage gap:** portfolio board rows are NOT yet namespace-aware — the override only reaches `40-learnings/`, `50-sessions/`, and the per-repo narrative mirror (`narrative-mirror.mjs`, #832 item 2); tracked separately in #832. Resolver: `scripts/lib/vault-mirror/namespace.mjs` (`resolveRepoNamespace`). |
-| `vault-integration.gitlab-groups` | string[] or null | `null` | List of GitLab group paths to scan for repos missing `.vault.yaml`. Consumed by `scripts/vault-backfill.mjs` (via `readVaultIntegrationConfig()`) and the `/plan retro` vault-backfill sub-mode (`skills/plan/mode-retro.md` Phase 1.6 Step 1). When null/unset, the backfill CLI exits with a "no groups configured" notice. |
+| `vault-integration.gitlab-groups` | string[] or null | `null` | List of GitLab group paths to scan for repos missing `.vault.yaml`. Parsed by `_parseVaultIntegration` (`scripts/lib/config/vault-integration.mjs`) and consumed by `scripts/vault-backfill.mjs`. Accepts a comma string, `[a, b]`, or a YAML block list; in the inline-object form more than one group needs `[a, b]`; an empty list is `null`. YAML semantics: `null`, `~` and an empty value mean unset (as a list element too, where they are dropped), and each element loses one pair of matching quotes — `["a"]` is the group `a`, and only a quoted `"null"` element is a group named `null`. Also consumed by the `/plan retro` vault-backfill sub-mode (`skills/plan/mode-retro.md` Phase 1.6 Step 1). When null/unset and neither `--groups` nor `--yes` is passed, the backfill CLI exits 1 with `no GitLab groups specified — pass --groups <CSV> or set vault-integration.gitlab-groups in CLAUDE.md`. |
 
 ### Environment override: `VAULT_MIRROR_CANONICAL_SUFFIX`
 
@@ -866,7 +866,7 @@ Opt-out configuration for the agent-writable memory tool. During a wave, an agen
 
 This is a Hermes-style memory-write API **without** Hermes' overwrites-manual-edits critique: the operator confirmation is mandatory and there is no silent overwrite path. Three safety layers keep the surface conservative:
 
-1. **Quota per wave** — `quota-per-wave` (default `5`) caps how many proposals any single agent may queue within one wave. Excess proposals exit `1` and the call-site logs the rejection.
+1. **Quota per wave** — `quota-per-wave` (default `5`) caps how many proposals ONE WAVE may queue, all of its agents together — not each agent: the store counts a wave's records by `wave_id` only (`scripts/lib/memory-proposals/store.mjs`). In a wave of N agents the 6th proposal of the wave exits `1` regardless of which agent sends it, so one agent that proposes five times uses up the quota for every sibling. Excess proposals exit `1` and the call-site logs the rejection.
 2. **Confidence floor** — `confidence-floor` (default `0.5`) rejects low-confidence proposals before they reach the operator (exit `2`). Tuned so a learning is only proposed when the agent is at least 50% sure of the insight.
 3. **AUQ confirm-or-discard** — the session-end phase never auto-persists. Every proposal is `AskUserQuestion`-gated; the operator can accept, reject, or edit before commit.
 
@@ -876,14 +876,14 @@ All fields live under the top-level `memory` object in your Session Config host
 memory:
   proposals:
     enabled: true                # default true; opt-out master toggle for the memory.propose feature
-    quota-per-wave: 5            # max proposals an agent may queue per wave (exit 1 on overflow)
+    quota-per-wave: 5            # max proposals per wave, all agents together (exit 1 on overflow)
     confidence-floor: 0.5        # proposals below this confidence are rejected (exit 2)
 ```
 
 | Field | Type | Default | Description |
 |-------|------|---------|-------------|
 | `memory.proposals.enabled` | boolean | `true` | Master toggle for the entire memory-proposals feature. When `false`, the `memory.propose` CLI exits `3` (rejected-wrong-context) for every call and session-end Phase 3.6.3 is skipped. When `true`, agents may queue proposals during waves and the coordinator surfaces them at session-end. PRD F2.1 / issue #501. |
-| `memory.proposals.quota-per-wave` | integer | `5` | Maximum number of proposals one wave-executor agent can queue per wave. The 6th proposal from the same agent in the same wave exits `1` (quota-exceeded). Bounds: integer ≥ 0. Set to `0` to disable proposals from agents without disabling the feature entirely (operator can still propose). |
+| `memory.proposals.quota-per-wave` | integer | `5` | Maximum number of proposals a wave can queue, counted across ALL of its agents (the store counts records by `wave_id` only). The 6th proposal of a wave exits `1` (quota-exceeded) whichever agent sends it — in a wave of N agents, the first five proposals of the wave win. Bounds: integer ≥ 0. Set to `0` to disable proposals from agents without disabling the feature entirely (operator can still propose). |
 | `memory.proposals.confidence-floor` | float | `0.5` | Minimum confidence (0.0..1.0) required for a proposal to be queued. Proposals with `--confidence < confidence-floor` exit `2` (rejected-low-confidence) before reaching the operator. Bounds: `0.0 ≤ value ≤ 1.0`. Set to `0.0` to accept any confidence (operator filters at AUQ time). |
 
 ### Agent CLI invocation
@@ -923,7 +923,7 @@ A successful dry-run exits `0` with stdout status `dry-run-ok` (see updated exit
 |-----------|-----------------|---------|--------------|
 | `0` | `queued` | Queued | Proposal accepted into the per-wave staging directory; awaits operator confirmation at session-end Phase 3.6.3. |
 | `0` | `dry-run-ok` | Validated, not written | `--dry-run` was passed and the proposal (argv + schema) validated successfully. No write to `proposals.jsonl` occurs; the wrong-context gates are bypassed under this flag (#741.3). |
-| `1` | `quota-exceeded` | Rejected — quota exceeded | This agent has already queued `quota-per-wave` proposals in this wave. Subsequent calls from the same agent fail until the next wave. Not applicable under `--dry-run` (gate bypassed). |
+| `1` | `quota-exceeded` | Rejected — quota exceeded | This wave has already queued `quota-per-wave` proposals, from any of its agents. Every further call in this wave fails, whichever agent makes it, until the next wave. Not applicable under `--dry-run` (gate bypassed). |
 | `2` | `rejected-low-confidence` | Rejected — low confidence | `--confidence` argument is below `confidence-floor`. Tighten the insight or raise the confidence (operator can still tune the floor). |
 | `3` | `rejected-wrong-context` | Rejected — wrong context | Feature disabled (`enabled: false`), STATE.md not active, or `SO_WAVE_AGENT != "1"` (call originated outside a wave-executor agent context). Not applicable under `--dry-run` (gate bypassed). |
 | `4` | `error` | Arg error | Missing or malformed flag — invalid `--type`, empty `--subject`, non-numeric `--confidence`. The CLI prints a one-line usage message on stderr. |
@@ -1626,7 +1626,7 @@ reaper:
 | `reaper.max-hook-latency-ms` | integer (≥ 1) | `50` | Ceiling the TRIGGER may delay a hook by — the config read, the marker `stat` and the detached spawn, measured with `performance.now()` in `maybeTriggerOrphanScan()`. Overrunning it writes ONE stderr WARN line and nothing else: no event (a `PostToolBatch`-class hook emitting per fire is the always-on signal HR-101 calls a broken instrument) and no abort (the child is already detached by then). The scan itself is not covered — that is the point of spawning detached. |
 | `reaper.false-alarm-window` | integer (≥ 1) | `50` | Rolling window of audit decisions the HR-101 10 % false-alarm rate is judged over — a window in DECISIONS, not calendar time, so the rate has a population on quiet hosts too. Reaches the scan as `--false-alarm-window` on the detached child's argv and becomes `runOrphanScan`'s `falseAlarmWindow`; the CLI refuses `0`, which `falseAlarmRate()` would read as “every firing ever recorded” rather than as a window. |
 
-**Used by:** `hooks/post-tool-batch-wave-signal.mjs`, `hooks/on-stop.mjs` (both via `maybeTriggerOrphanScan()`), `scripts/lib/orphan-reaper.mjs`, `scripts/lib/config/reaper.mjs` (`_parseReaper`). PRD `docs/prd/2026-09-20-prozessgruppen-kill-und-waisen-waechter.md`, Epic #1425, issue #1432.
+**Used by:** `hooks/post-tool-batch-wave-signal.mjs`, `hooks/on-stop.mjs` (both via `maybeTriggerOrphanScan()` from `scripts/lib/orphan-reaper/trigger.mjs`), `scripts/lib/orphan-reaper.mjs`, `scripts/lib/config/reaper.mjs` (`_parseReaper`). PRD `docs/prd/2026-09-20-prozessgruppen-kill-und-waisen-waechter.md`, Epic #1425, issue #1432.
 
 ## Gate Timeout — Path B (#1425 A3)
 

package/docs/vault-docs-architecture.md

@@ -169,10 +169,14 @@ entirely. Source: `docs/session-config-reference.md` § Docs Orchestrator.
 The `docs-writer` agent operates under a **hallucination ban**: every
 substantive paragraph must trace to one of the canonical four sources, or
 carry an inline `<!-- REVIEW: source needed -->` marker. The four sources are
-defined once and reused everywhere:
-
-1. **diff** — `git diff $SESSION_START_REF..HEAD`
-2. **git-log** — `git log $SESSION_START_REF..HEAD --format="%H %s%n%b"`
+defined once — in `skills/docs-orchestrator/SKILL.md` — and reused everywhere.
+Diffs take `"$SESSION_RANGE"`, ONE complete range (the pinned SHA's
+`<sha>..HEAD`, else the resolved `<base>...HEAD` from the accessor in
+`skills/session-end/plan-verification.md`); only the log keeps the two-dot
+`$SESSION_START_REF..HEAD`. An empty range or ref is a skip, never "no changes":
+
+1. **diff** — `git diff "$SESSION_RANGE"`
+2. **git-log** — `git log "$SESSION_START_REF..HEAD" --format="%H %s%n%b"`
 3. **session-memory** — `~/.claude/projects/<project>/memory/session-*.md` and
    `.orchestrator/` outputs
 4. **affected-files** — files in the wave-scope `allowedPaths` block

package/hooks/_lib/hook-import-set.json

@@ -1,6 +1,6 @@
 {
-  "generated_at": "2026-10-01T17:18:47.118Z",
-  "head": "ffc5929f12df0b5fd7c75d9708a3aa1a5dc6fa45",
+  "generated_at": "2026-10-03T07:30:53.188Z",
+  "head": "0cfbaa2c4fad16d825b94b8000ca8aea3dc9af68",
   "entries": [
     {
       "file": "hooks/_lib/atomic-json.mjs",
@@ -308,6 +308,7 @@
     {
       "file": "scripts/lib/command-blocker.mjs",
       "reachable_from": [
+        "on-stop.mjs",
         "post-bash-issue-budget-refund.mjs",
         "post-bash-write-verify.mjs",
         "post-edit-validate.mjs",
@@ -315,7 +316,8 @@
         "pre-bash-issue-budget.mjs",
         "pre-bash-memory-propose-audit.mjs",
         "pre-bash-staging-fence.mjs",
-        "pre-bash-templates-first.mjs"
+        "pre-bash-templates-first.mjs",
+        "pre-task-scope-disjoint.mjs"
       ]
     },
     {
@@ -841,8 +843,7 @@
       "file": "scripts/lib/env-check.mjs",
       "reachable_from": [
         "post-bash-write-verify.mjs",
-        "post-edit-validate.mjs",
-        "pre-bash-memory-propose-audit.mjs"
+        "post-edit-validate.mjs"
       ]
     },
     {
@@ -975,8 +976,7 @@
       "file": "scripts/lib/hardening.mjs",
       "reachable_from": [
         "post-bash-write-verify.mjs",
-        "post-edit-validate.mjs",
-        "pre-bash-memory-propose-audit.mjs"
+        "post-edit-validate.mjs"
       ]
     },
     {
@@ -1172,6 +1172,13 @@
         "post-tool-batch-wave-signal.mjs"
       ]
     },
+    {
+      "file": "scripts/lib/orphan-reaper/trigger.mjs",
+      "reachable_from": [
+        "on-stop.mjs",
+        "post-tool-batch-wave-signal.mjs"
+      ]
+    },
     {
       "file": "scripts/lib/owner-yaml.mjs",
       "reachable_from": [
@@ -1296,10 +1303,12 @@
     {
       "file": "scripts/lib/scope-gate.mjs",
       "reachable_from": [
+        "on-stop.mjs",
         "post-bash-write-verify.mjs",
         "post-edit-validate.mjs",
         "post-tool-batch-wave-signal.mjs",
-        "pre-bash-memory-propose-audit.mjs"
+        "pre-bash-memory-propose-audit.mjs",
+        "pre-task-scope-disjoint.mjs"
       ]
     },
     {

package/hooks/_lib/lock-bootstrap.mjs

@@ -25,11 +25,11 @@
  *     ttl_hours:            number,
  *   }
  *
- * The current scripts/lib/session-lock.mjs (pre-I3) writes the v1 shape
- * (no last_heartbeat, no semantic_session_id). This helper layers v2 fields
- * on top via an atomic tmp+rename overwrite — when I3 ships its v2 schema,
- * this helper's overlay becomes a no-op (the field is already there) and
- * everything continues to work.
+ * scripts/lib/session-lock.mjs `buildLock()` has written `last_heartbeat`
+ * itself since Epic #583 W2-I3 (`last_heartbeat` = `started_at` at genesis).
+ * This helper's tmp+rename overlay therefore re-writes an identical
+ * `last_heartbeat`, and its remaining job is `semantic_session_id`, which
+ * `acquire()` / `forceAcquire()` are not given here.
  *
  * @module hooks/_lib/lock-bootstrap
  */
@@ -55,6 +55,10 @@ import { writeJsonAtomicSync } from '../../scripts/lib/io.mjs';
  */
 export const SAME_LOGICAL_SESSION_SOURCES = new Set(['resume', 'clear', 'compact']);
 
+/** Re-reads of a just-acquired lock that answers ENOENT, and the pause between them (#1494). */
+const ENRICH_READ_RETRIES = 5;
+const ENRICH_READ_RETRY_MS = 10;
+
 /**
  * Bootstrap the session.lock for this hook invocation.
  *
@@ -189,6 +193,13 @@ export async function bootstrapLock({
       // session-lock.mjs; matching only the new one keeps this force-branch
       // reachable.
       acquireResult.reason === 'stale-heartbeat' ||
+      // A lock file that is not a lock record (invalid JSON or not the lock
+      // shape) can never be a live lock — every writer writes atomically — so
+      // it is reclaimed like a stale one, with one stderr WARN below. Before
+      // acquire() reported 'corrupt' it answered 'active' / existingLock:null,
+      // which this predicate could never force: one damaged file wedged every
+      // new session in the repo.
+      acquireResult.reason === 'corrupt' ||
       (acquireResult.reason === 'active' &&
         acquireResult.existingLock &&
         (acquireResult.existingLock.session_id === sessionId ||
@@ -201,12 +212,41 @@ export async function bootstrapLock({
             acquireResult.existingLock.session_id === predecessorSessionId)))
     );
 
+  // Recorded on the acquired event below, so a takeover of a stale or corrupt
+  // lock is countable — its stderr WARN is discarded by the harness (#1401).
+  let reclaimed = null;
   if (!acquireResult.ok && shouldForce) {
+    const reclaimingCorrupt = acquireResult.reason === 'corrupt';
+    const forcedFrom = acquireResult.reason;
+    // A session resuming its OWN stale lock (same raw id after > ttl idle) is
+    // a refresh, not a takeover — counting it would inflate the very figure
+    // `reclaimed` exists to make countable.
+    const priorOwner = acquireResult.existingLock?.session_id;
     try {
-      acquireResult = forceAcquireFn({ sessionId, mode, ttlHours, repoRoot });
+      // A stale or corrupt lock is reclaimed single-winner (#1494): two starts
+      // that both saw it used to force it, both got ok:true, and the later
+      // rename won. With onlyIfNotLive the loser gets the winner's live lock
+      // back as 'active' and bails into the conflict signal below. The same-
+      // session refresh of a LIVE lock keeps the unconditional overwrite.
+      const reclaim = forcedFrom === 'stale-heartbeat' || forcedFrom === 'corrupt';
+      acquireResult = forceAcquireFn({ sessionId, mode, ttlHours, repoRoot, ...(reclaim ? { onlyIfNotLive: true } : {}) });
     } catch {
       return null;
     }
+    if (
+      acquireResult?.ok === true &&
+      (forcedFrom === 'corrupt' || (forcedFrom === 'stale-heartbeat' && priorOwner !== sessionId))
+    ) {
+      reclaimed = forcedFrom;
+    }
+    if (reclaimingCorrupt) {
+      // The file's content is not echoed: it is unbounded and may be anything.
+      process.stderr.write(
+        acquireResult && acquireResult.ok === true
+          ? '⚠ lock-bootstrap: .orchestrator/session.lock was not a valid lock record — reclaimed for this session\n'
+          : `⚠ lock-bootstrap: .orchestrator/session.lock is not a valid lock record and could not be reclaimed (${acquireResult?.reason ?? 'unknown'}) — this session runs without a lock\n`,
+      );
+    }
   }
 
   // Any other non-ok reason (parallel-conflict, fs-error, other-session-active)
@@ -221,6 +261,20 @@ export async function bootstrapLock({
   // failure is swallowed and the bail proceeds. The return contract is unchanged —
   // bootstrapLock STILL returns null on this path.
   if (!acquireResult || acquireResult.ok !== true) {
+    // #1494 / #599: a lock path that exists but cannot be read (EACCES, or a
+    // directory) is never reclaimed — but it is no longer silent either. The
+    // WARN is discarded by the harness, so the read_anomaly event (the one
+    // SessionEnd already emits for the same state) is the countable trace.
+    if (acquireResult && acquireResult.reason === 'unreadable') {
+      process.stderr.write(
+        `⚠ lock-bootstrap: .orchestrator/session.lock exists but cannot be read (${acquireResult.error ?? 'unknown'}) — this session runs without a lock\n`,
+      );
+      await emitBestEffort(_emitEventImpl, 'orchestrator.session.lock.read_anomaly', {
+        session_id: sessionId,
+        status: 'unreadable',
+        ...(typeof acquireResult.error === 'string' ? { error: acquireResult.error } : {}),
+      });
+    }
     if (
       acquireResult &&
       acquireResult.reason === 'active' &&
@@ -236,19 +290,46 @@ export async function bootstrapLock({
 
   // Step 2: enrich the lock with v2 fields (last_heartbeat + semantic_session_id).
   // We re-read the file fresh (acquire() just wrote it) and overlay the new
-  // fields, then atomically tmp+rename. When I3 lands and acquire() writes the
-  // v2 shape natively, this overlay becomes idempotent (already-present fields
-  // get overwritten with identical values).
+  // fields, then atomically tmp+rename. acquire() already writes
+  // last_heartbeat (Epic #583 W2-I3), so that half of the overlay re-writes an
+  // identical value; semantic_session_id is the half that adds information.
   const lockFile = path.join(repoRoot, '.orchestrator', 'session.lock');
+  let raw;
+  // ENOENT right after ok:true is most likely a racer holding OUR fresh lock in
+  // its tombstone: a second start that saw the same stale lock renames it
+  // aside, finds it live and links it back within microseconds
+  // (session-lock.mjs reclaimIfNotLive). Reading once and giving up left the
+  // lock ours but without semantic_session_id, owner proof and lock.acquired
+  // (#1494 review: two racers are enough). Bounded: 5 retries × 10 ms, so a lock
+  // that is really gone costs this hook at most ~50 ms. Measured 2026-10-02
+  // (2000 live-restore reclaims, load average ~9): the racer's rename→link-back
+  // window was p50 0.34 ms, p99 2.4 ms, max 31.7 ms. Ceiling (BV-004): a window
+  // longer than ~50 ms still ends in the lockless-enrichment null above;
+  // revisit if lock.acquired goes missing for sessions that own the lock.
+  for (let attempt = 0; raw === undefined; attempt += 1) {
+    try {
+      raw = fs.readFileSync(lockFile, 'utf8');
+    } catch (err) {
+      if (err?.code !== 'ENOENT' || attempt >= ENRICH_READ_RETRIES) return null;
+      await new Promise((resolve) => setTimeout(resolve, ENRICH_READ_RETRY_MS));
+    }
+  }
   let baseLock;
   try {
-    const raw = fs.readFileSync(lockFile, 'utf8');
     baseLock = JSON.parse(raw);
     if (typeof baseLock !== 'object' || baseLock === null) return null;
   } catch {
-    // Lock vanished between write and read — best-effort, return null.
     return null;
   }
+  // The file can belong to another session by now. The reclaim above is
+  // single-winner since #1494 (tombstone rename + link-create in
+  // forceAcquire's onlyIfNotLive), but a plain forceAcquire — the same-session
+  // refresh, an operator's Phase-1.2 force-take — still overwrites
+  // unconditionally, and a link-back that loses to a third writer drops the
+  // lock it was restoring (session-lock.mjs reclaimIfNotLive, ceiling 2).
+  // Enriching a foreign lock would stamp OUR label onto ITS record and write
+  // an owner proof that verifies against it, so it is left as is.
+  if (baseLock.session_id !== sessionId) return null;
 
   const startedAt = typeof baseLock.started_at === 'string'
     ? baseLock.started_at
@@ -301,27 +382,38 @@ export async function bootstrapLock({
     }
   } catch { /* best-effort — a missing proof never breaks session-start */ }
 
-  // Step 3: best-effort observability breadcrumb. Failures are swallowed
-  // so a missing events module never breaks the hook.
+  // Step 3: best-effort observability breadcrumb.
+  await emitBestEffort(_emitEventImpl, 'orchestrator.session.lock.acquired', {
+    session_id: enriched.session_id,
+    semantic_session_id: enriched.semantic_session_id,
+    mode: enriched.mode,
+    pid: enriched.pid,
+    host: enriched.host,
+    ttl_hours: enriched.ttl_hours,
+    ...(reclaimed ? { reclaimed } : {}),
+  });
+
+  return enriched;
+}
+
+/**
+ * Emit one event; every failure is swallowed so a missing events module never
+ * breaks the hook (observability is best-effort).
+ *
+ * @param {Function|undefined} emitImpl — the `_emitEventImpl` test seam.
+ * @param {string} name
+ * @param {object} payload
+ * @returns {Promise<void>}
+ */
+async function emitBestEffort(emitImpl, name, payload) {
   try {
-    let emitFn = _emitEventImpl;
+    let emitFn = emitImpl;
     if (!emitFn) {
       const eventsMod = await import('../../scripts/lib/events.mjs');
       emitFn = eventsMod.emitEvent;
     }
-    if (typeof emitFn === 'function') {
-      await emitFn('orchestrator.session.lock.acquired', {
-        session_id: enriched.session_id,
-        semantic_session_id: enriched.semantic_session_id,
-        mode: enriched.mode,
-        pid: enriched.pid,
-        host: enriched.host,
-        ttl_hours: enriched.ttl_hours,
-      });
-    }
+    if (typeof emitFn === 'function') await emitFn(name, payload);
   } catch { /* observability is best-effort */ }
-
-  return enriched;
 }
 
 /**

package/hooks/config-protection.mjs

@@ -81,7 +81,7 @@ const PROTECTED_PATTERNS = [
   /^tsconfig.*\.json$/, // tsconfig.json, tsconfig.base.json, tsconfig.build.json, …
   /^\.prettierrc(?:\..+)?$/, // .prettierrc, .prettierrc.json, .prettierrc.js, …
   /^prettier\.config\.(?:js|cjs|mjs)$/,
-  /^commitlint\.config\.(?:js|cjs|mjs|ts)$/,
+  /^commitlint(?:\.ci)?\.config\.(?:js|cjs|mjs|ts)$/, // + the strict CI config (commitlint.ci.config.mjs)
 ];
 
 /**

package/hooks/enforce-commands.mjs

@@ -95,9 +95,10 @@ import { pathToFileURL } from 'node:url';
 /** @type {typeof import('../scripts/lib/io.mjs').emitAllow} */ let emitAllow;
 /** @type {typeof import('../scripts/lib/io.mjs').emitDeny} */ let emitDeny;
 /** @type {typeof import('../scripts/lib/io.mjs').emitWarn} */ let emitWarn;
-let resolveProjectDir;
+let resolveSessionRoot;
 let readJson;
-let findScopeFile;
+// #1504 point 6 — bound from scope-gate below.
+let findOwnScopeFile;
 let extractBashWriteTargets;
 let pathMatchesPattern;
 /** @type {typeof import('../scripts/lib/session-identity/own-session.mjs').readProcessLocalSessionIds} */
@@ -165,7 +166,8 @@ function bannerProjectDir() {
  * the entry-point catch banners.
  *
  * `hardening.mjs` is bound (no headFallback — it carries relative imports) for
- * `findScopeFile` / `extractBashWriteTargets` / `pathMatchesPattern`; the two
+ * `extractBashWriteTargets` / `pathMatchesPattern` (and `scope-gate.mjs` for
+ * `findOwnScopeFile`, #1504 point 6); the two
  * command-matching primitives come from the direct `blocker` namespace, which is
  * the only entry that opts into the `git show HEAD:` recovery. Because hardening
  * transitively imports command-blocker (via scope-gate.mjs), a broken command-blocker
@@ -184,6 +186,9 @@ async function bootstrap() {
       platform: { specifier: lib('platform.mjs') },
       common: { specifier: lib('common.mjs') },
       hardening: { specifier: lib('hardening.mjs') },
+      // #1504 point 6 — `findOwnScopeFile`. Already reachable through the
+      // hardening barrel, so no new module edge.
+      scopeGate: { specifier: lib('scope-gate.mjs') },
       blocker: {
         specifier: lib('command-blocker.mjs'),
         headFallback: true,
@@ -203,9 +208,10 @@ async function bootstrap() {
   );
 
   ({ readStdin, emitAllow, emitDeny, emitWarn } = modules.io);
-  ({ resolveProjectDir } = modules.platform);
+  ({ resolveSessionRoot } = modules.platform);
   ({ readJson } = modules.common);
-  ({ findScopeFile, extractBashWriteTargets, pathMatchesPattern } = modules.hardening);
+  ({ extractBashWriteTargets, pathMatchesPattern } = modules.hardening);
+  ({ findOwnScopeFile } = modules.scopeGate);
   ({ readProcessLocalSessionIds, classifyManifestSession } = modules.sessionIdentity);
   blocker = modules.blocker;
   degradedLabels = degraded;
@@ -275,10 +281,22 @@ async function main() {
     );
   }
 
-  const projectRoot = resolveProjectDir();
-
-  // G3 — no scope file → allow
-  const scopePath = findScopeFile(projectRoot);
+  // #1492 — the SESSION's working copy, not the launch dir `$CLAUDE_PROJECT_DIR`
+  // keeps after `EnterWorktree` (the manifest lives in the worktree). See
+  // `resolveSessionRoot` in scripts/lib/platform.mjs.
+  const projectRoot = resolveSessionRoot(input.cwd);
+
+  // `new Set(...)` is load-bearing: `readProcessLocalSessionIds` returns a
+  // string[], and `classifyManifestSession` does `ownIds instanceof Set ?
+  // ownIds : new Set()` — a bare array would silently become EMPTY.
+  const ownIds = new Set(readProcessLocalSessionIds({ hookInput: input }));
+
+  // G3 — no scope file → allow. #1504 point 6: the first manifest that is not
+  // provably a peer's, so a peer's higher-precedence `.pi`/`.cursor`/`.codex`
+  // manifest no longer hides this session's own one; only when every candidate
+  // is foreign does the first come back, and G3b below stands down as before.
+  const located = findOwnScopeFile(projectRoot, ownIds, classifyManifestSession);
+  const scopePath = located.path ?? located.foreignPath;
   if (!scopePath) return flushNotices(notices);
 
   // SECURITY-REQ-08: read scope file exactly once; use the parsed object
@@ -313,10 +331,7 @@ async function main() {
   // empty, so this gate is permanently `'unknown'` = enforce = pre-#1153
   // behaviour there. Revisit when those hook payloads carry a session id.
   {
-    // `new Set(...)` is load-bearing: `readProcessLocalSessionIds` returns a
-    // string[], and `classifyManifestSession` does `ownIds instanceof Set ?
-    // ownIds : new Set()` — a bare array would silently become EMPTY.
-    const ownIds = new Set(readProcessLocalSessionIds({ hookInput: input }));
+    // `ownIds` is the process-local set built above G3.
     const { verdict, manifestIds } = classifyManifestSession(scope, ownIds);
     if (verdict === 'foreign') {
       // Observability only, and deliberately NOT emitWarn: this branch is hit on