session-orchestrator 5.5.0 → 5.6.0

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
   },
   "metadata": {
     "description": "A repeatable Plan, Go, Close workflow for AI coding sessions: /session reads your repo and agrees the scope, /go runs the work in waves with a quality gate between each, /close verifies and commits. Runs on Claude Code, Codex CLI, Cursor and Pi.",
-    "version": "5.5.0"
+    "version": "5.6.0"
   },
   "plugins": [
     {

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "session-orchestrator",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "description": "A repeatable Plan, Go, Close workflow for AI coding sessions: /session reads your repo and agrees the scope, /go runs the work in waves with a quality gate between each, /close verifies and commits. Runs on Claude Code, Codex CLI, Cursor and Pi.",
   "author": {
     "name": "Bernhard Goetzendorfer",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "session-orchestrator",
-  "version": "5.5.0+codex.20261003080809",
+  "version": "5.6.0+codex.20261003103620",
   "description": "A repeatable Plan, Go, Close workflow for AI coding sessions: /session reads your repo and agrees the scope, /go runs the work in waves with a quality gate between each, /close verifies and commits. Runs on Claude Code, Codex CLI, Cursor and Pi.",
   "keywords": [
     "session",

package/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "session-orchestrator",
-  "version": "5.5.0",
+  "version": "5.6.0",
   "description": "A repeatable Plan, Go, Close workflow for AI coding sessions: /session reads your repo and agrees the scope, /go runs the work in waves with a quality gate between each, /close verifies and commits. Runs on Claude Code, Codex CLI, Cursor and Pi.",
   "author": {
     "name": "Bernhard Goetzendorfer"

package/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [5.6.0] - 2026-10-03
+
+### Added
+
+- **`validate-wave-scope --assert-disjoint --no-manifest`** (#1510 f): runs the disjointness check on the per-wave sidecar alone, without a manifest on stdin, so `/plan` no longer fabricates a dummy manifest. Without the flag an empty stdin stays an error (fail-closed); combining it with `--union`, `--assert-subset`, `--expand-test-siblings` or a positional manifest is rejected.
+
+### Changed
+
+- **Wave git facts follow the session root** (`hooks/post-tool-batch-wave-signal.mjs`, `hooks/on-stop.mjs`, `hooks/pre-bash-memory-propose-audit.mjs`, #1511 a–c): in a session that entered a worktree, the wave's start SHA, changed-file count, HEAD, the stop record's branch/commit and the audit record's `cwd` now describe the tree the session works in. `current-session.json`, `session.lock` and the heartbeat stay at the launch dir, where `on-session-start` writes them.
+- **The commit guard also judges the session-root manifest** (`hooks/wave-scope-commit-guard.mjs`, #1511 d): a session launched in a repo subdirectory has its own manifest checked in addition to the repo-root manifest, which is judged exactly as before; either one blocking blocks the commit. Staged paths outside the session root are violations without pattern matching, and the path is resolved with `realpathSync.native`.
+- **One scope-entry spelling rule** (`scripts/lib/scope-gate.mjs` `scopeEntrySpelling`, now exported, #1510 g): `pre-task-scope-disjoint` drops its drifted copy (`scripts/././lib` stayed unpromoted there, so a sibling claim compared as disjoint).
+- **Close-backfill reads ledger gaps inside the session's own window** (`scripts/lib/session-close-backfill.mjs`, #1512): a recoverable `unindexed-archive` gap overlapping the session defers the candidate; a pruned `missing-archive` gap writes the record and lists `session_type`/`session_profile` (and `completed_at` when the gap runs past the last event) in `_backfill_incomplete_fields`. Gaps outside the window, or without bounds, no longer matter.
+- **Website, README and npm description** lead with the problem the plugin solves and group the features by benefit (site EN/DE, guide, `llms.txt`, `llms-full.txt`).
+
+### Fixed
+
+- **A sidecar changed under a standing manifest no longer downgrades violations** (`hooks/post-bash-write-verify.mjs`, #1504 point 5): the sidecar hash is bound into the hook's trusted snapshot; on a mismatch `peer-session-*` records are ignored and one notice per mismatching hash is shown. A mid-wave Peer-Scope-Union must re-run the full scope sequence including the skeleton rewrite (`skills/_shared/parallel-aware-auq.md`).
+- **Destructive-command guard counts on the site** read 11 blocking of 15 rules; the policy has 12 blocking and 4 warning rules of 16.
+- **`.phase-result` on the site** loses its coloured side stripe (#1357, first half).
+
 ## [5.5.0] - 2026-10-03
 
 ### Added

package/README.md

@@ -1,15 +1,17 @@
 # Session Orchestrator
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
-[![Version](https://img.shields.io/badge/version-5.5.0-blue.svg)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/version-5.6.0-blue.svg)](CHANGELOG.md)
 [![npm](https://img.shields.io/npm/v/session-orchestrator.svg)](https://www.npmjs.com/package/session-orchestrator)
 
 **Give your agents a working rhythm.**
 
+Your coding agents get an agreed plan, a check after each round of changes and a handover to the next session. On their own, coding agents drift from the plan, overwrite each other's files and call work done before it is checked; Session Orchestrator closes those gaps.
+
 You type three commands:
 
 - **`/session`** reads your repository, your open issues and the last session, proposes what to work on, and waits for your correction.
-- **`/go`** runs the agreed work in waves of parallel agents and runs your test, typecheck and lint commands between each wave. Work that fails a check goes back to be fixed before the next wave starts.
+- **`/go`** runs the agreed work in waves of parallel agents. After each implementation wave your tests and typecheck run, and failures become fix tasks for the next wave. The full test, typecheck and lint gate runs before `/close` commits.
 - **`/close`** checks every planned item against what actually happened, commits, and files the rest as issues for next time.
 
 Session Orchestrator is a free, MIT-licensed workflow plugin for **Claude Code, Codex CLI, Cursor IDE, or [Pi](docs/pi-setup.md)**. It runs on your machine and writes plain text into your repository. No account, no server, nothing to sign up for.
@@ -59,7 +61,7 @@ persistence: true
 enforcement: warn
 ```
 
-The first three are the commands `/go` runs between waves and `/close` runs at the end — use whatever your project actually uses. Everything else is opt-in: [full template](docs/session-config-template.md) · [every key, its type and default](docs/session-config-reference.md).
+The first three are the commands the quality gate runs: tests and typecheck after each implementation wave, all three after the Quality wave and before `/close` commits — use whatever your project actually uses. Everything else is opt-in: [full template](docs/session-config-template.md) · [every key, its type and default](docs/session-config-reference.md).
 
 **3. Run the loop.**
 
@@ -73,6 +75,20 @@ On Codex the same three are `$session-orchestrator:session feature`, `$session-o
 
 In headless Claude Code (`claude -p`), `/session` and `/plan` are reserved terminal-only built-in names and the bare form is refused; use `/session-orchestrator:session` and `/session-orchestrator:plan` there. Every other command keeps its bare form.
 
+## What you get
+
+Each item: what it does for you, then how it works.
+
+| You get | How |
+|---|---|
+| **Know what to work on.** Every session starts from the real state of your project, not from a prompt you rewrite. | `/session` reads git, open issues, recent commits and the last session record, recommends one scope and waits for your correction. `/plan`, `/brainstorm` and `/grill` help while an idea is still vague. |
+| **Errors stop at the next check.** A broken test is found right after the work that caused it, not after more work is built on top. | `/go` checks each wave with your tests and typecheck and turns failures into fix tasks; lint and the full suite run before the commit. `/close` checks every planned item against what happened. `/debug` looks for the root cause before a fix. |
+| **Agents keep to their files.** Parallel agents do not overwrite each other, and destructive commands do not slip through. | Each agent gets a declared list of files it may change; overlapping lists are rejected before dispatch. A guard blocks 12 destructive command patterns (hard reset, `rm -rf`, force-push, `DROP TABLE`, …) and warns on 4. Hooks on Claude Code, bridges on Cursor and Pi, instructions only on Codex. |
+| **Pick up where you stopped.** A crash or a second session in the same folder does not cost you the work. | `STATE.md` (a progress file in your repo) records each finished wave, and the next `/session` offers to resume. A session lock with a heartbeat keeps two sessions apart in one checkout. `/close` files what is left as GitLab or GitHub issues. |
+| **It improves with your sessions.** Patterns from your own work become rules, once you approve them. | Every session appends a record. `/evolve` proposes learnings with a confidence score, `/reconcile` drafts rules from them; you approve or delete each one. Optional mirror into a Markdown notes vault. |
+| **Audit, test and review on demand.** Find problems you did not ask about, and show the app works. | A discovery scan at `/close` turns confirmed findings into issues. `/test` drives web and macOS flows end to end, `/ux-grill` audits a running web app, `/test-audit` removes tests that catch nothing. `/repo-audit` and `/harness-audit` score a repository against a checklist, and `/persona-panel` has several reviewer personas read the same output in parallel. |
+| **Longer runs, more repositories.** | `/autopilot` chains sessions and stops on any of 10 kill-switches. `/dispatcher` recommends the next free repository and claims it once you confirm, and `/portfolio` summarises issues, MRs and CI across the repositories registered in your notes vault. |
+
 ## How it works
 
 When you type `/session feature`:
@@ -80,7 +96,7 @@ When you type `/session feature`:
 1. **It reads the project.** Git state, open issues, recent commits, documentation, host resources and the records of previous sessions become a Session Overview with one recommendation.
 2. **You correct the scope.** Nothing is implemented until you agree to the plan.
 3. **The work is split into waves.** The session type decides how many: housekeeping 1, feature 3, deep 5, the ultradeep profile 7. Each wave gets a purpose, a list of file paths it may write to, and a result that can be checked.
-4. **`/go` runs it.** Agents whose file scopes do not overlap run at the same time on Claude Code and Codex; Cursor and Pi run them one after another. After each wave the quality gate runs, and anything it reports goes back for correction before the next wave starts.
+4. **`/go` runs it.** Agents whose file scopes do not overlap run at the same time on Claude Code and Codex; Cursor and Pi run them one after another. After each implementation wave your tests and typecheck run, and failures become fix tasks for the next wave. The full test, typecheck and lint gate runs after the Quality wave.
 5. **`/close` checks and records.** It compares the plan against what happened, runs the full quality gate, commits file by file, and opens issues for whatever was not finished.
 
 **What it writes into your repository**, and nothing else — all of it plain text, all of it local:
@@ -100,7 +116,7 @@ The plugin is **51 skills, 27 slash commands, 14 typed subagents and 29 hook fil
 ## Why it is built this way
 
 - **The wave order is deliberate.** Discovery runs first so every implementer starts from the same picture of the code. Impl-Core runs before Impl-Polish so the structure exists before anything integrates against it. The Quality wave simplifies generated code *before* tests are written — write the tests first and they assert whatever the model produced, so changing it later means rewriting the tests too.
-- **Checks run between waves, not only at the end.** A mistake caught after wave 2 costs one wave. The same mistake found at `/close` has already been copied into every wave after it. Findings below the configured confidence threshold are not shown to you.
+- **Checks run after each implementation wave, not only at the end.** A mistake caught after wave 2 costs one wave. The same mistake found at `/close` has already been copied into every wave after it. Findings below the configured confidence threshold are not shown to you.
 - **A crash does not lose the session.** `STATE.md` records which wave finished and what deviated from the plan. The next `/session` offers to continue from the last completed wave.
 - **Two sessions in one working copy is treated as a real risk.** Two people, or two of your own sessions, in the same checkout share one git index, one filesystem and one `STATE.md`, and neither can see the other's uncommitted work. A heartbeat session lock, per-agent file-scope manifests, and the PSA rules in [`.claude/rules/parallel-sessions.md`](https://github.com/Kanevry/session-orchestrator/blob/main/.claude/rules/parallel-sessions.md) exist for exactly that case.
 - **Guards run where the harness supports them, and the table below says where it does not.** A destructive-command policy — 12 rules block, 4 warn — and file-scope enforcement run as real hooks on Claude Code, as bridges on Cursor and Pi, and as instructions only on Codex. Details: [`docs/components.md`](docs/components.md#other-surfaces).
@@ -123,16 +139,15 @@ How this compares to other orchestrators, with measured results kept separate fr
 
 All four platforms share the same skills, commands and scripts; only the hooks differ, because each harness fires different events. Codex leaves its `PreToolUse` handlers empty because these guards do not yet match its tool names and edit payloads ([why](docs/codex-setup.md#why-our-pretooluse-guards-stay-unwired--the-reason-corrected)). Cursor and Pi have known event-coverage limits — see [`docs/cursor-setup.md`](docs/cursor-setup.md) and [`docs/pi-setup.md`](docs/pi-setup.md).
 
-## Recent highlights (v5.5.0)
+## Recent highlights (v5.6.0)
 
-Highlights of the v5.5.0 line:
+Highlights of the v5.6.0 line:
 
-- **Scope guards hold in worktrees, subdirectory launches and beside peer sessions.** The guards read the session's own working copy, find this session's own `wave-scope.json` even when a peer session's manifest ranks higher, and the wave readers, staging fence and orphan reaper follow the same session root. `blockedCommands` carries only command patterns, so redirects inside `bash -c` payloads are no longer denied (#1492, #1493, #1504, #1509).
-- **Session locks are taken over by exactly one session.** A stale or corrupt lock is reclaimed through a tombstone, a future-stamped lock or registry entry never counts as young, and leftovers of a killed reclaim are swept (#1494, #1505).
-- **vault-mirror never overwrites a note it does not own.** The namespace follows the mirrored ledger, a note of another project or generator is skipped, and the vault writers honour the `vault-integration` off switch (#1496, #1503, #1506).
-- **The learnings store keeps every line.** Unparseable lines survive each rewrite, `sweep-expired-learnings --drop-malformed` removes one on purpose, and a prune snapshots first and refuses on drift (#1486, #1489, #1500).
-- **Conventional commits on every path to `main`.** CI lints each commit range and the squash title, and accepts merge or revert headers only from real merges and reverts (#1477, #1502, #1507).
-- **`npm run update:local` updates every local install**, and Claude Code installs the plugin's dependencies again (the `overrides` block it refused is gone). The `/session-orchestrator:navigator` skill left the package; the fleet file contract stays (#1491).
+- **Clearer about what you get.** The website, this README and the npm page now open with the problem the plugin solves and list the features by benefit: what each part does for you, then how it works.
+- **Sessions in a worktree or a subdirectory report their own tree.** A wave's start commit, changed files, HEAD and the stop record's branch now describe the tree the session works in, and the commit guard also checks the manifest of a session launched in a subdirectory, never less strictly than before (#1511).
+- **One rule for how scope paths are spelled.** The overlap check before dispatch and the scope tools now compare paths the same way, and `validate-wave-scope --assert-disjoint --no-manifest` checks a plan's file lists without a dummy manifest (#1510).
+- **A changed scope sidecar can no longer hide a violation.** If the per-wave sidecar changes under a standing manifest, peer records stop counting and you get one notice (#1504).
+- **Close-backfill reads ledger gaps only inside the session's own time window**, so one pruned archive no longer holds back every later session (#1512).
 
 Full changes and verification: [CHANGELOG.md](CHANGELOG.md).
 

package/docs/scope-collision-guard.md

@@ -35,7 +35,9 @@ The same ordering argument applies one level up: step 2 runs on the **declared**
 
 ### 2.2 Why the scope files are not temp files
 
-Steps 1, 2, 3, 4 and the `--assert-subset` assertion all read the *same* file, addressed by wave and agent id. A `$TMPDIR` copy is the one failure in this chain that **costs no error**: the injector finds nothing, no `FILE-SCOPE` block reaches the prompt, `extractScopeFromPrompt()` returns `[]`, and the hook allows the dispatch exactly as it did before #1020 — signal-free (matrix rows 5/6 below). The scope files are control state like `wave-scope.json` itself, never a wave territory, so they never enter `allowedPaths` — that would grant agents write access to the deconfliction record. Until #1027 Pkt 5 writing them tripped `bash-write-verify` once per wave rollover; its `computeReport` now drops `<state-dir>/filescopes/**` from the violation set beside the manifest itself (`isScopeDeclarationPath()` in `scope-gate.mjs`, keyed on the ACTIVE manifest's state dir, so another harness dir's `filescopes/` still reports). The cost, named: a Bash rewrite of a scope file after dispatch is no longer reported there. For the per-agent files `filescopes/wave-<N>/<agent-id>.json` what it can change is bounded — the dispatch already read the file, `wave-scope.json` (and with it `allowedPaths`) keeps its content-hash control notice, and `scope-echo --verify` turns a rewritten file into `digest-unknown`. The aggregate sidecar `filescopes/wave-<N>.scopes.json` is NOT bounded that way: `post-bash-write-verify` re-reads it on every call (`readPeerScopeRecords()`), and a `peer-session-*` record added there downgrades the matching violations to a "peer write" notice — the control hash covers only `wave-scope.json`, and `scope-echo` digests only the `wave-<N>/` directory. Open follow-up: hash the sidecar into the control state (or report its rewrite) so a peer record added after dispatch is visible.
+Steps 1, 2, 3, 4 and the `--assert-subset` assertion all read the *same* file, addressed by wave and agent id. A `$TMPDIR` copy is the one failure in this chain that **costs no error**: the injector finds nothing, no `FILE-SCOPE` block reaches the prompt, `extractScopeFromPrompt()` returns `[]`, and the hook allows the dispatch exactly as it did before #1020 — signal-free (matrix rows 5/6 below). The scope files are control state like `wave-scope.json` itself, never a wave territory, so they never enter `allowedPaths` — that would grant agents write access to the deconfliction record. Until #1027 Pkt 5 writing them tripped `bash-write-verify` once per wave rollover; its `computeReport` now drops `<state-dir>/filescopes/**` from the violation set beside the manifest itself (`isScopeDeclarationPath()` in `scope-gate.mjs`, keyed on the ACTIVE manifest's state dir, so another harness dir's `filescopes/` still reports). The cost, named: a Bash rewrite of a scope file after dispatch is no longer reported there. For the per-agent files `filescopes/wave-<N>/<agent-id>.json` what it can change is bounded — the dispatch already read the file, `wave-scope.json` (and with it `allowedPaths`) keeps its content-hash control notice, and `scope-echo --verify` turns a rewritten file into `digest-unknown`. The aggregate sidecar `filescopes/wave-<N>.scopes.json` is re-read on every call (`readPeerScopeRecords()`), and a `peer-session-*` record there downgrades the matching violations to a "peer write" notice — so since #1504 point 5 its hash is BOUND to the manifest in the hook's trusted snapshot (`bindPeerSidecar()`): bound whenever the `wave-scope.json` hash changes, which fits the materialize → assert → union → write-manifest order. A sidecar that changes while the same manifest stands is untrusted: no peer record is honoured (those writes report as violations) until the manifest is rewritten, and a ⚠ notice names the file once per mismatching sidecar hash (HR-101 — not on every call). Named ceilings: a sidecar changed before the hook first observes the manifest is bound as found; one rewritten together with the manifest is covered only by the control-file notice; re-materializing the SAME wave without rewriting the manifest raises the notice once and leaves every peer record disabled until the manifest is rewritten — and because `--union` excludes `peer-session-*` records, a mid-wave Peer-Scope-Union changes the sidecar but not `allowedPaths`, so only the § 3.3 skeleton→final manifest rewrite changes the manifest hash and re-binds (the re-binding DEPENDS on that rewrite; `skills/_shared/parallel-aware-auq.md` § Peer-Scope-Union step 2 requires it); a forged complete snapshot record is believed (`trustedScopeState()`'s residual). No digest is written into any file the coordinator controls — a digest beside the sidecar sits where the same Bash line can rewrite it.
+
+**A peer session's real manifest is reported once (#1511 e, named ceiling).** `.codex/wave-scope.json` or `<other-harness>/filescopes/**` written by a live peer appears once in this session's out-of-scope report (the report-once snapshot then holds it). The obvious exemption — "the manifest's binding names another session" — was shipped and withdrawn (e52bd786): the binding is what the file says about itself, so one Bash line could write a foreign-looking manifest and silence everything under that `filescopes/`. The hook cannot attribute a write to a caller either: as a `PostToolUse` hook it sees only the tree after the call and the PREVIOUS call's snapshot, so a peer's write between two calls and this call's own write land in the same window. Every other candidate signal is forgeable from inside this session as well: mtime (`touch -d`), a registry-live peer id (readable, so writable into the file), the harness directory. Until a signal exists that this session cannot produce, the one-time report stands.
 
 The coordinator's **own** planned direct edits belong in `coordinator.json` in the identical form. They are not dispatches, so the hook can never see them (§ 6); the CLI check is the only gate that covers them.
 
@@ -111,7 +113,7 @@ It cannot compare a batch of siblings directly — the header records why, measu
 
 - **Ledger:** `.orchestrator/wave-dispatch-scopes.<session>.json` — ONE FILE PER SESSION since #1493, `<session>` being the payload's `session_id` reduced to `[A-Za-z0-9._-]` (`ledgerPathsFor()`). Before, every session of the working copy shared one file holding one `waveKey`: claims of two sessions were never compared (the key's first segment is the session id), but a peer's dispatch reset the file and erased this session's live claims. The pre-split `.orchestrator/wave-dispatch-scopes.json` is read once for migration — adopted only while this session has no file yet and its `waveKey` names this session — and never written or deleted, since it may be a peer's live state. (Gitignored in this repo; consumer repos get the ignore line from bootstrap's `store-lock-ignore` step since #1495 — a repo bootstrapped earlier gets it on its next `--upgrade` or `--refresh-lock`), keyed `<session-id>|w<wave>|<role>` from `<state-dir>/wave-scope.json`.
 - **Lock:** `.orchestrator/wave-dispatch-scopes.<session>.lock`, one per ledger file — the read-modify-write cycle runs under `withFileLock()` (the primitive behind the PSA-005 STATE.md lock). `writeJsonAtomicSync` makes the write atomic, never the *cycle*.
-- **Scope extraction:** `extractScopeFromPrompt()` finds a scope marker line and takes the FIRST fenced block after it, accepting only lines that survive a deliberately strict `looksLikeRepoPath()`. `normalizeScopeEntry()` then folds `./`, `//` and `/./` spellings together, and `promoteDirEntries()` rewrites `scripts/lib` → `scripts/lib/` **on evidence** (not a tracked file itself, at least one tracked file beneath it) — both because two spellings of one path previously compared as disjoint.
+- **Scope extraction:** `extractScopeFromPrompt()` finds a scope marker line and takes the FIRST fenced block after it, accepting only lines that survive a deliberately strict `looksLikeRepoPath()`. `decide()` then folds `./`, `//` and `/./` spellings together with `scopeEntrySpelling()` — the same rule `findScopeCollisions()` and `unionFileScopes()` apply, exported from `scope-gate.mjs` so no second copy can drift (#1510 g), and `promoteDirEntries()` rewrites `scripts/lib` → `scripts/lib/` **on evidence** (not a tracked file itself, at least one tracked file beneath it) — both because two spellings of one path previously compared as disjoint.
 - **DENY** fires on exactly one condition: a collision involving THIS dispatch with a prior agent of the same wave that is **still in flight** (§ 5). The reason names the agent pair, the collision kind and the evidence paths; the suggestion is "give the file exactly ONE owner, or wait for the named agent(s) and re-dispatch", plus this session's ledger path to delete if the state is stale (never a peer's). The ledger is deliberately **not** persisted on a deny — the dispatch did not happen, so recording it would make the retry-after-fix look like a duplicate.
 
 ### 4.1 Error-class matrix — deliberately fail-**open**
@@ -214,7 +216,7 @@ Complete list of what this guard does **not** see, or sees only approximately:
 node scripts/validate-wave-scope.mjs --assert-disjoint "$WAVE_SCOPES_SIDECAR" < <state-dir>/wave-scope.json
 ```
 
-Exit 1 prints one `ERROR:` line per collision (`agents "A" and "B" both claim [...]`) and one per duplicate id. Exit 0 — nothing on stderr, the manifest echoed back on stdout — means the declared scopes really are disjoint and the hook was right to allow; the divergence is then in the prompt, not in the plan.
+Exit 1 prints one `ERROR:` line per collision (`agents "A" and "B" both claim [...]`) and one per duplicate id. Exit 0 — nothing on stderr, the manifest echoed back on stdout — means the declared scopes really are disjoint and the hook was right to allow; the divergence is then in the prompt, not in the plan. No manifest yet (e.g. `/plan`, before any `wave-scope.json` exists)? Add `--no-manifest` and drop the stdin redirect: the sidecar is checked alone and stdout stays empty — without the flag an empty stdin is still an error, and the flag refuses `--union` / `--assert-subset`, which need the manifest (#1510 f).
 
 **Reset.** Delete this session's `.orchestrator/wave-dispatch-scopes.<session>.json` (and its `.lock` if a dead holder is suspected) — never a peer's. Both are gitignored here (in a consumer repo only once bootstrap's `store-lock-ignore` step has run, #1495), both are rebuilt on the next dispatch, and neither is shared with any other mechanism or session. After the final wave, `<state-dir>/filescopes/` is deleted along with `wave-scope.json` and this session's ledger file (`skills/wave-executor/references/wave-loop-scope-manifest.md` step 7, session-end 3.0); a crashed session's file stays behind, inert — no other session reads it — a stale `wave-<N>/` directory left behind is a scope claim nobody re-verified.
 

package/hooks/hooks-codex.json

@@ -7,7 +7,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "echo '🎯 Session Orchestrator v5.5.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
+            "command": "echo '🎯 Session Orchestrator v5.6.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
             "async": false
           },
           {

package/hooks/hooks.json

@@ -6,7 +6,7 @@
         "hooks": [
           {
             "type": "command",
-            "command": "echo '🎯 Session Orchestrator v5.5.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
+            "command": "echo '🎯 Session Orchestrator v5.6.0 — /session [housekeeping|feature|deep] | /plan [new|feature|retro] | /discovery [scope] | /evolve [analyze|review|list]'",
             "async": false
           },
           {

package/hooks/on-stop.mjs

@@ -400,10 +400,16 @@ function reaperTriggerField(trigger) {
  * @param {{reason?: string}|null} [reaperTrigger]  `maybeTriggerOrphanScan()` result.
  */
 async function handleStop(input, reaperTrigger = null) {
+  // Two roots, by writer (#1511 point b). `current-session.json` and
+  // `session.lock` (session id, lock heartbeat, duration) stay at the LAUNCH
+  // dir: on-session-start.mjs writes both at `resolveProjectDir()`. The wave
+  // and the commit/branch describe the tree the session WORKS in — after
+  // EnterWorktree that is the session root, not the launch checkout.
   const projectRoot = getProjectDir();
+  const sessionRoot = resolveSessionRoot(input?.cwd);
 
-  const wave = await readWaveNumber(resolveSessionRoot(input?.cwd), input);
-  const { commit, branch } = await gitInfo(projectRoot);
+  const wave = await readWaveNumber(sessionRoot, input);
+  const { commit, branch } = await gitInfo(sessionRoot);
 
   const { sessionId, semanticSessionId } = await resolveSessionId(input, projectRoot);
 

package/hooks/post-bash-write-verify.mjs

@@ -408,14 +408,11 @@ export { PEER_RECORD_PREFIX };
  * @param {unknown} wave the manifest's `wave` field
  * @returns {Array<{ id: string, files: string[] }>}
  */
-export function readPeerScopeRecords(stateDir, wave) {
-  if (typeof stateDir !== 'string' || stateDir === '') return [];
-  if (typeof wave !== 'number' || !Number.isInteger(wave) || wave <= 0) return [];
+export function readPeerScopeRecords(stateDir, wave, raw = readPeerSidecarRaw(stateDir, wave)) {
+  if (typeof raw !== 'string') return [];
   let parsed;
   try {
-    parsed = JSON.parse(
-      readFileSync(path.join(stateDir, 'filescopes', `wave-${wave}.scopes.json`), 'utf8'),
-    );
+    parsed = JSON.parse(raw);
   } catch {
     return [];
   }
@@ -429,6 +426,100 @@ export function readPeerScopeRecords(stateDir, wave) {
     .map((r) => ({ id: r.id, files: r.files.filter((f) => typeof f === 'string') }));
 }
 
+/**
+ * The raw bytes of a wave's aggregate scope sidecar, or null (absent,
+ * unreadable, or no usable state dir / wave). Read ONCE per call so the bytes
+ * that are hashed ({@link bindPeerSidecar}) are the bytes that are parsed.
+ *
+ * @param {string} stateDir
+ * @param {unknown} wave
+ * @returns {string|null}
+ */
+export function readPeerSidecarRaw(stateDir, wave) {
+  if (typeof stateDir !== 'string' || stateDir === '') return null;
+  if (typeof wave !== 'number' || !Number.isInteger(wave) || wave <= 0) return null;
+  try {
+    return readFileSync(path.join(stateDir, 'filescopes', `wave-${wave}.scopes.json`), 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Bind the aggregate sidecar's content to the manifest it was written for
+ * (#1504 point 5). The sidecar carried no integrity anchor: a `peer-session-*`
+ * record appended AFTER dispatch downgraded matching violations to a peer-write
+ * notice, because the control hash covers only `wave-scope.json`.
+ *
+ * The anchor is the trusted snapshot's `scopeState` — the one record this hook
+ * already treats as control state. The coordinator's order is materialize →
+ * assert-disjoint → union → write manifest, so the sidecar is final by the time
+ * the manifest is; the hash is therefore (re)bound whenever the MANIFEST hash
+ * changes (or no binding exists yet), and must hold while the manifest stands.
+ * No coordinator step and no new field: a materializer-written digest would sit
+ * in a file the same actor can rewrite, which binds nothing.
+ *
+ *   manifest changed / no prior binding  → bind the current hash, honour records
+ *   same manifest, same sidecar hash     → honour records
+ *   same manifest, sidecar now absent    → nothing to honour; keep the binding so
+ *                                          a re-created sidecar still mismatches
+ *   same manifest, DIFFERENT sidecar     → `tampered`: honour NO peer record
+ *                                          (fail toward reporting) and keep the
+ *                                          ORIGINAL binding until the manifest is
+ *                                          rewritten; the notice fires ONCE per
+ *                                          mismatching sidecar hash (`notify`)
+ *
+ * Once, not per call: a legitimate mid-wave Peer-Scope-Union rewrites the sidecar
+ * while `--union` (which excludes peer records) leaves the manifest bytes
+ * unchanged, so `tampered` holds for the rest of the wave. Repeating the ⚠ on
+ * every Bash call would be an always-on signal (HR-101). The marker
+ * `sidecarNotified` is persisted in the trusted snapshot by the caller only on
+ * the path that emits; a further change of the sidecar (a new hash) notifies again.
+ *
+ * A snapshot written before this field existed has no `sidecarHash` and binds
+ * silently on its first call — the same one-time adoption the control hash had.
+ *
+ * NAMED CEILING: a sidecar changed BEFORE this hook first observes the manifest
+ * (no trusted snapshot yet) is bound as found; so is one rewritten together with
+ * the manifest (that path already raises the control-file notice). A forged
+ * COMPLETE snapshot record is believed — `trustedScopeState`'s residual.
+ *
+ * @param {{ hash: string, sidecarHash?: unknown }|null} prevScopeState trusted prior state
+ * @param {string} manifestHash this call's manifest hash
+ * @param {string} sidecarHash this call's sidecar hash, or 'absent'
+ * @returns {{ sidecarHash: string, tampered: boolean, notify: boolean, sidecarNotified?: string }}
+ *   the hash to persist, the verdict, whether to emit the mismatch notice, and
+ *   (when tampered) the marker to persist once it has been emitted
+ */
+export function bindPeerSidecar(prevScopeState, manifestHash, sidecarHash) {
+  const bound = prevScopeState?.sidecarHash;
+  if (!prevScopeState || prevScopeState.hash !== manifestHash || typeof bound !== 'string') {
+    return { sidecarHash, tampered: false, notify: false };
+  }
+  if (bound === sidecarHash || sidecarHash === 'absent') {
+    return { sidecarHash: bound, tampered: false, notify: false };
+  }
+  return {
+    sidecarHash: bound,
+    tampered: true,
+    notify: prevScopeState.sidecarNotified !== sidecarHash,
+    sidecarNotified: sidecarHash,
+  };
+}
+
+/**
+ * Render the sidecar-mismatch notice (#1504 point 5) — an alarm (⚠), because the
+ * consequence is that agreed peer writes now report as violations.
+ *
+ * @param {string} relSidecarPath
+ * @returns {string}
+ */
+export function formatSidecarMismatchNotice(relSidecarPath) {
+  return `bash-write-verify: ${relSidecarPath} changed since wave-scope.json was written — `
+    + 'its peer-session-* records are NOT honoured (writes under them report as violations) '
+    + 'until the manifest is rewritten (#1504 point 5).';
+}
+
 /**
  * Which peer record — if any — declared this path?
  *
@@ -960,6 +1051,16 @@ async function main() {
       : 'unparseable',
     gateOn: scope ? scope?.gates?.['bash-write-verify'] !== false : true,
   };
+  // #1504 point 5 — bind the aggregate sidecar to this manifest (see
+  // `bindPeerSidecar`). Part of `currentScopeState` so EVERY snapshot write
+  // below, stand-down paths included, carries the binding forward.
+  const sidecarRaw = readPeerSidecarRaw(path.dirname(scopePath), scope?.wave);
+  const sidecarBinding = bindPeerSidecar(
+    prevScopeState,
+    currentScopeState.hash,
+    sidecarRaw === null ? 'absent' : createHash('sha1').update(sidecarRaw).digest('hex').slice(0, 16),
+  );
+  currentScopeState.sidecarHash = sidecarBinding.sidecarHash;
 
   // G3b (#1153 P1) — is this manifest even MINE?
   //
@@ -1153,6 +1254,9 @@ async function main() {
     },
   });
 
+  // The mismatch notice below is emitted on this path only, so its once-marker
+  // is persisted here and nowhere else (see `bindPeerSidecar`).
+  if (sidecarBinding.tampered) currentScopeState.sidecarNotified = sidecarBinding.sidecarNotified;
   writeSnapshot(snapFile, { ...nextSnapshot, scopeState: currentScopeState });
 
   const messages = [];
@@ -1172,7 +1276,17 @@ async function main() {
   // reachable. Such a write is agreed, not a bypass. Split it out of the violation report and
   // name it, so the peer's file is countable without being an alarm. Sidecar
   // absent ⇒ `peerRecords` is empty ⇒ every path stays a violation, unchanged.
-  const peerRecords = readPeerScopeRecords(path.dirname(scopePath), scope.wave);
+  // #1504 point 5 — a sidecar changed under a standing manifest is untrusted:
+  // no peer record is honoured, and the mismatch is named.
+  const peerRecords = sidecarBinding.tampered
+    ? []
+    : readPeerScopeRecords(path.dirname(scopePath), scope.wave, sidecarRaw);
+  if (sidecarBinding.notify) {
+    messages.push(formatSidecarMismatchNotice(
+      path.relative(repoRoot, path.join(path.dirname(scopePath), 'filescopes', `wave-${scope.wave}.scopes.json`)),
+    ));
+    warn = true;
+  }
   const violations = [];
   for (const relPath of report) {
     const peerId = peerRecordFor(relPath, peerRecords);

package/hooks/post-tool-batch-wave-signal.mjs

@@ -354,6 +354,13 @@ async function main() {
     ...(waveSignal !== null ? { wave_signal: waveSignal } : {}),
   };
 
+  // Two roots, by writer (#1511 point a). `current-session.json` and
+  // `session.lock` stay at the LAUNCH dir: on-session-start.mjs writes both at
+  // `resolveProjectDir()`, and a reader elsewhere finds no record. Everything
+  // about the WAVE — its manifest, its start sha, the files it changed — is read
+  // at the SESSION root: after EnterWorktree the launch dir is a different
+  // checkout, whose HEAD and working tree say nothing about this wave.
+  const sessionRoot = resolveSessionRoot(input?.cwd);
   const sessionFile = path.join(getProjectDir(), '.orchestrator', 'current-session.json');
 
   const lastBatchResult = await atomicMutateJson(sessionFile, {}, (current) => ({
@@ -462,7 +469,7 @@ async function main() {
     // last_wave_completed === last_wave and stays silent.
     try {
       const wave = await resolveWaveNumber(
-        resolveSessionRoot(input?.cwd),
+        sessionRoot,
         new Set(readProcessLocalSessionIds({ hookInput: input })),
       );
       if (wave > 0) {
@@ -495,7 +502,7 @@ async function main() {
           if (lastWave > lastWaveCompleted) {
             // #980 — measure the closing wave's diff size BEFORE the new wave's
             // start sha is persisted below. Unmeasurable → both keys omitted.
-            const filesChanged = countFilesChangedSince(getProjectDir(), waveStartSha);
+            const filesChanged = countFilesChangedSince(sessionRoot, waveStartSha);
             await emitEvent('orchestrator.wave.completed', {
               wave_number: lastWave,
               ...(filesChanged !== null
@@ -537,7 +544,7 @@ async function main() {
             // #980 — the OPEN half: stamp the sha this new wave starts from.
             // Written as null (not omitted) when git is unreadable, so the
             // PREVIOUS wave's sha can never linger and inflate the next count.
-            const startSha = readHeadSha(getProjectDir());
+            const startSha = readHeadSha(sessionRoot);
             const markResult = await atomicMutateJson(sessionFile, {}, (current) => ({
               ...current,
               wave_start_sha: startSha,
@@ -593,7 +600,7 @@ async function main() {
   // Rooted at the SESSION root (#1492 point 2, #1504 point 4): the quality gate
   // registers its children in the ledger of the tree it runs in, which for an
   // entered worktree is the worktree — the launch dir holds none of them.
-  await maybeTriggerOrphanScan({ projectDir: resolveSessionRoot(input?.cwd) });
+  await maybeTriggerOrphanScan({ projectDir: sessionRoot });
 }
 
 // Entry guard (#1393): run only as the node script the harness execs — a bare

package/hooks/pre-bash-memory-propose-audit.mjs

@@ -29,7 +29,7 @@ import { readFile } from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { emitEvent } from '../scripts/lib/events.mjs';
-import { resolveSessionRoot } from '../scripts/lib/platform.mjs';
+import { getProjectDir, resolveSessionRoot } from '../scripts/lib/platform.mjs';
 import { findOwnScopeFile } from '../scripts/lib/scope-gate.mjs';
 import {
   classifyManifestSession,
@@ -246,18 +246,23 @@ async function main() {
   if (!MEMORY_PROPOSE_REGEX.test(command)) return emitAllow();
 
   // Matched — proceed with audit logging (G4-G7)
-  const projectDir = process.env.CLAUDE_PROJECT_DIR
-    ?? process.env.CODEX_PROJECT_DIR
-    ?? process.cwd();
+  // Two roots, by writer (#1511 point c). The session-id fallback reads
+  // `current-session.json` where on-session-start.mjs WRITES it — the launch dir,
+  // through the same resolver (`resolveProjectDir`; the hand-rolled
+  // `CLAUDE_PROJECT_DIR ?? CODEX_PROJECT_DIR ?? process.cwd()` kept a set-but-
+  // empty var, skipped the Cursor/Pi vars and never walked up). The wave and the
+  // recorded `cwd` describe the tree the session WORKS in: the SESSION root the
+  // scope guards use (#1504 point 4), which after EnterWorktree is not the
+  // launch dir.
+  const projectDir = getProjectDir();
+  const sessionRoot = resolveSessionRoot(input.cwd);
 
   // G4 — resolve session_id
   const sessionId = await resolveSessionId(input, projectDir);
 
   // G5 — resolve wave
-  // Read at the SESSION root the scope guards use (#1504 point 4), not at the
-  // launch dir above, which stays put while the session works in a worktree.
   const wave = await resolveWave(
-    resolveSessionRoot(input.cwd),
+    sessionRoot,
     new Set(readProcessLocalSessionIds({ hookInput: input })),
   );
 
@@ -280,7 +285,7 @@ async function main() {
       command_hash: commandHash,
       flags_present: flags,
       argv_length: command.length,
-      cwd: relativeCwd(process.cwd(), projectDir),
+      cwd: relativeCwd(process.cwd(), sessionRoot),
       exit_code: null,
     });
   } catch { /* telemetry never blocks the hook (#1183) */ }

package/hooks/pre-task-scope-disjoint.mjs

@@ -267,6 +267,7 @@ import { shouldRunHook } from './_lib/profile-gate.mjs';
 /** @type {typeof import('../scripts/lib/scope-echo.mjs').scopeDigest} */ let scopeDigest;
 /** @type {typeof import('../scripts/lib/platform.mjs').resolveSessionRoot} */ let resolveSessionRoot;
 let findScopeCollisions;
+/** @type {typeof import('../scripts/lib/scope-gate.mjs').scopeEntrySpelling} */ let scopeEntrySpelling;
 let findOwnScopeFile;
 let readProcessLocalSessionIds;
 let classifyManifestSession;
@@ -581,7 +582,7 @@ async function bootstrap() {
   );
 
   ({ readStdin, emitAllow, emitDeny, emitWarn, writeJsonAtomicSync } = modules.io);
-  ({ findScopeCollisions, findOwnScopeFile } = modules.scopeGate);
+  ({ findScopeCollisions, findOwnScopeFile, scopeEntrySpelling } = modules.scopeGate);
   ({ readProcessLocalSessionIds, classifyManifestSession } = modules.sessionIdentity);
   ({ withFileLock } = modules.fileLock);
   ({ scopeDigest } = modules.scopeEcho);
@@ -739,36 +740,6 @@ function cleanScopeLine(line) {
     .trim();
 }
 
-/**
- * Canonicalise a scope entry's SPELLING so two agents writing the same file two
- * ways are not read as disjoint (review LOW). Measured before this existed:
- * `['./scripts/lib/foo.mjs']` vs `['scripts/lib/foo.mjs']` compared `ok: true`
- * — the hook extracts from PROSE, and `looksLikeRepoPath` admits a `./` prefix,
- * so both spellings reach the comparison verbatim.
- *
- * Purely syntactic and meaning-preserving: `./` prefixes, `/./` segments and
- * duplicated slashes are removed. A TRAILING slash is deliberately kept — it is
- * the directory-prefix operator of `pathMatchesPattern`, so stripping it would
- * silently narrow a scope. The `dir` ↔ `dir/` case is handled by
- * {@link promoteDirEntries}, which decides it on evidence rather than guessing.
- *
- * `scope-gate.mjs` is a hook-safe pure library and out of this change's scope,
- * so the normalisation lives on THIS side of the call, applied to both sides of
- * every comparison.
- *
- * @param {string} entry
- * @returns {string}
- */
-export function normalizeScopeEntry(entry) {
-  if (typeof entry !== 'string') return '';
-  let s = entry.trim();
-  if (s === '') return '';
-  s = s.replace(/\/{2,}/g, '/');       // `a//b` → `a/b`
-  s = s.replace(/(?:^|\/)\.\//g, (m) => (m.startsWith('/') ? '/' : '')); // `./a`, `a/./b`
-  while (s.startsWith('./')) s = s.slice(2);
-  return s;
-}
-
 /**
  * Promote an entry that names a DIRECTORY to its `dir/` prefix form, on
  * evidence. `scripts/lib` and `scripts/lib/` are the same claim, but
@@ -815,7 +786,11 @@ function collectScopePaths(segments) {
   for (const raw of segments) {
     // A trailing sentence period is punctuation, never part of a path
     // (measured: "docs/events-schema.md." at the end of an inline declaration).
-    const cleaned = normalizeScopeEntry(cleanScopeLine(raw).replace(/\.$/, ''));
+    // Lexical cleaning only (prose → path); the SPELLING rule is
+    // `scopeEntrySpelling` in scope-gate.mjs, applied in `decide()` (#1510 g).
+    // The second trim: a period stripped after `cleanScopeLine`'s trim can
+    // expose a space (`foo.mjs .`), which `looksLikeRepoPath` would reject.
+    const cleaned = cleanScopeLine(raw).replace(/\.$/, '').trim();
     if (!looksLikeRepoPath(cleaned)) continue;
     if (seen.has(cleaned)) continue;
     seen.add(cleaned);
@@ -906,7 +881,8 @@ export function extractScopeSignal(prompt) {
  * (and the tests that pin them) keep the original signature.
  *
  * @param {string} prompt
- * @returns {string[]} repo-relative paths/globs, normalised, deduped, order preserved
+ * @returns {string[]} repo-relative paths/globs as declared (lexically cleaned,
+ *   deduped, order preserved) — the SPELLING rule runs in `decide()` (#1510 g)
  */
 export function extractScopeFromPrompt(prompt) {
   return extractScopeSignal(prompt).files;
@@ -2070,9 +2046,11 @@ export function scopeDigestFields(files, prompt, digestFn) {
  * @param {string} [params.nowIso]            dispatch timestamp recorded on the entry
  * @param {(paths: string[]) => string} [params.digestFn] scope-digest function
  *   (injected for testability; defaults to the late-bound `scopeDigest`)
+ * @param {(entry: string) => string} [params.spellFn] scope-entry spelling rule
+ *   (injected for testability; defaults to the late-bound `scopeEntrySpelling`)
  * @returns {Verdict}
  */
-export function decide({ input, ledger, ledgerCorrupt, waveKey, knownFiles, collide, isFinished, nowIso, digestFn }) {
+export function decide({ input, ledger, ledgerCorrupt, waveKey, knownFiles, collide, isFinished, nowIso, digestFn, spellFn }) {
   const toolName = input?.tool_name;
   // Row 4: not our tool.
   if (toolName !== DISPATCH_TOOL) return { action: 'allow' };
@@ -2083,7 +2061,14 @@ export function decide({ input, ledger, ledgerCorrupt, waveKey, knownFiles, coll
   const at = typeof nowIso === 'string' ? nowIso : new Date().toISOString();
 
   const signal = extractScopeSignal(toolInput.prompt);
-  const files = signal.files;
+  // #1510 g — ONE spelling rule, scope-gate's, applied before the ledger, the
+  // digest and `promoteDirEntries` see an entry: `./scripts/lib` must reach the
+  // dir-promotion as `scripts/lib`, or a bare-dir claim stays a literal and
+  // compares disjoint with the files beneath it. Re-deduped on the spelling.
+  // Unbound (a direct importer that never ran `bootstrap()`) ⇒ entries as
+  // extracted; `findScopeCollisions` still spells both sides itself.
+  const spell = typeof spellFn === 'function' ? spellFn : scopeEntrySpelling;
+  const files = typeof spell === 'function' ? [...new Set(signal.files.map(spell))] : signal.files;
   const id = agentIdOf(toolInput);
   const priorAgents = (ledger !== null && ledger?.waveKey === waveKey && Array.isArray(ledger.agents))
     ? ledger.agents

package/hooks/wave-scope-commit-guard.mjs

@@ -48,8 +48,8 @@
 //     `git commit --no-verify` skips it entirely (operator opts out by name).
 
 import { execSync } from 'node:child_process';
-import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
-import { join, relative } from 'node:path';
+import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from 'node:fs';
+import { isAbsolute, join, relative, sep } from 'node:path';
 
 // Re-use existing helpers from scripts/lib/hardening.mjs.
 // IMPORTANT: import is resolved relative to THIS file's location (the hook
@@ -59,6 +59,7 @@ import { join, relative } from 'node:path';
 import { pathMatchesPattern } from '../scripts/lib/hardening.mjs';
 import { withStagingFenceLock } from '../scripts/lib/session-lock.mjs';
 import { isMainModule } from '../scripts/lib/is-main-module.mjs';
+import { resolveSessionRoot } from '../scripts/lib/platform.mjs';
 import { classifyEmptyScope, findOwnScopeFile, sessionAgeMs } from '../scripts/lib/scope-gate.mjs';
 import {
   classifyManifestSession,
@@ -175,14 +176,20 @@ function mtimeMsOf(file) {
  *
  * @param {object} p
  * @param {Record<string, unknown>} p.scope parsed manifest
- * @param {string[]} p.stagedFiles
+ * @param {string[]} p.stagedFiles  repo-relative, as `git diff --cached` prints them
+ * @param {(f: string) => string|null} [p.scopePathOf]  a staged path as the
+ *   manifest names it — relative to the SESSION root; identity when that is the
+ *   repo root. `null` = the path lies OUTSIDE the session root: a violation
+ *   without pattern matching, since a `../`-prefixed path would match a glob
+ *   like `**\/*.mjs` and enforce-scope denies every write outside its root
+ *   (REQ-04).
  * @param {string} p.scopeRel manifest path for messages, repo-relative
  * @param {Set<string>} p.ownIds this process's session ids
  * @param {number|null} p.scopeMtimeMs
  * @param {number|null} p.sessionAge ms since the newest session clock
  * @returns {{action: 'pass'|'report'|'block', lines: string[]}}
  */
-function scopeCommitVerdict({ scope, stagedFiles, scopeRel, ownIds, scopeMtimeMs, sessionAge }) {
+function scopeCommitVerdict({ scope, stagedFiles, scopePathOf = (f) => f, scopeRel, ownIds, scopeMtimeMs, sessionAge }) {
   if (stagedFiles.length === 0) return { action: 'pass', lines: [] };
 
   // Same classifier and same disposition as enforce-scope Gate 3b: only a
@@ -200,7 +207,10 @@ function scopeCommitVerdict({ scope, stagedFiles, scopeRel, ownIds, scopeMtimeMs
   const allowedPaths = Array.isArray(scope.allowedPaths) ? scope.allowedPaths : [];
   if (allowedPaths.length > 0) {
     const violations = stagedFiles.filter(
-      (f) => !allowedPaths.some((pattern) => pathMatchesPattern(f, pattern)),
+      (f) => {
+        const scoped = scopePathOf(f);
+        return scoped === null || !allowedPaths.some((pattern) => pathMatchesPattern(scoped, pattern));
+      },
     );
     if (violations.length === 0) return { action: 'pass', lines: [] };
     // Blocks under `warn` too — see the header: in a warn-mode wave this is
@@ -258,6 +268,30 @@ function scopeCommitVerdict({ scope, stagedFiles, scopeRel, ownIds, scopeMtimeMs
   };
 }
 
+/**
+ * The session root a commit at `repoRoot` is judged against when it lies
+ * STRICTLY inside the repo, else `null` (judge at `repoRoot`, as before) — see
+ * the call site in `main()` (#1511 point d). Both sides realpath-resolved, so
+ * macOS `/var` vs `/private/var` cannot split one directory in two.
+ *
+ * @param {string} repoRoot  `git rev-parse --show-toplevel`
+ * @returns {{sessionRoot: string, realRepoRoot: string}|null}
+ */
+function subdirSessionRoot(repoRoot) {
+  const canon = (p) => {
+    // `.native` canonicalises letter case on case-insensitive APFS (as
+    // enforce-scope's clamp does since #1504 pt 8); the JS realpath keeps a
+    // case-different CLAUDE_PROJECT_DIR verbatim, which relativises to `../..`
+    // against the git toplevel and switches the subdirectory mode off silently.
+    try { return realpathSync.native(p); } catch { return p; }
+  };
+  const realRepoRoot = canon(repoRoot);
+  const sessionRoot = canon(resolveSessionRoot(repoRoot, repoRoot));
+  const rel = relative(realRepoRoot, sessionRoot);
+  if (rel === '' || rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)) return null;
+  return { sessionRoot, realRepoRoot };
+}
+
 /**
  * Both sub-modes, in the order the pre-commit hook needs them. Every statement
  * here used to sit at module top level, which meant a bare `import()` of this
@@ -282,8 +316,34 @@ async function main() {
   // committing session's env; there is no hook payload here, so the env tier is
   // the only process-local identity.
   const ownIds = new Set(readProcessLocalSessionIds());
-  const located = findOwnScopeFile(repoRoot, ownIds, classifyManifestSession);
-  const scopePath = located.path ?? located.foreignPath;
+
+  // #1511 point d — ALSO read the manifest at the SESSION root the scope guards
+  // resolve (`resolveSessionRoot`, enforce-scope.mjs): a session launched in a
+  // repo SUBDIRECTORY keeps its manifest there, so the repo root held none and
+  // sub-mode B never ran for it. git runs this hook at the worktree top level
+  // and the committing session's env (the launch dir) is inherited, so the
+  // toplevel stands in for the payload `cwd` the Edit/Write guards get. Only a
+  // root STRICTLY inside the repo is adopted: the one rung that answers above it
+  // (a harness `agent-<hex>` worktree lifted to its launch checkout) would judge
+  // this repo's staged paths against another tree's manifest.
+  //
+  // The repo-root manifest is ALWAYS judged exactly as before #1511 d, and the
+  // subdirectory manifest is judged IN ADDITION, each against its own path
+  // mapping; either one blocking blocks. So the verdict is never laxer than the
+  // repo-root-only guard it extends — choosing ONE of the two manifests let an
+  // unbound or `enforcement: off` subdirectory manifest silence a repo-root wave
+  // that blocked the same commit (second review, MED-1).
+  const subdir = subdirSessionRoot(repoRoot);
+  const judgements = [{ root: repoRoot, scopePathOf: (f) => f }];
+  if (subdir !== null) {
+    judgements.push({
+      root: subdir.sessionRoot,
+      scopePathOf: (f) => {
+        const rel = relative(subdir.sessionRoot, join(subdir.realRepoRoot, f));
+        return rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel) ? null : rel;
+      },
+    });
+  }
   const fenceDir = join(repoRoot, '.orchestrator', 'staging-fence');
 
   // -------------------------------------------------------------------------
@@ -293,7 +353,11 @@ async function main() {
   const stagedOutput = execSync('git diff --cached --name-only', { encoding: 'utf8' });
   const stagedFiles = stagedOutput.split('\n').filter(Boolean);
 
-  if (scopePath) {
+  let blocked = false;
+  for (const { root, scopePathOf } of judgements) {
+    const located = findOwnScopeFile(root, ownIds, classifyManifestSession);
+    const scopePath = located.path ?? located.foreignPath;
+    if (!scopePath) continue;
     let scope;
     try {
       scope = JSON.parse(readFileSync(scopePath, 'utf8'));
@@ -305,14 +369,16 @@ async function main() {
     const verdict = scopeCommitVerdict({
       scope: scope !== null && typeof scope === 'object' ? scope : {},
       stagedFiles,
+      scopePathOf,
       scopeRel: relative(repoRoot, scopePath) || scopePath,
       ownIds,
       scopeMtimeMs: mtimeMsOf(scopePath),
-      sessionAge: sessionAgeMs(repoRoot),
+      sessionAge: sessionAgeMs(root),
     });
     for (const line of verdict.lines) process.stderr.write(`${line}\n`);
-    if (verdict.action === 'block') process.exit(1);
+    if (verdict.action === 'block') blocked = true;
   }
+  if (blocked) process.exit(1);
 
   // -------------------------------------------------------------------------
   // Sub-mode C — cross-agent staging-fence reconciliation (issue #552)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "session-orchestrator",
-  "version": "5.5.0",
-  "description": "A repeatable Plan, Go, Close workflow for AI coding sessions: /session reads your repo and agrees the scope, /go runs the work in waves with a quality gate between each, /close verifies and commits. Runs on Claude Code, Codex CLI, Cursor and Pi.",
+  "version": "5.6.0",
+  "description": "Your coding agents get an agreed plan, a check after each round of changes and a handover to the next session. Plan, Go, Close: /session reads your repo and agrees the scope, /go runs the work in waves with your tests and typecheck after each implementation wave, /close runs the full gate, verifies, commits and files the rest as issues. Scope and destructive-command guards, crash-safe resume, learnings you approve. For Claude Code, Codex CLI, Cursor and Pi.",
   "type": "module",
   "homepage": "https://session-orchestrator.com",
   "keywords": [
@@ -16,7 +16,12 @@
     "orchestration",
     "developer-tools",
     "mcp",
-    "llm"
+    "llm",
+    "workflow",
+    "quality-gates",
+    "ai-coding",
+    "gitlab",
+    "github"
   ],
   "engines": {
     "node": ">=24.0.0"

package/scripts/lib/scope-gate.mjs

@@ -1295,10 +1295,17 @@ function normalizeAgentScopes(agentScopes) {
  * NAMED CEILING: `..` segments are left alone — `a/../b` is not provably `b`
  * when `a` is a glob segment. Revisit if a plan ever declares a `..` entry.
  *
+ * EXPORTED as the ONE spelling rule (#1510 g): `hooks/pre-task-scope-disjoint.mjs`
+ * applies it (late-bound) before its own dedupe and dir-promotion, instead of a
+ * hand-copied twin that had already drifted (`a/././b` kept a `./` segment).
+ * Whitespace is NOT trimmed here: no writer of a scope entry produces padding
+ * (the hook's prose cleaner trims before this rule runs; sidecar entries are
+ * JSON strings the plan writes), and trimming would rewrite a declared path.
+ *
  * @param {string} entry - a non-empty scope entry
  * @returns {string}
  */
-function scopeEntrySpelling(entry) {
+export function scopeEntrySpelling(entry) {
   const spelled = entry.replace(/\/{2,}/g, '/').replace(/(^|\/)(?:\.\/)+/g, '$1');
   // `./` alone would spell as '' — keep the entry rather than invent a meaning.
   return spelled.length > 0 ? spelled : entry;

package/scripts/lib/session-close-backfill.mjs

@@ -348,8 +348,11 @@ export const REQUIRED_EVENTS_WINDOW_DAYS = null;
  * @param {string} eventsPath
  * @param {string} id
  * @param {number|null} deadlineMs — epoch ms the scan must end by; `null` = unbounded
- * @returns {Array<object>|null} `null` when the deadline had passed before the
- *   scan or cut it short — a partial history is never handed on as a whole one.
+ * @returns {{records: Array<object>, lostFields: string[]}|null} `null` when the
+ *   deadline had passed before the scan or cut it short, or a recoverable cut
+ *   lies in the session's window — a partial history is never handed on as a
+ *   whole one. `lostFields` names the record fields a PERMANENTLY pruned archive
+ *   inside the window may have changed (see {@link windowGapVerdict}).
  */
 function recordsMentioning(eventsPath, id, deadlineMs) {
   let budgetMs;
@@ -358,7 +361,7 @@ function recordsMentioning(eventsPath, id, deadlineMs) {
     if (!(budgetMs > 0)) return null;
   }
   const newestFirst = [];
-  const { truncated, unreadable } = scanEventsBackwards({
+  const { truncated, unreadable, gaps } = scanEventsBackwards({
     filePath: eventsPath,
     filter: id,
     budgetMs,
@@ -371,13 +374,73 @@ function recordsMentioning(eventsPath, id, deadlineMs) {
   // deadline does — its records are simply absent — so it defers the candidate
   // the same way. Ceiling (BV-004): a PERMANENTLY unreadable archive defers its
   // candidates on every run (`skipped-history-unread`, visible, never a record
-  // dated NOW). `gaps` (pruned/unindexed archives) are deliberately NOT treated
-  // so: the walk reports every gap of the whole ledger, mostly far older than
-  // the candidate, and deferring on any of them would skip the candidate
-  // forever — telling a gap inside the session's window apart needs its
-  // first_ts/last_ts against the session's range, a follow-up.
-  const cut = truncated || (Array.isArray(unreadable) && unreadable.length > 0);
-  return cut ? null : newestFirst.reverse();
+  // dated NOW).
+  if (truncated || (Array.isArray(unreadable) && unreadable.length > 0)) return null;
+  const verdict = windowGapVerdict(gaps, newestFirst);
+  if (verdict.defer) return null;
+  return { records: newestFirst.reverse(), lostFields: verdict.lostFields };
+}
+
+/**
+ * What a pruned/unindexed archive (`gaps` of {@link scanEventsBackwards}) means
+ * for the session whose found records are `records` (#1512).
+ *
+ * The walk reports every gap of the WHOLE ledger, mostly far older than the
+ * candidate; deferring on any of them would skip the candidate forever. So a
+ * gap counts only when its `[first_ts, last_ts]` intersects the session's
+ * window `[earliest, latest]` timestamp of the records the walk found.
+ *
+ * A counted gap's KIND then decides. `unindexed-archive` — the file still sits
+ * in `_archive/` under a name the walk does not index — can resolve (a rename
+ * puts it back), so it DEFERS (`skipped-history-unread`). `missing-archive` —
+ * pruned, its bytes gone — never resolves, so deferring would skip the candidate
+ * on every run forever; the record is written instead, naming in `lostFields`
+ * what the lost span may have held: `session_type` and `session_profile` (the
+ * LAST `shape_resolved` decides both) always, `completed_at` when the gap reaches past the latest found
+ * record. An unknown kind defers (fail toward not writing a wrong record).
+ *
+ * Fail direction (BV-004): a gap missing either bound, or a session with no
+ * dated record, is NOT counted — an unbounded gap would intersect every later
+ * session and recreate the defer-forever bug. Such a candidate is written as
+ * before #1512, its unread start listed in `_backfill_incomplete_fields`.
+ * Likewise a gap that ate the session's START lies just before the earliest
+ * found record and stays outside the window — same incomplete-start answer.
+ * Symmetrically a gap that starts AFTER the newest found record (it ate the
+ * session's END) is not counted either, so a `shape_resolved` or stop event
+ * lost there goes unnamed in `lostFields`; revisit if a backfilled record's
+ * `completed_at` is later contradicted by a recovered archive.
+ * Ceiling: an `unindexed-archive` nobody renames back defers its candidate on
+ * every run, visibly. Revisit if tombstones without `first_ts`/`last_ts` still
+ * appear in ledgers, or if `skipped-history-unread` persists across many runs.
+ *
+ * @param {Array<{kind?: string, first_ts?: string|null, last_ts?: string|null}>|undefined} gaps
+ * @param {Array<object>} records
+ * @returns {{defer: boolean, lostFields: string[]}}
+ */
+function windowGapVerdict(gaps, records) {
+  const none = { defer: false, lostFields: [] };
+  if (!Array.isArray(gaps) || gaps.length === 0) return none;
+  let lo = Infinity;
+  let hi = -Infinity;
+  for (const r of records) {
+    const ts = typeof r?.timestamp === 'string' ? Date.parse(r.timestamp) : NaN;
+    if (Number.isNaN(ts)) continue;
+    lo = Math.min(lo, ts);
+    hi = Math.max(hi, ts);
+  }
+  if (lo > hi) return none;
+  const lost = new Set();
+  for (const g of gaps) {
+    const first = typeof g?.first_ts === 'string' ? Date.parse(g.first_ts) : NaN;
+    const last = typeof g?.last_ts === 'string' ? Date.parse(g.last_ts) : NaN;
+    if (Number.isNaN(first) || Number.isNaN(last)) continue;
+    if (!(first <= hi && last >= lo)) continue;
+    if (g.kind !== 'missing-archive') return { defer: true, lostFields: [] };
+    lost.add('session_type');
+    lost.add('session_profile'); // same latest-wins `shape_resolved` record
+    if (last > hi) lost.add('completed_at');
+  }
+  return { defer: false, lostFields: [...lost] };
 }
 
 /**
@@ -414,19 +477,21 @@ function recordsMentioning(eventsPath, id, deadlineMs) {
  * @param {string} eventsPath
  * @param {{ sessionId: string|null, semanticSessionId: string|null }} ids
  * @param {number|null} [deadlineMs=null] — shared scan deadline (epoch ms); `null` = unbounded
- * @returns {ReturnType<typeof collectSessionEvents> & { historyUnread?: true }}
+ * @returns {ReturnType<typeof collectSessionEvents> & { historyUnread?: true, historyLostFields?: string[] }}
  */
 function gatherSessionEvents(readFileSync, eventsPath, ids, deadlineMs = null) {
   const gathered = collectSessionEvents(readJsonlSafe(readFileSync, eventsPath), ids);
   if (gathered.startedAt !== null) return gathered;
   try {
     let uuid = isUuid(ids.sessionId) ? ids.sessionId : null;
+    let bridgeLost = [];
     if (uuid === null) {
       const label = ids.semanticSessionId || ids.sessionId;
       if (!label) return gathered;
       const bridge = recordsMentioning(eventsPath, label, deadlineMs);
       if (bridge === null) return { ...gathered, historyUnread: true };
-      const bridged = collectSessionEvents(bridge, ids).uuids;
+      bridgeLost = bridge.lostFields;
+      const bridged = collectSessionEvents(bridge.records, ids).uuids;
       if (bridged.size !== 1) return gathered;
       [uuid] = bridged;
     }
@@ -434,7 +499,12 @@ function gatherSessionEvents(readFileSync, eventsPath, ids, deadlineMs = null) {
     if (history === null) return { ...gathered, historyUnread: true };
     // Empty only when the scan found no source at all — e.g. a reader seam the
     // filesystem does not back; the active answer stands.
-    return history.length > 0 ? collectSessionEvents(history, ids) : gathered;
+    if (history.records.length === 0) return gathered;
+    const collected = collectSessionEvents(history.records, ids);
+    // #1512: a permanently pruned archive inside the window — written, with
+    // what it may have held named instead of deferring forever.
+    const lostFields = [...new Set([...bridgeLost, ...history.lostFields])];
+    return lostFields.length > 0 ? { ...collected, historyLostFields: lostFields } : collected;
   } catch {
     return gathered;
   }
@@ -559,6 +629,9 @@ function synthesizeRecord({ recordId, synthetic, gathered, nowMs, status = 'aban
   // no terminal event was found, so mark it incomplete so downstream duration
   // consumers can tell an events-attested end apart from an estimate (#914 R1).
   if (completedEstimated) incomplete.push('completed_at');
+  // #1512: fields a permanently pruned archive inside the session window may
+  // have held (`windowGapVerdict`), named rather than deferring forever.
+  for (const f of gathered.historyLostFields ?? []) if (!incomplete.includes(f)) incomplete.push(f);
 
   const record = {
     session_id: recordId,

package/scripts/validate-wave-scope.mjs

@@ -10,6 +10,7 @@
  *   cat wave-scope.json | node scripts/validate-wave-scope.mjs
  *   node scripts/validate-wave-scope.mjs --assert-subset <agent-filescope.json> < wave-scope.json
  *   node scripts/validate-wave-scope.mjs --assert-disjoint <agent-scopes.json> < wave-scope.json
+ *   node scripts/validate-wave-scope.mjs --assert-disjoint <agent-scopes.json> --no-manifest
  *   node scripts/validate-wave-scope.mjs --union <agent-scopes.json> < wave-scope.json
  *
  * Flags:
@@ -38,6 +39,17 @@
  *                           Runs even when the manifest fails schema validation
  *                           (#1026.4): it reads only the sidecar, so schema
  *                           errors and collisions are reported together (exit 1).
+ *   --no-manifest           #1510 f. With --assert-disjoint ONLY: check the
+ *                           sidecar alone and read NO manifest (no stdin, no
+ *                           positional file) — `/plan` checks disjointness
+ *                           before any wave-scope.json exists and had to pipe
+ *                           a fabricated dummy. Stdout stays EMPTY (there is no
+ *                           manifest to echo); exit 0 = disjoint, 1 = collision.
+ *                           An explicit flag, never inferred from empty stdin:
+ *                           WITHOUT it, empty/missing stdin stays an error
+ *                           (fail-closed, #1083 class). Rejected (exit 1) with
+ *                           --union / --assert-subset / --expand-test-siblings
+ *                           or a positional path — those need a manifest.
  *   --union <path>          #1020. QUERY MODE. Read the same sidecar, compute
  *                           `expandTestSiblings(unionFileScopes(scopes), {role})`
  *                           using the MANIFEST'S OWN `role`, and print the
@@ -161,7 +173,8 @@ function flagValue(argv, i, flag) {
  *
  * @param {string[]} argv - full process.argv
  * @returns {{ assertSubset: string|null, expandTestSiblings: boolean,
- *             assertDisjoint: string|null, union: string|null, positionals: string[] }}
+ *             assertDisjoint: string|null, union: string|null, noManifest: boolean,
+ *             positionals: string[] }}
  */
 function parseArgs(argv) {
   const positionals = [];
@@ -169,6 +182,7 @@ function parseArgs(argv) {
   let expandTestSiblings = false;
   let assertDisjoint = null;
   let union = null;
+  let noManifest = false;
   for (let i = 2; i < argv.length; i++) {
     const a = argv[i];
     if (a === '--expand-test-siblings') {
@@ -185,11 +199,27 @@ function parseArgs(argv) {
     } else if (a === '--union') {
       union = flagValue(argv, i, '--union');
       i++; // consume the value
+    } else if (a === '--no-manifest') {
+      noManifest = true;
     } else {
       positionals.push(a);
     }
   }
-  return { assertSubset, expandTestSiblings, assertDisjoint, union, positionals };
+  if (noManifest) {
+    // #1510 f — every other mode reads the MANIFEST (`role`, `allowedPaths`), so
+    // combining it with "there is no manifest" is a contradiction, not a no-op.
+    if (assertDisjoint === null) die('--no-manifest requires --assert-disjoint <agent-scopes.json>', 1);
+    const needsManifest = [
+      union !== null && '--union',
+      assertSubset !== null && '--assert-subset',
+      expandTestSiblings && '--expand-test-siblings',
+      positionals.length > 0 && `a wave-scope.json path (${positionals[0]})`,
+    ].filter(Boolean);
+    if (needsManifest.length > 0) {
+      die(`--no-manifest cannot be combined with ${needsManifest.join(', ')}: that mode reads the manifest`, 1);
+    }
+  }
+  return { assertSubset, expandTestSiblings, assertDisjoint, union, noManifest, positionals };
 }
 
 /**
@@ -755,7 +785,12 @@ function validate(
   process.stdout.write(input.endsWith('\n') ? input : input + '\n');
 }
 
-const { assertSubset, expandTestSiblings, assertDisjoint, union, positionals } = parseArgs(
+const { assertSubset, expandTestSiblings, assertDisjoint, union, noManifest, positionals } = parseArgs(
   process.argv,
 );
-validate(readInput(positionals[0]), assertSubset, expandTestSiblings, assertDisjoint, union);
+if (noManifest) {
+  // #1510 f — sidecar-only: stdin is never read, so no dummy manifest is needed.
+  assertDisjointOrDie(assertDisjoint);
+} else {
+  validate(readInput(positionals[0]), assertSubset, expandTestSiblings, assertDisjoint, union);
+}

package/skills/_shared/parallel-aware-auq.md

@@ -113,7 +113,7 @@ In-place beside a peer is survivable when the two scopes are DECLARED to each ot
 Four steps, in order. Steps 1 and 2 are the protocol; 3 and 4 are what keeps it honest.
 
 1. **Declare the COMPLETE path list.** The arriving session sends the peer every path it will write — including the ones a script produces (fixtures, snapshots, result files, temp helpers), not only the ones it plans to edit by hand. A path omitted here is a path the peer's guard reports as a violation. In the same message it adopts the peer's resource rules.
-2. **The peer unions.** The receiving coordinator adds those paths to its `allowedPaths` as ONE record `peer-session-<id>` in the wave's scope manifest, re-asserts subset/disjointness, and re-materializes them on every wave rollover (`skills/wave-executor/wave-loop.md` § Scope Manifest).
+2. **The peer unions.** The receiving coordinator adds those paths to its `allowedPaths` as ONE record `peer-session-<id>` in the wave's scope manifest, re-asserts subset/disjointness, and re-materializes them on every wave rollover (`skills/wave-executor/wave-loop.md` § Scope Manifest). Mid-wave, re-run the FULL sequence of `skills/wave-executor/references/wave-loop-scope-manifest.md` § 3, including § 3.3's skeleton write (`"allowedPaths": []`) before the final manifest: `--union` excludes `peer-session-*` records, so re-materializing the sidecar alone leaves the manifest bytes unchanged, `bash-write-verify` keeps the sidecar bound to the OLD hash, and every agreed peer write then reports as a violation for the rest of the wave (#1504 point 5). The skeleton rewrite changes the manifest hash, which re-binds the new sidecar.
 3. **Probe with ONE real write.** Before dispatching any agent, make one small PLANNED Edit from the declared list. A denial here costs one edit; the same denial found after a fan-out costs the wave.
 4. **Announce before committing.** The arriving session sends its final file list, the peer sequences its own push behind it, and the SHAs come back. The git index is shared (PSA-007) — sequencing it is the only thing that makes two sessions in one checkout committable.
 

package/skills/wave-executor/references/wave-loop-scope-manifest.md

@@ -100,7 +100,7 @@ Before each wave dispatch:
      --assert-disjoint "$WAVE_SCOPES_SIDECAR" < <state-dir>/wave-scope.json
    ```
 
-   Exit 1 (one stderr message per collision) means two agents were handed the same file: fix the session plan, re-materialize, re-assert. Never widen the union to make it pass. This runs **before** 3.3 because a union computed over colliding scopes launders the defect into the very artefact meant to prevent it — `allowedPaths` then grants the file and every later gate sees a legal write.
+   Exit 1 (one stderr message per collision) means two agents were handed the same file: fix the session plan, re-materialize, re-assert. Where no manifest exists yet (`/plan` checking a draft), pass `--no-manifest` instead of piping a fabricated one — it checks the sidecar alone, and is rejected together with `--union` / `--assert-subset` (#1510 f). Never widen the union to make it pass. This runs **before** 3.3 because a union computed over colliding scopes launders the defect into the very artefact meant to prevent it — `allowedPaths` then grants the file and every later gate sees a legal write.
 
    **3.3 — compute the union.** `--union` is a QUERY MODE that still requires a schema-valid manifest on stdin, so write the skeleton first with `"allowedPaths": []`, then: