session-orchestrator 5.5.0 → 5.7.0

package/scripts/lib/memory-proposals/store.mjs

@@ -413,7 +413,10 @@ export async function appendProposal({
  * Reads proposals.jsonl without acquiring the lock — suitable for diagnostics
  * and reads where eventual consistency is acceptable.
  *
- * Returns 0 when the file does not exist.
+ * Returns 0 when the file does not exist (silently — `countWaveLines` maps
+ * ENOENT to 0). Any other read failure also returns 0, but with a stderr WARN
+ * so a 0 caused by an unreadable file is distinguishable from an empty queue
+ * (#1216).
  *
  * @param {object} opts
  * @param {string} opts.repoRoot
@@ -424,7 +427,11 @@ export async function countProposalsForWave({ repoRoot, waveId }) {
   const jsonlPath = jsonlPathFor(repoRoot);
   try {
     return countWaveLines(jsonlPath, waveId);
-  } catch {
+  } catch (err) {
+    process.stderr.write(
+      `[memory-proposals] WARN: countProposalsForWave: ` +
+        `${err?.code ?? '?'}: ${err?.message ?? String(err)} — returning 0\n`,
+    );
     return 0;
   }
 }

package/scripts/lib/reconcile/rule-expiry-sweep.mjs

@@ -590,6 +590,58 @@ export async function planRuleExpirySweep(opts = {}) {
     const advisory = headerAdvisory(parsed, expiryById);
     const raiseTo = headerRaiseTarget(parsed, expiryById);
 
+    if (
+      parsed.counterLine === -1 &&
+      parsed.entries.length === 0 &&
+      parsed.pairs.length === 1 &&
+      substantive.length === 1 &&
+      parsed.expiresAt !== null &&
+      Number.isFinite(Date.parse(parsed.expiresAt))
+    ) {
+      // SINGLE-ENTRY file (#1513): one learning, one pair, no `### ` entries,
+      // no counter sentence — the shape the reconciliation engine writes per
+      // learning in consumer repos (measured 2026-10-03: all 21 generated rules
+      // of the Meta-Vault). The fail-closed branch below skipped every one of
+      // them as `no-counter-sentence`, so they stayed on disk forever after
+      // expiry. Here the date is unambiguous — the file's own frontmatter
+      // `expires-at`, the one `rule-loader.mjs` acts on — and there is no
+      // body sentence to keep in agreement. The later of that date and the
+      // learning's store `expires_at` (when it resolves) decides, so a
+      // re-stamped learning never loses its rule. Expired → the same `delete`
+      // as a fully expired consolidated file: the pair is stamped terminal
+      // before the unlink, so `/reconcile` does not re-propose it.
+      const pair = substantive[0];
+      const storeAt = expiryById.has(pair.id) ? Date.parse(expiryById.get(pair.id)) : Number.NaN;
+      const fileAt = Date.parse(parsed.expiresAt);
+      const effectiveAt = Number.isFinite(storeAt) ? Math.max(storeAt, fileAt) : fileAt;
+      const base = {
+        file: rule.file,
+        expiredPairIds: [],
+        keptPairIds: [pair.id],
+        unresolvedPairIds: expiryById.has(pair.id) ? [] : [pair.id],
+        bytesBefore: Buffer.byteLength(content, 'utf8'),
+        headings: 0,
+        substantivePairs: 1,
+      };
+      if (effectiveAt < cutoffMs) {
+        plans.push({
+          ...base,
+          expiredPairIds: [pair.id],
+          keptPairIds: [],
+          unresolvedPairIds: [],
+          action: 'delete',
+          reason: 'single-entry-expired',
+          newExpiresAt: null,
+          newAbsorbedCount: 0,
+          bytesAfter: 0,
+          stampKeys: [pair.key],
+        });
+      } else {
+        plans.push({ ...base, action: 'keep', newExpiresAt: null, newAbsorbedCount: 1, bytesAfter: base.bytesBefore });
+      }
+      continue;
+    }
+
     if (parsed.counterLine === -1) {
       // FAIL-CLOSED (GH#70). Every write this module performs moves the
       // frontmatter `expires-at` AND the body sentence that restates it. When

package/scripts/lib/scope-gate.mjs

@@ -1295,10 +1295,17 @@ function normalizeAgentScopes(agentScopes) {
  * NAMED CEILING: `..` segments are left alone — `a/../b` is not provably `b`
  * when `a` is a glob segment. Revisit if a plan ever declares a `..` entry.
  *
+ * EXPORTED as the ONE spelling rule (#1510 g): `hooks/pre-task-scope-disjoint.mjs`
+ * applies it (late-bound) before its own dedupe and dir-promotion, instead of a
+ * hand-copied twin that had already drifted (`a/././b` kept a `./` segment).
+ * Whitespace is NOT trimmed here: no writer of a scope entry produces padding
+ * (the hook's prose cleaner trims before this rule runs; sidecar entries are
+ * JSON strings the plan writes), and trimming would rewrite a declared path.
+ *
  * @param {string} entry - a non-empty scope entry
  * @returns {string}
  */
-function scopeEntrySpelling(entry) {
+export function scopeEntrySpelling(entry) {
   const spelled = entry.replace(/\/{2,}/g, '/').replace(/(^|\/)(?:\.\/)+/g, '$1');
   // `./` alone would spell as '' — keep the entry rather than invent a meaning.
   return spelled.length > 0 ? spelled : entry;

package/scripts/lib/session-close-backfill.mjs

@@ -118,6 +118,22 @@ const EVENTS_REL = ['.orchestrator', 'metrics', 'events.jsonl'];
 const SESSIONS_REL = ['.orchestrator', 'metrics', 'sessions.jsonl'];
 const BACKFILL_LOG_REL = ['.orchestrator', 'metrics', 'session-close-backfill.log'];
 
+/**
+ * Which outcomes reach the side-log (#1513). Only EVENTS — `backfilled`,
+ * `would-backfill`, `error` and any other non-skip action — are written; every
+ * `skipped-*` outcome is the steady state of a session close and stays out.
+ * Measured in the Meta-Vault 2026-10-03: 5.786 lines / 723 KB, 86 %
+ * `skipped-already-recorded`, one commit-worthy diff per close. The skips lose
+ * nothing: on-session-end emits every outcome, skips included, as a queryable
+ * event (#1068 AC2), and an injected `log` callback still receives them all.
+ *
+ * @param {unknown} action
+ * @returns {boolean}
+ */
+export function isLoggedBackfillAction(action) {
+  return typeof action === 'string' && !action.startsWith('skipped-');
+}
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -348,8 +364,11 @@ export const REQUIRED_EVENTS_WINDOW_DAYS = null;
  * @param {string} eventsPath
  * @param {string} id
  * @param {number|null} deadlineMs — epoch ms the scan must end by; `null` = unbounded
- * @returns {Array<object>|null} `null` when the deadline had passed before the
- *   scan or cut it short — a partial history is never handed on as a whole one.
+ * @returns {{records: Array<object>, lostFields: string[]}|null} `null` when the
+ *   deadline had passed before the scan or cut it short, or a recoverable cut
+ *   lies in the session's window — a partial history is never handed on as a
+ *   whole one. `lostFields` names the record fields a PERMANENTLY pruned archive
+ *   inside the window may have changed (see {@link windowGapVerdict}).
  */
 function recordsMentioning(eventsPath, id, deadlineMs) {
   let budgetMs;
@@ -358,7 +377,7 @@ function recordsMentioning(eventsPath, id, deadlineMs) {
     if (!(budgetMs > 0)) return null;
   }
   const newestFirst = [];
-  const { truncated, unreadable } = scanEventsBackwards({
+  const { truncated, unreadable, gaps } = scanEventsBackwards({
     filePath: eventsPath,
     filter: id,
     budgetMs,
@@ -371,13 +390,73 @@ function recordsMentioning(eventsPath, id, deadlineMs) {
   // deadline does — its records are simply absent — so it defers the candidate
   // the same way. Ceiling (BV-004): a PERMANENTLY unreadable archive defers its
   // candidates on every run (`skipped-history-unread`, visible, never a record
-  // dated NOW). `gaps` (pruned/unindexed archives) are deliberately NOT treated
-  // so: the walk reports every gap of the whole ledger, mostly far older than
-  // the candidate, and deferring on any of them would skip the candidate
-  // forever — telling a gap inside the session's window apart needs its
-  // first_ts/last_ts against the session's range, a follow-up.
-  const cut = truncated || (Array.isArray(unreadable) && unreadable.length > 0);
-  return cut ? null : newestFirst.reverse();
+  // dated NOW).
+  if (truncated || (Array.isArray(unreadable) && unreadable.length > 0)) return null;
+  const verdict = windowGapVerdict(gaps, newestFirst);
+  if (verdict.defer) return null;
+  return { records: newestFirst.reverse(), lostFields: verdict.lostFields };
+}
+
+/**
+ * What a pruned/unindexed archive (`gaps` of {@link scanEventsBackwards}) means
+ * for the session whose found records are `records` (#1512).
+ *
+ * The walk reports every gap of the WHOLE ledger, mostly far older than the
+ * candidate; deferring on any of them would skip the candidate forever. So a
+ * gap counts only when its `[first_ts, last_ts]` intersects the session's
+ * window `[earliest, latest]` timestamp of the records the walk found.
+ *
+ * A counted gap's KIND then decides. `unindexed-archive` — the file still sits
+ * in `_archive/` under a name the walk does not index — can resolve (a rename
+ * puts it back), so it DEFERS (`skipped-history-unread`). `missing-archive` —
+ * pruned, its bytes gone — never resolves, so deferring would skip the candidate
+ * on every run forever; the record is written instead, naming in `lostFields`
+ * what the lost span may have held: `session_type` and `session_profile` (the
+ * LAST `shape_resolved` decides both) always, `completed_at` when the gap reaches past the latest found
+ * record. An unknown kind defers (fail toward not writing a wrong record).
+ *
+ * Fail direction (BV-004): a gap missing either bound, or a session with no
+ * dated record, is NOT counted — an unbounded gap would intersect every later
+ * session and recreate the defer-forever bug. Such a candidate is written as
+ * before #1512, its unread start listed in `_backfill_incomplete_fields`.
+ * Likewise a gap that ate the session's START lies just before the earliest
+ * found record and stays outside the window — same incomplete-start answer.
+ * Symmetrically a gap that starts AFTER the newest found record (it ate the
+ * session's END) is not counted either, so a `shape_resolved` or stop event
+ * lost there goes unnamed in `lostFields`; revisit if a backfilled record's
+ * `completed_at` is later contradicted by a recovered archive.
+ * Ceiling: an `unindexed-archive` nobody renames back defers its candidate on
+ * every run, visibly. Revisit if tombstones without `first_ts`/`last_ts` still
+ * appear in ledgers, or if `skipped-history-unread` persists across many runs.
+ *
+ * @param {Array<{kind?: string, first_ts?: string|null, last_ts?: string|null}>|undefined} gaps
+ * @param {Array<object>} records
+ * @returns {{defer: boolean, lostFields: string[]}}
+ */
+function windowGapVerdict(gaps, records) {
+  const none = { defer: false, lostFields: [] };
+  if (!Array.isArray(gaps) || gaps.length === 0) return none;
+  let lo = Infinity;
+  let hi = -Infinity;
+  for (const r of records) {
+    const ts = typeof r?.timestamp === 'string' ? Date.parse(r.timestamp) : NaN;
+    if (Number.isNaN(ts)) continue;
+    lo = Math.min(lo, ts);
+    hi = Math.max(hi, ts);
+  }
+  if (lo > hi) return none;
+  const lost = new Set();
+  for (const g of gaps) {
+    const first = typeof g?.first_ts === 'string' ? Date.parse(g.first_ts) : NaN;
+    const last = typeof g?.last_ts === 'string' ? Date.parse(g.last_ts) : NaN;
+    if (Number.isNaN(first) || Number.isNaN(last)) continue;
+    if (!(first <= hi && last >= lo)) continue;
+    if (g.kind !== 'missing-archive') return { defer: true, lostFields: [] };
+    lost.add('session_type');
+    lost.add('session_profile'); // same latest-wins `shape_resolved` record
+    if (last > hi) lost.add('completed_at');
+  }
+  return { defer: false, lostFields: [...lost] };
 }
 
 /**
@@ -414,19 +493,21 @@ function recordsMentioning(eventsPath, id, deadlineMs) {
  * @param {string} eventsPath
  * @param {{ sessionId: string|null, semanticSessionId: string|null }} ids
  * @param {number|null} [deadlineMs=null] — shared scan deadline (epoch ms); `null` = unbounded
- * @returns {ReturnType<typeof collectSessionEvents> & { historyUnread?: true }}
+ * @returns {ReturnType<typeof collectSessionEvents> & { historyUnread?: true, historyLostFields?: string[] }}
  */
 function gatherSessionEvents(readFileSync, eventsPath, ids, deadlineMs = null) {
   const gathered = collectSessionEvents(readJsonlSafe(readFileSync, eventsPath), ids);
   if (gathered.startedAt !== null) return gathered;
   try {
     let uuid = isUuid(ids.sessionId) ? ids.sessionId : null;
+    let bridgeLost = [];
     if (uuid === null) {
       const label = ids.semanticSessionId || ids.sessionId;
       if (!label) return gathered;
       const bridge = recordsMentioning(eventsPath, label, deadlineMs);
       if (bridge === null) return { ...gathered, historyUnread: true };
-      const bridged = collectSessionEvents(bridge, ids).uuids;
+      bridgeLost = bridge.lostFields;
+      const bridged = collectSessionEvents(bridge.records, ids).uuids;
       if (bridged.size !== 1) return gathered;
       [uuid] = bridged;
     }
@@ -434,7 +515,12 @@ function gatherSessionEvents(readFileSync, eventsPath, ids, deadlineMs = null) {
     if (history === null) return { ...gathered, historyUnread: true };
     // Empty only when the scan found no source at all — e.g. a reader seam the
     // filesystem does not back; the active answer stands.
-    return history.length > 0 ? collectSessionEvents(history, ids) : gathered;
+    if (history.records.length === 0) return gathered;
+    const collected = collectSessionEvents(history.records, ids);
+    // #1512: a permanently pruned archive inside the window — written, with
+    // what it may have held named instead of deferring forever.
+    const lostFields = [...new Set([...bridgeLost, ...history.lostFields])];
+    return lostFields.length > 0 ? { ...collected, historyLostFields: lostFields } : collected;
   } catch {
     return gathered;
   }
@@ -559,6 +645,9 @@ function synthesizeRecord({ recordId, synthetic, gathered, nowMs, status = 'aban
   // no terminal event was found, so mark it incomplete so downstream duration
   // consumers can tell an events-attested end apart from an estimate (#914 R1).
   if (completedEstimated) incomplete.push('completed_at');
+  // #1512: fields a permanently pruned archive inside the session window may
+  // have held (`windowGapVerdict`), named rather than deferring forever.
+  for (const f of gathered.historyLostFields ?? []) if (!incomplete.includes(f)) incomplete.push(f);
 
   const record = {
     session_id: recordId,
@@ -1096,6 +1185,7 @@ export async function backfillAbandonedSession({
         return;
       }
       if (typeof repoRoot !== 'string' || repoRoot.length === 0) return;
+      if (!isLoggedBackfillAction(res.action)) return;
       const logPath = path.join(repoRoot, ...BACKFILL_LOG_REL);
       fs.mkdirSync(path.dirname(logPath), { recursive: true });
       fs.appendFileSync(
@@ -1359,6 +1449,7 @@ export async function backfillCompletedFromStateMd({
         return;
       }
       if (typeof repoRoot !== 'string' || repoRoot.length === 0) return;
+      if (!isLoggedBackfillAction(res.action)) return;
       const logPath = path.join(repoRoot, ...BACKFILL_LOG_REL);
       fs.mkdirSync(path.dirname(logPath), { recursive: true });
       fs.appendFileSync(

package/scripts/lib/validate/check-test-value-bans.mjs

@@ -406,6 +406,15 @@ const SEAM_CLOCK_ARG = new RegExp(`${CLOCK_NAME}:`);
  * `{ now }` or a positional `now` loses its seam proof and its bombs go unseen.
  * REVISIT on the first B5 finding whose subject is a helper, or the first CI
  * `test-value-bans` B5 finding the ±days clock-shift probe shows to be false.
+ *
+ * CEILING (#1507 item 3) — three known blind spots of the SCREAMING_CASE forms,
+ * left deliberately: (a) a bare `NOW)` / `NOW,` counts as a handover, whatever
+ * the constant holds; (b) arithmetic on a collected clock (`NOW - DAY`) is NOT
+ * seen as a handover, the terminator follows the operand, not the name; (c) an
+ * IMPORTED clock constant is not checked for provenance — `NOW` from a helper
+ * module that holds `Date.now()` reads as controlled. Measured impact
+ * 2026-10-03: 0 changed findings over 722 test files.
+ * REVISIT on the first B5 miss or false finding traced to (a), (b) or (c).
  */
 const CONTROL_CLOCK_ARG = new RegExp(String.raw`${CLOCK_NAME}(:|,|\}|\))`, 'g');