session-orchestrator 5.8.0 → 5.10.0

package/scripts/lib/vault-backfill/template.mjs

@@ -173,7 +173,7 @@ export function renderTemplate({ humanName, slug, tier, gitlabPath, owner }, tem
 
   // owner field — value comes from GitLab API (externally controlled).
   // Use yamlScalar() to produce a quoted scalar, preventing newline injection (CWE-1336, #247).
-  // The template has a bare unquoted owner value (e.g. `owner: bernhard`);
+  // The template has a bare unquoted owner value (e.g. `owner: example-owner`);
   // the regex replaces only the bare value token, preserving any trailing comment.
   out = out.replace(/^(\s*owner:\s*)\S+(.*)$/m, `$1${yamlScalar(owner)}$2`);
 

package/scripts/lib/vault-mirror/render-sessions.mjs

@@ -16,6 +16,7 @@
  */
 
 import { toDate, buildTag, slugifyIdSafe } from './utils.mjs';
+import { stableHostname } from '../host-identity.mjs';
 import { sourceRecordValue, sourceRecordLine } from './render-learnings.mjs';
 import { sessionNarrativeText } from './retention.mjs';
 
@@ -275,6 +276,17 @@ export function vaultStatusForSession(entry) {
     : VAULT_STATUS_FALLBACK;
 }
 
+/**
+ * Recorded identity only: never infer the writer's machine for historical notes.
+ * Hardware class is a fallback, and cannot distinguish equally equipped hosts.
+ */
+function sessionHostLine(entry) {
+  const recorded = [entry?.host_id, entry?.host, entry?.host_class]
+    .find((value) => typeof value === 'string' && value.trim() !== '');
+  if (recorded === undefined) return '';
+  return `host: ${JSON.stringify(stableHostname(recorded))}\n`;
+}
+
 /**
  * Frontmatter line emitter — skips emission when value is null/undefined/empty
  * to avoid template-literal coercion bugs (e.g. `platform: undefined` → "undefined").
@@ -549,7 +561,7 @@ status: ${vaultStatus}
 created: ${created}
 updated: ${updated}
 tags: ${tags}
-${fmLine('source-repo', repoNs)}${sourceRecordLine(sessionSourceRecord(entry))}_generator: ${GENERATOR_MARKER}
+${sessionHostLine(entry)}${fmLine('source-repo', repoNs)}${sourceRecordLine(sessionSourceRecord(entry))}_generator: ${GENERATOR_MARKER}
 ---
 
 # Session ${session_id}
@@ -636,7 +648,7 @@ status: ${vaultStatus}
 created: ${created}
 updated: ${updated}
 tags: ${tags}
-${fmLine('source-repo', repoNs)}${sourceRecordLine(sessionSourceRecord(entry))}_generator: ${GENERATOR_MARKER}
+${sessionHostLine(entry)}${fmLine('source-repo', repoNs)}${sourceRecordLine(sessionSourceRecord(entry))}_generator: ${GENERATOR_MARKER}
 ---
 
 # Session ${session_id}
@@ -763,7 +775,7 @@ status: ${vaultStatus}
 created: ${created}
 updated: ${updated}
 tags: ${tags}
-${fmLine('source-repo', repoNs)}${sourceRecordLine(sessionSourceRecord(entry))}_generator: ${GENERATOR_MARKER}
+${sessionHostLine(entry)}${fmLine('source-repo', repoNs)}${sourceRecordLine(sessionSourceRecord(entry))}_generator: ${GENERATOR_MARKER}
 ---
 
 # Session ${session_id}

package/scripts/lib/vault-status/board-writer.mjs

@@ -54,6 +54,7 @@ import path from 'node:path';
 
 import { emitEvent, sessionAttribution } from '../events.mjs';
 import { isLockLive, readLock, DEFAULT_TTL_HOURS } from '../session-lock.mjs';
+import { stableHostname } from '../host-identity.mjs';
 import { readRegistry, repoPathHash, isRegistryEntryFresh } from '../session-registry.mjs';
 import { parseFrontmatter } from '../vault-mirror/utils.mjs';
 import { readConfigFile, parseSessionConfig } from '../config.mjs';
@@ -351,6 +352,10 @@ export async function collectRows({ repos, now = new Date(), registry, priorStat
     const semanticFromRegistry = registryEntry
       ? (registryEntry.semantic_session_id ?? registryEntry.session_id ?? null)
       : null;
+    // Hardware class is only a fallback; it cannot distinguish identical machines.
+    const recordedHost = [lock?.host_id, lock?.host, registryEntry?.host_id, registryEntry?.host, registryEntry?.host_class]
+      .find((value) => typeof value === 'string' && value.trim() !== '');
+    const host = recordedHost === undefined ? null : stableHostname(recordedHost);
     const session = semanticFromLock ?? semanticFromRegistry ?? null;
 
     // branch ONLY exists on the registry entry — the lock has no branch field.
@@ -435,6 +440,7 @@ export async function collectRows({ repos, now = new Date(), registry, priorStat
       branch: status === STATUS_FREI ? null : branch,
       mode: status === STATUS_FREI ? null : mode,
       heartbeat: status === STATUS_FREI ? null : heartbeat,
+      host: status === STATUS_FREI ? null : host,
     });
   }
 
@@ -458,7 +464,7 @@ export async function collectRows({ repos, now = new Date(), registry, priorStat
  *
  * @param {Array<{ repo: string, key?: string|null, status: string,
  *   session?: string|null, branch?: string|null, mode?: string|null,
- *   heartbeat?: string|null }>} rows
+ *   heartbeat?: string|null, host?: string|null }>} rows
  * @param {{ now: Date, createdIso?: string, updatedPlaceholder?: string }} opts
  * @returns {string} full markdown (frontmatter + table)
  */
@@ -495,13 +501,13 @@ export function renderBoard(rows, opts = {}) {
   lines.push('');
 
   // Board table
-  lines.push('| Repo | Status | Session | Branch | Mode | Last heartbeat | Key |');
-  lines.push('|---|---|---|---|---|---|---|');
+  lines.push('| Repo | Status | Session | Branch | Mode | Last heartbeat | Key | Host |');
+  lines.push('|---|---|---|---|---|---|---|---|');
   for (const row of sortedRows) {
     lines.push(
       `| ${cell(row?.repo)} | ${cell(row?.status)} | ${cell(row?.session)} | ` +
       `${cell(row?.branch)} | ${cell(row?.mode)} | ${cell(fmtHeartbeat(row?.heartbeat))} | ` +
-      `${cell(row?.key)} |`,
+      `${cell(row?.key)} | ${row?.host ? cell(row.host) : ''} |`,
     );
   }
   lines.push('');
@@ -528,9 +534,10 @@ export function normalizeUpdated(content) {
  * (status carry-over + row preservation for repos not in the current update).
  *
  * Tolerant by design: skips the header + separator rows, ignores any line that
- * is not a 6- or 7-column table row, and maps the literal '—' placeholder back
+ * is not a 6-, 7- or 8-column table row, and maps the literal '—' placeholder back
  * to null. Unescapes the `\|` pipe-escaping applied by {@link renderBoard}.
  *
+ * Host is appended as column 8 (#1054); older rows retain a null host.
  * SIX **or** seven columns (#871): the pre-#871 board rendered 6. A hard
  * `length !== 7` filter would silently DROP every row on an operator's existing
  * board on the first run after upgrade — the board would appear to reset. A
@@ -553,7 +560,7 @@ export function parseBoardRows(content) {
       .split(/(?<!\\)\|/)
       .slice(1, -1)
       .map((c) => c.trim());
-    if (cells.length !== 6 && cells.length !== 7) continue;
+    if (cells.length !== 6 && cells.length !== 7 && cells.length !== 8) continue;
     // Skip the header row and the |---|---| separator row.
     if (cells[0] === 'Repo' || /^-+$/.test(cells[0])) continue;
     const unesc = (v) => (v === '—' ? null : v.replace(/\\\|/g, '|'));
@@ -561,12 +568,13 @@ export function parseBoardRows(content) {
     if (repo === null) continue;
     rows.push({
       repo,
-      key: cells.length === 7 ? unesc(cells[6]) : null,
+      key: cells.length >= 7 ? unesc(cells[6]) : null,
       status: cells[1],
       session: unesc(cells[2]),
       branch: unesc(cells[3]),
       mode: unesc(cells[4]),
       heartbeat: unesc(cells[5]),
+      host: cells.length === 8 ? (unesc(cells[7]) || null) : null,
     });
   }
   return rows;

package/scripts/lib/wave-executor/remote-dispatch.mjs

@@ -412,6 +412,11 @@ export async function dispatchRemote(
  * `Ferdinands-Macbook-2 ready=yes · load 14.23 · mem free 96% · headless: slots
  * none, keychain-route ok · 9 jobs · claude procs 12`
  *
+ * New doctor lines split `gate-ready` and `headless-ready`; only the latter
+ * authorizes Claude dispatch. Legacy `ready` remains accepted without new markers.
+ * `load` also holds the new `load5 (5 min)` reading; `memFreePct` holds free
+ * (Darwin) or available (Linux) percent. No live new-format measurement is implied.
+ *
  * Every metric is `null` when its segment is absent — never a fabricated `0`,
  * which would read as "measured, idle" for a host that answered nothing.
  * @param {string} raw
@@ -420,19 +425,32 @@ export async function dispatchRemote(
  */
 export function parseDoctorLine(raw) {
   const text = String(raw ?? '');
-  const num = (re) => {
+  // New-format markers suppress the legacy fallback, even if their value or
+  // key boundary is malformed. Conflicting/unknown headless values fail closed.
+  const key = /\b(?:gate-ready|headless-ready)\b/i.test(text) ? 'headless-ready' : 'ready';
+  const values = [...text.matchAll(new RegExp(`(?:^|\\s)${key}=([^\\s]*)`, 'gi'))];
+  const count = (re) => {
     const m = re.exec(text);
     return m ? Number(m[1]) : null;
   };
+  const segments = text.split(/[·\r\n]/).map((segment) => segment.trim());
+  const num = (re, max = Infinity) => {
+    const m = segments.map((segment) => re.exec(segment)).find(Boolean);
+    const value = m ? Number(m[1]) : NaN;
+    return Number.isFinite(value) && value <= max ? value : null;
+  };
   return {
-    // `ready` is the ONLY decision field: anything that is not a literal
-    // `ready=yes` is not-ready, including an unparseable line.
-    ready: /\bready=yes\b/i.test(text),
+    // Claude dispatch uses headless readiness, independently of gate readiness.
+    // Only the old format falls back to an exact, standalone `ready=yes` token.
+    ready: values.length > 0 && values.every((m) => /^yes$/i.test(m[1])),
     raw: text,
-    load: num(/\bload\s+([0-9]+(?:\.[0-9]+)?)/i),
-    memFreePct: num(/\bmem free\s+([0-9]+(?:\.[0-9]+)?)\s*%/i),
-    jobs: num(/\b([0-9]+)\s+jobs?\b/i),
-    claudeProcs: num(/\bclaude procs\s+([0-9]+)/i),
+    load: num(/^load(?:5\s+\(5 min\))?\s+([0-9]+(?:\.[0-9]+)?)$/i),
+    // The existing field holds Darwin free % or Linux available %, never kB.
+    memFreePct:
+      num(/^mem (?:free|available)\s+([0-9]+(?:\.[0-9]+)?)\s*%$/i, 100) ??
+      num(/^mem available\s+[0-9]+\s+kB available\s*\/\s*[0-9]+\s+kB total\s+\(([0-9]+(?:\.[0-9]+)?)% available\)$/i, 100),
+    jobs: count(/\b([0-9]+)\s+jobs?\b/i),
+    claudeProcs: count(/\bclaude procs\s+([0-9]+)/i),
   };
 }
 
@@ -491,7 +509,7 @@ export function remoteDoctor({ host, execFn = execFileSync, timeoutMs = 90_000 }
  * @param {string} alias — declared host alias (`remote-hosts[].alias`).
  * @param {object} [opts]
  * @param {Function} [opts.execFn] — `child_process.execFileSync` seam.
- * @returns {Promise<boolean>} true only on a literal `ready=yes` line.
+ * @returns {Promise<boolean>} true only for headless-ready=yes (legacy ready=yes without new markers).
  */
 export async function remoteReadyProbe(alias, { execFn } = {}) {
   try {

package/scripts/lib/wave-resource-gate.mjs

@@ -134,7 +134,8 @@ async function applyDecisionRules(measurements, opts) {
  * The gate does NOT probe the network — a placement decision must stay a pure
  * function of its inputs. The caller supplies a readiness WITNESS:
  *   - `opts.remoteReady` — `{ [alias]: boolean }`, e.g. built from the
- *     SessionStart `Offload m5: ready=yes` banner or `remoteDoctor()`.
+ *     SessionStart `Offload <alias>: headless-ready=yes` banner (legacy `ready=yes` only
+ *     without new readiness markers) or `remoteDoctor().ready`.
  *   - `opts.probeFn` — `async (alias) => boolean`, consulted only for hosts the
  *     `remoteReady` map does not already answer for. Default `null`. A probeFn
  *     that REJECTS is read as not-ready and its message is appended to

package/scripts/migrate-vault-paths.mjs

@@ -52,6 +52,7 @@ import { promises as fs, existsSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import path from 'node:path';
 import os from 'node:os';
+import { load as loadYaml } from 'js-yaml';
 import {
   loadVaultMigrationRules,
   VAULT_MIGRATION_RULES_PATH,
@@ -59,6 +60,7 @@ import {
 import { parseColumnFlags, CliFlagError } from './lib/cli-flags.mjs';
 import { isMainModule } from './lib/is-main-module.mjs';
 import { atomicWriteText, envelopeToError } from './lib/io.mjs';
+import { loadHostPaths, resolveHostPath } from './lib/config/host-paths.mjs';
 
 // ---------------------------------------------------------------------------
 // Constants
@@ -89,28 +91,9 @@ function _setSegmentsForTest(oldSeg, newSeg) {
 }
 
 // ── Missing-segment class (GitLab #600 D3) ────────────────────────────────────
-// A second, username-independent drift class: a `vault-dir:` value that points at
-// `~/Projects/vault` (or `/Users/<user>/Projects/vault`) — MISSING the canonical
-// `/Bernhard/` owner segment — must become `~/Projects/Bernhard/vault`.
-//
-// Scoping discipline (do NOT blunt-rewrite every `~/Projects/` path):
-//   - Only lines in a `vault-dir:` context (vault-integration.vault-dir /
-//     vault-sync.vault-dir) are touched. `cache: ~/Projects/vault-backups` and
-//     other unrelated `~/Projects/...` paths are left untouched.
-//   - The match anchors the value to `~` or `/Users/<user>` immediately before
-//     `/Projects/vault`, and requires a path boundary AFTER `vault` (negative
-//     lookahead `(?![\w-])`) so `vault-backups` / `vaultfoo` never match.
-//   - Matching `Projects/vault` directly (not `Projects/Bernhard/vault`) yields
-//     idempotency for free: a canonical line has `Projects/Bernhard/vault`, so
-//     the pattern does not match it → no `.../Bernhard/Bernhard/vault`.
-//
-// The owner segment is the canonical `Bernhard`; the rewrite inserts it between
-// `Projects/` and `vault`.
-const MISSING_SEGMENT_OWNER = 'Bernhard';
-
-// Classification label for the missing-/Bernhard/-segment drift class. Referenced
-// in findMissingSegmentHits() (hit record) and the emit() action strings — hoisted
-// here so the literal lives in exactly one place (architect MED #607 D3).
+// Legacy vault-dir values rooted at Projects/vault use an explicit host canonical
+// target. Detection remains narrow; rewriting never guesses a personal segment.
+// Username-owned lines and historical contexts remain separate migration classes.
 const MISSING_SEGMENT_CLASS = 'vault-dir-missing-segment';
 
 const MISSING_SEGMENT_RE = new RegExp(
@@ -243,6 +226,8 @@ historical contexts (decisions.md, history/, archive*).
 
 Both --from and --to are required unless username-rewrites[0] is set in
 ${VAULT_MIGRATION_RULES_PATH}.
+Legacy vault-dir targets use SO_VAULT_DIR or owner.yaml paths.vault-dir;
+unconfigured targets are skipped without guessing a location.
 
 Options:
   --from SEG           Literal source segment (e.g. '/Users/oldname/')
@@ -330,8 +315,7 @@ function findCandidateFiles(roots) {
 /**
  * Discover files containing a missing-segment `vault-dir:` drift (GitLab #600
  * D3) — i.e. a `vault-dir:` line pointing at `~/Projects/vault` (or
- * `/Users/<user>/Projects/vault`) that lacks the canonical `/Bernhard/` owner
- * segment. These files do NOT contain OLD_SEGMENT, so findCandidateFiles() (which
+ * `/Users/<user>/Projects/vault`) that may need an explicitly configured canonical target. These files do NOT contain OLD_SEGMENT, so findCandidateFiles() (which
  * greps OLD_SEGMENT) cannot find them.
  *
  * grep matches the literal `Projects/vault`; per-file classification then applies
@@ -350,7 +334,7 @@ function findMissingSegmentFiles(roots) {
       '--include=*.md',
       // Coarse literal pre-filter; precise vault-dir/idempotency check happens
       // per-line in findMissingSegmentHits(). 'Projects/vault' also matches
-      // canonical 'Projects/Bernhard/vault' lines, but those are dropped later.
+      // longer paths; exact per-line matching prevents unrelated rewrites.
       'Projects/vault',
       ...roots,
     ],
@@ -407,8 +391,8 @@ function classifyHit(filePath, line) {
 /**
  * Does this line carry a missing-segment `vault-dir:` drift (GitLab #600 D3)?
  * Returns true only for a `vault-dir:` value at `~/Projects/vault` or
- * `/Users/<user>/Projects/vault` that is NOT already canonical
- * (`~/Projects/Bernhard/vault`) — see MISSING_SEGMENT_RE for the precise shape.
+ * `/Users/<user>/Projects/vault` matching the legacy shape — see MISSING_SEGMENT_RE.
+ * Whether the target differs is decided separately by the configured rewrite.
  * `RegExp.test` advances lastIndex on a /g regex, so reset it before each probe.
  */
 function lineHasMissingSegment(line) {
@@ -444,7 +428,7 @@ function isOwnedByUsernamePath(line) {
  * deliberately skipped here: a `vault-dir: /Users/oldname/Projects/vault` line is
  * a username drift (→ /Users/newname/Projects/vault), NOT a missing-segment drift.
  * Without this guard the two classes collide and the username output would gain a
- * spurious /Bernhard/ segment.
+ * second, unrelated vault-target rewrite.
  */
 function findMissingSegmentHits(filePath, content) {
   const historical = isHistorical(filePath);
@@ -464,37 +448,40 @@ function findMissingSegmentHits(filePath, content) {
 }
 
 /**
- * Rewrite missing-segment `vault-dir:` values in `content`: insert the canonical
- * `/Bernhard/` owner segment between `Projects/` and `vault`. Only `vault-dir:`
- * lines matching MISSING_SEGMENT_RE are touched — unrelated `~/Projects/...`
- * paths (e.g. `cache: ~/Projects/vault-backups`) are preserved verbatim.
- *
- * `originalContent` (the file BEFORE rewriteContent ran) gates which lines are
- * eligible: any line whose original carried OLD_SEGMENT is owned by the username
- * path and is skipped, even though the username rewrite may have produced a
- * `/Users/newname/Projects/vault` form that would otherwise match the regex.
- * This keeps the two classes from colliding when both transforms chain.
- *
- * `originalContent` is REQUIRED (no default): the collision-gate is meaningless
- * without the pre-rewrite text, and a `= content` default silently fails open if
- * a future caller forgets it — passing the already-rewritten content as its own
- * "original" would let a chained username rewrite leak a spurious /Bernhard/
- * segment. Callers MUST pass the original content explicitly (architect MED #607 D3).
+ * Rewrite a legacy vault-dir base to an explicit canonical target, preserving
+ * suffixes, scalar quotes and comments. Missing/invalid targets leave text intact.
+ * originalContent is required so username-owned lines are never rewritten twice.
  */
-function rewriteMissingSegment(content, originalContent) {
+function rewriteMissingSegment(content, originalContent, canonicalVaultPath) {
   const origLines = originalContent.split('\n');
-  return content
-    .split('\n')
-    .map((line, i) => {
-      // Skip lines the username path owns (matched on the ORIGINAL line text).
-      if (isOwnedByUsernamePath(origLines[i])) return line;
-      MISSING_SEGMENT_RE.lastIndex = 0;
-      return line.replace(
-        MISSING_SEGMENT_RE,
-        (_m, prefix, root) => `${prefix}${root}/Projects/${MISSING_SEGMENT_OWNER}/vault`,
-      );
-    })
-    .join('\n');
+  if (typeof canonicalVaultPath !== 'string' || !canonicalVaultPath.trim()) return content;
+  const target = canonicalVaultPath.trim().replace(/\/+$/, '') || '/';
+  if (!target.startsWith('/') && !target.startsWith('~/')) return content;
+  if ([...target].some((c) => c.charCodeAt(0) < 32)) return content;
+  return content.split('\n').map((line, i) => {
+    if (isOwnedByUsernamePath(origLines[i])) return line;
+    return line.replace(/(vault-dir:\s*)(?:"((?:\\[^\r\n]|[^"\\\r\n])*)"|'((?:''|[^'\r\n])*)'|([^#\r\n]*))/g,
+      (match, prefix, double, single, bare) => {
+        let value = bare;
+        if (double !== undefined || single !== undefined) {
+          // Decode the complete scalar once so YAML escapes retain their path meaning.
+          try {
+            value = loadYaml(double !== undefined ? `"${double}"` : `'${single}'`);
+          } catch {
+            return match; // Leave malformed quoted values untouched.
+          }
+        }
+        const tailSpace = value.match(/\s*$/)[0];
+        const pathValue = value.slice(0, value.length - tailSpace.length);
+        const legacy = /^(?:~|\/Users\/[^/\s'"]+)\/Projects\/vault(?![\w-])(.*)$/.exec(pathValue);
+        if (!legacy) return match;
+        const replacement = target === '/' && legacy[1].startsWith('/') ? legacy[1] : target + legacy[1];
+        if (double !== undefined) return prefix + JSON.stringify(replacement + tailSpace);
+        if (single !== undefined) return prefix + "'" + (replacement + tailSpace).replace(/'/g, "''") + "'";
+        const scalar = /[\s#:'"[\]{}&*!|>]/.test(replacement) ? JSON.stringify(replacement) : replacement;
+        return prefix + scalar + tailSpace;
+      });
+  }).join('\n');
 }
 
 // ---------------------------------------------------------------------------
@@ -554,6 +541,8 @@ function abbrev(filePath) {
 
 async function main() {
   const opts = parseArgs(process.argv);
+  const canonicalVaultPath = resolveHostPath('vault-dir', null, loadHostPaths());
+  let canonicalWarningEmitted = false;
 
   if (opts.help) {
     printHelp();
@@ -659,7 +648,7 @@ async function main() {
     totalScanned++;
     // Two independent drift classes, each discovered per-line:
     //   - OLD_SEGMENT username drift  → rewriteContent (split+join)
-    //   - missing /Bernhard/ segment  → rewriteMissingSegment (#600 D3)
+    //   - legacy vault base → rewriteMissingSegment (#600 D3)
     const hits = findHits(filePath, content);
     const missingHits = findMissingSegmentHits(filePath, content);
     if (hits.length === 0 && missingHits.length === 0) continue;
@@ -669,7 +658,15 @@ async function main() {
     // in mixed files are rare; if any exist, classify each line and skip-count.
     const fixableHits = hits.filter((h) => h.classification !== 'historical');
     const historicalHits = hits.filter((h) => h.classification === 'historical');
-    const fixableMissing = missingHits.filter((h) => h.classification !== 'historical');
+    const pendingMissing = missingHits.filter((h) => h.classification !== 'historical');
+    if (pendingMissing.length && !canonicalVaultPath && !canonicalWarningEmitted) {
+      process.stderr.write('migrate-vault-paths: WARN legacy vault targets skipped — set SO_VAULT_DIR or owner.yaml paths.vault-dir\n');
+      canonicalWarningEmitted = true;
+    }
+    const fixableMissing = pendingMissing.filter((h) => rewriteMissingSegment(h.text, h.text, canonicalVaultPath) !== h.text);
+    for (const h of pendingMissing.filter((hit) => !fixableMissing.includes(hit))) {
+      emit(opts, { action:'skipped', reason: canonicalVaultPath ? 'canonical-target-unchanged-or-invalid' : 'canonical-vault-unconfigured', file:filePath, line:h.line, classification:h.classification });
+    }
     const historicalMissing = missingHits.filter((h) => h.classification === 'historical');
 
     for (const h of [...historicalHits, ...historicalMissing]) {
@@ -695,7 +692,7 @@ async function main() {
     // touches a line the username rewrite already owns (see rewriteMissingSegment).
     let newContent = content;
     if (fixableHits.length > 0) newContent = rewriteContent(newContent);
-    if (fixableMissing.length > 0) newContent = rewriteMissingSegment(newContent, content);
+    if (fixableMissing.length > 0) newContent = rewriteMissingSegment(newContent, content, canonicalVaultPath);
 
     for (const h of fixableHits) {
       totalLinesFixed++;