@claude-flow/cli 3.56.9 → 3.57.0

package/dist/src/services/policy-runtime.js

@@ -1,16 +1,36 @@
-import { AgenticPolicyEngine, createLegacyCompatibleState, isMcpCallerAuthEnabled, decodeTokenEnvelope, publicKeyFromHex, verifyInvocationToken, } from '@claude-flow/security';
+// Narrow subpath imports (not the '@claude-flow/security' barrel): this module
+// is loaded eagerly by the MCP server, and the barrel also evaluates the OAuth
+// callback server (an ESM `node:http` import that materialises http's lazy
+// undici getters), bcryptjs, keychain and credential helpers that the policy
+// runtime never uses.
+import { AgenticPolicyEngine, POLICY_STATE_VERSION, createLegacyCompatibleState, } from '@claude-flow/security/policy/index';
+import { isMcpCallerAuthEnabled, decodeTokenEnvelope, publicKeyFromHex, verifyInvocationToken, } from '@claude-flow/security/mcp-caller-identity';
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
-import { closeSync, constants as fsConstants, existsSync, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readlinkSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { closeSync, constants as fsConstants, existsSync, fstatSync, fsyncSync, ftruncateSync, writeSync, lstatSync, mkdirSync, openSync, readFileSync, readSync, readlinkSync, realpathSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { hostname, userInfo } from 'node:os';
 import { syncPolicyProjection } from '../mods/policy-projection.js';
+import { ATOMIC_JSON_WRITER } from './policy-anchor-log.js';
+import { captureArchiveSnapshot, verifyFullPolicyLedger } from './policy-ledger-audit.js';
 import { assessAnchors, policyTrustRoot, recordAnchor } from './policy-ledger-anchor.js';
 const POLICY_DIR = join('.claude-flow', 'policy');
 const POLICY_FILE = 'state.json';
 const LOCK_FILE = 'state.lock';
-const LOCK_STALE_MS = 30_000;
+const RECEIPT_ARCHIVE_FILE = 'receipts.ledger.jsonl';
 const LOCK_WAIT_MS = 5_000;
+// #3164: without a bound, `state.receipts` grows forever and every
+// transaction's verify/clone/serialize cost is O(all receipts ever issued) —
+// eventually exceeding LOCK_WAIT_MS and timing out every MCP tool call.
+// Pruned receipts are archived to RECEIPT_ARCHIVE_FILE, never discarded.
+const DEFAULT_LEDGER_RETENTION = 2_000;
+function ledgerRetention() {
+    const raw = process.env.CLAUDE_FLOW_POLICY_LEDGER_RETENTION;
+    if (!raw)
+        return DEFAULT_LEDGER_RETENTION;
+    const parsed = Number(raw);
+    return Number.isInteger(parsed) && parsed >= 0 ? parsed : DEFAULT_LEDGER_RETENTION;
+}
 // A lock is ~170 bytes plus the hostname (at most 255 bytes).
 const LOCK_MAX_BYTES = 1_024;
 // Linux PID namespace of this process, e.g. `pid:[4026531836]`; undefined on
@@ -39,7 +59,7 @@ const BOOT_ID = (() => {
 function paths(projectRoot) {
     const root = resolve(projectRoot);
     const dir = join(root, POLICY_DIR);
-    return { dir, state: join(dir, POLICY_FILE), lock: join(dir, LOCK_FILE) };
+    return { dir, state: join(dir, POLICY_FILE), lock: join(dir, LOCK_FILE), archive: join(dir, RECEIPT_ARCHIVE_FILE) };
 }
 function sleep(ms) {
     return new Promise((resolveSleep) => setTimeout(resolveSleep, ms));
@@ -62,7 +82,7 @@ function isPidAlive(pid) {
 /**
  * Reads a lock only if it is a small regular file: never follows a symlink,
  * never blocks on a FIFO or device, never reads more than LOCK_MAX_BYTES.
- * Anything else returns undefined and the caller keeps the mtime rule.
+ * Anything else returns undefined; unknown owners are preserved.
  */
 function readLockFile(lockPath) {
     if (!lstatSync(lockPath).isFile())
@@ -88,8 +108,8 @@ function readLockFile(lockPath) {
  * boot and in this PID namespace: anywhere else (a bwrap --unshare-pid
  * sandbox, a container, another machine on a shared filesystem) a live owner
  * also answers ESRCH. Locks without that identity (older ruflo, a crash
- * between create and write, anything unparsable) return false and keep the
- * mtime rule.
+ * between create and write, anything unparsable) return false and require
+ * explicit operator inspection rather than age-only takeover.
  */
 function lockOwnerIsDead(lockPath) {
     try {
@@ -121,6 +141,36 @@ function lockOwnerIsDead(lockPath) {
         return false;
     }
 }
+/** Serialize dead-owner reclamation across processes. A normal acquirer can
+ * create state.lock after deletion, but the next reclaimer must re-probe that
+ * new owner under this guard. Guard orphans fail closed, requiring explicit
+ * operator recovery after validating their exact recorded owner and nonce.
+ * Unknown/foreign owners are never stolen merely because their mtime aged. */
+function reclaimDeadLock(lockPath) {
+    const guard = `${lockPath}.reclaim`;
+    let fd;
+    try {
+        fd = openSync(guard, 'wx', 0o600);
+    }
+    catch {
+        return;
+    }
+    const ownership = JSON.stringify({ pid: process.pid, nonce: randomUUID(), host: hostname(), platform: process.platform, pidns: PID_NAMESPACE, boot: BOOT_ID });
+    try {
+        writeFileSync(fd, ownership);
+        if (lockOwnerIsDead(lockPath))
+            unlinkSync(lockPath);
+    }
+    catch { /* lock changed, unknown identity, or an inaccessible path */ }
+    finally {
+        closeSync(fd);
+        try {
+            if (readLockFile(guard) === ownership)
+                unlinkSync(guard);
+        }
+        catch { /* preserve an unknown guard */ }
+    }
+}
 /**
  * Exported for ADR-406 mission storage, which takes the same per-file lock
  * (pid, pid namespace and boot id identify a dead owner) rather than a copy.
@@ -130,33 +180,37 @@ export async function acquireLock(lockPath) {
     while (Date.now() - started < LOCK_WAIT_MS) {
         try {
             const fd = openSync(lockPath, 'wx', 0o600);
-            writeFileSync(fd, JSON.stringify({
+            const ownership = JSON.stringify({
                 pid: process.pid,
                 acquiredAt: Date.now(),
                 host: hostname(),
                 platform: process.platform,
                 pidns: PID_NAMESPACE,
                 boot: BOOT_ID,
-            }));
-            closeSync(fd);
+                nonce: randomUUID(),
+            });
+            try {
+                writeFileSync(fd, ownership);
+            }
+            finally {
+                closeSync(fd);
+            }
             return () => {
                 try {
-                    unlinkSync(lockPath);
+                    if (readLockFile(lockPath) === ownership)
+                        unlinkSync(lockPath);
                 }
                 catch { /* already released */ }
             };
         }
         catch {
-            try {
-                if (lockOwnerIsDead(lockPath)
-                    || Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS)
-                    unlinkSync(lockPath);
-            }
-            catch { /* another process changed the lock */ }
+            reclaimDeadLock(lockPath);
             await sleep(10);
         }
     }
-    throw new Error('policy-state-lock-timeout');
+    throw new Error(lockOwnerIsDead(lockPath)
+        ? 'policy-state-lock-timeout: dead owner; inspect exact owner of state.lock.reclaim before explicit recovery'
+        : 'policy-state-lock-timeout');
 }
 // #3398: Windows rename over a file another process holds open fails with
 // EPERM/EBUSY/EACCES. Retry (~1.3s total, inside LOCK_WAIT_MS), never leave the
@@ -164,17 +218,129 @@ export async function acquireLock(lockPath) {
 // and consumed approval uses, so dropping it would let an approval be reused.
 const RENAME_RETRY_DELAYS_MS = [25, 50, 100, 150, 250, 300, 400];
 const TRANSIENT_RENAME_CODES = new Set(['EPERM', 'EBUSY', 'EACCES']);
+function mkdirDurably(dir) {
+    if (existsSync(dir))
+        return;
+    const parent = dirname(dir);
+    if (parent !== dir)
+        mkdirDurably(parent);
+    try {
+        mkdirSync(dir, { mode: 0o700 });
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    syncDirectory(parent);
+}
+function syncDirectory(dir) {
+    // Windows does not expose directory fsync through Node. File sync and
+    // atomic rename still apply there; POSIX failures must reach the caller.
+    if (process.platform === 'win32')
+        return;
+    const fd = openSync(dir, fsConstants.O_RDONLY | (fsConstants.O_DIRECTORY ?? 0));
+    try {
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Recover only an incomplete, unacknowledged final append. All inspection,
+ * truncation, append and sync use the same nofollow regular-file descriptor. */
+function appendArchiveDurably(file, receipts, verifier) {
+    const fd = openSync(file, fsConstants.O_RDWR | fsConstants.O_CREAT
+        | (fsConstants.O_NOFOLLOW ?? 0) | (fsConstants.O_NONBLOCK ?? 0), 0o600);
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile())
+            throw new Error('policy-ledger-archive-not-regular');
+        const limit = 64 * 1024;
+        const start = Math.max(0, stat.size - limit);
+        const buffer = Buffer.alloc(stat.size - start);
+        if (readSync(fd, buffer, 0, buffer.length, start) !== buffer.length)
+            throw new Error('policy-ledger-archive-short-read');
+        let end = stat.size;
+        const lastNewline = buffer.lastIndexOf(10);
+        if (buffer.length && buffer[buffer.length - 1] !== 10) {
+            if (lastNewline < 0 && start > 0)
+                throw new Error('policy-ledger-archive-tail-too-large');
+            const fragmentBytes = buffer.subarray(lastNewline + 1);
+            const fragment = fragmentBytes.toString('utf8');
+            try {
+                JSON.parse(fragment);
+                throw new Error('policy-ledger-archive-unterminated-record');
+            }
+            catch (error) {
+                if (!(error instanceof SyntaxError))
+                    throw error;
+            }
+            // A parse failure alone grants no repair authority: the bytes must
+            // be an exact prefix of a receipt still available in the verified hot
+            // state and being retried by this prune.
+            if (!fragmentBytes.length || !receipts.some(receipt => {
+                const expected = Buffer.from(JSON.stringify(receipt));
+                return fragmentBytes.length < expected.length && expected.subarray(0, fragmentBytes.length).equals(fragmentBytes);
+            })) {
+                throw new Error('policy-ledger-archive-unrecoverable-tail');
+            }
+            end = start + lastNewline + 1;
+        }
+        const complete = buffer.subarray(0, end - start).toString('utf8');
+        const usable = start === 0 ? complete : complete.slice(complete.indexOf('\n') + 1);
+        for (const line of usable.split('\n')) {
+            if (!line.trim())
+                continue;
+            let record;
+            try {
+                record = JSON.parse(line);
+            }
+            catch {
+                throw new Error('policy-ledger-archive-parse-error');
+            }
+            if (verifier.verifyReceipt(record))
+                throw new Error('policy-ledger-archive-conflict');
+        }
+        if (end < stat.size) {
+            ftruncateSync(fd, end);
+            fsyncSync(fd);
+        }
+        const bytes = Buffer.from(`${receipts.map(receipt => JSON.stringify(receipt)).join('\n')}\n`);
+        let written = 0;
+        while (written < bytes.length) {
+            const count = writeSync(fd, bytes, written, bytes.length - written, end + written);
+            if (!count)
+                throw new Error('policy-ledger-archive-short-write');
+            written += count;
+        }
+        fsyncSync(fd);
+        syncDirectory(dirname(file));
+    }
+    finally {
+        closeSync(fd);
+    }
+}
 async function writeJsonAtomic(file, value) {
-    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    mkdirDurably(dirname(file));
     const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
     let renamed = false;
     try {
-        writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+        const fd = openSync(temporary, 'wx', 0o600);
+        try {
+            if (value && typeof value[ATOMIC_JSON_WRITER] === 'function')
+                value[ATOMIC_JSON_WRITER](fd);
+            else
+                writeFileSync(fd, `${JSON.stringify(value, null, 2)}\n`);
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
         for (let attempt = 0;; attempt++) {
             try {
                 renameSync(temporary, file);
                 renamed = true;
-                return;
+                break;
             }
             catch (error) {
                 const code = error?.code ?? '';
@@ -183,6 +349,9 @@ async function writeJsonAtomic(file, value) {
                 await sleep(RENAME_RETRY_DELAYS_MS[attempt]);
             }
         }
+        // A post-rename sync failure is a publication failure, not a rename
+        // failure. Never retry with a temporary file already consumed by rename.
+        syncDirectory(dirname(file));
     }
     finally {
         if (!renamed) {
@@ -204,8 +373,16 @@ function trustKey(projectRoot, create) {
     if (!existsSync(key)) {
         if (!create)
             return undefined;
-        mkdirSync(dirname(key), { recursive: true, mode: 0o700 });
-        writeFileSync(key, randomBytes(32), { mode: 0o600, flag: 'wx' });
+        mkdirDurably(dirname(key));
+        const fd = openSync(key, 'wx', 0o600);
+        try {
+            writeFileSync(fd, randomBytes(32));
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        syncDirectory(dirname(key));
     }
     const material = readFileSync(key);
     if (material.length !== 32)
@@ -232,11 +409,11 @@ function verifyStateAnchor(projectRoot, state) {
         throw new Error('policy-state-authentication-failed');
     }
 }
-async function writePolicyState(projectRoot, statePath, state, anchorEvent = 'append', by) {
+async function writePolicyState(projectRoot, statePath, state, anchorEvent = 'append', by, assessedTip) {
     await writePolicyStateFiles(projectRoot, statePath, state);
     // #3602: the second anchor is written after the state, so a crash leaves the
     // state AHEAD of the log (caught up on the next write), never behind it.
-    await recordAnchor(projectRoot, state, writeJsonAtomic, anchorEvent, by);
+    await recordAnchor(projectRoot, state, writeJsonAtomic, anchorEvent, by, writeJsonAtomic, assessedTip);
     // ADR-404: the ruflo mod reads Claude Code tool rules from a small
     // projection, never from state.json. Written only after the state and its
     // anchor are safely down; a failure here never fails the state write. A
@@ -310,7 +487,7 @@ export function loadPolicyState(projectRoot = process.cwd()) {
         return createLegacyCompatibleState(detectLegacyCapabilities(projectRoot));
     }
     const parsed = JSON.parse(readFileSync(target.state, 'utf8'));
-    if (parsed.version !== 1 || !Array.isArray(parsed.rules) || !Array.isArray(parsed.receipts)) {
+    if ((parsed.version !== 1 && parsed.version !== POLICY_STATE_VERSION) || !Array.isArray(parsed.rules) || !Array.isArray(parsed.receipts)) {
         throw new Error(`unsupported-policy-state-version:${String(parsed.version)}`);
     }
     verifyStateAnchor(projectRoot, parsed);
@@ -331,7 +508,7 @@ export async function autoMigratePolicyStateIfNeeded(projectRoot = process.cwd()
     if (!existsSync(join(resolve(projectRoot), '.claude-flow'))
         && !existsSync(join(resolve(projectRoot), '.swarm')))
         return { migrated: false };
-    mkdirSync(target.dir, { recursive: true, mode: 0o700 });
+    mkdirDurably(target.dir);
     const release = await acquireLock(target.lock);
     try {
         if (!existsSync(target.state)) {
@@ -351,7 +528,7 @@ export async function autoMigratePolicyStateIfNeeded(projectRoot = process.cwd()
 }
 export async function withPolicyTransaction(projectRoot, operation, options = {}) {
     const target = paths(projectRoot);
-    mkdirSync(target.dir, { recursive: true, mode: 0o700 });
+    mkdirDurably(target.dir);
     const release = await acquireLock(target.lock);
     try {
         const loaded = loadPolicyState(projectRoot);
@@ -370,10 +547,30 @@ export async function withPolicyTransaction(projectRoot, operation, options = {}
                 : gate.result.error ?? 'policy-ledger-verification-failed');
         }
         const result = await operation(engine);
-        if (!engine.verifyLedger().valid)
+        const verified = engine.verifyLedger();
+        if (!verified.valid)
             throw new Error('policy-ledger-verification-failed');
+        // Only archive the prefix already committed in loaded state. Archiving
+        // newly generated receipts before their first state publication would
+        // leave conflicting same-sequence records when a failed operation is
+        // retried with a different timestamp/request. Retention=0 and large
+        // batches therefore retain this transaction's new receipts until a
+        // subsequent transaction can archive their exact committed bytes.
+        const newlyAppended = verified.length - ((loaded.retainedFrom ?? 0) + loaded.receipts.length);
+        const pruned = engine.pruneReceipts(Math.max(ledgerRetention(), newlyAppended));
+        // #3164: archive BEFORE writing the shrunk state. If the process crashes
+        // between the two writes, the archive append already landed but
+        // `retainedFrom` on disk still reflects the pre-prune length, so the next
+        // prune recomputes and re-appends the SAME receipts — a harmless,
+        // detectable duplicate (same sequence, identical content), deduped by
+        // `verifyPolicyLedger({ full: true })`. The reverse order (state first)
+        // would instead risk a permanent gap if the process died in between,
+        // which is strictly worse for an audit ledger — never reorder this.
+        if (pruned.length > 0) {
+            appendArchiveDurably(target.archive, pruned, engine);
+        }
         const nextState = engine.exportState();
-        await writePolicyState(projectRoot, target.state, nextState, gate.event);
+        await writePolicyState(projectRoot, target.state, nextState, gate.event, undefined, gate.anchorTip);
         return result;
     }
     finally {
@@ -433,7 +630,9 @@ export async function revokePolicyApproval(id, projectRoot = process.cwd()) {
  */
 function reconcileLedger(projectRoot, engine, options) {
     const state = engine.exportState();
-    const length = state.receipts.length;
+    // #3164: the historical length includes anything pruned out of the hot
+    // array — `length` here must keep meaning "total receipts ever issued".
+    const length = (state.retainedFrom ?? 0) + state.receipts.length;
     const primary = typeof state.ledgerLength === 'number';
     const base = engine.verifyLedger();
     const fail = (error) => ({ result: { valid: false, length, error }, persist: false });
@@ -448,7 +647,7 @@ function reconcileLedger(projectRoot, engine, options) {
                 ? { result: { ...base, secondaryAnchor: 'established-explicitly' }, persist: true, event: 'establish-anchor' }
                 : { result: { ...base, secondaryAnchor: 'recorded-from-state' }, persist: true, event: 'migrated-from-state' };
         }
-        return { result: base, persist: assessed.kind === 'ok' && assessed.behind, event: 'append' };
+        return { result: base, persist: assessed.kind === 'ok' && assessed.behind, event: 'append', anchorTip: assessed.kind === 'ok' ? assessed.last : undefined };
     }
     // No primary anchor.
     if (length === 0)
@@ -457,7 +656,7 @@ function reconcileLedger(projectRoot, engine, options) {
         // The second anchor is authentic and agrees with the chain: the deleted
         // primary can be restored from it. Truncation was already rejected above.
         engine.verifyLedger({ establishAnchor: true });
-        return { result: { valid: true, length, secondaryAnchor: 'restored-primary' }, persist: true, event: 'append' };
+        return { result: { valid: true, length, secondaryAnchor: 'restored-primary' }, persist: true, event: 'append', anchorTip: assessed.last };
     }
     if (options.establishAnchor) {
         const established = engine.verifyLedger({ establishAnchor: true });
@@ -477,23 +676,51 @@ function reconcileLedger(projectRoot, engine, options) {
  */
 export async function verifyPolicyLedger(projectRoot = process.cwd(), options = {}) {
     const target = paths(projectRoot);
-    mkdirSync(target.dir, { recursive: true, mode: 0o700 });
+    mkdirDurably(target.dir);
+    const engineOptions = {
+        signingKey: process.env.CLAUDE_FLOW_POLICY_SIGNING_KEY,
+        keyId: process.env.CLAUDE_FLOW_POLICY_KEY_ID,
+    };
+    let outcomeResult;
+    let snapshotState;
+    let archiveSnapshot;
+    // Capture the verified hot state and a checked regular archive descriptor
+    // plus immutable byte boundary under the writer lock. Historical read,
+    // authentication, deduplication and replay all happen after release, using
+    // bounded chunks and private disposable disk scratch instead of O(history)
+    // strings, receipt arrays or maps. The descriptor pins path replacements.
     const release = await acquireLock(target.lock);
     try {
-        const engine = AgenticPolicyEngine.fromState(loadPolicyState(projectRoot), {
-            signingKey: process.env.CLAUDE_FLOW_POLICY_SIGNING_KEY,
-            keyId: process.env.CLAUDE_FLOW_POLICY_KEY_ID,
-        });
+        const engine = AgenticPolicyEngine.fromState(loadPolicyState(projectRoot), engineOptions);
         const outcome = reconcileLedger(projectRoot, engine, options);
         if (outcome.persist) {
             const by = outcome.event === 'establish-anchor' ? userInfo().username : undefined;
-            await writePolicyState(projectRoot, target.state, engine.exportState(), outcome.event, by);
+            await writePolicyState(projectRoot, target.state, engine.exportState(), outcome.event, by, outcome.anchorTip);
+        }
+        outcomeResult = outcome.result;
+        snapshotState = engine.exportState();
+        if (options.full && outcomeResult.valid) {
+            try {
+                archiveSnapshot = captureArchiveSnapshot(target.archive);
+            }
+            catch (error) {
+                outcomeResult = { valid: false, length: outcomeResult.length, error: error.message };
+            }
         }
-        return outcome.result;
     }
     finally {
         release();
     }
+    if (!options.full || !outcomeResult.valid)
+        return outcomeResult;
+    try {
+        const full = await verifyFullPolicyLedger(archiveSnapshot, snapshotState, engineOptions);
+        return { ...full, secondaryAnchor: outcomeResult.secondaryAnchor };
+    }
+    finally {
+        if (archiveSnapshot !== undefined)
+            closeSync(archiveSnapshot.fd);
+    }
 }
 /**
  * Resolve the caller identity for `authorizeMcpTool`.

package/dist/src/services/worker-daemon.d.ts

@@ -316,6 +316,17 @@ export declare class WorkerDaemon extends EventEmitter {
      * Execute a worker with timeout protection
      */
     private executeWorker;
+    /**
+     * Feed a finished worker job into the self-learning pipeline as a one-step
+     * trajectory (SONA + ReasoningBank + @ruvector/ruvllm forwarding, persisted
+     * to `.claude-flow/neural/stats.json`). Before this, the daemon could run
+     * hundreds of jobs at "100% success" while `trajectoriesRecorded` stayed 0:
+     * no daemon code path ever called the intelligence module.
+     *
+     * Best-effort and bounded: never throws, never changes the WorkerResult.
+     * Opt-out: RUFLO_DAEMON_NO_LEARN=1.
+     */
+    private recordWorkerTrajectory;
     /**
      * Run a function with timeout (P1 fix)
      * @param fn - The async function to execute

package/dist/src/services/worker-daemon.js

@@ -75,6 +75,9 @@ const CONSOLIDATE_DEDUP_DISTANCE = 0.2;
 // `--no-distill` flag on `daemon start` (see commands/daemon.ts), which sets
 // this env var on the forked/foreground daemon process.
 const NO_DISTILL_ENV = 'RUFLO_DAEMON_NO_DISTILL';
+// Opt-out for recording each finished worker job as a learning trajectory
+// (see WorkerDaemon.recordWorkerTrajectory).
+const NO_LEARN_ENV = 'RUFLO_DAEMON_NO_LEARN';
 // #2356 — Self-terminating lifecycle defaults. A background daemon with no
 // upper bound on its lifetime runs until the box reboots; in the field this
 // leaked tens of thousands of headless `claude --print` sweeps over many days
@@ -1234,6 +1237,7 @@ export class WorkerDaemon extends EventEmitter {
             this.emit('worker:complete', result);
             this.log('info', `Worker ${workerConfig.type} completed in ${durationMs}ms`);
             this.saveState();
+            await this.recordWorkerTrajectory(result);
             return result;
         }
         catch (error) {
@@ -1253,6 +1257,7 @@ export class WorkerDaemon extends EventEmitter {
             this.emit('worker:error', result);
             this.log('error', `Worker ${workerConfig.type} failed: ${result.error}`);
             this.saveState();
+            await this.recordWorkerTrajectory(result);
             return result;
         }
         finally {
@@ -1261,6 +1266,38 @@ export class WorkerDaemon extends EventEmitter {
             this.processPendingWorkers();
         }
     }
+    /**
+     * Feed a finished worker job into the self-learning pipeline as a one-step
+     * trajectory (SONA + ReasoningBank + @ruvector/ruvllm forwarding, persisted
+     * to `.claude-flow/neural/stats.json`). Before this, the daemon could run
+     * hundreds of jobs at "100% success" while `trajectoriesRecorded` stayed 0:
+     * no daemon code path ever called the intelligence module.
+     *
+     * Best-effort and bounded: never throws, never changes the WorkerResult.
+     * Opt-out: RUFLO_DAEMON_NO_LEARN=1.
+     */
+    async recordWorkerTrajectory(result) {
+        if (process.env[NO_LEARN_ENV] === '1')
+            return;
+        try {
+            const intel = await import('../memory/intelligence.js');
+            await intel.recordTrajectory([{
+                    type: 'result',
+                    // A worker error is free text (it can quote command output): keep only its first line, cut, so it cannot fill the learning store.
+                    content: `daemon worker ${result.type} ${result.success ? 'succeeded' : `failed: ${String(result.error ?? 'unknown error').split('\n')[0].slice(0, 200)}`}`,
+                    metadata: {
+                        source: 'worker-daemon',
+                        worker: result.type,
+                        success: result.success,
+                        durationMs: result.durationMs,
+                    },
+                    timestamp: Date.now(),
+                }], result.success ? 'success' : 'failure');
+        }
+        catch (error) {
+            this.log('warn', `Worker ${result.type}: trajectory recording skipped: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
     /**
      * Run a function with timeout (P1 fix)
      * @param fn - The async function to execute

package/dist/src/transfer/store/discovery.js

@@ -251,9 +251,12 @@ export class PatternDiscovery {
      * Get built-in genesis registry (always available offline)
      */
     getGenesisRegistry(cid) {
+        // #4157: this is an offline placeholder, so it claims nothing it cannot back: no
+        // verification, no signature, no popularity numbers, and fixed (not "now") dates.
         return {
+            source: 'builtin-fallback',
             version: '1.0.0',
-            updatedAt: new Date().toISOString(),
+            updatedAt: '2026-01-08T18:42:31.126Z',
             ipnsName: 'k51qzi5uqu5dj0w8q1xvqn8ql2g4p7x8qpk9vz3xm1y2n3o4p5q6r7s8t9u0v',
             previousCid: undefined,
             patterns: [
@@ -269,25 +272,24 @@ export class PatternDiscovery {
                     author: {
                         id: 'claude-flow-team',
                         displayName: 'Claude Flow Team',
-                        verified: true,
+                        verified: false,
                         patterns: 1,
-                        totalDownloads: 1000,
+                        totalDownloads: 0,
                     },
                     license: 'MIT',
                     categories: ['routing', 'coordination'],
                     tags: ['genesis', 'foundational', 'routing', 'swarm', 'coordination', 'multi-agent', 'hello-world'],
                     language: 'typescript',
                     framework: 'claude-flow',
-                    downloads: 1000,
-                    rating: 5.0,
-                    ratingCount: 42,
-                    lastUpdated: new Date().toISOString(),
+                    downloads: 0,
+                    rating: 0,
+                    ratingCount: 0,
+                    lastUpdated: '2026-01-08T18:42:31.126Z',
                     createdAt: '2026-01-08T18:42:31.126Z',
                     minClaudeFlowVersion: '3.0.0',
-                    verified: true,
-                    trustLevel: 'verified',
-                    signature: 'ed25519:genesis-pattern-signature',
-                    publicKey: 'ed25519:claude-flow-team-key',
+                    verified: false,
+                    trustLevel: 'unverified',
+                    source: 'builtin-fallback',
                 },
             ],
             categories: [
@@ -301,20 +303,17 @@ export class PatternDiscovery {
                 {
                     id: 'claude-flow-team',
                     displayName: 'Claude Flow Team',
-                    publicKey: 'ed25519:claude-flow-team-key',
-                    verified: true,
+                    verified: false,
                     patterns: 1,
-                    totalDownloads: 1000,
+                    totalDownloads: 0,
                 },
             ],
             totalPatterns: 1,
-            totalDownloads: 1000,
+            totalDownloads: 0,
             totalAuthors: 1,
             featured: ['seraphine-genesis-v1'],
             trending: ['seraphine-genesis-v1'],
             newest: ['seraphine-genesis-v1'],
-            registrySignature: crypto.randomBytes(32).toString('hex'),
-            registryPublicKey: 'ed25519:claude-flow-registry-key',
         };
     }
     /**

package/dist/src/transfer/store/types.d.ts

@@ -32,6 +32,8 @@ export interface PatternEntry {
     trustLevel: TrustLevel;
     signature?: string;
     publicKey?: string;
+    /** Where the entry came from. 'builtin-fallback' = the offline placeholder, not live registry data (#4157). */
+    source?: 'registry' | 'builtin-fallback';
 }
 /**
  * Pattern author info
@@ -60,6 +62,8 @@ export interface PatternCategory {
  * Stored on IPFS with IPNS pointer for updates
  */
 export interface PatternRegistry {
+    /** 'builtin-fallback' when discovery could not reach a registry and used the offline placeholder (#4157). */
+    source?: 'registry' | 'builtin-fallback';
     version: string;
     updatedAt: string;
     ipnsName: string;