@haaaiawd/second-nature 0.2.9 → 0.2.12

package/index.js

@@ -31,6 +31,12 @@
  *   illusion of a working plugin while agent sessions see no tool. We hit
  *   exactly that on 2026-05-06; the fix lives in plugin/openclaw.plugin.json
  *   under the `activation` block.
+ * - Cloud Feishu/OpenClaw sessions can report `capabilities=none`. In that
+ *   mode, binding activation to `onCapabilities:["tool"]` prevents the agent
+ *   tool from entering the session even though the plugin loaded. Therefore
+ *   the manifest keeps `activation.onStartup === true` for daemon loading and
+ *   declares the tool through `contracts.tools`, but does not require a session
+ *   capability to activate `second_nature_ops`.
  * - `Shape: non-capability` reported by `openclaw plugins info` is EXPECTED
  *   for this plugin. OpenClaw counts capabilities only across cli-backend /
  *   text-inference / speech / realtime-* / media-understanding /

package/openclaw.plugin.json

@@ -1,13 +1,10 @@
 {
   "id": "second-nature",
   "name": "Second Nature",
-  "version": "0.2.9",
+  "version": "0.2.12",
   "description": "OpenClaw native plugin with synchronous surface registration and bundled runtime spine. Set SECOND_NATURE_WORKSPACE_ROOT or tool workspaceRoot to the same path as the agent workspace. Agent inner guide is packaged as agent-inner-guide.md. Ops surface: loop_status, self_health, tool_affordance, heartbeat_check, heartbeat_run, heartbeat_digest, snapshot:capture, narrative:diff, timeline, restore, runtime_secret_bootstrap, connector:run, guidance_payload.",
   "activation": {
-    "onStartup": true,
-    "onCapabilities": [
-      "tool"
-    ]
+    "onStartup": true
   },
   "contracts": {
     "commands": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@haaaiawd/second-nature",
-  "version": "0.2.9",
+  "version": "0.2.12",
   "description": "OpenClaw native plugin with synchronous registration, a packaged runtime artifact, and operator-facing status/explain flows.",
   "keywords": [
     "openclaw",

package/runtime/cli/host-capability/probe-host-capability.js

@@ -7,7 +7,7 @@ function mergeEvidenceRefs(...groups) {
     const out = [];
     for (const group of groups) {
         for (const ref of group) {
-            const key = `${ref.kind}:${ref.id}`;
+            const key = `${ref.family}:${ref.id}`;
             if (!seen.has(key)) {
                 seen.add(key);
                 out.push(ref);

package/runtime/cli/host-capability/types.d.ts

@@ -3,15 +3,10 @@
  *
  * Test coverage: tests/unit/cli/host-capability.test.ts, tests/integration/cli/host-capability-probe.test.ts
  */
+import type { SourceRef } from "../../shared/types/v8-contracts.js";
+export type { SourceRef } from "../../shared/types/v8-contracts.js";
 export type DeliveryCapabilityStatus = "target_available" | "target_none" | "channel_missing" | "host_api_unavailable" | "host_unsupported" | "unknown";
 export type CapabilityVerdict = "pass" | "fail" | "unknown" | "not_applicable";
-export interface SourceRef {
-    id: string;
-    kind: "platform_item" | "workspace_artifact" | "decision_record" | "user_anchor" | "connector_result" | "host_report" | "fallback_artifact";
-    uri: string;
-    excerptHash?: string;
-    observedAt?: string;
-}
 export interface HostCapabilityDocReference {
     title: string;
     url: string;

package/runtime/cli/host-capability/types.js

@@ -1,6 +1 @@
-/**
- * Host capability probe contracts (cli-system v5 / ADR-007).
- *
- * Test coverage: tests/unit/cli/host-capability.test.ts, tests/integration/cli/host-capability-probe.test.ts
- */
 export {};

package/runtime/cli/ops/heartbeat-surface.d.ts

@@ -45,6 +45,8 @@ export interface HeartbeatSurfaceResult {
         capabilityClass?: string | null;
         impulseText?: string | null;
         atmosphereText?: string | null;
+        expressionBoundaryConstraints?: string[] | null;
+        expressionBoundaryStyle?: string | null;
         freshnessMs?: number;
         missingReason?: string;
     };

package/runtime/cli/ops/heartbeat-surface.js

@@ -1,6 +1,23 @@
 import { createWorkspaceHeartbeatRunner } from "./workspace-heartbeat-runner.js";
 // T-CP.R.2: v8 real runtime spine bridge
 import { runRealRuntimeHeartbeatCycle, } from "../../core/second-nature/control-plane/real-runtime-spine.js";
+async function refreshHeartbeatImpulseContext(state, now) {
+    const { assembleImpulseSync } = await import("../../guidance/impulse-assembler.js");
+    const { buildExpressionBoundary } = await import("../../guidance/output-guard.js");
+    const { getShortAtmosphereTemplate } = await import("../../guidance/template-registry.js");
+    const { writeImpulseContext } = await import("../../core/second-nature/guidance/impulse-context-writer.js");
+    const impulseResult = assembleImpulseSync({ sceneType: "heartbeat" });
+    const atmosphere = getShortAtmosphereTemplate("active", "low");
+    const expressionBoundary = buildExpressionBoundary("heartbeat");
+    const result = await writeImpulseContext(state, {
+        sceneType: "heartbeat",
+        impulseResult,
+        atmosphereText: atmosphere.text,
+        expressionBoundaryConstraints: expressionBoundary.constraints,
+        expressionBoundaryStyle: expressionBoundary.style,
+    }, { now });
+    return "id" in result ? result.id : undefined;
+}
 function mapCycleToSurface(cycle, surfaceMode) {
     const status = cycle.status === "runtime_carrier_only"
         ? "runtime_carrier_only"
@@ -111,6 +128,11 @@ export async function heartbeatCheck(input) {
                 }
                 else {
                     const spine = v8Result;
+                    const artifactId = await refreshHeartbeatImpulseContext(input.state, timestamp);
+                    if (artifactId) {
+                        spine.impulseContextArtifactId = artifactId;
+                        surfaceResult.reasons.push(`impulse_context_refreshed:${artifactId}`);
+                    }
                     surfaceResult.v8Spine = spine;
                     surfaceResult.livedExperienceLoopClaimed = Boolean(spine.cycleId && (spine.closureRef || spine.noActionReason));
                     surfaceResult.reasons = [
@@ -134,7 +156,7 @@ export async function heartbeatCheck(input) {
         if (input.state) {
             try {
                 const { readImpulseContext } = await import("../../core/second-nature/guidance/impulse-context-reader.js");
-                const ctx = await readImpulseContext(input.state, "social");
+                const ctx = await readImpulseContext(input.state, "heartbeat");
                 if (ctx.available) {
                     surfaceResult.impulseContext = {
                         available: true,
@@ -142,6 +164,8 @@ export async function heartbeatCheck(input) {
                         capabilityClass: ctx.artifact.capabilityClass,
                         impulseText: ctx.artifact.impulseText,
                         atmosphereText: ctx.artifact.atmosphereText,
+                        expressionBoundaryConstraints: ctx.artifact.expressionBoundaryConstraints,
+                        expressionBoundaryStyle: ctx.artifact.expressionBoundaryStyle,
                         freshnessMs: ctx.freshnessMs,
                     };
                     surfaceResult.reasons.push(`impulse_context:${ctx.artifact.id}`);
@@ -154,8 +178,13 @@ export async function heartbeatCheck(input) {
                     surfaceResult.reasons.push(`impulse_context_missing:${ctx.reason}`);
                 }
             }
-            catch {
-                // Non-fatal: impulse context is advisory
+            catch (readErr) {
+                const msg = readErr instanceof Error ? readErr.message : String(readErr);
+                surfaceResult.impulseContext = {
+                    available: false,
+                    missingReason: `read_exception:${msg.slice(0, 120)}`,
+                };
+                surfaceResult.reasons.push(`impulse_context_read_failed:${msg.slice(0, 120)}`);
             }
         }
         return surfaceResult;

package/runtime/cli/ops/ops-router.js

@@ -325,9 +325,9 @@ function createStaticUnknownAdapter(workspaceRoot) {
                     evidenceRefs: [
                         {
                             id: `delivery:${parsed.manifest.platformId}`,
-                            kind: "workspace_artifact",
+                            family: "audit",
                             uri: `workspace://connectors/${parsed.manifest.platformId}/manifest.yaml`,
-                            observedAt: now,
+                            redactionClass: "none",
                         },
                     ],
                 };
@@ -1527,7 +1527,7 @@ export function createOpsRouter(deps) {
                 const platformId = typeof input?.platformId === "string"
                     ? input.platformId
                     : undefined;
-                const validSceneTypes = ["social", "reply", "outreach", "quiet", "explain", "user_reply"];
+                const validSceneTypes = ["social", "reply", "outreach", "quiet", "heartbeat", "explain", "user_reply"];
                 if (!validSceneTypes.includes(sceneType)) {
                     const envelope = {
                         ok: false,

package/runtime/cli/ops/workspace-heartbeat-runner.js

@@ -4,6 +4,7 @@ import { createAgentGoalStore } from "../../storage/goal/agent-goal-store.js";
 import { createNarrativeStateStore } from "../../storage/narrative/narrative-state-store.js";
 import { createRelationshipMemoryStore } from "../../storage/relationship/relationship-memory-store.js";
 import { createIdentityProfileStore } from "../../storage/services/identity-profile-store.js";
+import { toCanonicalSourceRef } from "../../shared/source-ref-compat.js";
 import { generateHeartbeatDigest, } from "../../observability/services/heartbeat-digest-assembler.js";
 import { createHistoryDigestStore } from "../../storage/services/history-digest-store.js";
 export async function loadSnapshotInputsForWorkspaceHeartbeat(readModels, options = {}) {
@@ -26,11 +27,7 @@ export async function loadSnapshotInputsForWorkspaceHeartbeat(readModels, option
             const snapshot = await loadLifeEvidenceSnapshot(options.state, options.workspaceRoot, { limit: 50 }, 
             // Skip repair gate here — runner is called inside a live cycle; gate ran at startup.
             { runRepairGate: false });
-            lifeEvidenceRefs = snapshot.evidenceRefs.map((ref) => ({
-                id: ref.id,
-                kind: ref.kind,
-                uri: ref.uri,
-            }));
+            lifeEvidenceRefs = snapshot.evidenceRefs.map((ref) => toCanonicalSourceRef(ref));
             platformEventCount = snapshot.platformEvents.length;
             workEventCount = snapshot.workEvents.length;
             if (snapshot.empty) {

package/runtime/connectors/manifest/manifest-schema.d.ts

@@ -116,7 +116,7 @@ export declare const connectorManifestV6Schema: z.ZodObject<{
 export type ConnectorManifestV6 = z.infer<typeof connectorManifestV6Schema>;
 export interface ConnectorConflict {
     platformId: string;
-    existingSource: "built_in" | "workspace";
+    existingSource: "built_in" | "workspace" | "workspace_shadow";
     attemptedSource: "built_in" | "workspace";
     reason: string;
 }
@@ -127,7 +127,7 @@ export interface ConnectorManifestValidationError {
 }
 export interface ConnectorInventoryEntry {
     platformId: string;
-    source: "built_in" | "workspace";
+    source: "built_in" | "workspace" | "workspace_shadow";
     manifestPath?: string;
     trustStatus: ConnectorTrustStatus;
     executable: boolean;

package/runtime/connectors/registry/dynamic-connector-registry.js

@@ -41,6 +41,12 @@ function manifestToInventoryEntry(manifest, source, manifestPath) {
         validationErrors: [],
     };
 }
+function isSafeBuiltInShadow(manifest) {
+    const reason = manifest.trust?.reason?.trim();
+    if (!manifest.trust?.override || !reason)
+        return false;
+    return manifest.runner.kind === "declarative_http" || manifest.runner.kind === "scriptable_node";
+}
 /**
  * DynamicConnectorRegistry scans workspace manifests, validates, classifies trust,
  * merges built-in entries, applies fail-closed conflict policy, and publishes
@@ -79,11 +85,20 @@ export class DynamicConnectorRegistry {
             }
             const manifest = parseResult.manifest;
             const manifestPath = path.relative(workspaceRoot, file.path);
-            // Duplicate platformId without override -> fail-closed
+            // Duplicate platformId without explicit safe override -> fail-closed.
+            // Built-ins may be shadowed only by an auditable workspace manifest with
+            // a trusted runner kind, so operators can repair endpoint config without
+            // silently replacing native code.
             if (builtInMap.has(manifest.platformId) || dynamicMap.has(manifest.platformId)) {
                 const existing = builtInMap.get(manifest.platformId) ?? dynamicMap.get(manifest.platformId);
                 const allowOverride = manifest.trust?.override === true;
                 const isTrustedSource = existing.source === "built_in";
+                if (isTrustedSource && isSafeBuiltInShadow(manifest)) {
+                    const entry = manifestToInventoryEntry(manifest, "workspace_shadow", manifestPath);
+                    dynamicMap.set(manifest.platformId, entry);
+                    registered++;
+                    continue;
+                }
                 if (!allowOverride || isTrustedSource) {
                     conflicts.push({
                         platformId: manifest.platformId,

package/runtime/connectors/services/connector-executor-adapter.js

@@ -51,7 +51,13 @@ function channelPriorityForRunner(manifest) {
         return ["browser"];
     return ["api_rest"];
 }
-function registerWorkspaceManifests(registry, workspaceRoot) {
+function isSafeBuiltInShadow(manifest) {
+    const reason = manifest.trust?.reason?.trim();
+    if (!manifest.trust?.override || !reason)
+        return false;
+    return manifest.runner.kind === "declarative_http" || manifest.runner.kind === "scriptable_node";
+}
+function registerWorkspaceManifests(registry, builtInPlatformIds, workspaceRoot) {
     if (!workspaceRoot)
         return;
     for (const file of scanConnectorManifests(workspaceRoot)) {
@@ -59,6 +65,12 @@ function registerWorkspaceManifests(registry, workspaceRoot) {
         if (!parsed.ok)
             continue;
         const manifest = parsed.manifest;
+        // Built-in platforms may only be shadowed by auditable, trusted-runner manifests.
+        // Unsafe shadows are ignored by execution registry; they remain visible in
+        // DynamicConnectorRegistry conflicts for diagnostics.
+        if (builtInPlatformIds.has(manifest.platformId) && !isSafeBuiltInShadow(manifest)) {
+            continue;
+        }
         try {
             registry.register({
                 platformId: manifest.platformId,
@@ -201,8 +213,8 @@ function createMoltbookMockRunner(workspaceRoot) {
                     latencyMs: Date.now() - started,
                     success: false,
                     error: {
-                        code: "mock_read_error",
-                        detail: String(err),
+                        code: "configuration_missing",
+                        detail: `moltbook mock unreadable: ${err instanceof Error ? err.message : String(err)}`,
                     },
                 };
             }
@@ -424,9 +436,13 @@ function createAdaptiveExecutionRunner(vault, workspaceRoot) {
             const workspaceManifest = workspaceManifestResult?.manifest;
             const isBuiltInPlatform = platformId === "moltbook" ||
                 platformId === "evomap" ||
-                platformId === "agent-world";
+                platformId === "agent-world" ||
+                platformId === "instreet";
+            const effectiveWorkspaceManifest = workspaceManifest && (!isBuiltInPlatform || isSafeBuiltInShadow(workspaceManifest))
+                ? workspaceManifest
+                : undefined;
             const requiresCredential = isBuiltInPlatform ||
-                Boolean(workspaceManifest?.credentials.some((credential) => credential.required !== false));
+                Boolean(effectiveWorkspaceManifest?.credentials.some((credential) => credential.required !== false));
             const credential = requiresCredential
                 ? await vault.loadCredentialContext(platformId)
                 : undefined;
@@ -448,9 +464,33 @@ function createAdaptiveExecutionRunner(vault, workspaceRoot) {
             const activeCredential = credential?.status === "active" && credential.encryptedValue
                 ? { encryptedValue: credential.encryptedValue }
                 : undefined;
+            // Safe workspace shadows of built-in platforms take precedence over built-in runners.
+            if (effectiveWorkspaceManifest && effectiveWorkspaceManifest.runner.kind === "declarative_http") {
+                const httpRunner = createDeclarativeHttpRunner(effectiveWorkspaceManifest, activeCredential);
+                return httpRunner.run(_plan, request);
+            }
+            if (effectiveWorkspaceManifest && effectiveWorkspaceManifest.runner.kind === "scriptable_node") {
+                if (!workspaceManifestResult) {
+                    return {
+                        platformId,
+                        channel: request.preferredChannel ?? "api_rest",
+                        latencyMs: Date.now() - started,
+                        success: false,
+                        error: {
+                            code: "configuration_missing",
+                            detail: "scriptable_node requires workspace manifest with manifestDir",
+                        },
+                    };
+                }
+                const scriptRunner = createScriptableNodeRunner(effectiveWorkspaceManifest, workspaceManifestResult.manifestDir, activeCredential);
+                return scriptRunner.run(_plan, request);
+            }
             if (platformId === "moltbook") {
                 const baseUrl = process.env.SECOND_NATURE_MOLTBOOK_BASE_URL;
                 if (baseUrl) {
+                    const effectivePlan = request.intent === "feed.read" && _plan.channel !== "api_rest"
+                        ? { ..._plan, channel: "api_rest", endpointMode: "rest_json", degraded: false }
+                        : _plan;
                     const apiClient = createMoltbookApiClient({
                         baseUrl,
                         accessToken: activeCredential.encryptedValue,
@@ -461,13 +501,13 @@ function createAdaptiveExecutionRunner(vault, workspaceRoot) {
                         skillRunner: {
                             run: async () => {
                                 throw {
-                                    code: "protocol_mismatch",
+                                    code: "configuration_missing",
                                     detail: "moltbook_skill_runner_not_configured",
                                 };
                             },
                         },
                     });
-                    return runner.run(_plan, request);
+                    return runner.run(effectivePlan, request);
                 }
                 // Mock fallback when real API is not configured
                 const mockRunner = createMoltbookMockRunner(workspaceRoot);
@@ -583,28 +623,6 @@ function createAdaptiveExecutionRunner(vault, workspaceRoot) {
                     },
                 };
             }
-            // Wave 83: workspace declarative_http connector fallback
-            if (workspaceManifest && workspaceManifest.runner.kind === "declarative_http") {
-                const httpRunner = createDeclarativeHttpRunner(workspaceManifest, activeCredential);
-                return httpRunner.run(_plan, request);
-            }
-            // Wave 90: workspace scriptable_node connector
-            if (workspaceManifest && workspaceManifest.runner.kind === "scriptable_node") {
-                if (!workspaceManifestResult) {
-                    return {
-                        platformId,
-                        channel: request.preferredChannel ?? "api_rest",
-                        latencyMs: Date.now() - started,
-                        success: false,
-                        error: {
-                            code: "configuration_missing",
-                            detail: "scriptable_node requires workspace manifest with manifestDir",
-                        },
-                    };
-                }
-                const scriptRunner = createScriptableNodeRunner(workspaceManifest, workspaceManifestResult.manifestDir, activeCredential);
-                return scriptRunner.run(_plan, request);
-            }
             return {
                 platformId,
                 channel: request.preferredChannel ?? "api_rest",
@@ -621,11 +639,12 @@ function createAdaptiveExecutionRunner(vault, workspaceRoot) {
 export function createConnectorExecutorAdapter(options) {
     const vault = createCredentialVault(options.stateDb.db);
     const registry = new CapabilityContractRegistry();
-    registry.register({ ...moltbookManifest });
-    registry.register({ ...evomapManifest });
-    registry.register({ ...agentWorldManifest });
-    registry.register({ ...instreetManifest });
-    registerWorkspaceManifests(registry, options.workspaceRoot);
+    const builtInManifests = [moltbookManifest, evomapManifest, agentWorldManifest, instreetManifest];
+    const builtInPlatformIds = new Set(builtInManifests.map((m) => m.platformId));
+    for (const manifest of builtInManifests) {
+        registry.register({ ...manifest });
+    }
+    registerWorkspaceManifests(registry, builtInPlatformIds, options.workspaceRoot);
     const cooldownPort = createConnectorCooldownPort(options.stateDb);
     const routeContextPort = createCredentialRouteContextPort(vault, options.stateDb);
     const routePlanner = new ConnectorRoutePlanner(registry, routeContextPort, new ChannelHealthStore());
@@ -641,7 +660,7 @@ export function createConnectorExecutorAdapter(options) {
     });
     return {
         async executeEffect(input) {
-            registerWorkspaceManifests(registry, options.workspaceRoot);
+            registerWorkspaceManifests(registry, builtInPlatformIds, options.workspaceRoot);
             return policy.executeWithPolicy(input.intent, {
                 platformId: input.platformId,
                 intent: input.intent,

package/runtime/core/second-nature/action/action-closure-recorder.d.ts

@@ -43,6 +43,8 @@ export interface ActionClosureRecord {
 }
 export interface RecordClosureOptions {
     now?: string;
+    platformId?: string;
+    capabilityId?: string;
 }
 export type RecordClosureResult = {
     status: "recorded";

package/runtime/core/second-nature/action/action-closure-recorder.js

@@ -60,7 +60,6 @@ export async function recordNoActionClosure(db, cycleId, noActionReason, options
             },
         ],
         redactionClass: "none",
-        lifecycleStatus: "closed",
         payloadJson: JSON.stringify({ dispatchAttempt: 0, inputSummary: "no-action" }),
     });
     if ("reason" in result) {
@@ -78,12 +77,13 @@ export async function recordRememberClosure(db, cycleId, memoryReviewCandidate,
         id: closureId,
         createdAt: now,
         cycleId,
+        platformId: options?.platformId ?? "heartbeat",
+        capabilityId: options?.capabilityId,
         status: "completed",
         reason: "remember_for_review",
         nextState: "pending_daily_review",
         sourceRefs: memoryReviewCandidate.sourceRefs,
         redactionClass: "none",
-        lifecycleStatus: "closed",
         payloadJson: JSON.stringify({
             memoryReviewCandidate,
             dispatchAttempt: 1,
@@ -132,7 +132,6 @@ export async function recordPolicyOutcomeClosure(db, cycleId, closureStatus, rea
         nextState: params.nextState ?? "await_next_cycle",
         sourceRefs,
         redactionClass: "none",
-        lifecycleStatus: "closed",
         payloadJson: JSON.stringify({
             dispatchAttempt: 1,
             inputSummary: buildInputSummary(params.proposalId, params.decisionId),
@@ -173,7 +172,6 @@ export async function recordExecutionClosure(db, cycleId, closureStatus, reason,
         nextState: params.nextState ?? (closureStatus === "completed" ? "await_next_cycle" : "retryable"),
         sourceRefs,
         redactionClass: "none",
-        lifecycleStatus: "closed",
         payloadJson: JSON.stringify({
             dispatchAttempt: 1,
             executionResultRef: params.executionResultRef,

package/runtime/core/second-nature/action/action-proposal-builder.js

@@ -22,22 +22,12 @@
  *
  * Test coverage: tests/unit/action/action-proposal-builder.test.ts
  */
-import { readJudgmentVerdictById, writeActionClosureRecord, } from "../../../storage/v8-state-stores.js";
+import { readJudgmentVerdictById, } from "../../../storage/v8-state-stores.js";
+import { parseSourceRefs } from "../../../shared/serialization.js";
 import { ACTION_KIND_REGISTRY } from "../../../shared/types/v8-contracts.js";
 // ───────────────────────────────────────────────────────────────
 // Helpers
 // ───────────────────────────────────────────────────────────────
-function parseVerdictSourceRefs(json) {
-    if (!json)
-        return [];
-    try {
-        const parsed = JSON.parse(json);
-        return Array.isArray(parsed) ? parsed : [];
-    }
-    catch {
-        return [];
-    }
-}
 function buildExpectedOutput(actionKind) {
     switch (actionKind) {
         case "ignore":
@@ -99,8 +89,8 @@ export async function buildActionProposal(db, judgmentVerdictId, options) {
             judgmentVerdictId,
         };
     }
-    const sourceRefs = parseVerdictSourceRefs(verdict.sourceRefsJson);
-    // remember → memory review candidate closure (no direct projection)
+    const sourceRefs = parseSourceRefs(verdict.sourceRefsJson);
+    // remember → memory review candidate (no direct projection; orchestrator writes closure)
     if (actionKind === "remember") {
         const candidate = {
             closureSubtype: "remember_for_review",
@@ -131,27 +121,10 @@ export async function buildActionProposal(db, judgmentVerdictId, options) {
                 },
             ]),
         };
-        const closureId = `cls_remember_${judgmentVerdictId}_${now.replace(/[:.]/g, "")}`;
-        const writeResult = await writeActionClosureRecord(db, {
-            id: closureId,
-            createdAt: now,
-            cycleId,
-            platformId: "heartbeat",
-            status: "completed",
-            reason: "remember_for_review",
-            nextState: "pending_daily_review",
-            sourceRefs: candidate.sourceRefs,
-            redactionClass: "none",
-            lifecycleStatus: "closed",
-            payloadJson: JSON.stringify({ memoryReviewCandidate: candidate }),
-        });
-        if ("reason" in writeResult) {
-            return writeResult;
-        }
         return {
             status: "remember_for_review",
             memoryReviewCandidate: candidate,
-            closureId,
+            closureId: `cls_remember_${judgmentVerdictId}_${now.replace(/[:.]/g, "")}`,
         };
     }
     // Actionable verdict → build proposal

package/runtime/core/second-nature/action/policy-bound-dispatch.js

@@ -20,6 +20,7 @@
  *
  * Test coverage: tests/unit/action/policy-bound-dispatch.test.ts
  */
+import { serializeSourceRefs } from "../../../shared/serialization.js";
 // ───────────────────────────────────────────────────────────────
 // Helpers
 // ───────────────────────────────────────────────────────────────
@@ -60,7 +61,7 @@ export function dispatchAllowedAction(proposal, decision, options) {
                 actionKind: target,
                 draftType,
                 policyProof: { decisionId: decision.id, decision: decision.decision },
-                sourceRefs: JSON.stringify(decision.proofRefs),
+                sourceRefs: serializeSourceRefs(decision.proofRefs),
             },
         };
     }
@@ -75,7 +76,7 @@ export function dispatchAllowedAction(proposal, decision, options) {
                     capabilityId: proposal.targetCapabilityId ?? "run_connector",
                     idempotencyKey: proposal.idempotencyKey,
                     policyProof: { decisionId: decision.id, decision: decision.decision },
-                    sourceRefs: JSON.stringify(proposal.sourceRefs),
+                    sourceRefs: serializeSourceRefs(proposal.sourceRefs),
                 },
             };
         }
@@ -91,7 +92,7 @@ export function dispatchAllowedAction(proposal, decision, options) {
                     actionKind: proposal.actionKind,
                     draftType,
                     policyProof: { decisionId: decision.id, decision: decision.decision },
-                    sourceRefs: JSON.stringify(proposal.sourceRefs),
+                    sourceRefs: serializeSourceRefs(proposal.sourceRefs),
                 },
             };
         }

package/runtime/core/second-nature/control-plane/accepted-projection-loader.js

@@ -20,6 +20,7 @@
  * Test coverage: tests/unit/control-plane/accepted-projection-loader.test.ts
  */
 import { readMemoryProjectionsByStatus, } from "../../../storage/v8-state-stores.js";
+import { parseSourceRefs } from "../../../shared/serialization.js";
 // ───────────────────────────────────────────────────────────────
 // Helpers
 // ───────────────────────────────────────────────────────────────
@@ -33,17 +34,6 @@ function parsePayloadJson(json) {
         return {};
     }
 }
-function parseSourceRefs(json) {
-    if (!json)
-        return [];
-    try {
-        const parsed = JSON.parse(json);
-        return Array.isArray(parsed) ? parsed : [];
-    }
-    catch {
-        return [];
-    }
-}
 // ───────────────────────────────────────────────────────────────
 // Public API
 // ───────────────────────────────────────────────────────────────

package/runtime/core/second-nature/control-plane/heartbeat-orchestrator.d.ts

@@ -35,6 +35,7 @@ export interface HeartbeatOrchestrationResult {
     closureRef?: SourceRef;
     noActionReason?: V8ReasonCode;
     degraded?: DegradedOperationResult;
+    rhythmDegraded?: DegradedOperationResult;
     rhythmState?: DailyRhythmState;
 }
 export declare function runHeartbeatCycle(db: StateDatabase, request: HeartbeatOrchestrationRequest): Promise<HeartbeatOrchestrationResult | DegradedOperationResult>;