agentic-qe 3.12.2 → 3.13.0

package/dist/cli/chunks/workflow-orchestrator-GOWSPR3G.js

@@ -0,0 +1,2 @@
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.13.0");process.exit(0)}
+import{a,b,c,d}from"./chunk-54MFKCLT.js";import"./chunk-IYDYJ33J.js";import"./chunk-G5DFYX3J.js";import"./chunk-W5YEIHIO.js";import"./chunk-BUGWPTMF.js";import"./chunk-HVB2L52I.js";import"./chunk-OXXMVQDF.js";import"./chunk-NUQBJGGF.js";import"./chunk-2DIT5AUU.js";import"./chunk-QI4CGJNK.js";import"./chunk-CYL2FV23.js";import"./chunk-E3B5XTXJ.js";import"./chunk-SNTUKW4Q.js";import"./chunk-TVMFH5N2.js";import"./chunk-THBTN7XB.js";import"./chunk-RDU4WTV2.js";import"./chunk-LBE2P6UC.js";import"./chunk-IZRLIWFN.js";import"./chunk-AO7AHX6K.js";import"./chunk-YRQLVGCI.js";import"./chunk-3GSYD5SL.js";import"./chunk-ES7WCYOU.js";export{b as DEFAULT_WORKFLOW_CONFIG,a as WorkflowEvents,c as WorkflowOrchestrator,d as createWorkflowOrchestrator};

package/dist/cli/chunks/{wrappers-MMO5YKOZ.js → wrappers-NA6FHA63.js}

@@ -1,2 +1,2 @@
-import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.12.2");process.exit(0)}
-import{a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v as L,w as M,x as N}from"./chunk-VOHYQ6MX.js";import{a as v,b as w,c as x,d as y,e as z,f as A,g as B,h as C,i as D,j as E,k as F,l as G,m as H,n as I,o as J,p as K}from"./chunk-DTXHRALB.js";import"./chunk-APVXTHTA.js";import"./chunk-AL5QT6OX.js";import"./chunk-YY4KXDI6.js";import"./chunk-R5HC6JVJ.js";import"./chunk-ACDZ2CRV.js";import"./chunk-CKFZOPZN.js";import"./chunk-P65S7AZA.js";import"./chunk-X47GHZY3.js";import"./chunk-WRMUQVKY.js";import"./chunk-UF3YOGHV.js";import"./chunk-V2QYW5KW.js";import"./chunk-4KEOBDEI.js";import"./chunk-C7VNQ4PY.js";import"./chunk-QYST2TZW.js";import"./chunk-YZ44FUVJ.js";import"./chunk-YDZIPP3Y.js";import"./chunk-CTFW7CMI.js";import"./chunk-HU6ETNA7.js";export{z as GNNLayerFactory,i as QEFlashAttention,x as QEGNNEmbeddingIndex,y as QEGNNIndexFactory,a as QESONA,e as QE_FLASH_ATTENTION_CONFIG,g as QE_PERFORMANCE_TARGETS,f as QE_SONA_CONFIG,A as TensorCompressionFactory,u as batchComputeAttention,K as batchDifferentiableSearch,M as checkRuvectorPackagesAvailable,c as createDomainQESONA,j as createQEFlashAttention,b as createQESONA,D as getDifferentiableSearch,F as getGetCompressionLevel,E as getHierarchicalForward,G as getInit,h as getOptimalBlockConfig,k as getQEFlashAttentionConfig,n as getRuvectorDotProductAttention,m as getRuvectorFlashAttention,p as getRuvectorHyperbolicAttention,B as getRuvectorLayer,q as getRuvectorLinearAttention,r as getRuvectorMoEAttention,o as getRuvectorMultiHeadAttention,L as getRuvectorPackageVersions,C as getTensorCompress,l as getWorkloadTypes,N as initAllRuvectorPackages,w as initGNN,d as isAttentionAvailable,v as isGNNAvailable,s as toFloat32Array,H as toFloat32ArrayGNN,J as toIEmbedding,t as toNumberArrayAttn,I as toNumberArrayGNN};
+import{createRequire as __cr}from"module";const require=__cr(import.meta.url);if(process.argv.includes('--version')||process.argv.includes('-v')){console.log("3.13.0");process.exit(0)}
+import{a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p,q,r,s,t,u,v as L,w as M,x as N}from"./chunk-HOKON5EL.js";import{a as v,b as w,c as x,d as y,e as z,f as A,g as B,h as C,i as D,j as E,k as F,l as G,m as H,n as I,o as J,p as K}from"./chunk-HTPM3URI.js";import"./chunk-G5DFYX3J.js";import"./chunk-W5YEIHIO.js";import"./chunk-BUGWPTMF.js";import"./chunk-HVB2L52I.js";import"./chunk-OXXMVQDF.js";import"./chunk-NUQBJGGF.js";import"./chunk-2DIT5AUU.js";import"./chunk-CYL2FV23.js";import"./chunk-SNTUKW4Q.js";import"./chunk-TVMFH5N2.js";import"./chunk-THBTN7XB.js";import"./chunk-RDU4WTV2.js";import"./chunk-LBE2P6UC.js";import"./chunk-IZRLIWFN.js";import"./chunk-AO7AHX6K.js";import"./chunk-YRQLVGCI.js";import"./chunk-3GSYD5SL.js";import"./chunk-ES7WCYOU.js";export{z as GNNLayerFactory,i as QEFlashAttention,x as QEGNNEmbeddingIndex,y as QEGNNIndexFactory,a as QESONA,e as QE_FLASH_ATTENTION_CONFIG,g as QE_PERFORMANCE_TARGETS,f as QE_SONA_CONFIG,A as TensorCompressionFactory,u as batchComputeAttention,K as batchDifferentiableSearch,M as checkRuvectorPackagesAvailable,c as createDomainQESONA,j as createQEFlashAttention,b as createQESONA,D as getDifferentiableSearch,F as getGetCompressionLevel,E as getHierarchicalForward,G as getInit,h as getOptimalBlockConfig,k as getQEFlashAttentionConfig,n as getRuvectorDotProductAttention,m as getRuvectorFlashAttention,p as getRuvectorHyperbolicAttention,B as getRuvectorLayer,q as getRuvectorLinearAttention,r as getRuvectorMoEAttention,o as getRuvectorMultiHeadAttention,L as getRuvectorPackageVersions,C as getTensorCompress,l as getWorkloadTypes,N as initAllRuvectorPackages,w as initGNN,d as isAttentionAvailable,v as isGNNAvailable,s as toFloat32Array,H as toFloat32ArrayGNN,J as toIEmbedding,t as toNumberArrayAttn,I as toNumberArrayGNN};

package/dist/cli/commands/llm-router.js

@@ -400,6 +400,7 @@ function getDefaultModelForProvider(provider) {
     const defaults = {
         claude: 'claude-sonnet-4-6',
         'claude-code': 'sonnet',
+        codex: 'gpt-5-codex',
         openai: 'gpt-4o',
         ollama: 'llama3.1',
         openrouter: 'anthropic/claude-sonnet-4',

package/dist/init/skills-installer.js

@@ -30,6 +30,7 @@ const V3_DOMAIN_SKILLS = [
     'qe-visual-accessibility', // Visual regression, WCAG
     'qe-chaos-resilience', // Fault injection, resilience
     'qe-learning-optimization', // Transfer learning, self-improvement
+    'qe-court', // Adversarial review court — overturn-gated SHIP/REMAND/BLOCK verdict (ADR-124)
     // V3 utilities
     'qe-iterative-loop', // QE iteration patterns
     // New skills (ADR-086 skill design standards)

package/dist/integrations/embeddings/base/EmbeddingGenerator.js

@@ -11,7 +11,6 @@
  * @module integrations/embeddings/base/EmbeddingGenerator
  */
 import { EmbeddingCache } from '../cache/EmbeddingCache.js';
-import { pipeline } from '@huggingface/transformers';
 import { cosineSimilarity } from '../../../shared/utils/vector-math.js';
 /**
  * Base embedding generator class
@@ -61,6 +60,19 @@ export class EmbeddingGenerator {
             const loadDtype = this.config.quantization === 'none' ? 'fp32' :
                 this.config.quantization === 'fp16' ? 'fp16' :
                     this.config.quantization === 'int8' ? 'int8' : 'q8';
+            // Lazy-load the optional transformers backend (#565). If it isn't
+            // installed, fail with an actionable message pointing at the endpoint path.
+            let pipeline;
+            try {
+                ({ pipeline } = await import('@huggingface/transformers'));
+            }
+            catch (err) {
+                throw new Error('Local (in-process) embeddings require the optional dependency ' +
+                    '"@huggingface/transformers", which is not installed. Either run ' +
+                    '`npm install @huggingface/transformers`, or configure an embedding ' +
+                    'endpoint (e.g. Cognitum /v1/embeddings) so the local backend is not needed. ' +
+                    `Underlying import error: ${err instanceof Error ? err.message : String(err)}`);
+            }
             this.model = await pipeline('feature-extraction', this.config.model, {
                 dtype: loadDtype,
                 // v4 narrowed ProgressInfo to a discriminated union — `progress`

package/dist/integrations/ruvector/brain-rvf-exporter.js

@@ -3,11 +3,82 @@
  * `.rvf` file using the @ruvector/rvf-node native binding via rvf-native-adapter.
  * Falls back to JSONL directory format when the native binding is unavailable.
  */
-import { existsSync, statSync, unlinkSync, writeFileSync } from 'fs';
-import { resolve } from 'path';
+import { existsSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync } from 'fs';
+import { basename, dirname, join, resolve } from 'path';
 import { createRvfStore, openRvfStore, openRvfStoreReadonly, isRvfNativeAvailable, } from './rvf-native-adapter.js';
 import { sha256, tableExists, queryAll, domainFilterForColumn, ensureTargetTables, mergeGenericRow, mergeAppendOnlyRow, TABLE_CONFIGS, TABLE_BLOB_COLUMNS, PK_COLUMNS, CONFIDENCE_COLUMNS, TIMESTAMP_COLUMNS, serializeRowBlobs, deserializeRowBlobs, } from './brain-shared.js';
 // --- Export ---
+/**
+ * Sidecar suffixes that make up a complete store on disk. `''` is the store
+ * itself; the adapter writes `.idmap.json` on close, and we write the manifest.
+ */
+const RVF_STORE_SUFFIXES = ['', '.idmap.json', '.manifest.json'];
+/**
+ * Everything an abandoned tmp export can leave behind. `.lock` is cleaned up
+ * but deliberately absent from RVF_STORE_SUFFIXES — renaming a lock into the
+ * final path is the very corruption this fix exists to prevent.
+ */
+const RVF_CLEANUP_SUFFIXES = [...RVF_STORE_SUFFIXES, '.lock'];
+/** Best-effort removal of a store and its sidecars at `base`. */
+function removeStoreFiles(base) {
+    for (const suffix of RVF_CLEANUP_SUFFIXES) {
+        try {
+            const p = `${base}${suffix}`;
+            if (existsSync(p))
+                unlinkSync(p);
+        }
+        catch {
+            // best-effort — a leftover tmp is inert, unlike a corrupt final store
+        }
+    }
+}
+/**
+ * Remove tmp stores orphaned by killed exports (#563). Each interrupted export
+ * strands a full-size tmp store, so on a project where the checkpoint hook is
+ * killed regularly these would accumulate unbounded.
+ *
+ * Only tmps whose owning pid is gone are removed: a live pid means a concurrent
+ * export is mid-write, and deleting its tmp would corrupt exactly what this
+ * change exists to protect.
+ */
+function sweepStaleTmpFiles(outPath) {
+    const dir = dirname(outPath);
+    const prefix = `${basename(outPath)}.tmp.`;
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (!entry.startsWith(prefix))
+            continue;
+        // `<name>.rvf.tmp.<pid>` and its `<...>.tmp.<pid>.idmap.json` siblings.
+        const pid = Number.parseInt(entry.slice(prefix.length).split('.')[0], 10);
+        if (!Number.isInteger(pid) || pid <= 0)
+            continue;
+        if (pid !== process.pid && isPidAlive(pid))
+            continue;
+        try {
+            unlinkSync(join(dir, entry));
+        }
+        catch {
+            // best-effort
+        }
+    }
+}
+/** True when a process with `pid` exists (signal 0 probes without delivering). */
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        // EPERM means it exists but belongs to another user — still alive.
+        return err.code === 'EPERM';
+    }
+}
 /** Export brain state to a single `.rvf` file with vector embeddings + kernel. */
 export function exportBrainToRvf(db, options, sourceDbLabel = 'memory.db') {
     if (!isRvfNativeAvailable()) {
@@ -15,14 +86,20 @@ export function exportBrainToRvf(db, options, sourceDbLabel = 'memory.db') {
     }
     const outPath = resolve(options.outputPath);
     const dimension = options.dimension ?? 384;
-    // Clean up any existing file
-    if (existsSync(outPath))
-        unlinkSync(outPath);
-    const idmapPath = `${outPath}.idmap.json`;
-    if (existsSync(idmapPath))
-        unlinkSync(idmapPath);
+    // Issue #563: build the store at a private tmp path and rename it over the
+    // final path only once it is closed and complete. The previous code deleted
+    // the old store and then built the new one in place, so any interruption
+    // (hook timeout, session teardown, SIGKILL) left a created-but-incomplete
+    // store that could neither be opened (ManifestNotFound) nor created over
+    // (FsyncFailed) — permanently disabling the RVF backend. With tmp+rename an
+    // interrupted export leaves the *previous* good store untouched and orphans
+    // only an inert tmp file, which the next export sweeps.
+    const tmpPath = `${outPath}.tmp.${process.pid}`;
+    sweepStaleTmpFiles(outPath);
+    removeStoreFiles(tmpPath);
     // Create RVF container via adapter (handles idmap automatically)
-    const rvf = createRvfStore(outPath, dimension);
+    const rvf = createRvfStore(tmpPath, dimension);
+    let closed = false;
     try {
         // --- Export all tables using TABLE_CONFIGS ---
         const allTableData = {};
@@ -153,12 +230,37 @@ export function exportBrainToRvf(db, options, sourceDbLabel = 'memory.db') {
             catch { /* best-effort */ }
         }
         // Persist manifest as sidecar JSON alongside the .rvf file
-        const manifestPath = `${outPath}.manifest.json`;
-        writeFileSync(manifestPath, JSON.stringify(manifest, null, 2), 'utf-8');
+        writeFileSync(`${tmpPath}.manifest.json`, JSON.stringify(manifest, null, 2), 'utf-8');
+        // Close before promoting: close() flushes the store and writes the idmap
+        // sidecar, so renaming any earlier would publish an incomplete store.
+        rvf.close();
+        closed = true;
+        // Promote tmp → final. The store itself goes last: until it lands, the
+        // previous store (if any) is still the one on disk, and a crash mid-promote
+        // leaves the old store readable rather than a half-written new one.
+        for (const suffix of [...RVF_STORE_SUFFIXES].reverse()) {
+            const from = `${tmpPath}${suffix}`;
+            const to = `${outPath}${suffix}`;
+            if (existsSync(from)) {
+                renameSync(from, to);
+            }
+            else if (existsSync(to)) {
+                // No new sidecar produced — drop the stale one so it can't be read
+                // against the new store.
+                unlinkSync(to);
+            }
+        }
         return manifest;
     }
-    finally {
-        rvf.close();
+    catch (err) {
+        if (!closed) {
+            try {
+                rvf.close();
+            }
+            catch { /* best-effort */ }
+        }
+        removeStoreFiles(tmpPath);
+        throw err;
     }
 }
 /** Legacy field-to-table mapping for older RVF exports. */

package/dist/integrations/ruvector/rvf-dual-writer.js

@@ -87,14 +87,31 @@ export class RvfDualWriter {
                 nativeAdapter = adapter.openRvfStore(this.config.rvfPath);
             }
             catch {
-                nativeAdapter = adapter.createRvfStore(this.config.rvfPath, this.config.dimensions);
+                try {
+                    nativeAdapter = adapter.createRvfStore(this.config.rvfPath, this.config.dimensions);
+                }
+                catch (createErr) {
+                    // Issue #563: open failed *and* create failed, so the file on disk is
+                    // provably unusable — the signature of an export killed mid-write
+                    // (open → ManifestNotFound, create → FsyncFailed because the path
+                    // exists). Previously this fell to the catch below and disabled RVF
+                    // silently for the whole run. Quarantine and rebuild instead.
+                    const { quarantineUnusableStore } = await import('./rvf-store-integrity.js');
+                    const quarantined = quarantineUnusableStore(this.config.rvfPath, createErr instanceof Error ? createErr.message : String(createErr));
+                    if (!quarantined)
+                        throw createErr; // live peer, or nothing to move
+                    nativeAdapter = adapter.createRvfStore(this.config.rvfPath, this.config.dimensions);
+                }
             }
             this.rvfStore = wrapNativeAdapter(nativeAdapter, this.config.dimensions);
             this.rvfAvailable = true;
         }
-        catch {
-            // Native adapter module not available at all
+        catch (err) {
+            // Native adapter unavailable, or recovery itself failed. Degrade to
+            // sqlite-only — but say so, instead of vanishing silently (#563).
             this.rvfAvailable = false;
+            console.warn(`[RVF] Dual-writer disabled for ${this.config.rvfPath}; falling back to SQLite: ` +
+                `${err instanceof Error ? err.message : String(err)}`);
         }
     }
     /**

package/dist/integrations/ruvector/rvf-store-integrity.d.ts

@@ -0,0 +1,49 @@
+/**
+ * RVF store integrity helpers (issue #563).
+ *
+ * An export that is killed mid-write leaves a store that was created but never
+ * completed. Such a file cannot be opened (`RVF error 0x0106: ManifestNotFound`)
+ * and cannot be created over either, because the path already exists
+ * (`RVF error 0x0303: FsyncFailed`). Both paths fail forever, so the RVF
+ * backend stays disabled for the life of the project until someone deletes the
+ * file by hand.
+ *
+ * Recovery has to be evidence-based rather than fingerprint-based. Measured
+ * against @ruvector/rvf-node 0.1.8:
+ *
+ *   • A *valid, empty* store is 162 bytes with magic `SFVR` — byte-for-byte
+ *     the size the issue reports as "truncated: header only". Size and magic
+ *     therefore cannot distinguish a broken store from a healthy empty one.
+ *   • `<store>.lock` is a 104-byte record with magic `FLVR` and the owning pid
+ *     as a little-endian u32 at offset 4. `FLVR` in a lock is the *normal*
+ *     case — the issue reads it as "RVF store bytes leaked into the lock", but
+ *     the store magic is `SFVR`; a 104-byte `FLVR` lock is just a live-or-stale
+ *     lock record.
+ *
+ * So the only sound trigger is "open failed *and* create failed": at that point
+ * the file is provably unusable. The lock's pid is used as a *guard* — if it is
+ * held by a live process, the store is presumed healthy and left alone.
+ */
+/** The pid recorded in `<rvfPath>.lock`, or null if there is no readable lock. */
+export declare function readLockOwnerPid(rvfPath: string): number | null;
+/**
+ * True when the store's lock is held by a process that is still running.
+ *
+ * Deliberately conservative: an unreadable or pid-less lock reports false (the
+ * caller's open already failed, so there is nothing to protect), while a live
+ * pid reports true and blocks recovery. Pid reuse can only produce a false
+ * "alive", which fails safe — we leave the store alone.
+ */
+export declare function isLockHeldByLiveProcess(rvfPath: string): boolean;
+/**
+ * Move an unusable store and its sidecars aside so the next create succeeds.
+ * Returns the quarantine base path, or null if nothing was quarantined.
+ *
+ * Only call this once open *and* create have both failed — that is the proof
+ * the file is unusable. The store is a derived cache, rebuilt from the unified
+ * DB, so quarantining is recoverable; we move rather than delete because the
+ * bytes may hold writes that never reached SQLite, and they are the only
+ * evidence if this recurs.
+ */
+export declare function quarantineUnusableStore(rvfPath: string, reason: string): string | null;
+//# sourceMappingURL=rvf-store-integrity.d.ts.map

package/dist/integrations/ruvector/rvf-store-integrity.js

@@ -0,0 +1,137 @@
+/**
+ * RVF store integrity helpers (issue #563).
+ *
+ * An export that is killed mid-write leaves a store that was created but never
+ * completed. Such a file cannot be opened (`RVF error 0x0106: ManifestNotFound`)
+ * and cannot be created over either, because the path already exists
+ * (`RVF error 0x0303: FsyncFailed`). Both paths fail forever, so the RVF
+ * backend stays disabled for the life of the project until someone deletes the
+ * file by hand.
+ *
+ * Recovery has to be evidence-based rather than fingerprint-based. Measured
+ * against @ruvector/rvf-node 0.1.8:
+ *
+ *   • A *valid, empty* store is 162 bytes with magic `SFVR` — byte-for-byte
+ *     the size the issue reports as "truncated: header only". Size and magic
+ *     therefore cannot distinguish a broken store from a healthy empty one.
+ *   • `<store>.lock` is a 104-byte record with magic `FLVR` and the owning pid
+ *     as a little-endian u32 at offset 4. `FLVR` in a lock is the *normal*
+ *     case — the issue reads it as "RVF store bytes leaked into the lock", but
+ *     the store magic is `SFVR`; a 104-byte `FLVR` lock is just a live-or-stale
+ *     lock record.
+ *
+ * So the only sound trigger is "open failed *and* create failed": at that point
+ * the file is provably unusable. The lock's pid is used as a *guard* — if it is
+ * held by a live process, the store is presumed healthy and left alone.
+ */
+import { existsSync, openSync, readSync, closeSync, renameSync, unlinkSync } from 'fs';
+/** Magic of a lock record (the store's own magic is `SFVR`). */
+const LOCK_MAGIC = 'FLVR';
+/** Byte offset of the owning pid within a lock record (u32 LE). */
+const LOCK_PID_OFFSET = 4;
+/** Sidecars that belong to a store and must be quarantined alongside it. */
+const STORE_SIDECAR_SUFFIXES = ['', '.idmap.json', '.manifest.json'];
+/** Read the first `n` bytes of a file, or null if unreadable/shorter. */
+function readHead(path, n) {
+    let fd;
+    try {
+        fd = openSync(path, 'r');
+        const buf = Buffer.alloc(n);
+        if (readSync(fd, buf, 0, n, 0) < n)
+            return null;
+        return buf;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* best-effort */ }
+        }
+    }
+}
+/** True when a process with `pid` exists (signal 0 probes without delivering). */
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        // EPERM means it exists but belongs to another user — still alive.
+        return err.code === 'EPERM';
+    }
+}
+/** The pid recorded in `<rvfPath>.lock`, or null if there is no readable lock. */
+export function readLockOwnerPid(rvfPath) {
+    const head = readHead(`${rvfPath}.lock`, LOCK_PID_OFFSET + 4);
+    if (!head || head.subarray(0, 4).toString('latin1') !== LOCK_MAGIC)
+        return null;
+    const pid = head.readUInt32LE(LOCK_PID_OFFSET);
+    return pid > 0 ? pid : null;
+}
+/**
+ * True when the store's lock is held by a process that is still running.
+ *
+ * Deliberately conservative: an unreadable or pid-less lock reports false (the
+ * caller's open already failed, so there is nothing to protect), while a live
+ * pid reports true and blocks recovery. Pid reuse can only produce a false
+ * "alive", which fails safe — we leave the store alone.
+ */
+export function isLockHeldByLiveProcess(rvfPath) {
+    const pid = readLockOwnerPid(rvfPath);
+    if (pid === null)
+        return false;
+    return pid !== process.pid && isPidAlive(pid);
+}
+/**
+ * Move an unusable store and its sidecars aside so the next create succeeds.
+ * Returns the quarantine base path, or null if nothing was quarantined.
+ *
+ * Only call this once open *and* create have both failed — that is the proof
+ * the file is unusable. The store is a derived cache, rebuilt from the unified
+ * DB, so quarantining is recoverable; we move rather than delete because the
+ * bytes may hold writes that never reached SQLite, and they are the only
+ * evidence if this recurs.
+ */
+export function quarantineUnusableStore(rvfPath, reason) {
+    if (!existsSync(rvfPath))
+        return null;
+    // Never pull a store out from under a live peer.
+    if (isLockHeldByLiveProcess(rvfPath)) {
+        console.warn(`[RVF] ${rvfPath} is unusable but its lock is held by a live process — ` +
+            'leaving it alone and degrading to SQLite for this run.');
+        return null;
+    }
+    // Keyed by pid, not a timestamp: a crash-loop quarantining the same file
+    // repeatedly overwrites its own copy instead of filling .agentic-qe/ with
+    // one corrupt store per startup.
+    const quarantineBase = `${rvfPath}.corrupt-${process.pid}`;
+    for (const sidecar of STORE_SIDECAR_SUFFIXES) {
+        const from = `${rvfPath}${sidecar}`;
+        if (!existsSync(from))
+            continue;
+        try {
+            renameSync(from, `${quarantineBase}${sidecar}`);
+        }
+        catch {
+            // A failed quarantine must not throw and take down the caller; the
+            // caller's retry will simply fail again and degrade as before.
+        }
+    }
+    // The store is gone, so its lock — stale by definition here — goes with it.
+    try {
+        if (existsSync(`${rvfPath}.lock`))
+            unlinkSync(`${rvfPath}.lock`);
+    }
+    catch {
+        // best-effort
+    }
+    console.warn(`[RVF] Quarantined unusable store ${rvfPath} → ${quarantineBase} (${reason}). ` +
+        'It is a derived cache and will be rebuilt from the unified DB. ' +
+        'Please report a recurrence with the quarantined files (issue #563).');
+    return quarantineBase;
+}
+//# sourceMappingURL=rvf-store-integrity.js.map

package/dist/integrations/ruvector/shared-rvf-adapter.js

@@ -13,6 +13,9 @@
 // Issue #516: lightweight, sqlite-free project-root resolver (static import so it
 // resolves under the test runner; avoids pulling unified-memory's sqlite graph).
 import { findProjectRoot } from '../../kernel/project-root.js';
+// Issue #563: static import — this module is fs-only, and a require() here
+// would not resolve under the test runner.
+import { quarantineUnusableStore, isLockHeldByLiveProcess, readLockOwnerPid, } from './rvf-store-integrity.js';
 let sharedAdapter = null;
 let initAttempted = false;
 // ---------------------------------------------------------------------------
@@ -131,16 +134,23 @@ function openOrCreateRvf(openFn, createFn, rvfPath, dimensions) {
     // .lock that subsequent invocations interpret as `LockHeld`. Since AQE
     // CLI is overwhelmingly single-shot serial, the realistic case is "the
     // prior process is dead and the lock is stale". We unlink the .lock and
-    // retry open exactly once. If a genuinely-live peer existed, it still
-    // holds the file open — but the binding's lock is content-based (lock
-    // file presence), so this is a best-effort cooperative recovery rather
-    // than an OS-level lock break.
+    // retry open exactly once.
+    //
+    // Issue #563: the lock record turns out to carry its owner's pid (u32 LE at
+    // offset 4, after the `FLVR` magic), so "is it stale?" is now a check rather
+    // than an assumption. This previously unlinked the lock unconditionally,
+    // which breaks a genuinely-live peer — the one case the old comment admitted
+    // it could not distinguish.
     if (!opened && isLockHeld(openErr)) {
         try {
             // eslint-disable-next-line @typescript-eslint/no-require-imports
             const fs = require('fs');
             const lockPath = `${rvfPath}.lock`;
-            if (fs.existsSync(lockPath)) {
+            if (fs.existsSync(lockPath) && isLockHeldByLiveProcess(rvfPath)) {
+                console.warn(`[RVF] ${rvfPath} is locked by a live process (pid ${readLockOwnerPid(rvfPath)}) — ` +
+                    'not breaking the lock; degrading to SQLite for this run.');
+            }
+            else if (fs.existsSync(lockPath)) {
                 fs.unlinkSync(lockPath);
                 console.warn(`[RVF] Removed stale lock file at ${lockPath} (prior process exited without closing). ` +
                     'Retrying open. If you see this repeatedly under live concurrency, file an issue.');
@@ -187,6 +197,14 @@ function openOrCreateRvf(openFn, createFn, rvfPath, dimensions) {
             return reopened;
         }
         catch {
+            // Pass 4 (#563): open failed, create failed, re-open failed. The file is
+            // provably unusable — the signature of an export killed mid-write, which
+            // used to disable the RVF backend permanently. Quarantine it (unless a
+            // live process holds its lock) and rebuild the derived cache.
+            const quarantined = quarantineUnusableStore(rvfPath, createErr instanceof Error ? createErr.message : String(createErr));
+            if (quarantined) {
+                return createFn(rvfPath, dimensions);
+            }
             // Fall through with the more informative original error.
             throw createErr instanceof Error ? createErr : new Error(String(createErr));
         }

package/dist/kernel/unified-memory.js

@@ -255,6 +255,10 @@ export class UnifiedMemoryManager {
             this.db = openSafeDatabase(this.config.dbPath, {
                 walMode: this.config.walMode,
                 busyTimeout: this.config.busyTimeout,
+                // M3.2: the missing-file case is handled above; this covers the
+                // EXISTS-but-MALFORMED case — auto-restore the newest verified backup and
+                // park the corrupt original (non-destructive) instead of opening a broken DB.
+                autoRestore: true,
             });
             this.db.pragma(`mmap_size = ${this.config.mmapSize}`);
             this.db.pragma(`cache_size = ${this.config.cacheSize}`);

package/dist/learning/pattern-store.js

@@ -11,7 +11,13 @@ import { v4 as uuidv4 } from 'uuid';
 import { findProjectRoot } from '../kernel/project-root.js';
 import { ok, err } from '../shared/types/index.js';
 import { RvfPatternStore } from './rvf-pattern-store.js';
-import { createRvfStore as _createRvfStore, isRvfNativeAvailable } from '../integrations/ruvector/rvf-native-adapter.js';
+import { createRvfStore as _createRvfStore, openRvfStore as _openRvfStore, isRvfNativeAvailable, } from '../integrations/ruvector/rvf-native-adapter.js';
+// Issue #563: static imports — a require() of a source module resolves in the
+// esbuild bundle but throws under the test runner, which silently changed which
+// code path tests exercised. Neither module loads the native binding at import
+// time, so this costs nothing at startup.
+import { quarantineUnusableStore } from '../integrations/ruvector/rvf-store-integrity.js';
+import { getSharedRvfAdapter } from '../integrations/ruvector/shared-rvf-adapter.js';
 import { toErrorMessage, toError } from '../shared/error-utils.js';
 import { calculateQualityScore, shouldPromotePattern, validateQEPattern, mapQEDomainToAQE, PROMOTION_THRESHOLD, } from './qe-patterns.js';
 import { applyFilterSync } from '../integrations/ruvector/filter-adapter.js';
@@ -1419,7 +1425,9 @@ export function createPatternStore(memory, config) {
                 // deadlock on the native lock.
                 let useSharedAdapter = false;
                 try {
-                    const { getSharedRvfAdapter } = require('../integrations/ruvector/shared-rvf-adapter.js');
+                    // Statically imported (#563): this require() throws "Cannot find
+                    // module" under the test runner, so every test silently took the
+                    // fallback ladder below instead of this preferred path.
                     const shared = getSharedRvfAdapter(rvfDir, mergedConfig.embeddingDimension);
                     if (shared) {
                         useSharedAdapter = true;
@@ -1439,11 +1447,13 @@ export function createPatternStore(memory, config) {
                     // open first, fall back to create, retry open on create-race.
                     // (Jordi #439 / RUFLO P020.)
                     const store = new RvfPatternStore((path, dim) => {
-                        // eslint-disable-next-line @typescript-eslint/no-require-imports
-                        const { openRvfStore } = require('../integrations/ruvector/rvf-native-adapter.js');
+                        // Statically imported (#563): a require() here resolves in the
+                        // esbuild bundle but throws "Cannot find module" under the test
+                        // runner, so this ladder — including its corruption recovery —
+                        // was unreachable from any test.
                         const tryOpen = () => {
                             try {
-                                return openRvfStore(path);
+                                return _openRvfStore(path);
                             }
                             catch {
                                 return null;
@@ -1467,6 +1477,14 @@ export function createPatternStore(memory, config) {
                             adapter = tryOpen();
                             if (adapter && adapter.dimension() === dim)
                                 return adapter;
+                            // Issue #563: open failed, create failed, re-open failed — the
+                            // store is provably unusable (an export killed mid-write leaves
+                            // exactly this). Without recovery, RvfPatternStore.initialize()
+                            // logs "vector search is DISABLED" and stays that way for the
+                            // life of the process.
+                            if (quarantineUnusableStore(path, createErr instanceof Error ? createErr.message : String(createErr))) {
+                                return _createRvfStore(path, dim);
+                            }
                             throw createErr;
                         }
                     }, { rvfPath, base: mergedConfig });

package/dist/learning/qe-flywheel/corpus-scorer.js

@@ -150,11 +150,13 @@ function selectHeldOut(docs, ratio) {
  */
 function scoreHeldOut(docs, policy, ratio) {
     if (docs.length === 0)
-        return 0;
+        return { mean: 0, samples: [] };
     const queries = selectHeldOut(docs, ratio);
     if (queries.length === 0)
-        return 0;
-    let sumReciprocalRank = 0;
+        return { mean: 0, samples: [] };
+    // Per-query reciprocal ranks: the mean is the held-out signal; the vector is
+    // the paired sample the accept/v1+sig significance gate needs (ADR-118).
+    const samples = [];
     for (const queried of queries) {
         const query = queried.bodyTokens; // subject deliberately withheld
         const rels = docs.map((d) => ({ doc: d, rel: relevance(query, d, queried, policy) }));
@@ -177,9 +179,10 @@ function scoreHeldOut(docs, policy, ratio) {
         }
         const ranked = rankMMR(pool, policy.mmrLambda);
         const rank = ranked.indexOf(queried.id) + 1; // 1-based; 0 -> not found
-        sumReciprocalRank += rank > 0 ? 1 / rank : 0;
+        samples.push(rank > 0 ? 1 / rank : 0);
     }
-    return sumReciprocalRank / queries.length;
+    const mean = samples.reduce((a, b) => a + b, 0) / samples.length;
+    return { mean, samples };
 }
 // ---------------------------------------------------------------------------
 // Anchor flat guard (the no-regression floor)
@@ -283,11 +286,11 @@ export function createCorpusScorer(opts) {
     const corpus = loadCorpus(opts.db);
     let anchorMeanCached = null;
     return (policy) => {
-        const heldOut = scoreHeldOut(corpus, policy, ratio);
+        const held = scoreHeldOut(corpus, policy, ratio);
         if (anchorMeanCached === null) {
             anchorMeanCached = gradeAnchor(anchorPath);
         }
-        return { heldOut, anchorMean: anchorMeanCached };
+        return { heldOut: held.mean, anchorMean: anchorMeanCached, heldOutSamples: held.samples };
     };
 }
 //# sourceMappingURL=corpus-scorer.js.map

package/dist/learning/qe-flywheel/generation.d.ts

@@ -22,6 +22,13 @@ export interface PolicyScores {
     heldOut: number;
     /** Mean over the ADR-117 frozen anchor items (the no-regression signal). */
     anchorMean: number;
+    /**
+     * Per-held-out-task scores whose mean is `heldOut`. Optional — when present and
+     * paired index-for-index with the baseline's, they enable the accept/v1+sig
+     * paired-bootstrap significance gate (ADR-118). Scorers that don't provide them
+     * simply can't use accept/v1+sig (it fail-closes).
+     */
+    heldOutSamples?: number[];
 }
 /** Injected: evaluate a policy → its held-out + anchor scores. */
 export type PolicyScorer = (policy: RetrievalPolicy) => PolicyScores | Promise<PolicyScores>;

package/dist/learning/qe-flywheel/generation.js

@@ -54,6 +54,11 @@ export async function runFlywheelGeneration(input) {
         anchorTol: input.anchorTol,
         provenanceTier,
         allowJudgeTier: input.allowJudgeTier,
+        // ADR-118 accept/v1+sig: seal the paired per-task samples ONLY when the sig
+        // rule is in use. Left undefined for accept/v1 (and thus absent from the
+        // sealed hash), so accept/v1 receipts remain byte-identical to before.
+        candidateHeldOutSamples: ruleVersion === 'accept/v1+sig' ? candidateScores.heldOutSamples : undefined,
+        baselineHeldOutSamples: ruleVersion === 'accept/v1+sig' ? baselineScores.heldOutSamples : undefined,
     };
     const ruleResult = reExecuteGate(ruleVersion, sealed);
     const verdict = ruleResult.promote ? 'promote' : 'reject';