fraim 2.0.350 → 2.0.352

package/dist/registry/scripts/learning/run-application.js

@@ -15,6 +15,7 @@ const run_record_1 = require("./run-record");
 const owner_identity_1 = require("./owner-identity");
 const proposal_queue_1 = require("./proposal-queue");
 const entry_authoring_1 = require("./entry-authoring");
+const run_publication_1 = require("./run-publication");
 const completion_state_2 = require("./completion-state");
 const artifact_paths_1 = require("../artifact-paths");
 const learning_source_record_1 = require("../learning-usage/learning-source-record");
@@ -50,8 +51,11 @@ function capabilityGuards(action, proof, options) {
             || typeof snapshot.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(snapshot.sha256);
     }))
         throw new Error('capability-local-proof-required');
-    if (snapshots.get(node_path_1.default.resolve(required[0]))?.sha256 !== action.delivery?.expectedHash)
-        throw new Error('capability-local-proof-conflict');
+    if (snapshots.get(node_path_1.default.resolve(required[0]))?.sha256 !== action.delivery?.expectedHash) {
+        if (typeof proof.reviewedContent !== 'string' || (0, proposal_queue_1.hashContent)(proof.reviewedContent) !== action.delivery?.expectedHash
+            || !(0, run_publication_1.sameDeliveryText)(node_fs_1.default.readFileSync(required[0], 'utf8'), proof.reviewedContent))
+            throw new Error('capability-local-proof-conflict');
+    }
     return [...snapshots.values()].map(item => {
         const absent = item.realPath === null && item.sha256 === null;
         if (!absent && (typeof item.realPath !== 'string' || typeof item.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(item.sha256)))
@@ -346,8 +350,11 @@ function applyRunAction(run, actionId, revision, expectedSequence, options) {
         if (!delivered?.published || !delivered.reachable || delivered.contentHash !== action.delivery?.expectedHash)
             throw new Error('capability-publication-or-reachability-pending');
         withLocalGuards(capabilityGuards(action, delivered, options), () => {
-            if (action.application?.stage !== 'applied')
-                (0, proposal_queue_1.withFileLock)(run.file, () => run.progress(actionId, { stage: 'applied', steps: [], publicationRef: delivered.reference }));
+            if (action.application?.stage !== 'applied' || (delivered.reviewedContent !== undefined && action.application.reviewedContent === undefined))
+                (0, proposal_queue_1.withFileLock)(run.file, () => run.progress(actionId, {
+                    stage: 'applied', steps: [], publicationRef: delivered.reference,
+                    ...(delivered.reviewedContent !== undefined ? { reviewedContent: delivered.reviewedContent } : {}),
+                }));
         });
         return run.read().actions[actionId];
     }
@@ -515,7 +522,8 @@ function sourceCompletion(run, homes, options, afterStage) {
     const prior = state.processedSources;
     const batch = (sources) => sources.map(source => ({ ...source, path: (0, completion_state_2.sourcePathKey)(source.path) })).sort((a, b) => a.path.localeCompare(b.path));
     if (prior && (0, run_record_1.canonical)(batch(prior.map(({ path, sha256, kind }) => ({ path, sha256, kind })))) !== (0, run_record_1.canonical)(batch(normalized))
-        && (!options.allowDeferred || prior.some(source => !normalized.some(item => (0, completion_state_2.sourcePathKey)(source.path) === (0, completion_state_2.sourcePathKey)(item.path) && source.sha256 === item.sha256 && source.kind === item.kind))))
+        && (!options.allowDeferred || prior.some(source => !normalized.some(item => (0, completion_state_2.sourcePathKey)(source.path) === (0, completion_state_2.sourcePathKey)(item.path) && source.sha256 === item.sha256 && source.kind === item.kind)
+            && !options.deferredSources?.some(item => (0, completion_state_2.sourcePathKey)(source.path) === (0, completion_state_2.sourcePathKey)(item.path)))))
         throw new Error('completion-sources-conflict');
     const date = new Date().toISOString().slice(0, 10);
     const validateInput = (body, source, root, contentRoot, owner, archivePath) => {
@@ -528,8 +536,11 @@ function sourceCompletion(run, homes, options, afterStage) {
     };
     const plans = normalized.map(source => {
         const recorded = prior?.find(item => (0, completion_state_2.sourcePathKey)(item.path) === (0, completion_state_2.sourcePathKey)(source.path));
-        if (recorded)
+        if (recorded) {
+            if (source.sha256 !== recorded.sha256 || source.kind !== recorded.kind)
+                throw new Error(`completion-sources-conflict: ${source.path}: original plan changed`);
             return recorded;
+        }
         const { root, destination, contentRoot, owner, layout } = allowed(source);
         regular(source.path, root);
         regular(destination, root);
@@ -539,8 +550,9 @@ function sourceCompletion(run, homes, options, afterStage) {
         validateInput(body, source, root, contentRoot, owner);
         return { ...source, destination, resultHash: (0, proposal_queue_1.hashContent)(stamp(body, date)), synthesizedAt: date, layout };
     });
-    if ((0, run_record_1.canonical)(prior) !== (0, run_record_1.canonical)(plans)) {
-        run.prepareSourceCompletion(plans, state.sequence, options.allowDeferred);
+    const reservationsAndPlans = [...(prior ?? []), ...plans.filter(source => !prior?.some(item => (0, completion_state_2.sourcePathKey)(item.path) === (0, completion_state_2.sourcePathKey)(source.path)))];
+    if ((0, run_record_1.canonical)(prior) !== (0, run_record_1.canonical)(reservationsAndPlans)) {
+        run.prepareSourceCompletion(reservationsAndPlans, state.sequence, options.allowDeferred);
         state = run.read();
     }
     afterStage?.('source-plan');
@@ -726,16 +738,21 @@ function completeRun(run, summary, homes, options, afterStage) {
                     sources.push({ path: ref, owner: home.owner, reason: 'action-processing-pending', ...(action.sourceHashes?.[ref] ? { sha256: action.sourceHashes[ref] } : {}) });
             }
         let reservationFailure;
+        let reserved = [];
         try {
-            (0, completion_state_2.readSourceReservations)([...new Set([run.directory, ...options.runDirectories])], run.file);
+            reserved = (0, completion_state_2.readSourceReservations)([...new Set([run.directory, ...options.runDirectories])], run.file);
         }
         catch (error) {
             reservationFailure = error.message;
         }
-        for (const source of options.analyzedSources ?? []) {
+        const selected = [...(options.analyzedSources ?? [])];
+        for (const source of state.processedSources ?? [])
+            if (!selected.some(item => (0, completion_state_2.sourcePathKey)(item.path) === (0, completion_state_2.sourcePathKey)(source.path)))
+                selected.push({ path: source.path, sha256: source.sha256, kind: source.kind });
+        for (const source of selected) {
             if (!source || !node_path_1.default.isAbsolute(source.path) || !/^[a-f0-9]{64}$/.test(source.sha256) || !['raw', 'retrospective'].includes(source.kind))
                 throw new Error('analyzed-sources-required');
-            if (state.processedSources?.some(item => (0, completion_state_2.sourcePathKey)(item.path) === (0, completion_state_2.sourcePathKey)(source.path)) || sources.some(item => (0, completion_state_2.sourcePathKey)(item.path) === (0, completion_state_2.sourcePathKey)(source.path)))
+            if (state.archivedSourcePaths?.includes((0, completion_state_2.sourcePathKey)(source.path)) || sources.some(item => (0, completion_state_2.sourcePathKey)(item.path) === (0, completion_state_2.sourcePathKey)(source.path)))
                 continue;
             const home = sourceHome(source.path);
             if (!home)
@@ -744,6 +761,19 @@ function completeRun(run, summary, homes, options, afterStage) {
             if (!reason)
                 try {
                     (0, owner_identity_1.configuredArtifactPath)(home, source.path);
+                    const recorded = state.processedSources?.find(item => (0, completion_state_2.sourcePathKey)(item.path) === (0, completion_state_2.sourcePathKey)(source.path));
+                    if (recorded && (recorded.sha256 !== source.sha256 || recorded.kind !== source.kind))
+                        throw new Error('original-source-plan-changed');
+                    const locations = (0, artifact_paths_1.resolveArtifactPaths)((0, owner_identity_1.ownerArtifactRoot)(home), home.contentRoot);
+                    const destination = (0, owner_identity_1.configuredArtifactPath)(home, node_path_1.default.join(source.kind === 'raw' ? locations.archiveRaw : locations.archiveRetrospectives, node_path_1.default.basename(source.path)));
+                    if (reserved.includes((0, completion_state_2.sourcePathKey)(source.path)) || reserved.includes((0, completion_state_2.sourcePathKey)(destination)))
+                        throw new Error('source-reserved-by-pending-run');
+                    if (recorded && node_fs_1.default.existsSync(destination) && (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(destination, 'utf8')) !== recorded.resultHash)
+                        throw new Error('source-archive-conflict');
+                    // A verified copy with no pending original is an interrupted successful archive.
+                    // The guarded finalizer revalidates its layout, identity and exact bytes.
+                    if (recorded && !node_fs_1.default.existsSync(source.path) && node_fs_1.default.existsSync(destination))
+                        continue;
                     const body = node_fs_1.default.readFileSync(source.path, 'utf8');
                     if ((0, proposal_queue_1.hashContent)(body) !== source.sha256)
                         throw new Error('analyzed-source-changed');
@@ -776,8 +806,11 @@ function completeRun(run, summary, homes, options, afterStage) {
         const omitted = new Set(sources.map(source => (0, completion_state_2.sourcePathKey)(source.path)));
         const inputs = [...(options.analyzedSources ?? [])].filter(source => !omitted.has((0, completion_state_2.sourcePathKey)(source.path)));
         for (const source of state.processedSources ?? []) {
-            if (omitted.has((0, completion_state_2.sourcePathKey)(source.path)))
-                throw new Error('completed-source-cannot-be-deferred');
+            if (omitted.has((0, completion_state_2.sourcePathKey)(source.path))) {
+                if (state.archivedSourcePaths?.includes((0, completion_state_2.sourcePathKey)(source.path)))
+                    throw new Error(`completed-source-cannot-be-deferred: ${source.path}`);
+                continue;
+            }
             if (!inputs.some(input => (0, completion_state_2.sourcePathKey)(input.path) === (0, completion_state_2.sourcePathKey)(source.path)))
                 inputs.push({ path: source.path, sha256: source.sha256, kind: source.kind });
         }
@@ -853,14 +886,16 @@ function completeRun(run, summary, homes, options, afterStage) {
         for (const item of terminal.values()) {
             const actual = item.step ? currentEntry(item.file, item.step.ref.entryId).entry : node_fs_1.default.existsSync(item.file) ? (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(item.file, 'utf8')) : null;
             const expected = item.step ? item.step.after : item.action.delivery?.expectedHash;
-            if (actual !== expected)
-                throw new Error('completion-artifact-changed');
+            const original = item.action.application?.reviewedContent;
+            if (actual !== expected && (item.step || typeof original !== 'string' || (0, proposal_queue_1.hashContent)(original) !== expected
+                || !(0, run_publication_1.sameDeliveryText)(node_fs_1.default.readFileSync(item.file, 'utf8'), original)))
+                throw new Error(`completion-artifact-changed: ${item.file}`);
         }
     };
     verifyLocal();
     const finalEvidence = node_fs_1.default.existsSync(run.completionFile) ? node_fs_1.default.readFileSync(run.completionFile, 'utf8') : undefined;
-    const committed = finalEvidence && (0, proposal_queue_1.hashContent)(finalEvidence) === state.finalization?.evidenceHash
-        && (0, run_record_1.decodeCompletion)(finalEvidence, { owner: run.owner, runId: run.runId }).finalizationState === 'complete';
+    const committed = finalEvidence && state.finalization?.receipt?.finalizationState === 'complete'
+        && (0, run_record_1.canonical)(run.readCompletion(finalEvidence)) === (0, run_record_1.canonical)(state.finalization.receipt);
     for (const item of terminal.values()) {
         if (!item.step) {
             const proof = options.verifyCapability?.(item.action);
@@ -890,8 +925,10 @@ function completeRun(run, summary, homes, options, afterStage) {
                 guard.verify();
             for (const item of terminal.values()) {
                 const actual = item.step ? currentEntry(item.file, item.step.ref.entryId).entry : node_fs_1.default.existsSync(item.file) ? (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(item.file, 'utf8')) : null;
-                if (actual !== (item.step ? item.step.after : item.action.delivery?.expectedHash))
-                    throw new Error('completion-artifact-changed');
+                if (item.step && actual !== item.step.after)
+                    throw new Error(`completion-artifact-changed: ${item.file}`);
+                // Capability guards recheck exact local snapshots captured by the
+                // delivery verifier, including when approved text used other EOLs.
             }
             if (finalizing && !deferred)
                 completionInventory(run, homes, true);
@@ -908,11 +945,12 @@ function completionInventory(run, homes, removeFamilies = false) {
     let recordedCleanup = state.cleanup;
     if ('finalization' in state && state.finalization && node_fs_1.default.existsSync(run.completionFile)) {
         const evidence = node_fs_1.default.readFileSync(run.completionFile, 'utf8');
-        if (![state.finalization.evidenceHash, state.finalization.previousEvidenceHash].includes((0, proposal_queue_1.hashContent)(evidence)))
-            throw new Error('completion-evidence-conflict');
         if (evidence.includes('fraim-sleep-decisions')) {
-            const prior = (0, run_record_1.decodeCompletion)(evidence, { runId: run.runId, owner: run.owner });
-            recordedCleanup = [...prior.cleanup, ...recordedCleanup];
+            const prior = run.readCompletion(evidence);
+            // Legacy finalizations have no journaled receipt. Their narrative cannot
+            // introduce cleanup authority beyond the original journal inventory.
+            if (state.finalization.receipt)
+                recordedCleanup = [...prior.cleanup, ...recordedCleanup];
         }
     }
     for (const item of recordedCleanup) {

package/dist/registry/scripts/learning/run-publication.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.sameDeliveryText = sameDeliveryText;
 exports.publishRunFile = publishRunFile;
 exports.verifyCapabilityDelivery = verifyCapabilityDelivery;
 const node_fs_1 = __importDefault(require("node:fs"));
@@ -11,6 +12,10 @@ const node_child_process_1 = require("node:child_process");
 const proposal_queue_1 = require("./proposal-queue");
 const owner_identity_1 = require("./owner-identity");
 const run_record_1 = require("./run-record");
+/** Delivery permits CRLF/LF conversion only; approval identities and local guards keep exact hashes. */
+function sameDeliveryText(actual, reviewed) {
+    return actual.replace(/\r\n/g, '\n') === reviewed.replace(/\r\n/g, '\n');
+}
 const { learningEntryBlocks } = require('./entry-format');
 function matchesLearningPublication(body, proof) {
     body = body.replace(/\r\n/g, '\n');
@@ -64,8 +69,8 @@ function verifySharedProjectPublication(projectPath, file, expectedHash, publica
         const effective = (0, node_child_process_1.spawnSync)('git', ['show', `${effectiveHead}:${relative}`], { cwd: projectPath, encoding: 'utf8', timeout: 30000, windowsHide: true });
         const current = node_fs_1.default.readFileSync(artifact.file, 'utf8');
         if (delivered.status !== 0 || effective.status !== 0 || (0, proposal_queue_1.hashContent)(current) !== artifact.expectedHash
-            || (0, proposal_queue_1.hashContent)(delivered.stdout.replace(/\r\n/g, '\n')) !== (0, proposal_queue_1.hashContent)(current.replace(/\r\n/g, '\n'))
-            || (0, proposal_queue_1.hashContent)(effective.stdout.replace(/\r\n/g, '\n')) !== (0, proposal_queue_1.hashContent)(current.replace(/\r\n/g, '\n')))
+            || !sameDeliveryText(delivered.stdout, current)
+            || !sameDeliveryText(effective.stdout, current))
             return { published: false, reference: pr.url };
     }
     return { published: true, reference: pr.url };
@@ -101,7 +106,7 @@ function publishRunFile(projectPath, file, home, operationKey, expectedHash, run
             const delivered = (0, node_child_process_1.spawnSync)('git', ['show', `${pr.mergeCommit.oid}:${packRelative}`], { cwd: home.root, encoding: 'utf8', timeout: 30000, windowsHide: true });
             const current = node_fs_1.default.readFileSync(file, 'utf8');
             const matches = (body) => entryProof ? matchesLearningPublication(body, entryProof)
-                : (0, proposal_queue_1.hashContent)(body.replace(/\r\n/g, '\n')) === (0, proposal_queue_1.hashContent)(current.replace(/\r\n/g, '\n'));
+                : sameDeliveryText(body, current);
             if ((0, proposal_queue_1.hashContent)(current) !== expectedHash || fetched.status !== 0 || delivered.status !== 0 || !matches(delivered.stdout))
                 return { published: false, reference: pr.url };
             // A merged snapshot proves this operation, but a later revert must
@@ -124,6 +129,7 @@ const [publisherPath,userConfigPath,file,relative,layer,branchSuffix,expectedHas
 const entryProof=JSON.parse(entryProofJson);
 const {learningEntryBlocks}=require(entryFormatPath);
 const matchesLearningPublication=${matchesLearningPublication.toString()};
+const sameDeliveryText=${sameDeliveryText.toString()};
 const publisher=require(publisherPath);
 const readConfig=require(userConfigPath).readUserFraimConfig;
 const remote=(process.env.FRAIM_REMOTE_URL||'https://fraim.wellnessatwork.me').replace(/\\/$/,'');
@@ -133,7 +139,7 @@ async function confirmedCloud(){
   if(!response.ok)throw Error('pack-read-failed');
   const pack=await response.json();
   const matches=Array.isArray(pack.files)?pack.files.filter(item=>item.relativePath===relative):[];
-  return {published:matches.length===1&&typeof matches[0].content==='string'&&(entryProof?matchesLearningPublication(matches[0].content,entryProof):hash(matches[0].content)===expectedHash),reference:remote+'/api/'+layer+'/pack#'+encodeURIComponent(relative)};
+  return {published:matches.length===1&&typeof matches[0].content==='string'&&(entryProof?matchesLearningPublication(matches[0].content,entryProof):sameDeliveryText(matches[0].content,fs.readFileSync(file,'utf8'))),reference:remote+'/api/'+layer+'/pack#'+encodeURIComponent(relative)};
 }
 (async()=>{
   if(hash(fs.readFileSync(file,'utf8'))!==expectedHash)throw Error('publication-content-conflict');
@@ -179,9 +185,20 @@ async function verifyCapabilityDelivery(action, input, options) {
     const target = (0, owner_identity_1.ownerArtifactPath)(home, action.target.relativePath);
     if (!/^[a-f0-9]{64}$/.test(input?.expectedHash || '') || !Array.isArray(input.callers) || !node_fs_1.default.existsSync(target))
         throw new Error('capability-verification-required');
-    const contentHash = (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(target, 'utf8'));
-    if (contentHash !== input.expectedHash)
-        return { published: false, reference: target, contentHash, reachable: false };
+    const targetContent = node_fs_1.default.readFileSync(target, 'utf8');
+    const localHash = (0, proposal_queue_1.hashContent)(targetContent);
+    // Legacy approvals may bind mixed line endings. Supplied original bytes are
+    // evidence only: their exact hash must already be authorized by the review.
+    if (input.reviewedContent !== undefined && (typeof input.reviewedContent !== 'string'
+        || (0, proposal_queue_1.hashContent)(input.reviewedContent) !== input.expectedHash))
+        throw new Error('capability-reviewed-content-mismatch');
+    if (localHash !== input.expectedHash && (input.reviewedContent === undefined || !sameDeliveryText(targetContent, input.reviewedContent))) {
+        return { published: false, reference: target, contentHash: localHash, reachable: false };
+    }
+    const contentHash = input.expectedHash;
+    // Preserve success evidence for later newline conversion, including an exact
+    // initial delivery. These bytes already match the immutable approved digest.
+    const reviewEvidence = { reviewedContent: input.reviewedContent ?? targetContent };
     const load = (relative) => options.runtimeModule(options.projectPath, relative);
     if (reader) {
         const snapshots = new Map();
@@ -249,14 +266,14 @@ async function verifyCapabilityDelivery(action, input, options) {
                     throw new Error('capability-local-content-changed');
             }
         };
-        if (snapshots.get(target)?.sha256 !== contentHash)
+        if (snapshots.get(target)?.sha256 !== localHash)
             throw new Error('capability-local-content-changed');
         verifySnapshots();
         if (home.requiresPublish && (!options.runtimeModulePath || !input.operationKey))
             throw new Error('capability-publication-required');
-        const publication = home.requiresPublish ? publishRunFile(options.projectPath, target, home, input.operationKey, contentHash, options.runtimeModulePath) : { published: true, reference: target };
+        const publication = home.requiresPublish ? publishRunFile(options.projectPath, target, home, input.operationKey, localHash, options.runtimeModulePath) : { published: true, reference: target };
         verifySnapshots();
-        return { ...publication, contentHash, reachable: true, localFiles };
+        return { ...publication, contentHash, reachable: true, localFiles, ...reviewEvidence };
     }
     const { LocalRegistryResolver } = load('core/utils/local-registry-resolver');
     const { resolvePackHome } = load('cli/utils/pack-home');
@@ -271,7 +288,7 @@ async function verifyCapabilityDelivery(action, input, options) {
     const snapshot = (file, expectedContent) => {
         const absolute = node_path_1.default.resolve(file);
         const body = node_fs_1.default.readFileSync(absolute, 'utf8');
-        if (expectedContent !== undefined && (0, proposal_queue_1.hashContent)(body) !== (0, proposal_queue_1.hashContent)(expectedContent))
+        if (expectedContent !== undefined && !sameDeliveryText(body, expectedContent))
             throw new Error('capability-local-content-changed');
         const current = { file: absolute, realPath: node_fs_1.default.realpathSync(absolute), sha256: (0, proposal_queue_1.hashContent)(body) };
         const prior = snapshots.get(absolute);
@@ -300,16 +317,18 @@ async function verifyCapabilityDelivery(action, input, options) {
                 node_path_1.default.join(options.projectPath, 'fraim/ai-employee', normalized), node_path_1.default.join(options.projectPath, 'fraim/ai-manager', normalized),
                 node_path_1.default.join(options.projectPath, 'fraim', normalized), node_path_1.default.join(options.projectPath, 'registry', normalized)];
         }
-        const source = candidates.find(file => node_fs_1.default.existsSync(file) && node_fs_1.default.statSync(file).isFile() && (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(file, 'utf8')) === (0, proposal_queue_1.hashContent)(resolved.content));
+        const source = candidates.find(file => node_fs_1.default.existsSync(file) && node_fs_1.default.statSync(file).isFile() && sameDeliveryText(node_fs_1.default.readFileSync(file, 'utf8'), resolved.content));
         if (source)
             snapshot(source, resolved.content);
     };
-    snapshot(target);
+    snapshot(target, targetContent);
+    if (snapshots.get(node_path_1.default.resolve(target))?.sha256 !== localHash)
+        throw new Error('capability-local-content-changed');
     const shared = action.target.owner.level === 'Project' && action.target.relativePath.startsWith('registry/');
     const targetPath = shared ? action.target.relativePath.slice('registry/'.length) : action.target.relativePath;
     const targetScope = shared ? undefined : action.target.owner.level.toLowerCase();
     const loadedTarget = await originalResolve(targetPath, { includeMetadata: false, stripMcpHeader: true });
-    if (loadedTarget.scope !== targetScope || (0, proposal_queue_1.hashContent)(loadedTarget.content) !== contentHash)
+    if (loadedTarget.scope !== targetScope || !sameDeliveryText(loadedTarget.content, targetContent))
         return { published: false, reference: target, contentHash, reachable: false };
     let reachable = true;
     const sharedCallers = [];
@@ -321,7 +340,7 @@ async function verifyCapabilityDelivery(action, input, options) {
         const callerPath = sharedCaller ? caller.relativePath.slice('registry/'.length) : caller.relativePath;
         const loadedCaller = await originalResolve(callerPath, { includeMetadata: false, stripMcpHeader: true });
         if (!node_fs_1.default.existsSync(callerFile) || loadedCaller.scope !== (sharedCaller ? undefined : caller.owner.level.toLowerCase())
-            || (0, proposal_queue_1.hashContent)(loadedCaller.content) !== (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(callerFile, 'utf8'))) {
+            || !sameDeliveryText(loadedCaller.content, node_fs_1.default.readFileSync(callerFile, 'utf8'))) {
             reachable = false;
             break;
         }
@@ -332,7 +351,7 @@ async function verifyCapabilityDelivery(action, input, options) {
         resolver.resolveFile = async (relative, resolveOptions) => {
             const resolved = await originalResolve(relative, resolveOptions);
             snapshotResolvedInclude(relative, resolved);
-            if (relative === targetPath && resolved.scope === targetScope && (0, proposal_queue_1.hashContent)(resolved.content) === contentHash)
+            if (relative === targetPath && resolved.scope === targetScope && sameDeliveryText(resolved.content, targetContent))
                 traversed = true;
             return resolved;
         };
@@ -343,7 +362,7 @@ async function verifyCapabilityDelivery(action, input, options) {
         }
     }
     resolver.resolveFile = originalResolve;
-    if (!reachable || (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(target, 'utf8')) !== contentHash)
+    if (!reachable || (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(target, 'utf8')) !== localHash)
         return { published: false, reference: target, contentHash, reachable: false };
     const localFiles = [...snapshots.values()].sort((a, b) => a.file.localeCompare(b.file));
     const verifySnapshots = () => {
@@ -352,13 +371,13 @@ async function verifyCapabilityDelivery(action, input, options) {
                 throw new Error('capability-local-content-changed');
     };
     if (shared) {
-        const publication = verifySharedProjectPublication(options.projectPath, target, contentHash, input.publicationRef, sharedCallers);
+        const publication = verifySharedProjectPublication(options.projectPath, target, localHash, input.publicationRef, sharedCallers);
         verifySnapshots();
-        return { ...publication, contentHash, reachable, localFiles };
+        return { ...publication, contentHash, reachable, localFiles, ...reviewEvidence };
     }
     if (home.requiresPublish && (!options.runtimeModulePath || !input.operationKey))
         throw new Error('capability-publication-required');
-    const publication = home.requiresPublish ? publishRunFile(options.projectPath, target, home, input.operationKey, contentHash, options.runtimeModulePath) : { published: true, reference: target };
+    const publication = home.requiresPublish ? publishRunFile(options.projectPath, target, home, input.operationKey, localHash, options.runtimeModulePath) : { published: true, reference: target };
     verifySnapshots();
-    return { ...publication, contentHash, reachable, localFiles };
+    return { ...publication, contentHash, reachable, localFiles, ...reviewEvidence };
 }

package/dist/registry/scripts/learning/run-record.js

@@ -49,8 +49,8 @@ function bindCleanupItem(item, home) {
     return { ...item, path: file, location: { owner: home.owner, relativePath } };
 }
 function sameCleanupIdentity(a, b) {
-    return node_path_1.default.resolve(a.path) === node_path_1.default.resolve(b.path) || !!(a.location && b.location
-        && (0, completion_state_1.canonicalJournal)(a.location) === (0, completion_state_1.canonicalJournal)(b.location) && a.sha256 === b.sha256);
+    return node_path_1.default.resolve(a.path) === node_path_1.default.resolve(b.path) && a.sha256 === b.sha256
+        && (0, completion_state_1.canonicalJournal)(a.location) === (0, completion_state_1.canonicalJournal)(b.location) && a.reason === b.reason;
 }
 function validateDeliveryReader(reader) { validateReader(reader, false); }
 function validateReader(reader, historical) {
@@ -134,6 +134,47 @@ function reviewedInput(input) {
             result[key] = structuredClone(input[key]);
     return result;
 }
+/** New authored text only: runtime owner/source bindings and historical replay keep their existing contract. */
+function assertPortableAuthoredText(value, previous) {
+    if (value === previous)
+        return;
+    if (typeof value === 'string') {
+        // Absolute API routes and filesystem paths share a syntax. Only an explicit
+        // HTTP-method context disambiguates a route; bare local-looking paths must
+        // use an owner-relative reference. No filesystem directory allowlist.
+        const text = value.replace(/https?:\/\/[^\s<>"'`]+/gi, url => {
+            try {
+                return new URL(url).hostname ? 'URL' : url;
+            }
+            catch {
+                return url;
+            }
+        }).replace(/\b(?:GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS|CONNECT|TRACE)[ \t]+([`"']?)(\/(?!\/)[^\s<>"'`]+)\1/g, 'HTTP route')
+            .replace(/<\/[A-Za-z][A-Za-z0-9:._-]*\s*>/g, 'closing tag')
+            .replace(/(<[A-Za-z][A-Za-z0-9:._-]*(?:\s+[^<>]*?)?)\/>/g, '$1>');
+        if (/\bfile:(?=\S)/i.test(text)
+            || /(?:\$(?:HOME|USERPROFILE)|\$\{(?:HOME|USERPROFILE)\}|%USERPROFILE%|\$env:USERPROFILE)[/\x5c]/i.test(text)
+            || /(?:^|[^\p{L}\p{N}_./\x5c-])(?:[A-Za-z]:[/\x5c]|\x5c{2}|\/\/(?=\S)|~(?:[/\x5c]|[\p{L}\p{N}_.-]+[/\x5c])|\/(?![\s/*]))/u.test(text)) {
+            throw new Error('machine-local-path-in-authored-text');
+        }
+    }
+    else if (Array.isArray(value)) {
+        value.forEach((item, index) => assertPortableAuthoredText(item, Array.isArray(previous) ? previous[index] : undefined));
+    }
+    else if (value && typeof value === 'object') {
+        for (const [key, item] of Object.entries(value)) {
+            assertPortableAuthoredText(key);
+            assertPortableAuthoredText(item, previous && typeof previous === 'object' ? previous[key] : undefined);
+        }
+    }
+}
+function assertPortableActionText(input, previous) {
+    // sourceRefs/sourceHashes are physical IO bindings in the existing journal
+    // schema. Authored entry trace references are part of content and are checked.
+    for (const key of ['claimKey', 'evidenceFingerprint', 'content', 'specification', 'verification']) {
+        assertPortableAuthoredText(input[key], previous?.[key]);
+    }
+}
 function validateAction(action, historical = false) {
     if (!['learning', 'capability'].includes(action.kind) || !['insert', 'update', 'move', 'remove', 'deliver', 'reconcile'].includes(action.operation))
         throw new Error('invalid-action');
@@ -206,6 +247,9 @@ function validateAction(action, historical = false) {
 function validateApplication(action, application) {
     if (!application || !['prepared', 'written', 'published', 'applied'].includes(application.stage) || !Array.isArray(application.steps))
         throw new Error('invalid-application');
+    if (application.reviewedContent !== undefined && (action.kind !== 'capability' || typeof application.reviewedContent !== 'string'
+        || (0, proposal_queue_1.hashContent)(application.reviewedContent) !== action.delivery?.expectedHash))
+        throw new Error('capability-reviewed-content-mismatch');
     const refs = action.kind === 'learning' ? [action.target, ...(action.operation === 'move' ? [action.source] : action.copies?.map(copy => copy.ref) || [])] : [];
     if (application.steps.length !== refs.length)
         throw new Error('invalid-application-targets');
@@ -343,7 +387,9 @@ function replay(file) {
             if (receipt.decisions.length !== completed.length || receipt.decisions.some(item => !completed.some(action => action.actionId === item.actionId
                 && (0, completion_state_1.canonicalJournal)(action.decision) === (0, completion_state_1.canonicalJournal)(item.decision) && (0, completion_state_1.canonicalJournal)(action.target) === (0, completion_state_1.canonicalJournal)(item.target))))
                 throw new Error('checkpoint-action-conflict');
-            if ((0, completion_state_1.canonicalJournal)(receipt.processedSources) !== (0, completion_state_1.canonicalJournal)(state.processedSources))
+            const omitted = new Set(receipt.deferred.sources.map(source => (0, completion_state_1.sourcePathKey)(source.path)));
+            if (state.archivedSourcePaths?.some(file => omitted.has(file))
+                || (0, completion_state_1.canonicalJournal)(receipt.processedSources) !== (0, completion_state_1.canonicalJournal)(state.processedSources?.filter(source => !omitted.has((0, completion_state_1.sourcePathKey)(source.path)))))
                 throw new Error('completion-sources-conflict');
             if ((0, completion_state_1.canonicalJournal)(receipt.outcomeAssessments) !== (0, completion_state_1.canonicalJournal)(state.outcomeAssessments))
                 throw new Error('completion-assessments-conflict');
@@ -362,6 +408,9 @@ function replay(file) {
         }
         else
             throw new Error('unknown-journal-event');
+        if (['checkpoint', 'finalization'].includes(type) && data.receipt?.finalizationState === 'complete') {
+            state.archivedSourcePaths = [...new Set([...(state.archivedSourcePaths ?? []), ...(data.receipt.processedSources ?? []).map((source) => (0, completion_state_1.sourcePathKey)(source.path))])];
+        }
         state.sequence = event.sequence;
     }
     if (!state)
@@ -419,6 +468,26 @@ class RunRecord {
         this.assertCompletionDirectory(state);
         return state;
     }
+    /** Narrative is editable; the journal owns the receipt and its interrupted replacement. */
+    readCompletion(body) {
+        const receipt = (0, completion_state_1.decodeCompletion)(body, { runId: this.runId, owner: this.owner });
+        if (!node_fs_1.default.existsSync(this.file))
+            return receipt;
+        const { events } = replay(this.file);
+        const bindings = events.filter(event => ['checkpoint', 'finalization'].includes(event.payload.type));
+        const latest = bindings.at(-1)?.payload.data;
+        if (latest?.receipt) {
+            // Older checkpoints already stored their authoritative receipt. Read the
+            // preceding event only for a crash between replacement intent and rename.
+            const previous = latest.previousReceipt ?? bindings.at(-2)?.payload.data.receipt;
+            if (![latest.receipt, previous].some(value => value && (0, completion_state_1.canonicalJournal)(value) === (0, completion_state_1.canonicalJournal)(receipt))) {
+                throw new Error(`completion-receipt-conflict: ${this.completionFile}: structured receipt differs from recorded decisions or source mappings`);
+            }
+        }
+        // Legacy finalization events recorded no receipt. The full-completion path
+        // reconstructs decisions from the journal and independently inventories cleanup.
+        return receipt;
+    }
     assertCompletionDirectory(state) {
         if ((0, completion_state_1.sourcePathKey)(state.completionDirectory ?? this.directory) !== (0, completion_state_1.sourcePathKey)(this.completionDirectory))
             throw new Error('completion-evidence-path-changed');
@@ -472,6 +541,7 @@ class RunRecord {
                 throw new Error('run-context-mismatch');
             if ([...(state.outcomeAssessments ?? []), ...(state.pendingOutcomeAssessments ?? [])].some(item => item.digest === record.digest))
                 return;
+            assertPortableAuthoredText([record.incidentId, record.rationale]);
             this.append('assessment-prepared', { record, sourcePaths });
         });
     }
@@ -494,6 +564,7 @@ class RunRecord {
             const prior = Object.values(state.actions).find(a => a.claimKey === input.claimKey && a.evidenceFingerprint === input.evidenceFingerprint && (0, owner_identity_1.ownerKey)(a.target.owner) === (0, owner_identity_1.ownerKey)(input.target.owner));
             if (prior)
                 return prior;
+            assertPortableActionText(input);
             for (const name of node_fs_1.default.readdirSync(this.directory).filter(n => n.endsWith('-completion.md'))) {
                 const history = node_fs_1.default.readFileSync(node_path_1.default.join(this.directory, name), 'utf8');
                 let completed;
@@ -523,6 +594,7 @@ class RunRecord {
                 throw new Error('action-completed');
             if (prior.application)
                 throw new Error('application-started');
+            assertPortableActionText(input, prior);
             if (prior.content && input.content && (0, completion_state_1.canonicalJournal)(prior.content.trace) !== (0, completion_state_1.canonicalJournal)(input.content.trace))
                 throw new Error('immutable-history');
             if (prior.target.entryId !== input.target.entryId)
@@ -554,6 +626,7 @@ class RunRecord {
                 throw new Error('action-completed');
             if (action.application || decision.reviewer !== state.reviewer || typeof decision.reason !== 'string' || !decision.reason.trim() || !['approve', 'reject'].includes(decision.action) || (decision.revisitCondition !== undefined && (decision.action !== 'reject' || typeof decision.revisitCondition !== 'string' || !decision.revisitCondition.trim())) || !validDecisionProvenance(decision))
                 throw new Error('invalid-decision');
+            assertPortableAuthoredText([decision.reason, decision.revisitCondition, decision.predecessorId]);
             this.append('decision', { actionId, decision: { ...decision, revision, digest: action.digest, at: new Date().toISOString() } });
             return this.read().actions[actionId];
         });
@@ -562,6 +635,7 @@ class RunRecord {
         return this.mutate(expectedSequence, state => {
             if (reviewer !== state.reviewer || !reason.trim() || !tuples.length || new Set(tuples.map(t => t.actionId)).size !== tuples.length)
                 throw new Error('invalid-batch-decision');
+            assertPortableAuthoredText(reason);
             for (const tuple of tuples) {
                 const action = state.actions[tuple.actionId];
                 if (!action || action.application || action.revision !== tuple.revision || action.digest !== tuple.digest)
@@ -613,6 +687,7 @@ class RunRecord {
         this.append('application', { actionId, digest: action.digest, application });
     }
     recordCleanup(item, expectedSequence) {
+        assertPortableAuthoredText(item.reason);
         // The normal run location supplies an unambiguous same-owner home for
         // direct registrations. Cross-owner reconciliations bind their resolved home explicitly.
         if (!item.location) {
@@ -648,6 +723,7 @@ class RunRecord {
                 }),
             };
             validateReconciliation(reconciliation, state);
+            assertPortableAuthoredText([input.rationale, input.preservedDecisions]);
             this.append('reconciliation', { reconciliation, cleanup });
             return this.read();
         });
@@ -680,6 +756,7 @@ class RunRecord {
                     return { actionId: id, revision: action.revision, digest: action.digest };
                 });
             (0, corpus_audit_1.validateCorpusAudit)(audit, state.reviewer);
+            assertPortableAuthoredText(audit.dispositions.map(item => item.rationale));
             this.append('corpus-audit', audit);
             return this.read();
         });
@@ -710,7 +787,7 @@ class RunRecord {
                 const result = (0, completion_state_1.decodeCompletion)(node_fs_1.default.readFileSync(this.completionFile, 'utf8'), { runId: this.runId, owner: this.owner });
                 if (result.finalizationState !== 'complete')
                     throw new Error('incomplete-finalization');
-                if ((0, completion_state_1.canonicalJournal)(result.retrospective) !== (0, completion_state_1.canonicalJournal)(retrospective))
+                if (result.retrospective?.relativePath !== retrospective?.relativePath)
                     throw new Error('completion-retrospective-conflict');
                 verifyApplied?.(true);
                 finishedInventory();
@@ -721,9 +798,11 @@ class RunRecord {
                 throw new Error('assessment-processing-pending');
             if (!summary?.trim() || summary.includes('fraim-sleep-decisions'))
                 throw new Error('invalid-completion-summary');
+            assertPortableAuthoredText(summary);
             const actions = deferred ? completedRunActions(state) : Object.values(state.actions);
             if (deferred) {
                 (0, completion_state_1.validateDeferredWork)(deferred);
+                assertPortableAuthoredText([...deferred.actions, ...deferred.sources, ...(deferred.corpusErrors ?? [])].map(item => item.reason));
                 const ids = new Set(actions.map(action => action.actionId));
                 if ((0, completion_state_1.canonicalJournal)(deferred.actions.map(item => [item.actionId, item.revision, item.digest])) !== (0, completion_state_1.canonicalJournal)(Object.values(state.actions).filter(action => !ids.has(action.actionId)).map(action => [action.actionId, action.revision, action.digest])))
                     throw new Error('checkpoint-action-conflict');
@@ -751,7 +830,7 @@ class RunRecord {
                 decisions: actions.map(a => ({ actionId: a.actionId, revision: a.revision, digest: a.digest, owner: a.target.owner, target: a.target, claimKey: a.claimKey, evidenceFingerprint: a.evidenceFingerprint, sourceRefs: a.sourceRefs, decision: a.decision, dependencies: a.dependencies.map(id => ({ actionId: id, outcome: state.actions[id].decision?.action === 'approve' ? 'applied' : 'rejected' })), ...(a.application?.publicationRef ? { publicationRef: a.application.publicationRef } : {}) })),
                 sourceDispositions: actions.flatMap(a => a.sourceRefs.map(sourceRef => ({ sourceRef, sourceHash: a.sourceHashes[sourceRef], outcome: a.decision.action === 'approve' ? 'applied' : 'rejected', actionId: a.actionId }))),
                 cleanup: snapshot,
-                ...(state.processedSources ? { processedSources: state.processedSources } : {}),
+                ...(state.processedSources ? { processedSources: state.processedSources.filter(source => !deferred?.sources.some(item => (0, completion_state_1.sourcePathKey)(item.path) === (0, completion_state_1.sourcePathKey)(source.path))) } : {}),
                 ...(state.sourceParticipants !== undefined ? { sourceParticipants: state.sourceParticipants } : {}),
                 ...(state.outcomeAssessments?.length ? { outcomeAssessments: state.outcomeAssessments } : {}),
                 ...(retrospective ? { retrospective } : {}),
@@ -767,6 +846,8 @@ class RunRecord {
             // Submission and feedback already own this path before the completion receipt exists.
             const existingEvidence = node_fs_1.default.existsSync(this.completionFile) ? node_fs_1.default.readFileSync(this.completionFile, 'utf8') : undefined;
             const hasReceipt = existingEvidence?.includes('fraim-sleep-decisions');
+            if (!hasReceipt && (state.checkpoint || state.finalization))
+                throw new Error(`completion-receipt-conflict: ${this.completionFile}: recorded receipt is missing`);
             if (existingEvidence && !hasReceipt) {
                 const header = existingEvidence.match(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/);
                 if (!header || (header[1].match(/^artifactKind:/gm) || []).length !== 1 || !/^artifactKind: work-evidence\s*$/m.test(header[1])
@@ -775,46 +856,73 @@ class RunRecord {
                 narrative = existingEvidence + `\n\n## Sleep completion: ${this.runId}\n\n${summary}\n\n## Decisions and source disposition\n\n`;
             }
             let trailingHistory = '\n';
+            let observedEvidence = existingEvidence;
             const writeEvidence = () => {
+                const currentBody = node_fs_1.default.existsSync(this.completionFile) ? node_fs_1.default.readFileSync(this.completionFile, 'utf8') : undefined;
+                if (currentBody !== observedEvidence) {
+                    if (!currentBody?.includes('fraim-sleep-decisions'))
+                        throw new Error(`completion-receipt-conflict: ${this.completionFile}: receipt removed during completion`);
+                    this.readCompletion(currentBody);
+                    narrative = currentBody.slice(0, currentBody.indexOf('<!-- fraim-sleep-decisions:v1 -->'));
+                    trailingHistory = currentBody.slice(currentBody.indexOf('<!-- /fraim-sleep-decisions -->') + '<!-- /fraim-sleep-decisions -->'.length);
+                }
                 if (actions.length)
                     narrative = narrative.replace(/^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/, header => header.replace(/^containsFeedback: false[ \t]*(?=\r?$)/m, 'containsFeedback: true'));
                 const encoded = JSON.stringify(result, null, 2).split('<').join(String.raw `\u003c`);
                 const body = narrative + `<!-- fraim-sleep-decisions:v1 -->\n\x60\x60\x60json\n${encoded}\n\x60\x60\x60\n<!-- /fraim-sleep-decisions -->` + trailingHistory;
                 (0, completion_state_1.decodeCompletion)(body, { runId: this.runId, owner: this.owner });
-                const previousEvidenceHash = node_fs_1.default.existsSync(this.completionFile) ? (0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(this.completionFile, 'utf8')) : undefined;
+                const previousBody = node_fs_1.default.existsSync(this.completionFile) ? node_fs_1.default.readFileSync(this.completionFile, 'utf8') : undefined;
+                const previousEvidenceHash = previousBody === undefined ? undefined : (0, proposal_queue_1.hashContent)(previousBody);
+                const previousReceipt = previousBody?.includes('fraim-sleep-decisions') ? this.readCompletion(previousBody) : undefined;
                 // A replacement intent names both recoverable states. A crash before
                 // or after the atomic rename can resume without accepting a third state.
-                if (deferred)
-                    this.append('checkpoint', { evidenceHash: (0, proposal_queue_1.hashContent)(body), previousEvidenceHash, receipt: result });
-                else if (previousEvidenceHash)
-                    this.append('finalization', { evidenceHash: (0, proposal_queue_1.hashContent)(body), previousEvidenceHash });
+                const event = deferred ? 'checkpoint' : 'finalization';
+                const binding = { evidenceHash: (0, proposal_queue_1.hashContent)(body), previousEvidenceHash, receipt: result, previousReceipt };
+                if (previousReceipt)
+                    this.append(event, binding);
                 (0, proposal_queue_1.atomicWrite)(this.completionFile, body);
+                observedEvidence = body;
                 const verified = node_fs_1.default.readFileSync(this.completionFile, 'utf8');
                 if ((0, proposal_queue_1.hashContent)(verified) !== (0, proposal_queue_1.hashContent)(body))
                     throw new Error('completion-write-conflict');
                 (0, completion_state_1.decodeCompletion)(verified, { runId: this.runId, owner: this.owner });
-                if (!deferred && !previousEvidenceHash)
-                    this.append('finalization', { evidenceHash: (0, proposal_queue_1.hashContent)(body) });
+                if (!previousReceipt)
+                    this.append(event, binding);
             };
             if (node_fs_1.default.existsSync(this.completionFile) && hasReceipt) {
                 const body = node_fs_1.default.readFileSync(this.completionFile, 'utf8');
-                const prior = (0, completion_state_1.decodeCompletion)(body, { runId: this.runId, owner: this.owner });
-                if (!deferred && !prior.deferred && prior.finalizationState === 'complete' && (0, completion_state_1.canonicalJournal)(prior.retrospective) !== (0, completion_state_1.canonicalJournal)(retrospective))
+                const prior = this.readCompletion(body);
+                if (!deferred && !prior.deferred && prior.finalizationState === 'complete' && prior.retrospective?.relativePath !== retrospective?.relativePath)
                     throw new Error('completion-retrospective-conflict');
-                if (!deferred && state.finalization && ![state.finalization.evidenceHash, state.finalization.previousEvidenceHash].includes((0, proposal_queue_1.hashContent)(body)))
-                    throw new Error('completion-evidence-conflict');
+                if (deferred && !state.checkpoint && !state.finalization?.receipt) {
+                    // A legacy full receipt has no structured journal binding. Prove its
+                    // original full state before partitioning an interrupted source batch.
+                    const inventory = inspect();
+                    if (prior.cleanup.some(item => !inventory.some(current => sameCleanupIdentity(item, current)))
+                        || inventory.some(item => !prior.cleanup.some(current => sameCleanupIdentity(item, current)))
+                        || prior.cleanup.some(item => ['deleted', 'absent'].includes(item.outcome) && inventory.some(current => sameCleanupIdentity(item, current) && current.outcome === 'pending')))
+                        throw new Error('cleanup-inventory-missing');
+                    const full = { ...result, finalizationState: 'pending', deferred: undefined, cleanup: prior.cleanup,
+                        processedSources: state.processedSources, reconciliations: state.reconciliations.length ? state.reconciliations : undefined,
+                        corpusAudit: state.corpusAudit, reconciliationHistory: reconciliationHistory.length ? reconciliationHistory : undefined,
+                        deferredHistory: state.deferredHistory?.length ? state.deferredHistory : undefined,
+                        deferredAttempts: state.deferredAttempts?.length ? state.deferredAttempts : undefined };
+                    if (prior.finalizationState !== 'pending' || (0, completion_state_1.canonicalJournal)(prior) !== (0, completion_state_1.canonicalJournal)(full))
+                        throw new Error(`completion-decisions-conflict: ${this.completionFile}: legacy receipt differs from original full journal state`);
+                }
                 if (deferred || prior.deferred) {
-                    if (!state.checkpoint || ![state.checkpoint.evidenceHash, state.checkpoint.previousEvidenceHash].includes((0, proposal_queue_1.hashContent)(body))
-                        || prior.decisions.some(item => !result.decisions.some(current => (0, completion_state_1.canonicalJournal)(current) === (0, completion_state_1.canonicalJournal)(item)))
-                        || prior.processedSources?.some(item => !result.processedSources?.some(current => (0, completion_state_1.canonicalJournal)(current) === (0, completion_state_1.canonicalJournal)(item))))
+                    if (prior.decisions.some(item => !result.decisions.some(current => (0, completion_state_1.canonicalJournal)(current) === (0, completion_state_1.canonicalJournal)(item)))
+                        || prior.processedSources?.some(item => !result.processedSources?.some(current => (0, completion_state_1.canonicalJournal)(current) === (0, completion_state_1.canonicalJournal)(item))
+                            && (prior.finalizationState === 'complete' || !deferred?.sources.some(source => (0, completion_state_1.sourcePathKey)(source.path) === (0, completion_state_1.sourcePathKey)(item.path)))))
                         throw new Error('completion-decisions-conflict');
                 }
-                else if ((0, completion_state_1.canonicalJournal)(prior.decisions) !== (0, completion_state_1.canonicalJournal)(result.decisions) || (0, completion_state_1.canonicalJournal)(prior.sourceDispositions) !== (0, completion_state_1.canonicalJournal)(result.sourceDispositions) || (0, completion_state_1.canonicalJournal)(prior.reconciliations) !== (0, completion_state_1.canonicalJournal)(result.reconciliations) || (0, completion_state_1.canonicalJournal)(prior.processedSources) !== (0, completion_state_1.canonicalJournal)(result.processedSources) || (0, completion_state_1.canonicalJournal)(prior.corpusAudit) !== (0, completion_state_1.canonicalJournal)(result.corpusAudit) || (0, completion_state_1.canonicalJournal)(prior.reconciliationHistory) !== (0, completion_state_1.canonicalJournal)(result.reconciliationHistory) || (0, completion_state_1.canonicalJournal)(prior.outcomeAssessments) !== (0, completion_state_1.canonicalJournal)(result.outcomeAssessments))
-                    throw new Error('completion-decisions-conflict');
-                if (deferred && prior.finalizationState === 'complete' && (0, completion_state_1.canonicalJournal)({ ...prior, finalizationState: 'pending' }) === (0, completion_state_1.canonicalJournal)(result)) {
+                else if (['decisions', 'sourceDispositions', 'reconciliations', 'processedSources', 'corpusAudit', 'reconciliationHistory', 'outcomeAssessments', 'sourceParticipants', 'deferredHistory', 'deferredAttempts']
+                    .some(key => (0, completion_state_1.canonicalJournal)(prior[key]) !== (0, completion_state_1.canonicalJournal)(result[key])))
+                    throw new Error(`completion-decisions-conflict: ${this.completionFile}: receipt differs from journaled decisions or source history`);
+                if (deferred && state.checkpoint && prior.finalizationState === 'complete' && (0, completion_state_1.canonicalJournal)({ ...prior, finalizationState: 'pending' }) === (0, completion_state_1.canonicalJournal)(result)) {
                     finishSources?.();
                     verifyApplied?.();
-                    this.append('deferred-attempt', { at: new Date().toISOString(), evidenceHash: (0, proposal_queue_1.hashContent)(body), reason: 'verified-subset-unchanged' });
+                    this.append('deferred-attempt', { at: new Date().toISOString(), evidenceHash: state.checkpoint.evidenceHash, reason: 'verified-subset-unchanged' });
                     return prior;
                 }
                 // While pending, the agent may update process evidence and the
@@ -824,26 +932,28 @@ class RunRecord {
                 if (prior.deferred && (!deferred || (0, completion_state_1.canonicalJournal)({ ...prior, finalizationState: 'pending' }) !== (0, completion_state_1.canonicalJournal)(result)))
                     narrative += `\n## Recovery completion\n\n${summary}\n\n`;
                 trailingHistory = body.slice(body.indexOf('<!-- /fraim-sleep-decisions -->') + '<!-- /fraim-sleep-decisions -->'.length);
-                if (!deferred && !prior.deferred && prior.finalizationState === 'complete' && !snapshot.some(item => item.outcome === 'pending')) {
-                    finishedInventory();
-                    finishSources?.();
-                    verifyApplied?.(true);
-                    node_fs_1.default.unlinkSync(this.file);
-                    return prior;
-                }
-                if (!deferred && !prior.deferred && prior.finalizationState === 'complete' && snapshot.some(item => item.outcome === 'pending'))
-                    throw new Error('cleanup-content-reappeared');
                 // The fresh inventory authorizes every remaining deletion. Never
                 // execute a path merely because it appeared in prior evidence.
+                if (!deferred && !prior.deferred && snapshot.some(current => !prior.cleanup.some(item => sameCleanupIdentity(item, current))))
+                    throw new Error(`cleanup-inventory-missing: ${this.completionFile}: receipt omitted recorded cleanup`);
                 for (const item of deferred ? [] : prior.cleanup) {
                     const found = snapshot.find(current => sameCleanupIdentity(item, current));
                     if (!found)
                         throw new Error('cleanup-inventory-missing');
                     if ((item.outcome === 'deleted' || item.outcome === 'absent') && found.outcome === 'pending')
                         throw new Error('cleanup-content-reappeared');
-                    if (found.outcome === 'absent' && item.outcome === 'deleted')
+                    if (state.finalization?.receipt && found.outcome === 'absent' && item.outcome === 'deleted')
                         found.outcome = 'deleted';
                 }
+                if (!deferred && !prior.deferred && state.finalization?.receipt && prior.finalizationState === 'complete' && !snapshot.some(item => item.outcome === 'pending') && (0, completion_state_1.canonicalJournal)(prior.retrospective) === (0, completion_state_1.canonicalJournal)(retrospective)) {
+                    finishedInventory();
+                    finishSources?.();
+                    verifyApplied?.(true);
+                    node_fs_1.default.unlinkSync(this.file);
+                    return prior;
+                }
+                if (!deferred && !prior.deferred && prior.finalizationState === 'complete' && snapshot.some(item => item.outcome === 'pending'))
+                    throw new Error('cleanup-content-reappeared');
             }
             writeEvidence();
             afterStage?.('evidence');
@@ -878,9 +988,8 @@ class RunRecord {
             result.finalizationState = 'complete';
             writeEvidence();
             afterStage?.('complete-evidence');
-            const binding = deferred ? this.read().checkpoint : this.read().finalization;
-            if ((0, proposal_queue_1.hashContent)(node_fs_1.default.readFileSync(this.completionFile, 'utf8')) !== binding?.evidenceHash)
-                throw new Error('completion-evidence-conflict');
+            if ((0, completion_state_1.canonicalJournal)(this.readCompletion(node_fs_1.default.readFileSync(this.completionFile, 'utf8'))) !== (0, completion_state_1.canonicalJournal)(result))
+                throw new Error(`completion-receipt-conflict: ${this.completionFile}: completed receipt changed`);
             // Complete attests this receipt's terminal subset. Only full coverage permits retiring run recovery.
             if (!deferred) {
                 finishedInventory();

package/dist/src/cli/learning/queue-operations.js

@@ -161,7 +161,7 @@ async function runQueueCommand(argv) {
         const coordinationFile = node_path_1.default.join(journalDirectory(homes.find(item => item.level === 'Manager')), 'owner-application');
         (0, run_application_1.reserveRunAction)(run, id, revision, expectedSequence, { resolveHome, runDirectories, coordinationFile, homes, readerRoots: () => resolveReaderCorpusRoots(projectPath) });
         const applySequence = run.read().sequence;
-        const capability = proposed?.kind === 'capability' ? await (0, run_publication_1.verifyCapabilityDelivery)(proposed, { ...input, operationKey: `${runId}-${id}-${revision}` }, { projectPath, resolveHome, runtimeModule: runtime_1.runtimeModuleStatic, runtimeModulePath: runtime_1.runtimeModulePathStatic }) : undefined;
+        const capability = proposed?.kind === 'capability' ? await (0, run_publication_1.verifyCapabilityDelivery)(proposed, { reviewedContent: proposed.application?.reviewedContent, ...input, operationKey: `${runId}-${id}-${revision}` }, { projectPath, resolveHome, runtimeModule: runtime_1.runtimeModuleStatic, runtimeModulePath: runtime_1.runtimeModulePathStatic }) : undefined;
         const capabilities = new Map();
         if (capability)
             capabilities.set(id, capability);
@@ -169,7 +169,7 @@ async function runQueueCommand(argv) {
             const dependency = state.actions[dependencyId];
             if (dependency?.kind !== 'capability')
                 continue;
-            capabilities.set(dependencyId, await (0, run_publication_1.verifyCapabilityDelivery)(dependency, { publicationRef: dependency.application?.publicationRef, operationKey: `${runId}-${dependencyId}-${dependency.revision}` }, { projectPath, resolveHome, runtimeModule: runtime_1.runtimeModuleStatic, runtimeModulePath: runtime_1.runtimeModulePathStatic }));
+            capabilities.set(dependencyId, await (0, run_publication_1.verifyCapabilityDelivery)(dependency, { publicationRef: dependency.application?.publicationRef, reviewedContent: dependency.application?.reviewedContent, operationKey: `${runId}-${dependencyId}-${dependency.revision}` }, { projectPath, resolveHome, runtimeModule: runtime_1.runtimeModuleStatic, runtimeModulePath: runtime_1.runtimeModulePathStatic }));
         }
         return (0, run_application_1.applyRunAction)(run, id, revision, applySequence, {
             resolveHome, runDirectories, coordinationFile, homes, readerRoots: () => resolveReaderCorpusRoots(projectPath),
@@ -185,7 +185,7 @@ async function runQueueCommand(argv) {
         if (node_fs_1.default.existsSync(run.file))
             for (const candidate of Object.values(run.read().actions)) {
                 if (candidate.kind === 'capability' && candidate.application?.stage === 'applied')
-                    capabilities.set(candidate.actionId, await (0, run_publication_1.verifyCapabilityDelivery)(candidate, { publicationRef: candidate.application.publicationRef, operationKey: `${runId}-${candidate.actionId}-${candidate.revision}` }, { projectPath, resolveHome, runtimeModule: runtime_1.runtimeModuleStatic, runtimeModulePath: runtime_1.runtimeModulePathStatic }));
+                    capabilities.set(candidate.actionId, await (0, run_publication_1.verifyCapabilityDelivery)(candidate, { publicationRef: candidate.application.publicationRef, reviewedContent: candidate.application.reviewedContent, operationKey: `${runId}-${candidate.actionId}-${candidate.revision}` }, { projectPath, resolveHome, runtimeModule: runtime_1.runtimeModuleStatic, runtimeModulePath: runtime_1.runtimeModulePathStatic }));
             }
         return (0, run_application_1.completeRun)(run, input?.summary, homes, { resolveHome, homes, readerRoots: () => resolveReaderCorpusRoots(projectPath), runDirectories: homes.map(journalDirectory), retrospective: input?.retrospective, analyzedSources: input.analyzedSources,
             allowDeferred: input?.allowDeferred === true, deferredSources: input?.deferredSources,

package/dist/src/cli/mcp/fraim-mcp-latest-launcher.js

@@ -232,9 +232,26 @@ function runPackage(plan, cacheDir) {
 const plan = resolvePackage();
 const versionCacheDir = path.join(CACHE_ROOT, plan.packageName + '-' + plan.version.replace(/[^a-zA-Z0-9._-]/g, '_'));
 pruneCaches(versionCacheDir, Date.now());
+
+/**
+ * True when npx materialized the package into this cache. A non-zero exit from a package
+ * that DID install is the CLI's own result, not a cache problem, and must be returned verbatim.
+ */
+function packageMaterialized(cacheDir) {
+  try {
+    const npxDir = path.join(cacheDir, '_npx');
+    return fs.readdirSync(npxDir).some(function (entry) {
+      return fs.existsSync(path.join(npxDir, entry, 'node_modules', plan.packageName));
+    });
+  } catch (error) {
+    return false;
+  }
+}
+
 let status = runPackage(plan, versionCacheDir);
 
-if (status !== 0 && process.platform === 'win32') {
+// Retry ONLY when npx could not materialize the package: the corrupt-cache case this exists for.
+if (status !== 0 && process.platform === 'win32' && !packageMaterialized(versionCacheDir)) {
   const retryCache = path.join(CACHE_ROOT, 'retry-' + Date.now() + '-' + process.pid);
   console.error('[fraim-mcp-launcher] Package execution failed; retrying once with a fresh npm cache.');
   status = runPackage(plan, retryCache);

package/dist/src/cli/setup/user-level-sync.js

@@ -70,6 +70,8 @@ const script_sync_utils_1 = require("../utils/script-sync-utils");
 const USER_LEVEL_RUNTIME_DEPS = {
     'node-edge-tts': '*', // used by scripts/author-audio.js
     'adm-zip': '^0.6.0', // used by scripts/communication/*.js (DOCX review layer) — matches root/packages/* manifests
+    'fast-glob': '^3.3.3', // used by scripts/exec-with-timeout.ts (Issue #1839)
+    'tree-kill': '^1.2.2', // used by scripts/exec-with-timeout.ts (Issue #1839)
 };
 /**
  * Ensure the user-level FRAIM directory structure exists.

package/dist/src/cli/utils/managed-agent-paths.js

@@ -227,6 +227,7 @@ function buildPathWithManagedAgentBins(basePath) {
 // launches already inherit the registry-composed PATH, so this returns null immediately on
 // win32 rather than attempting a login-shell equivalent that doesn't exist.
 const LOGIN_SHELL_PATH_TIMEOUT_MS = 3000;
+const LOGIN_SHELL_PATH_CACHE_TTL_MS = 60_000;
 function defaultResolveLoginShellPath() {
     if (process.platform === 'win32')
         return null;
@@ -279,18 +280,20 @@ let loginShellPathResolverOverride = null;
  */
 function __setLoginShellPathResolverForTests(resolver) {
     loginShellPathResolverOverride = resolver;
-    cachedLoginShellPath = undefined;
-    cachedNpmGlobalBinDirsForRecovery.clear();
+    __clearLoginShellPathCacheForTests();
 }
 let cachedLoginShellPath;
+let cachedLoginShellPathAtMs = 0;
 /**
- * Resolves and memoizes the PATH the user's own login shell would produce. Computed at most
- * once per process (AC-A5: bounded, fixed cost) — this feeds every agent-resolution call, so
- * recomputing per call would multiply one shell spawn by the number of agents probed.
+ * Resolves the user's login PATH at most once per minute, including failed reads. A
+ * running Hub can discover later installations without spawning a shell per agent probe.
  */
 function resolveLoginShellPathCached() {
-    if (cachedLoginShellPath !== undefined)
+    const nowMs = Date.now();
+    const ageMs = nowMs - cachedLoginShellPathAtMs;
+    if (cachedLoginShellPath !== undefined && ageMs >= 0 && ageMs < LOGIN_SHELL_PATH_CACHE_TTL_MS) {
         return cachedLoginShellPath;
+    }
     const resolver = loginShellPathResolverOverride ?? defaultResolveLoginShellPath;
     // AC-A5: a resolver failing must degrade to "no recovery", never propagate. The default
     // resolver already guards its own spawnSync internally; this also protects against an
@@ -301,13 +304,20 @@ function resolveLoginShellPathCached() {
     catch {
         cachedLoginShellPath = null;
     }
+    cachedLoginShellPathAtMs = nowMs;
+    // npm's configured global prefix can change even when the recovered PATH does not.
+    // Refresh both tiers together so an old prefix cannot outlive login-PATH recovery.
+    cachedNpmGlobalBinDirsForRecovery.clear();
     return cachedLoginShellPath;
 }
 /** Test seam only. Clears the memoized login-shell PATH so the next call recomputes. */
 function __clearLoginShellPathCacheForTests() {
     cachedLoginShellPath = undefined;
+    cachedLoginShellPathAtMs = 0;
+    cachedNpmGlobalBinDirsForRecovery.clear();
 }
 const cachedNpmGlobalBinDirsForRecovery = new Map();
+const NPM_GLOBAL_RECOVERY_CACHE_MAX_ENTRIES = 64;
 /**
  * Memoized wrapper around resolveNpmGlobalBinDirs(), scoped to buildRecoveredAgentPath()'s
  * own use only — NOT a change to resolveNpmGlobalBinDirs() itself, which fraim doctor and the
@@ -321,8 +331,8 @@ const cachedNpmGlobalBinDirsForRecovery = new Map();
  * and because each call sits inside a Promise executor that runs synchronously up to its own
  * spawnSync, the "concurrent" probes actually serialized behind it — up to 5 agents × 5s of
  * blocking spawnSync is exactly the event-loop-freezing regression issue #1010 eliminated,
- * reintroduced one layer deeper. Memoizing once per process (like resolveLoginShellPathCached
- * above) restores the bound this repo's own #1010 postmortem requires.
+ * reintroduced one layer deeper. Memoizing between login-PATH refreshes keeps repeated
+ * probes in the same round from duplicating that work.
  *
  * Keyed by `basePath` (not a single scalar): `resolveManagedCommand()` also routes through this
  * cache now, and unlike `detectEmployeesAsync()`'s repeated same-ambient-PATH probing, its
@@ -330,7 +340,8 @@ const cachedNpmGlobalBinDirsForRecovery = new Map();
  * isolated tests that swap `FRAIM_USER_DIR`/`PATH` per test case). A single scalar cache would
  * let the FIRST basePath's answer silently leak into every later, differently-scoped lookup —
  * concretely, a real machine's actual npm-global `codex` shadowing a test's own isolated managed
- * shim. Per-basePath keys keep the "once per distinct PATH" bound without that cross-contamination.
+ * shim. Per-basePath keys avoid that cross-contamination; a size limit bounds memory when
+ * callers supply many distinct PATHs before the next refresh.
  */
 function resolveNpmGlobalBinDirsCached(basePath) {
     const cached = cachedNpmGlobalBinDirsForRecovery.get(basePath);
@@ -343,6 +354,11 @@ function resolveNpmGlobalBinDirsCached(basePath) {
     catch {
         dirs = [];
     }
+    if (cachedNpmGlobalBinDirsForRecovery.size >= NPM_GLOBAL_RECOVERY_CACHE_MAX_ENTRIES) {
+        const oldestKey = cachedNpmGlobalBinDirsForRecovery.keys().next().value;
+        if (oldestKey !== undefined)
+            cachedNpmGlobalBinDirsForRecovery.delete(oldestKey);
+    }
     cachedNpmGlobalBinDirsForRecovery.set(basePath, dirs);
     return dirs;
 }

package/dist/src/local-mcp-server/learning-context-builder.js

@@ -47,7 +47,6 @@ const REPO_LEARNINGS_REL = (0, project_fraim_paths_1.getWorkspaceFraimDisplayPat
  * would keep passing if this default ever changed.
  */
 exports.DEFAULT_THRESHOLD = 3.0;
-const AGING_HORIZON_DAYS = 7;
 const MAX_ENTRIES_SCANNED = 200;
 const L0_SLEEP_ON_LEARNINGS_PROMPT_MIN = 5;
 // ── Single source of truth for the learning-entry format contract (#533) ──────
@@ -306,11 +305,10 @@ function getScoreThreshold(workspaceRoot) {
     return exports.DEFAULT_THRESHOLD;
 }
 /**
- * Effective score for an L1 learning entry. The aging-risk count below uses
- * this same decay model with `now` shifted forward.
+ * Effective score for an L1 learning entry. Score is display-only and does
+ * not gate delivery; the tier file is the authoritative delivery gate.
  *
- * @param now Optional override for "now" (for forward-looking aging-risk
- *            calculations). Defaults to the current wall clock.
+ * @param now Optional override for "now". Defaults to the current wall clock.
  */
 function computeEffectiveScore(severity, lastSeenDate, recurrences, fileType, now = new Date()) {
     const baseScore = severity === 'P-CRITICAL' ? 10 : severity === 'P-HIGH' ? 8 : severity === 'P-MED' ? 5 : 3;
@@ -330,72 +328,6 @@ function computeEffectiveScore(severity, lastSeenDate, recurrences, fileType, no
     const recurrenceBoost = Math.log2(Math.max(1, recurrences) + 1);
     return baseScore * decay * recurrenceBoost;
 }
-function scanMistakePatternFile(filePath, threshold, fileType = 'mistake-patterns') {
-    const empty = { active: 0, dormant: 0, agingRisk: 0 };
-    if (!(0, fs_1.existsSync)(filePath))
-        return empty;
-    let content;
-    try {
-        content = (0, fs_1.readFileSync)(filePath, 'utf8');
-    }
-    catch {
-        return empty;
-    }
-    const lines = content.split(/\r?\n/);
-    const now = new Date();
-    const horizon = new Date(now.getTime() + AGING_HORIZON_DAYS * 86_400_000);
-    let active = 0;
-    let dormant = 0;
-    let agingRisk = 0;
-    let scanned = 0;
-    let inEntry = false;
-    let severity = null;
-    let lastSeen = '';
-    let recurrences = 1;
-    const flush = () => {
-        if (!severity)
-            return;
-        scanned++;
-        const today = computeEffectiveScore(severity, lastSeen, recurrences, fileType, now);
-        if (today >= threshold) {
-            active++;
-            if (lastSeen) {
-                const future = computeEffectiveScore(severity, lastSeen, recurrences, fileType, horizon);
-                if (future < threshold)
-                    agingRisk++;
-            }
-        }
-        else {
-            dormant++;
-        }
-    };
-    for (const line of lines) {
-        if (scanned >= MAX_ENTRIES_SCANNED)
-            break;
-        const headerMatch = line.match((0, learning_entry_format_1.learningEntryHeadingRegex)());
-        if (headerMatch) {
-            flush();
-            inEntry = true;
-            severity = headerMatch[1];
-            lastSeen = '';
-            recurrences = 1;
-            continue;
-        }
-        if (!inEntry)
-            continue;
-        const lastSeenMatch = line.match(/^\*\*Last seen\*\*:\s*(.+)/);
-        if (lastSeenMatch) {
-            lastSeen = lastSeenMatch[1].trim();
-            continue;
-        }
-        const recurrenceMatch = line.match(/^\*\*Recurrences\*\*:\s*(\d+)/);
-        if (recurrenceMatch) {
-            recurrences = parseInt(recurrenceMatch[1], 10);
-        }
-    }
-    flush();
-    return { active, dormant, agingRisk };
-}
 /** Historical counters are only read for the human library view. */
 function resolveUsageStats() {
     try {
@@ -597,10 +529,10 @@ function mergeLearningEntriesAcrossTiers(tiers) {
     return tiers.flatMap(tier => tier.entries);
 }
 const CONTEXT_CATEGORIES = {
-    mistake: { ft: 'mistake-patterns', gated: true, label: '(entries above score threshold)' },
-    pref: { ft: 'preferences', gated: false, label: '(all entries)' },
-    coach: { ft: 'manager-coaching', gated: false, label: '(manager-facing; all entries)' },
-    validated: { ft: 'validated-patterns', gated: true, label: '(entries above score threshold)' },
+    mistake: { ft: 'mistake-patterns', label: '(all entries)' },
+    pref: { ft: 'preferences', label: '(all entries)' },
+    coach: { ft: 'manager-coaching', label: '(manager-facing; all entries)' },
+    validated: { ft: 'validated-patterns', label: '(all entries)' },
 };
 /** Resolve the files listed in injected context, in delivery order. */
 function resolveContextLearningFiles(workspaceRoot, resolvedUserId, roots, forJob, domain) {
@@ -646,7 +578,6 @@ function resolveContextLearningFiles(workspaceRoot, resolvedUserId, roots, forJo
                     path: tier.path,
                     displayPath: tier.displayPath,
                     fileType: meta.ft,
-                    gated: meta.gated,
                     label: meta.label,
                     isCoach: key === 'coach',
                     level: tier.level ?? fallbackLevel,
@@ -669,42 +600,14 @@ function resolveContextLearningFiles(workspaceRoot, resolvedUserId, roots, forJo
     const l1 = collect({ global: l1GlobalCats, domain: l1DomainCats }, (ft, dom) => resolvePersonalLearningFileTiers(roots.repoLearningsBase, roots.managerCacheBase, roots.managerCacheDisplayBase, roots.globalPersonalBase, roots.globalPersonalDisplayBase, dom ? `${resolvedUserId}-${dom}-${ft}.md` : `${resolvedUserId}-${ft}.md`), 'manager');
     return { l2, l1, multiTier, coachPresent };
 }
-/**
- * Report how many entries have been demoted, without naming the file they live in.
- *
- * Issue #861 keeps demoted entries out of the injected context, and #1103 keeps it
- * that way after trying the alternative. Naming the `.cold.md` path here was
- * considered and reverted: the path states a family (`…-mistake-patterns.cold.md`)
- * and not a subject, so an instruction to "read it if this job touches its
- * subject" is one the agent has no basis to follow. It degrades to reading the
- * file every job, which is the token cost #861 removed, or never, which makes the
- * line noise.
- *
- * Recovery for a demoted entry is a synthesis-time concern, not a runtime one.
- * `sleep-on-learnings` reads both tiers when deciding whether a signal is a
- * recurrence, so an entry that becomes relevant again is found, updated and
- * promoted there. See that job's gather-signals and analyze phases.
- */
-function renderDemotedLine(listed, label) {
-    const total = listed.reduce((sum, f) => sum + f.dormant, 0);
-    if (total === 0)
-        return '';
-    return total === 1
-        ? `Demoted: 1 ${label} pattern has gone quiet and is not listed above.\n`
-        : `Demoted: ${total} ${label} patterns have gone quiet and are not listed above.\n`;
-}
 function buildLearningContextSection(workspaceRoot, userId, forJob, domain) {
     const roots = getLearningRoots(workspaceRoot);
     const resolvedUserId = resolveLearningUserId(workspaceRoot, userId, roots);
-    const threshold = getScoreThreshold(workspaceRoot);
     const resolved = resolveContextLearningFiles(workspaceRoot, resolvedUserId, roots, forJob, domain);
     const multiTier = resolved.multiTier;
     const toListed = (f) => ({
         displayPath: f.displayPath,
         label: f.label,
-        dormant: f.gated
-            ? scanMistakePatternFile(f.path, threshold, f.fileType).dormant
-            : 0,
         isCoach: f.isCoach,
     });
     const l2Files = resolved.l2.map(toListed);
@@ -726,14 +629,12 @@ function buildLearningContextSection(workspaceRoot, userId, forJob, domain) {
         section += '### L2 - Org patterns\n';
         for (const f of l2Files)
             section += `\`${f.displayPath}\`  ${f.label}\n`;
-        section += renderDemotedLine(l2Files, 'org');
         section += '\n';
     }
     if (hasL1) {
         section += '### L1 - Your patterns\n';
         for (const f of l1Files)
             section += `\`${f.displayPath}\`  ${f.label}\n`;
-        section += renderDemotedLine(l1Files, 'personal');
         section += '\n';
     }
     if (l0CoachingCount > 0 || l0RetroCount > 0) {
@@ -1409,13 +1310,11 @@ function listDomainLearningFiles(dir, prefix, fileType) {
 }
 // Parse the `## [P-…] Title` entries (and their body prose) out of one learning
 // file. Score metadata (Last seen / Recurrences) is captured to compute the
-// effective decayed score and the injected flag; those bookkeeping lines are
-// still excluded from the rendered body.
+// effective decayed score for display; those bookkeeping lines are excluded from
+// the rendered body.
 //
-// threshold: entries with score >= threshold (or in a non-gated category) are
-//   marked injected:true. Callers that don't need scoring pass Infinity so
-//   all entries are injected.
-function parseLearningEntries(filePath, displayPath, category, level, domain = 'global', tier, threshold = exports.DEFAULT_THRESHOLD, usageStats) {
+// `injected` reflects tier standing (hot = true, cold = false); score is display-only.
+function parseLearningEntries(filePath, displayPath, category, level, domain = 'global', tier, usageStats) {
     if (!(0, fs_1.existsSync)(filePath))
         return [];
     let content;
@@ -1426,7 +1325,7 @@ function parseLearningEntries(filePath, displayPath, category, level, domain = '
         return [];
     }
     const fileType = exports.CATEGORY_TO_FILETYPE[category];
-    // preferences and manager-coaching are threshold-free — always injected.
+    // mistake-patterns and validated-patterns carry a display score; other categories do not.
     const isScoreGated = fileType === 'mistake-patterns' || fileType === 'validated-patterns';
     const out = [];
     let current = null;
@@ -1443,12 +1342,11 @@ function parseLearningEntries(filePath, displayPath, category, level, domain = '
                 if (curLastSeen !== null) {
                     const s = computeEffectiveScore(current.severity, curLastSeen, curRecurrences, fileType, new Date());
                     current.score = s;
-                    current.injected = s >= threshold;
+                    current.injected = tier !== 'cold';
                 }
                 else {
                     current.score = null;
-                    // No date metadata: treat as fresh / always inject.
-                    current.injected = true;
+                    current.injected = tier !== 'cold';
                 }
             }
             else {
@@ -1620,7 +1518,6 @@ function readRejectedProposals(workspaceRoot, userId) {
 }
 function readPreservedLearnings(workspaceRoot, userId, scope, level = 'machine') {
     const roots = getLearningRoots(workspaceRoot);
-    const threshold = getScoreThreshold(workspaceRoot);
     const usageStats = resolveUsageStats();
     // Only the human library reads these observations. An unavailable store must
     // fail this read, so a client can retain known history rather than invent zeroes.
@@ -1657,7 +1554,7 @@ function readPreservedLearnings(workspaceRoot, userId, scope, level = 'machine')
     // ResolvedLearningTier uses 'manager' to mean machine-level personal; map it to 'machine'.
     const tierLevel = (t) => t.level === 'manager' ? 'machine' : t.level;
     const parseTiers = (tiers, cat, tierVal, domainVal) => mergeLearningEntriesAcrossTiers(tiers.map((t) => ({
-        entries: parseLearningEntries(t.path, t.displayPath, cat, tierLevel(t), domainVal ?? 'global', tierVal, threshold, usageStats)
+        entries: parseLearningEntries(t.path, t.displayPath, cat, tierLevel(t), domainVal ?? 'global', tierVal, usageStats)
             .map(entry => decorateAssessment(entry, t.path)),
     })));
     if (scope === 'org') {
@@ -1679,7 +1576,7 @@ function readPreservedLearnings(workspaceRoot, userId, scope, level = 'machine')
                 seenDomainFile.add(fileName);
                 const domainTiers = resolveOrgLearningFileTiers(roots.repoLearningsBase, fileName);
                 if (domainTiers.length === 0) {
-                    out.push(...parseLearningEntries((0, path_1.join)(base, fileName), `${REPO_LEARNINGS_REL}/${fileName}`, cat, 'org', domain, undefined, threshold, usageStats)
+                    out.push(...parseLearningEntries((0, path_1.join)(base, fileName), `${REPO_LEARNINGS_REL}/${fileName}`, cat, 'org', domain, undefined, usageStats)
                         .map(entry => decorateAssessment(entry, (0, path_1.join)(base, fileName))));
                 }
                 else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fraim",
-  "version": "2.0.350",
+  "version": "2.0.352",
   "description": "FRAIM core CLI and MCP package.",
   "main": "index.js",
   "bin": {