ruvnet-brain 4.0.35 → 4.0.90-dev

package/scripts/brain-score.mjs

@@ -0,0 +1,252 @@
+/**
+ * brain-score.mjs — the ONLY sanctioned source of a score about this product.
+ *
+ * THE DEFECT THIS REPLACES, measured 2026-08-13. Asked to grade the architecture, I counted files
+ * — stores/repos, cards/stores — called the result 52/100, and reported it as an architecture
+ * grade. Six graders sat unused in this same repo. The real numbers were nothing like 52, and they
+ * disagreed with each other in ways that mattered:
+ *
+ *     grounded  100/100   does it fabricate?              (evals/baseline.json)
+ *     routed     63/80    does it reach the right store?  same file, same run
+ *     panel      ~56      independent multi-vendor grade  (data/grade-*.json)
+ *
+ * A single number could not have carried that. My 52 did not measure quality at all; it measured
+ * CATALOGUE COVERAGE and wore a quality label. That is the specific error this file makes
+ * structurally impossible: dimensions carry a `kind`, and `composite()` REFUSES to average across
+ * kinds. A coverage percentage and a quality percentage are answers to different questions, and
+ * collapsing them tells the owner his working product is failing while his users report it works.
+ *
+ * THE SECOND DEFECT, committed while correcting the first. Having found `grounded 100/100`, I
+ * quoted it as current. It was recorded 2026-07-10 — 34 days and ~40 commits earlier. The existing
+ * claims gate passed it because it checks INTERNAL consistency (k<=n, lo<=p<=hi) and never asks
+ * WHEN. So every dimension here declares `maxAgeDays`, and a reading past it is `stale` — reported,
+ * never silently used, and never the basis of a claim.
+ *
+ * This is not new machinery. It is ADR-065's own rule — facts are GENERATED, behaviours are TESTED
+ * — applied to the one class of fact that was still being typed by hand. `orgTotalApprox: 248` was
+ * this exact bug about a repo count; it was wrong by 48 in two files at once. `sync-version.mjs`
+ * and `sync-census.mjs` fixed it for versions and counts. Scores were never brought along.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+const DAY = 86_400_000;
+
+/**
+ * Every dimension names the QUESTION it answers, because a number whose question is unstated is
+ * the thing that produced the 52. `kind` is load-bearing: see `composite()`.
+ */
+export const DIMENSIONS = [
+  {
+    key: 'grounded',
+    kind: 'quality',
+    question: 'When it answers, is the answer bound to real retrieved source rather than invented?',
+    artifact: 'evals/baseline.json',
+    maxAgeDays: 14,
+    read: (j) => ({ value: pct(j?.score?.grounded), detail: frac(j?.score?.grounded), at: j?.recorded }),
+  },
+  {
+    key: 'routed',
+    kind: 'quality',
+    question: 'Does a by-description query reach the store that actually holds the answer?',
+    artifact: 'evals/baseline.json',
+    maxAgeDays: 14,
+    read: (j) => ({ value: pct(j?.score?.routed), detail: frac(j?.score?.routed), at: j?.recorded }),
+  },
+  {
+    key: 'abstained',
+    kind: 'quality',
+    question: 'When it does NOT know, does it decline instead of producing something?',
+    artifact: 'evals/baseline.json',
+    maxAgeDays: 14,
+    read: (j) => ({ value: pct(j?.score?.abstain), detail: frac(j?.score?.abstain), at: j?.recorded }),
+  },
+  {
+    key: 'panelStrict',
+    kind: 'quality',
+    question: 'How do INDEPENDENT-vendor graders score the answers, strictly? (ADR-0002 gate)',
+    artifact: 'data/grade-*.json',
+    maxAgeDays: 30,
+    read: null, // aggregated across files — see readPanel()
+  },
+  {
+    key: 'catalogue',
+    kind: 'coverage',
+    question: 'What FRACTION of rUv\'s live repos has a store at all? (NOT a quality measure)',
+    artifact: 'data/org-repo-count.json + the live store root',
+    maxAgeDays: 7,
+    read: null, // derived — see readCatalogue()
+  },
+  {
+    key: 'routable',
+    kind: 'coverage',
+    question: 'What fraction of BUILT stores can a by-description query actually reach?',
+    artifact: 'capability-cards.md at the store root',
+    maxAgeDays: 7,
+    read: null,
+  },
+];
+
+/**
+ * Is this store reachable by a by-description query? ALIAS-AWARE, because the router is.
+ *
+ * Pure and exported so the rule can be tested without a live store root — the previous version was
+ * an inline `cards.has(s)` buried in an async reader, which is why nobody noticed it disagreed with
+ * the router. `resolve` is injected rather than imported here so a fixture can supply its own
+ * registry; production passes `repositoryNames` from kb/card-lane.mjs, the router's own resolver.
+ */
+export function isRoutable(store, cards, root, resolve) {
+  return resolve(store, root).some((name) => cards.has(name));
+}
+
+const pct = (s) => (s && Number.isFinite(s.p) ? Math.round(s.p * 1000) / 10 : null);
+const frac = (s) => (s && Number.isFinite(s.k) ? `${s.k}/${s.n}` : null);
+
+function readJson(rel) {
+  try { return JSON.parse(fs.readFileSync(path.join(ROOT, rel), 'utf8')); } catch { return null; }
+}
+
+/** Aggregate the multi-vendor panel across whatever stores have actually been graded. */
+function readPanel() {
+  const dir = path.join(ROOT, 'data');
+  let files = [];
+  try { files = fs.readdirSync(dir).filter((f) => /^grade-.*\.json$/.test(f)); } catch { /* none */ }
+  const rows = files.map((f) => ({ f, j: readJson(path.join('data', f)) })).filter((r) => r.j?.summary);
+  if (!rows.length) return { value: null, detail: null, at: null };
+  const strict = rows.map((r) => r.j.summary.avgStrict).filter(Number.isFinite);
+  if (!strict.length) return { value: null, detail: null, at: null };
+  const at = rows
+    .map((r) => { try { return fs.statSync(path.join(dir, r.f)).mtime.toISOString(); } catch { return null; } })
+    .filter(Boolean).sort().pop();
+  return {
+    value: Math.round((strict.reduce((a, b) => a + b, 0) / strict.length) * 10) / 10,
+    detail: `${strict.length} store(s) graded`,
+    at,
+  };
+}
+
+/**
+ * Coverage is DERIVED from the live store root, never from a number in a doc. Returns null rather
+ * than a guess when the denominator is unknown — a wrong denominator still renders, which is worse
+ * than an absent one.
+ */
+async function readCoverage() {
+  const { storeRoot, storesAt, cardsAt } = await import('../kb/store-root.mjs');
+  // ROUTABILITY IS ALIAS-AWARE, BECAUSE THE ROUTER IS.
+  //
+  // `carded` was `stores.filter((s) => cards.has(s))` — a direct name match against card HEADINGS,
+  // while the real router resolves a store through `repositoryNames()` first. So a store reachable
+  // ONLY under an alias counted as unroutable, and this metric under-reported the brain's own
+  // reachability: measured 2026-08-19, 30 stores called unroutable when 26 actually are —
+  // `metaharness` among the four, which is reachable through the `agent-harness-generator` card.
+  //
+  // That is not a rounding error, it is the same alias-blindness ADR-058 records as open in
+  // `darkStores()`, and it already cost something real: a false "dark store" reading led to a
+  // DUPLICATE `## metaharness` card being added, which collided with `agent-harness-generator` and
+  // broke alias resolution outright. A metric that cannot see aliases manufactures work that
+  // damages the thing it measures.
+  const { repositoryNames } = await import('../kb/card-lane.mjs');
+  const root = storeRoot();
+  const stores = storesAt(root);
+  const cards = new Set(cardsAt(root));
+  const org = readJson('data/org-repo-count.json');
+  const total = Number.isFinite(org?.count) && org.count > 0 ? org.count : null;
+  const carded = stores.filter((s) => isRoutable(s, cards, root, repositoryNames)).length;
+  return {
+    catalogue: {
+      value: total ? Math.round((stores.length / total) * 1000) / 10 : null,
+      detail: total ? `${stores.length}/${total} live repos` : `${stores.length} stores, org total UNKNOWN`,
+      at: org?.at ?? null,
+    },
+    routable: {
+      value: stores.length ? Math.round((carded / stores.length) * 1000) / 10 : null,
+      detail: `${carded}/${stores.length} built stores have a card`,
+      // Derived from the live store root at this instant, so it is current BY CONSTRUCTION. A
+      // read-now value reported as stale would train the reader to ignore the stale flag, which
+      // costs more than the flag is worth.
+      at: new Date().toISOString(),
+    },
+  };
+}
+
+/** A reading past its dimension's `maxAgeDays`, or with no timestamp at all, is not current. */
+export function staleness(at, maxAgeDays, now = Date.now()) {
+  if (!at) return { stale: true, ageDays: null, why: 'no timestamp recorded' };
+  const ms = now - Date.parse(at);
+  if (!Number.isFinite(ms)) return { stale: true, ageDays: null, why: 'unparseable timestamp' };
+  const ageDays = Math.round((ms / DAY) * 10) / 10;
+  return { stale: ageDays > maxAgeDays, ageDays, why: ageDays > maxAgeDays ? `${ageDays}d > ${maxAgeDays}d budget` : null };
+}
+
+export async function brainScore({ now = Date.now() } = {}) {
+  const cov = await readCoverage();
+  const out = [];
+  for (const d of DIMENSIONS) {
+    let r;
+    if (d.key === 'panelStrict') r = readPanel();
+    else if (cov[d.key]) r = cov[d.key];
+    else r = d.read ? d.read(readJson(d.artifact)) : { value: null, detail: null, at: null };
+    out.push({
+      ...d,
+      ...r,
+      ...staleness(r.at, d.maxAgeDays, now),
+      status: r.value === null ? 'unmeasured' : (staleness(r.at, d.maxAgeDays, now).stale ? 'stale' : 'current'),
+    });
+  }
+  return out;
+}
+
+/**
+ * THE STRUCTURAL GUARD. Averaging a coverage percentage with a quality percentage is precisely the
+ * 52. It is refused here rather than discouraged in prose, because prose did not stop me.
+ */
+export function composite(dims, kind) {
+  if (!kind) return { value: null, refused: 'a score must name WHICH question it answers — pass a kind' };
+  const mine = dims.filter((d) => d.kind === kind);
+  if (!mine.length) return { value: null, refused: `no dimensions of kind "${kind}"` };
+  const usable = mine.filter((d) => d.status === 'current' && d.value !== null);
+  if (usable.length < mine.length) {
+    return {
+      value: null,
+      refused: `${mine.length - usable.length} of ${mine.length} ${kind} dimension(s) are stale or unmeasured`,
+      missing: mine.filter((d) => !usable.includes(d)).map((d) => `${d.key} (${d.status})`),
+    };
+  }
+  return { value: Math.round((usable.reduce((a, d) => a + d.value, 0) / usable.length) * 10) / 10, of: usable.length };
+}
+
+const isMain = (() => {
+  try { return process.argv[1] && fs.realpathSync(process.argv[1]) === fileURLToPath(import.meta.url); }
+  catch { return false; }
+})();
+
+if (isMain) {
+  const dims = await brainScore();
+  const asJson = process.argv.includes('--json');
+  if (asJson) {
+    console.log(JSON.stringify({ recorded: new Date().toISOString(), dimensions: dims }, null, 2));
+  } else {
+    console.log('\nRUVNET-BRAIN — MEASURED, never typed. Each row names the question it answers.\n');
+    for (const kind of ['quality', 'coverage']) {
+      console.log(`  ${kind.toUpperCase()}`);
+      for (const d of dims.filter((x) => x.kind === kind)) {
+        const v = d.value === null ? 'UNMEASURED' : `${d.value}`.padStart(5);
+        const age = d.ageDays === null ? '' : ` ${d.ageDays}d old`;
+        const flag = d.status === 'current' ? '' : `  <-- ${d.status.toUpperCase()}${d.why ? ` (${d.why})` : ''}`;
+        console.log(`    ${d.key.padEnd(13)} ${v}  ${(d.detail ?? '').padEnd(26)}${age}${flag}`);
+        console.log(`      ${d.question}`);
+      }
+      const c = composite(dims, kind);
+      console.log(c.value === null ? `    => NO ${kind} COMPOSITE: ${c.refused}` : `    => ${kind} composite ${c.value} (mean of ${c.of})`);
+      console.log('');
+    }
+    console.log('  A quality number and a coverage number are NEVER averaged. That was the 52.\n');
+  }
+  const anyStale = dims.some((d) => d.status !== 'current');
+  if (process.argv.includes('--require-current') && anyStale) {
+    console.error('brain-score: refusing — at least one dimension is stale or unmeasured. Re-run the graders.');
+    process.exit(1);
+  }
+}

package/scripts/brain-stamp.mjs

@@ -10,6 +10,9 @@ import { execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { canonicalRvfStores, hasCanonicalRvfStore } from './rvf-generation.mjs';
 import { getVersionTag, stripTag } from './version.mjs';
+// The org total is DERIVED, never a literal: it was hardcoded 248 in this file and in its
+// sibling while the account actually had 200 — one stale fact, restated twice (2026-08-12).
+import { orgRepoCount } from './org-repo-count.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const arg = (f, d) => { const i = process.argv.indexOf(f); return i >= 0 && process.argv[i + 1] ? process.argv[i + 1] : d; };
@@ -70,11 +73,12 @@ for (const store of canonicalRvfStores(KB_DIR)) {
   });
 }
 const built = repos.filter((r) => r.status === 'built');
+const ORG = orgRepoCount();
 const manifest = {
   brainVersion: stripTag(BRAIN_VERSION), // FIELD = bare literal; the "v" tag is display-only (see version.mjs)
   generated: NOW,
   generatedHuman: new Date(NOW).toUTCString(),
-  coverage: { built: built.length, catalogued: repos.length, orgTotalApprox: 248, pending: repos.length - built.length },
+  coverage: { built: built.length, catalogued: repos.length, orgTotalApprox: ORG.count, orgTotalSource: ORG.source, orgTotalAt: ORG.at, pending: repos.length - built.length },
   builtRepos: built,
   pendingRepos: repos.filter((r) => r.status === 'pending').map((r) => ({ name: r.name, tier: r.tier })),
 };

package/scripts/build-bundle.mjs

@@ -19,6 +19,9 @@ import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { getVersion, getVersionTag, stripTag } from './version.mjs';
 import { auditRvfIndexes } from './rvf-index-audit.mjs';
+// The org total is DERIVED, never a literal: it was hardcoded 248 in this file and in its
+// sibling while the account actually had 200 — one stale fact, restated twice (2026-08-12).
+import { orgRepoCount } from './org-repo-count.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const KB = path.join(ROOT, 'kb');
@@ -263,6 +266,26 @@ if (hasGists) for (const suf of ['ruv-gists.big.rvf', 'ruv-gists.big.rvf.idmap.j
     fs.writeFileSync(path.join(OUT, 'capability-cards.md'), parts[0] + kept.join(''));
     copied++;
     if (filteredAny) console.log('[build-bundle] filtered private repo card(s) out of shipped capability-cards.md');
+
+    // repo-aliases.json TRAVELS WITH THE CARDS OR EVERY ALIAS IS DEAD ON ARRIVAL.
+    //
+    // card-lane.mjs reads it (REPO_ALIASES_FILE) to resolve a PRODUCT name to its installed store:
+    // `agent-harness-generator -> metaharness`, `ruvnet-brain -> brain`, `ruvector -> rvf`,
+    // `agentic-qe -> qe`. The bundle never copied it, so on every install those mappings were absent
+    // and the fast lane could not route them. Measured 2026-08-19 against the live store root:
+    // repo-aliases.json ABSENT, and `search_ruvnet("metaharness: what does Darwin mode mutate?")`
+    // answered "card router was ambiguous" — the product cannot be found by its own name.
+    //
+    // `forge-update.mjs:505` already lists this file among the ones it manages, so the updater knew
+    // about it and the builder did not — one fact, two shipping paths, only one of them told. Same
+    // shape as the reader/writer store-root split and the ingest `--out` bug fixed this week.
+    const aliasesSrc = path.join(KB, 'repo-aliases.json');
+    if (fs.existsSync(aliasesSrc)) {
+      fs.copyFileSync(aliasesSrc, path.join(OUT, 'repo-aliases.json'));
+      copied++;
+    } else {
+      console.log('[build-bundle] note: kb/repo-aliases.json absent — product-name aliases will not resolve on install');
+    }
   } else {
     console.log('[build-bundle] note: kb/capability-cards.md absent — the fast lane ships with no card source and will honestly fall through on every query');
   }
@@ -395,11 +418,12 @@ cp(path.join(ROOT, 'keys', 'ruvnet-brain-signing.pub.pem'), path.join(OUT, 'keys
 const builtLower = new Set(built.map((b) => b.toLowerCase()));
 const pendingRepos = regFlat.filter((r) => !builtLower.has(r.name.toLowerCase())).map((r) => ({ name: r.name, tier: r.tier }));
 const now = new Date();
+const ORG = orgRepoCount();
 const manifest = {
   brainVersion: stripTag(BRAIN_VERSION), // FIELD = bare literal; BRAIN_VERSION stays the v-prefixed Release tag
   generated: now.toISOString(),
   generatedHuman: now.toUTCString(),
-  coverage: { built: builtRepos.length, catalogued: regFlat.length, orgTotalApprox: 248, pending: pendingRepos.length },
+  coverage: { built: builtRepos.length, catalogued: regFlat.length, orgTotalApprox: ORG.count, orgTotalSource: ORG.source, orgTotalAt: ORG.at, pending: pendingRepos.length },
   crossRepoTool: { mcp: 'forge-mcp-all.mjs', cli: 'forge-ask-all.mjs', tool: 'search_ruvnet' },
   conceptsStore: hasConcepts ? { store: 'concepts.big.rvf', note: 'L2 synthesis + per-repo primers embedded as prose; unioned by search_ruvnet so code-implemented capabilities are retrievable as high-confidence prose.' } : null,
   builtRepos,

package/scripts/console-engine.mjs

@@ -126,7 +126,7 @@ export function buildHealthRecommendations({ memory = null, learning = null } =
   if (Number.isFinite(age) && age > STALE_TRAIN_SECONDS) {
     recs.push(makeRecommendation({
       id: 'learning:train',
-      scope: 'user',
+      scope: 'project',
       title: 'Your learner has gone quiet',
       rationale: 'It is installed and switched on, but it has not learned anything recently — so it is not getting smarter.',
       severity: 'SUGGESTED',

package/scripts/health-repair.mjs

@@ -24,7 +24,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { execFileSync, spawnSync } from 'node:child_process';
 import { findStores, diagnose } from './memory-doctor.mjs';
-import { loadRuntimePreferences } from '../plugin/scripts/runtime-preferences.mjs';
+import { learnerCwd, loadRuntimePreferences } from '../plugin/scripts/runtime-preferences.mjs';
 
 const HOME = os.homedir();
 // The SAME project root learn-flush.mjs computes, by the same rule — the two halves of the flush
@@ -195,7 +195,16 @@ function flushLearning() {
 function trainLearning() {
   if (!RUFLO) return { ok: false, log: 'ruflo is not on this machine — install it with `npm i -g ruflo@latest` to enable learning' };
   try {
-    execFileSync(RUFLO, ['hooks', 'intelligence', '--train'], { cwd: HOME, env: RUFLO_ENV, stdio: 'ignore', timeout: 600_000 });
+    // ISSUE #136: train the SAME store the console card reads. With `cwd: HOME` the card read the
+    // project's learner and this trained the home one, so the button could never clear the card it
+    // was offered for — a remedy that cannot resolve its own finding is worse than no button.
+    // PROJECT is the same root learn-flush.mjs and learn-capture.sh resolve (#134).
+    // ISSUE #139 — now that ruflo v3.38.9 made `--train` REAL (ruvnet/ruflo#2940 was a no-op
+    // before), training the wrong store is no longer harmless: it moves that store's
+    // lastAdaptation to 0s and the card SILENTLY SELF-CLEARS while the learner the operator
+    // actually uses is untouched. #136 already moved this off `cwd: HOME`; it now shares the
+    // console's resolver so the remedy provably trains the store the card measured.
+    execFileSync(RUFLO, ['hooks', 'intelligence', '--train'], { cwd: learnerCwd({ cwd: PROJECT }), env: RUFLO_ENV, stdio: 'ignore', timeout: 600_000 });
   } catch (e) { return { ok: false, log: `training cycle failed: ${e.message}` }; }
   return { ok: true, log: 'ran one training cycle in the cross-project learner' };
 }

package/scripts/host-install-matrix.mjs

@@ -70,6 +70,27 @@ export const VARIANTS = Object.freeze({
     env: () => ({
       RUVNET_STRICT_INSTALL: '1',
       RUVNET_BRAIN_PROFILE: 'complete',
+      // A VIRGIN AUTOMATED HOME CAN NEVER HAVE RECORDED CODEX HOOK TRUST (fixed 2026-08-08).
+      //
+      // The staged variant above has carried this since it was written; the published variant did
+      // not, and that asymmetry failed the post-publication seal on EVERY release. The doctor ran
+      // green on everything that matters — "✓ Healthy", "✓ Grounding PROVEN", "✓ Self-check passed",
+      // 17 hook registrations across 68 firings — and then exited non-zero on the one condition a
+      // fixture cannot satisfy:
+      //
+      //     ! Codex installed the Brain, but 17 lifecycle hooks await review.
+      //       Fix: Start a fresh Codex session, run /hooks, and trust ruvnet-brain@ruvnet-brain.
+      //
+      // That instruction is correct for a human and impossible for a runner: hook trust is recorded
+      // interactively. So each release published both channels successfully and then reported
+      // failure, which is the exact "gate reporting something other than what it measured" pattern
+      // this repo has spent a week removing — and worse here, because it made a GOOD release look bad.
+      //
+      // This does NOT weaken the check. install.mjs:1994 documents the bypass as executing the real
+      // hook commands "without pretending a fresh interactive user has already reviewed them", and
+      // the hooks still run — 68 firings, all inside contract. Only the pending-trust verdict is
+      // waived, and only for an automated fixture. End-user doctor runs remain fail-closed.
+      RUVNET_CODEX_HOOK_TRUST_MODE: 'bypass',
     }),
   }),
 });

package/scripts/ingest-repo.mjs

@@ -20,6 +20,7 @@ import fs from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { FULL_HINTS, KEEP_DIRS } from './full-hints.mjs';
+import { storeRoot } from '../kb/store-root.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const arg = (f, d) => { const i = process.argv.indexOf(f); return i >= 0 && process.argv[i + 1] ? process.argv[i + 1] : d; };
@@ -33,7 +34,26 @@ if (!NAME) {
   process.exit(2);
 }
 
-const KB = path.join(ROOT, 'kb');
+// THE WRITER NOW USES THE SAME RESOLVER AS THE READER. This was `path.join(ROOT, 'kb')` — the
+// repo's build directory — while retrieval (kb/forge-mcp-all.mjs) reads storeRoot(), which defaults
+// to ~/.cache/ruvnet-brain/kb. That split is why on 2026-08-12 three repos were ingested, each
+// printed `roundtrip 3/3 PASS` and "searchable now", and NONE of them could be found by search: the
+// ingest wrote one root and the live brain read another. This file's own header promises "the new
+// repo is searchable immediately", and that promise was false by construction.
+//
+// Two adversarial audits both flagged that fixing the READER alone (kb/store-root.mjs, earlier
+// today) made the split GUARANTEED rather than accidental for a dev checkout. This closes it at the
+// writer, which is the half that was left.
+//
+// The repo's own bundle build still targets ./kb by setting KB_DIR — an explicit override of a
+// stated default, not a second answer to the same question.
+// TWO DIFFERENT THINGS, WHICH THE ORIGINAL `path.join(ROOT,'kb')` CONFLATED and my first fix
+// inherited: where the BUILD SCRIPTS live (forge-refresh.mjs, always in this checkout) and where
+// the STORES go (the root retrieval actually reads). Pointing both at storeRoot() broke immediately
+// with `Cannot find module .../.cache/ruvnet-brain/kb/forge-refresh.mjs` — the tool is not the
+// output. One name for two facts is the same defect as one fact in two names.
+const KB_TOOLS = path.join(ROOT, 'kb');   // where forge-refresh.mjs lives
+const KB = storeRoot();                   // where stores go — the root the reader reads
 const CLONES = path.join(ROOT, 'clones');
 const kb = NAME.toLowerCase();
 const dir = SOURCE ? path.resolve(SOURCE) : path.join(CLONES, NAME);
@@ -62,18 +82,58 @@ const url = process.env.RUVNET_CANONICAL_URL || 'https://raw.githubusercontent.c
 // full-body source indexing (the 2026-07-10 depth-restore run zeroed ruvector this way).
 const FULL = arg('--full', FULL_HINTS[kb] || '');
 const KEEP = arg('--keep', KEEP_DIRS[kb] || '');
-const buildArgs = ['forge-refresh.mjs', '--repo', dir, '--out', '.', '--name', kb, '--canonical-url', url];
+// `--out` is the STORE ROOT, not '.' — cwd is the tools directory now, and '.' would have written
+// the store next to the build script, which is precisely the reader/writer split this change closes.
+const buildArgs = ['forge-refresh.mjs', '--repo', dir, '--out', KB, '--name', kb, '--canonical-url', url];
 if (FULL) buildArgs.push('--full', FULL);
 if (KEEP) buildArgs.push('--keep', KEEP);
 console.log(`[refresh bge-768] ${kb}${FULL ? ' (--full: ' + FULL.split(',').length + ' prefixes)' : ''}${KEEP ? ' (--keep: ' + KEEP + ')' : ''}`);
-run('node', buildArgs, { cwd: KB, env });
+run('node', buildArgs, { cwd: KB_TOOLS, env });
 console.log(`[symbols] ${kb}`);
 try { run('node', ['scripts/build-symbols.mjs', '--name', kb], { cwd: ROOT, env }); } catch { console.log('  (symbols skipped — sparse repo)'); }
 
 const ok = fs.existsSync(path.join(KB, `${kb}.big.rvf`))
   && fs.existsSync(path.join(KB, `${kb}.passages.jsonl`))
   && fs.existsSync(path.join(KB, `${kb}.meta.json`));
-console.log(ok
-  ? `\n[done] ${NAME} ingested → searchable now via search_ruvnet (no restart). For capability-confidence, build its primer next.`
-  : `\n[FAIL] ${NAME}: expected stores missing after build.`);
+// BUILT IS NOT REACHABLE, AND THIS LINE USED TO CLAIM OTHERWISE. It printed "searchable now" on
+// the strength of three files existing. Measured 2026-08-13 on the very next run: helix ingested
+// cleanly, every file present, and `search_ruvnet` answered "Searched 0 RuvNet repos" — the router
+// declined because nothing in capability-cards.md describes the repo, so a by-description query
+// cannot reach it. 26 of 66 stores are in exactly that state. The 2026-08-12 incident (three repos
+// ingested, all reporting success, none findable) was read as a path bug; the path was only half of
+// it. A store with no card is BUILT AND DARK, and saying "searchable" of it is the product lying.
+const carded = (() => {
+  try {
+    return new RegExp(`^##\\s+${kb}\\s*$`, 'im')
+      .test(fs.readFileSync(path.join(KB, 'capability-cards.md'), 'utf8'));
+  } catch { return false; }
+})();
+// AN ARTIFACT WITH NO COMMITTED RECIPE IS NOT DURABLE WORK — it is a local side effect with a
+// countdown on it. Proven overnight 2026-08-13 -> 08-14: a scheduled bundle apply extracted an
+// Aug-8 bundle over the live cache. capability-cards.md SURVIVED because it was committed and the
+// brain was restored from the repo in one command. helix, rvQR, RuCelium and wifi-veil — ingested
+// and VERIFIED ROUTING hours earlier — were gone without a trace, because a .rvf is a 32MB
+// gitignored build artifact that existed in exactly one directory on one machine.
+//
+// The stores themselves cannot be committed. The FACT that they were ingested can, so a wipe
+// becomes detectable and replayable instead of silent and permanent. This record is the recipe.
+if (ok) {
+  try {
+    const ledger = path.join(ROOT, 'kb', 'local-ingests.json');
+    const prior = fs.existsSync(ledger) ? JSON.parse(fs.readFileSync(ledger, 'utf8')) : { ingests: [] };
+    const rest = (prior.ingests || []).filter((e) => e.name !== NAME);
+    rest.push({ name: NAME, org: ORG, at: new Date().toISOString(), store: kb });
+    rest.sort((a, b) => a.name.localeCompare(b.name));
+    fs.writeFileSync(ledger, `${JSON.stringify({ ingests: rest }, null, 2)}\n`);
+    console.log(`[record] kb/local-ingests.json — ${rest.length} local ingest(s) recorded. COMMIT THIS.`);
+  } catch (e) { console.log(`[record] could not record the ingest: ${e.message}`); }
+}
+
+console.log(!ok
+  ? `\n[FAIL] ${NAME}: expected stores missing after build.`
+  : carded
+    ? `\n[done] ${NAME} ingested AND routable → answers by-description queries now (no restart).`
+    : `\n[done] ${NAME} ingested, but DARK: no '## ${kb}' section in ${path.join(KB, 'capability-cards.md')}.\n`
+      + `       The store is valid and a by-description query CANNOT reach it. Write a card describing\n`
+      + `       what ${NAME} is for and when to reach for it, then re-check with a real search_ruvnet query.`);
 process.exit(ok ? 0 : 1);

package/scripts/learning-replay-cli.mjs

@@ -132,9 +132,14 @@ export async function main(argv = process.argv.slice(2)) {
   const dirs = buildFixtures(base);
   process.once('exit', () => cleanupFixtureDaemons(dirs));
   const record = recordInProjectA(dirs, { trap });
-  const seed = trap === TRAP.MEMORY_SEARCH
-    ? seedProjectBMemory(dirs)
-    : { key: null, storeExit: null, ok: true, skipped: 'not required' };
+  // Every target fixture needs a real AgentDB file before Codex starts. The global SessionStart
+  // contract otherwise injects an opt-in question and requires the model to wait for an answer,
+  // which prevents both post-task arms from producing the command this trap is meant to compare.
+  // Only the memory-search trap needs the independent cache note; post-task needs an initialized,
+  // otherwise empty store so its control differs solely on the lesson under test.
+  const seed = seedProjectBMemory(dirs, {
+    includeFixtureRecord: trap === TRAP.MEMORY_SEARCH,
+  });
   const refresh = nightlyRefresh(dirs);
   console.log(`  record: ${record.projectCount} sources; promoted=${record.promoted}; ok=${record.ok}`);
   console.log(`  seed: ${seed.skipped || `ok=${seed.ok}`}`);

package/scripts/learning-replay-fixture.mjs

@@ -23,11 +23,16 @@ import {
 const CLAUDE_BIN = process.env.RUVNET_CLAUDE_BIN
   || path.join(os.homedir(), '.npm-global', 'bin', 'claude');
 const CODEX_BIN = process.env.RUVNET_CODEX_BIN || 'codex';
-const sh = (cmd, args, options = {}) => spawnSync(cmd, args, {
-  encoding: 'utf8',
-  timeout: 120_000,
-  ...options,
-});
+const sh = (cmd, args, options = {}) => {
+  const [binary, argv] = /\.[cm]?js$/i.test(cmd)
+    ? [process.execPath, [cmd, ...args]]
+    : [cmd, args];
+  return spawnSync(binary, argv, {
+    encoding: 'utf8',
+    timeout: 120_000,
+    ...options,
+  });
+};
 const remove = (target) => {
   try { fs.rmSync(target, { recursive: true, force: true }); } catch { /* already gone */ }
 };
@@ -143,9 +148,23 @@ export function recordInProjectA(dirs, {
   };
 }
 
-export function seedProjectBMemory(dirs, { ruflo = RUFLO_BIN } = {}) {
+export function seedProjectBMemory(dirs, {
+  ruflo = RUFLO_BIN,
+  includeFixtureRecord = true,
+} = {}) {
   const db = path.join(dirs.projectB, '.swarm', 'memory.db');
   const init = initMemoryDb(ruflo, db, dirs.projectB);
+  if (!includeFixtureRecord) {
+    return {
+      db,
+      key: null,
+      initExit: init.status,
+      storeExit: null,
+      exactReadExit: null,
+      ok: init.status === 0 && fs.existsSync(db),
+      skipped: 'AgentDB initialized; memory-search record not required',
+    };
+  }
   const store = sh(ruflo, [
     'memory', 'store', '-k', PROJECT_B_MEMORY_KEY,
     '--value', PROJECT_B_MEMORY_VALUE, '-n', 'default', '--path', db,

package/scripts/learning-replay-proof.mjs

@@ -454,6 +454,44 @@ export function writeArtifact(file, aggregateResult, meta = {}) {
     runs,
   };
   fs.mkdirSync(path.dirname(file), { recursive: true });
+
+  // AN ENVIRONMENT THAT CANNOT MEASURE MUST NOT OVERWRITE ONE THAT DID.
+  // Measured 2026-08-19: `learning-replay` had been red on main since 2026-08-11 because the
+  // artifact was re-recorded carrying `verdict: UNKNOWN` and "3/3 run(s) could not be measured;
+  // executor error: spawnSync codex ENOENT" — written by a nightly container with no `codex` on
+  // PATH. `codex` resolves fine on the owner's machine (0.148.0), so a real PASS was replaced by
+  // "I could not look", and every later CI run correctly refused the non-PASS verdict. The gate was
+  // right; its INPUT had been destroyed by a host that could never produce one. Same distinction
+  // `restore-local-ingests.mjs` and `degradation-watch` both needed: CANNOT-MEASURE is not
+  // MEASURED-AND-FAILED. A real FAIL still overwrites — that is a measurement, and it must land.
+  // "PARTIALLY MEASURED" IS NOT "COULD NOT MEASURE" either, and the first version of this guard got
+  // that wrong within the hour — the same conflation it exists to prevent, committed inside it. Its
+  // predicate was a substring match on "could not be measured", so a run reporting
+  // "1/3 run(s) could not be measured; 1/3 passed" — a genuine mixed result carrying a live
+  // regression signal — was swallowed, leaving a PASS from 2026-08-03 standing. It suppressed
+  // exactly the finding it should have let through. A host that cannot measure produces NO
+  // measurements: every run unknown. If even one run yielded a pass or a fail, the executor plainly
+  // ran and the result is real, however unwelcome.
+  const runsTotal = Number(artifact.n ?? 0);
+  const runsUnknown = Number(artifact.unknowns ?? 0);
+  const nothingMeasured = runsTotal > 0 && runsUnknown === runsTotal;
+  const unmeasurable = artifact.verdict === 'UNKNOWN'
+    && nothingMeasured
+    && /ENOENT|executor error/i.test(String(artifact.why ?? ''));
+  if (unmeasurable && fs.existsSync(file)) {
+    try {
+      const prior = JSON.parse(fs.readFileSync(file, 'utf8'));
+      if (prior?.verdict && prior.verdict !== 'UNKNOWN') {
+        process.stderr.write(
+          `[learning-replay] REFUSING to overwrite a ${prior.verdict} recorded ${prior.at} with an\n`
+          + `  unmeasurable UNKNOWN — this host cannot run the executor (${artifact.why}).\n`
+          + '  The prior measurement stands. Re-record on a host that has the executor.\n',
+        );
+        return prior;
+      }
+    } catch { /* unreadable prior is not a reason to keep a bad one — fall through and write */ }
+  }
+
   fs.writeFileSync(file, `${JSON.stringify(artifact, null, 2)}\n`);
   return artifact;
 }

package/scripts/nightly-wrapper.sh

@@ -83,6 +83,19 @@ RUFLO_DAEMON_AUTOSTART=0 ~/.npm-global/bin/ruflo memory distill run --path .swar
 # automatically (keeps last 14), zero risk to the live DB (reads only).
 RUFLO_DAEMON_AUTOSTART=0 ~/.npm-global/bin/ruflo memory backup --db .swarm/memory.db --keep 14 >> "$LOG" 2>&1 || true
 
+# LESSON BRIDGE (ADR-066, 2026-08-10) — carry newly-tagged machine-wide lessons into the store the
+# hooks actually read. Without this the bridge is a command someone has to remember, and a learning
+# system that depends on being remembered is the thing ADR-066 was written to fix: knowledge sat in
+# AgentDB for 18 days while the repo re-made the mistake it described.
+#
+# Safe to run unattended and to run when nothing changed: it is idempotent (bridged rows are replaced
+# wholesale, native rows are never touched), it writes through the store's locked atomic writer, and
+# it REFUSES to apply when it reads zero rows while bridged lessons are installed — so a transient
+# read failure can never strip the store. Best-effort, never blocks the rebuild.
+echo "===== lesson-bridge — $(date -u +%FT%TZ) =====" >> "$LOG"
+/usr/local/bin/node plugin/scripts/lesson-bridge.mjs --apply >> "$LOG" 2>&1 \
+  || echo "===== lesson-bridge: SKIPPED (see line above) =====" >> "$LOG"
+
 # AgentDB drift canary (2026-07-23, P7 wiring sweep) — scripts/memdb-health.sh existed unwired since
 # 2026-07-09/10, the exact nights idx_bridge_key/idx_bridge_ns corruption recurred 3x on this very DB
 # while in WAL mode. Best-effort, same shape as its brain-health/key-health siblings below: never