ruvnet-brain 4.3.28 → 4.3.30

package/scripts/loop-checkpoint.mjs

@@ -15,6 +15,9 @@
 //   check  → evaluate stop conditions. Exit codes are the protocol:
 //              0 = continue      3 = DONE (doneCriteria command exited 0)
 //              4 = NO-PROGRESS stop (two strikes)      2 = usage/state error
+//   stale  → is `updatedAt` too old to trust (H3, ADR-0011 Phase 1's stale-resume gap)? Exit codes:
+//              0 = fresh (safe to resume)      1 = stale (stdout: age in whole days)
+//              2 = unknown (no checkpoint, or no parseable updatedAt — never treated as fresh OR stale)
 //
 // doneCriteria is a SHELL COMMAND, not prose — "machine-checkable done" means exit code 0, not a
 // model's opinion that it's finished.
@@ -52,6 +55,28 @@ export function writeCheckpoint({ iteration, doneCriteria, next, blockers }, fil
   return cp;
 }
 
+// H3 (GitHub issue: AUTONOMOUS MODE injected into attended sessions + a stale checkpoint resumed as
+// if it were live). ground-ruvnet.sh used to inject `.ruvnet-brain/checkpoint.json`'s raw content on
+// every autonomous-flagged turn with no age check at all — a checkpoint from a loop that ended days
+// or weeks ago would be resumed as though it were the current session's own state. This is the ONE
+// place "how old is too old" is decided; ground-ruvnet.sh (via the `stale` CLI verb below) and
+// scripts/single-source-check.mjs's E1 audit both judge staleness against this exact threshold and
+// this exact field, so the two can never quietly disagree about what "stale" means.
+export const CHECKPOINT_STALE_MS = 24 * 60 * 60 * 1000; // 24h
+
+/**
+ * Age verdict for a checkpoint object, judged by its OWN `updatedAt` claim — never by the file's
+ * mtime, which a copy/rsync/restore can reset without the checkpoint's content actually changing.
+ * `known: false` means there is nothing to judge (no checkpoint, or no parseable `updatedAt`); a
+ * caller must treat "unknown" as neither proven-fresh nor proven-stale.
+ */
+export function checkpointStaleness(cp, now = Date.now()) {
+  const updatedAtMs = cp && typeof cp.updatedAt === 'string' ? Date.parse(cp.updatedAt) : NaN;
+  if (!Number.isFinite(updatedAtMs)) return { known: false, stale: false, ageMs: null, ageDays: null };
+  const ageMs = now - updatedAtMs;
+  return { known: true, stale: ageMs >= CHECKPOINT_STALE_MS, ageMs, ageDays: ageMs / 86_400_000 };
+}
+
 /** Stop-condition verdict. Pure decision from state + one real doneCriteria execution. */
 export function checkCheckpoint(file = FILE, runner = (c) => spawnSync('sh', ['-c', c], { stdio: 'ignore' }).status) {
   const cp = readCheckpoint(file);
@@ -79,8 +104,19 @@ if (invokedDirectly) {
     const r = checkCheckpoint();
     console.log(r.verdict);
     process.exit(r.code);
+  } else if (cmd === 'stale') {
+    // H3: the ONE place a caller (ground-ruvnet.sh, via `node loop-checkpoint.mjs stale`) asks "is
+    // this checkpoint too old to resume from?" without re-deriving the 24h rule itself. Exit codes
+    // are the protocol, same style as `check`: 0 = fresh (safe to inject/resume), 1 = stale (stdout
+    // carries the whole age in days, floored, for a human-readable message), 2 = unknown — no
+    // checkpoint, unparseable JSON, or no usable `updatedAt` to judge by. A caller must not treat 2
+    // as either fresh or stale.
+    const info = checkpointStaleness(readCheckpoint());
+    if (!info.known) process.exit(2);
+    if (info.stale) { console.log(String(Math.floor(info.ageDays))); process.exit(1); }
+    process.exit(0);
   } else {
-    console.error('usage: loop-checkpoint.mjs <read|write|check> [--dir D] [--iteration N --done-criteria CMD --next "…" --blockers "…"]');
+    console.error('usage: loop-checkpoint.mjs <read|write|check|stale> [--dir D] [--iteration N --done-criteria CMD --next "…" --blockers "…"]');
     process.exit(2);
   }
 }

package/scripts/metaharness-receipts.mjs

@@ -11,6 +11,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
 import { pathToFileURL } from 'node:url';
+import { CLAUDE_MODEL_IDS } from './route-cheap.mjs';
 
 export function receiptsPath() {
   return (
@@ -61,7 +62,7 @@ export function formatTable(rows) {
     r.source === 'claude-subagent' ? 'subagent' : r.source === 'calibration' ? 'calibrate' : 'openrouter',
     r.task_class || '?',
     r.model,
-    r.frontier_ref || 'claude-opus-4.8',
+    r.frontier_ref || CLAUDE_MODEL_IDS.opus,
     fmt$(r.est_cost ?? 0),
     fmt$(r.est_frontier_cost ?? 0),
     fmt$(r.saved),
@@ -79,7 +80,7 @@ export function formatTable(rows) {
   const pct = totalFrontier > 0 ? Math.round((totalSaved / totalFrontier) * 100) : 0;
 
   // Baselines now vary per row; name them all rather than picking one and implying it covers everything.
-  const baselines = [...new Set(rows.map((r) => r.frontier_ref || 'claude-opus-4.8'))].join(', ');
+  const baselines = [...new Set(rows.map((r) => r.frontier_ref || CLAUDE_MODEL_IDS.opus))].join(', ');
   const timedTotal = rows.reduce((s, r) => s + (typeof r.duration_ms === 'number' && r.duration_ms > 0 ? r.duration_ms : 0), 0);
   const timedRows = rows.filter((r) => typeof r.duration_ms === 'number' && r.duration_ms > 0).length;
   // TIME as a percentage, like cost — "20 seconds" is trivia; "~40% faster" is the message

package/scripts/nightly-two-run-proof.mjs

@@ -11,7 +11,7 @@ import { managedStorageInventory } from '../kb/update-storage-transaction.mjs';
 import { REQUIRED_REFRESH_PHASES, validateCurrentRunPhaseExecution, inspectRefreshOwner, refreshLockPath } from '../kb/refresh-run.mjs';
 import { npmInvocation } from './npm-invocation.mjs';
 import { packageTreeObservation, observeNpxPackage, validateNpxObservations } from './nightly-package-observation.mjs';
-import { validateRefreshReceiptEnvelope } from '../plugin/scripts/nightly-scheduler.mjs';
+import { NIGHTLY_LABEL, NIGHTLY_PROOF_LABEL, validateRefreshReceiptEnvelope } from '../plugin/scripts/nightly-scheduler.mjs';
 import { validateCoverageDirectory, validateCoverageLedger } from '../plugin/scripts/coverage-integrity.mjs';
 
 const PUBLIC_KEY = fs.readFileSync(new URL('../keys/ruvnet-brain-signing.pub.pem', import.meta.url), 'utf8');
@@ -117,7 +117,7 @@ function refreshExecutionStopped(receipt, kbDir) {
 export async function triggerNativeRun({ scheduler, registration, platform, env, brainHome, kbDir,
   timeoutMs, command = run, receipts = nightlyReceipts, pause = sleep, now = Date.now, stopped = refreshExecutionStopped }) {
   const identity = registration.identity;
-  if (!/^com\.ruvnet\.brain-update\.proof-[A-Za-z0-9._-]+$/.test(identity || '')) {
+  if (!NIGHTLY_PROOF_LABEL.test(identity || '')) {
     throw new Error('native proof requires a unique proof scheduler identity');
   }
   if (!['darwin', 'linux', 'win32'].includes(platform)) throw new Error(`unsupported native scheduler platform: ${platform}`);
@@ -209,7 +209,7 @@ export async function runNativeSchedulerSmoke({ packageRoot, packagePath, bundle
     || typeof scheduler.installScheduler !== 'function' || typeof scheduler.schedulerStatus !== 'function'
     || typeof scheduler.removeScheduler !== 'function') throw new Error('scheduler smoke adapter is incomplete');
 
-  const identity = `com.ruvnet.brain-update.proof-smoke-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
+  const identity = `${NIGHTLY_LABEL}.proof-smoke-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
   const packageSha256 = sha256(fs.readFileSync(packageArchive));
   const bundleSha256 = sha256(fs.readFileSync(bundle));
   const registration = scheduler.installNightlyRunner({ brainHome,
@@ -281,7 +281,7 @@ export function validateNativeSchedulerSmoke(smoke, { platform, sourceSha, workf
     || smoke.scope !== 'public-release-scheduler-boundary') failures.push('scheduler smoke envelope is invalid');
   if (smoke.platform !== platform || smoke.sourceSha !== sourceSha
     || String(smoke.workflowRunId || '') !== String(workflowRunId || '')) failures.push('scheduler smoke identity differs');
-  if (!/^com\.ruvnet\.brain-update\.proof-smoke-[A-Za-z0-9._-]+$/.test(smoke.identity || '')) failures.push('scheduler smoke identity is not isolated');
+  if (!NIGHTLY_PROOF_LABEL.test(smoke.identity || '') || !String(smoke.identity || '').includes('.proof-smoke-')) failures.push('scheduler smoke identity is not isolated');
   if (smoke.loaded !== true || smoke.cleaned !== true || smoke.trigger?.identity !== smoke.identity) failures.push('scheduler smoke did not prove load, trigger, and cleanup');
   const expectedTrigger = { darwin: 'launchctl-kickstart', linux: 'cron-registration', win32: 'schtasks-run' }[platform];
   if (smoke.trigger?.kind !== expectedTrigger) failures.push('scheduler smoke trigger differs');
@@ -424,7 +424,7 @@ export function validateNightlyProofReceipt(receipt, { platform, version, packag
   if (!/^[a-f0-9]{64}$/.test(bundleSha256 || '') || receipt.candidate?.bundle?.sha256 !== bundleSha256) failures.push('native proof bundle digest differs');
   if (!/^[a-f0-9]{40}$/.test(sourceSha || '') || receipt.sourceSha !== sourceSha) failures.push('native proof source SHA differs');
   if (!/^\d+$/.test(String(workflowRunId || '')) || String(receipt.workflowRunId || '') !== String(workflowRunId)) failures.push('native proof workflow run differs');
-  if (!/^com\.ruvnet\.brain-update\.proof-[A-Za-z0-9._-]+$/.test(receipt.identity || '')) failures.push('native proof identity is not isolated');
+  if (!NIGHTLY_PROOF_LABEL.test(receipt.identity || '')) failures.push('native proof identity is not isolated');
   if (receipt.packageExecution !== undefined || receipt.registration?.packageTarget?.spec === 'ruvnet-brain@latest') {
     failures.push(...validateNpxObservations(receipt));
   }
@@ -480,7 +480,7 @@ export async function runNightlyTwoRunProof({ packagePath, bundlePath, out, time
   const prefix = path.join(root, 'prefix');
   const npmCache = path.join(root, 'npm-cache');
   const logPath = path.join(kbDir, 'update.log');
-  const identity = `com.ruvnet.brain-update.proof-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
+  const identity = `${NIGHTLY_LABEL}.proof-${process.pid}-${crypto.randomBytes(6).toString('hex')}`;
   const tempDir = path.join(root, 'tmp');
   const env = {
     ...Object.fromEntries(['SystemRoot', 'SYSTEMROOT', 'ComSpec', 'COMSPEC', 'PATHEXT']

package/scripts/nightly-watchdog.mjs

@@ -227,6 +227,14 @@ export function productSchedulerVerdict(status) {
   return { ...base, state: mapped, detail: run.evidence };
 }
 
+/** ONE update owner per machine (CONTRIBUTING.md § The knowledge corpus). agentic-kit removes the
+ *  Brain's own scheduler by design and updates through `ak sync`, which the registry watches as
+ *  com.stuartkerr.ak-sync — so on such a machine the Brain scheduler is not expected to exist. */
+export function brainUpdateOwnedByAgenticKit(home = os.homedir()) {
+  try { return JSON.parse(fs.readFileSync(path.join(home, '.config', 'agentic-kit', 'kit.json'), 'utf8')).ruvnetBrain === true; }
+  catch { return false; }
+}
+
 const loadState = () => { try { return JSON.parse(fs.readFileSync(STATE, 'utf8')); } catch { return {}; } };
 const saveState = (s) => { fs.mkdirSync(path.dirname(STATE), { recursive: true }); fs.writeFileSync(STATE, JSON.stringify(s, null, 2)); };
 
@@ -253,9 +261,9 @@ async function main() {
   const json = process.argv.includes('--json');
   const quiet = process.argv.includes('--quiet');
   const brainHome = process.env.RUVNET_BRAIN_HOME || path.join(os.homedir(), '.cache', 'ruvnet-brain');
-  const results = [...checkAll(new Date()), productSchedulerVerdict(schedulerStatus({
+  const results = [...checkAll(new Date()), ...(brainUpdateOwnedByAgenticKit() ? [] : [productSchedulerVerdict(schedulerStatus({
     brainHome, kbDir: process.env.RUVNET_BRAIN_KB || path.join(brainHome, 'kb'),
-  }))];
+  }))])];
   const bad = results.filter((r) => r.state !== OK);
 
   const prev = loadState();

package/scripts/onboarding-console.mjs

@@ -27,7 +27,7 @@ import { fileURLToPath } from 'node:url';
 import { spawnSync, execFileSync, spawn } from 'node:child_process';
 
 import { auditModel, installedVersion } from './stack-sync.mjs';
-import { candidateRoots, findStores, diagnose } from './memory-doctor.mjs';
+import { candidateRoots, findStores, findProjects, diagnose } from './memory-doctor.mjs';
 import { buildStackRecommendations, buildWiringRecommendations, summarizeWiring, scoreMemoryHealth, buildHealthRecommendations, buildCapabilityRecommendations } from './console-engine.mjs';
 import { planFor } from './remedy-registry.mjs';
 import { auditAll as capabilityAuditAll } from './capability-registry.mjs';
@@ -73,6 +73,7 @@ import { applyNightlyChoice, nightlyStatus } from './nightly-controller.mjs';
 // One canonical answer to "which directory is this, and have I counted it already?" — shared with
 // the PreCompact snapshot producer (#85) and with memory-doctor's root scan (#107).
 import { canonicalPath, pathIdentity, projectDirectory } from '../plugin/scripts/project-identity.mjs';
+import { resolveProjectStore } from '../plugin/scripts/project-store-resolver.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const REPO = path.dirname(__dirname);
@@ -350,27 +351,6 @@ function robustReadJSON(db, sql) {
 const VENDOR = ['/clones/', '/node_modules/', '/vendor/', '/upstream/', '.claude-backup', '_snapshots',
   '/ruvnet-repos/', '/ruvnet_repos/'];
 
-// memory-doctor.mjs owns candidate-root policy for the standalone CLI, Console, and other callers.
-// Keeping one exported implementation prevents a new project-root convention from fixing one
-// surface while another continues to print a confident but incomplete machine-wide count (#81).
-function findProjects(root) {
-  const out = new Set();
-  const walk = (dir, depth) => {
-    if (depth > 4) return;
-    let ents; try { ents = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
-    for (const e of ents) {
-      const p = path.join(dir, e.name);
-      if (VENDOR.some((m) => (p + '/').includes(m))) continue;
-      if (e.isDirectory()) {
-        if (e.name === '.claude') { out.add(dir); continue; }
-        if (e.name.startsWith('.') || e.name === 'node_modules') continue;
-        walk(p, depth + 1);
-      } else if (e.name === '.mcp.json') out.add(dir);
-    }
-  };
-  walk(root, 0);
-  return [...out].sort();
-}
 // Text that PRINTS the word npx is not an npx call site. Two of the sites this card warned about were
 // `echo "Session ended. Run: npx aqe learn status"` — advice being displayed to the user, matched as
 // though the machine were executing it. Strip quoted echo/printf payloads before classifying.
@@ -483,15 +463,25 @@ function memoryRows(file) {
   return r.ok ? (r.value === null ? 0 : parseInt(r.value, 10)) : null;
 }
 export function memoryStores(projectDir) {
-  const [canonicalPath, coordinationPath] = MEMORY_DB_NAMES.map((name) => path.join(projectDir, '.swarm', name));
-  const canonical = { path: canonicalPath, exists: fs.existsSync(canonicalPath), rows: memoryRows(canonicalPath) };
-  const coordination = { path: coordinationPath, exists: fs.existsSync(coordinationPath), rows: memoryRows(coordinationPath) };
-  // A canonical store that holds rows — or is busy being written this instant (rows null) — is the
-  // one scored. Only an absent or EMPTY canonical store hands the score to the coordination file.
-  const scored = canonical.exists && (canonical.rows === null || canonical.rows > 0) ? canonical.path
-    : coordination.exists ? coordination.path
-      : canonical.path; // canonical name for the "absent" message
-  return { canonical, coordination, scored };
+  let canonicalPath;
+  let resolutionError = null;
+  try { canonicalPath = resolveProjectStore({ projectDir }).canonicalAgentDbPath; }
+  catch (error) {
+    // A resolver refusal (foreign store, broken symlink, or ambiguous project) is an
+    // authoritative UNKNOWN. Never probe a guessed path after the resolver declines it.
+    canonicalPath = path.join(projectDir, '.swarm', MEMORY_DB_NAMES[0]);
+    resolutionError = String(error?.message || error);
+  }
+  const coordinationPath = path.join(path.dirname(canonicalPath), MEMORY_DB_NAMES[1]);
+  const canonical = resolutionError
+    ? { path: canonicalPath, exists: null, rows: null, status: 'unknown', error: resolutionError }
+    : { path: canonicalPath, exists: fs.existsSync(canonicalPath), rows: memoryRows(canonicalPath) };
+  const coordination = resolutionError
+    ? { path: coordinationPath, exists: null, rows: null, status: 'unknown', error: 'canonical project store could not be resolved' }
+    : { path: coordinationPath, exists: fs.existsSync(coordinationPath), rows: memoryRows(coordinationPath) };
+  // Coordination storage is a separate diagnostic container. It can never become project memory
+  // merely because the canonical file is absent, empty, busy, or larger.
+  return { canonical, coordination, scored: canonical.path, resolutionError };
 }
 export function resolveMemoryDb(projectDir) {
   return memoryStores(projectDir).scored;
@@ -519,6 +509,12 @@ function probeMemory(projectDir, { now = Date.now() } = {}) {
   // recall quality: honestly NOT probed at render (a true probe needs an embedding query; left for an explicit deep test)
   probes.recallQuality = { status: 'notTested', detail: 'not checked this session — a real recall probe needs an embedding round-trip, which render deliberately avoids' };
 
+  if (stores.resolutionError) {
+    probes.liveness = { status: 'unknown', detail: `canonical project store could not be resolved: ${stores.resolutionError}` };
+    probes.coverage = { status: 'unknown', detail: 'project checkpoint cannot be assessed until the canonical store resolves' };
+    return probes;
+  }
+
   if (!fs.existsSync(db)) {
     probes.liveness = { status: 'fail', detail: 'this project has no memory store (.swarm/memory.db) yet' };
     probes.coverage = { status: 'warn', detail: 'no checkpoint — no store has been created here' };
@@ -580,7 +576,8 @@ function gatherMemory(cwd, { fleet = true } = {}) {
   // launched from a subdirectory probes the project root the hook actually wrote to, instead of
   // warning that a snapshot it can see on disk does not exist (#85).
   const scope = projectDirectory({ cwd });
-  const project = fs.existsSync(path.join(scope, '.swarm/memory.db')) ? scope : REPO;
+  let project = scope;
+  try { project = resolveProjectStore({ projectDir: scope }).projectRoot; } catch { /* probe reports unavailable */ }
   const projName = project.replace(CONSOLE_ROOT + '/Code/', '').replace(CONSOLE_ROOT + '/', '~/');
   const probes = probeMemory(project);
   const health = scoreMemoryHealth({ project: projName, probes });
@@ -1534,11 +1531,33 @@ function writeCache(file, at, data, scope = null) {
  */
 let REFRESH_CHILD = null;
 const REFRESH_WEDGED_MS = 5 * 60 * 1000;
-function kickRefresh({ force = false } = {}) {
-  if (process.env.RUVNET_CONSOLE_DISABLE_BACKGROUND_REFRESH === '1') return false;
+let REFRESH_STATE = Object.freeze({ status: 'idle', runId: null, error: null });
+export function refreshState() { return REFRESH_STATE; }
+export function classifyRefreshState({ disabled = false, running = false, debounced = false, failed = null, runId = null } = {}) {
+  if (disabled) return Object.freeze({ status: 'disabled', runId: null, error: null });
+  if (failed) return Object.freeze({ status: 'failed', runId, error: String(failed) });
+  if (running || debounced) return Object.freeze({ status: 'already-running', runId, error: debounced ? 'debounced' : null });
+  return Object.freeze({ status: 'started', runId, error: null });
+}
+export function settleRefreshState({ currentRunId, runId, code = 0, signal = null } = {}) {
+  if (currentRunId !== runId) return null;
+  if (code !== 0 || signal) return classifyRefreshState({ failed: signal ? `signal ${signal}` : `exit ${code}`, runId });
+  return Object.freeze({ status: 'settled', runId, error: null });
+}
+function kickRefreshDetailed({ force = false } = {}) {
+  if (process.env.RUVNET_CONSOLE_DISABLE_BACKGROUND_REFRESH === '1') {
+    REFRESH_STATE = classifyRefreshState({ disabled: true });
+    return REFRESH_STATE;
+  }
   const now = Date.now();
-  if (REFRESH_CHILD && now - LAST_REFRESH_KICK < REFRESH_WEDGED_MS) return false;  // one at a time
-  if (!force && now - LAST_REFRESH_KICK < 15000) return false;   // debounce: at most one background refresh / 15s
+  if (REFRESH_CHILD && now - LAST_REFRESH_KICK < REFRESH_WEDGED_MS) {
+    REFRESH_STATE = classifyRefreshState({ running: true, runId: REFRESH_STATE.runId });
+    return REFRESH_STATE;
+  }
+  if (!force && now - LAST_REFRESH_KICK < 15000) {
+    REFRESH_STATE = classifyRefreshState({ debounced: true, runId: REFRESH_STATE.runId });
+    return REFRESH_STATE;
+  }
   LAST_REFRESH_KICK = now;
   try {
     // cwd = the SERVED project, NOT REPO. This was `cwd: REPO` and it was a real console-honesty bug
@@ -1553,12 +1572,32 @@ function kickRefresh({ force = false } = {}) {
     // contract (the 2026-07-17 outage) — only to which project the background compute is about.
     const child = spawn(process.execPath, [SELF, '--refresh-cache'], { detached: true, stdio: 'ignore', cwd: process.cwd() });
     REFRESH_CHILD = child;
+    const runId = `${process.pid}-${now}`;
+    REFRESH_STATE = classifyRefreshState({ runId });
     // unref() only releases the event-loop hold; these listeners still fire while the server lives.
-    child.on('exit', () => { REFRESH_CHILD = null; });
-    child.on('error', () => { REFRESH_CHILD = null; });
+    child.on('exit', (code, signal) => {
+      // An older child can exit after a newer run has started. It may only settle its own run.
+      const settled = settleRefreshState({ currentRunId: REFRESH_STATE.runId, runId, code, signal });
+      if (!settled) return;
+      REFRESH_CHILD = null;
+      REFRESH_STATE = settled;
+    });
+    child.on('error', (error) => {
+      const settled = settleRefreshState({ currentRunId: REFRESH_STATE.runId, runId, code: 1, signal: error?.message || error });
+      if (!settled) return;
+      REFRESH_CHILD = null;
+      REFRESH_STATE = settled;
+    });
     child.unref();   // let it outlive this request; it writes the caches and exits on its own
-    return true;
-  } catch { REFRESH_CHILD = null; return false; /* a failed spawn just means the cache ages until the next kick */ }
+    return REFRESH_STATE;
+  } catch (error) {
+    REFRESH_CHILD = null;
+    REFRESH_STATE = classifyRefreshState({ failed: error?.message || error });
+    return REFRESH_STATE;
+  }
+}
+function kickRefresh(options = {}) {
+  return kickRefreshDetailed(options).status === 'started';
 }
 
 /**
@@ -1819,10 +1858,12 @@ function findMemoryStores(root) {
       const p = path.join(dir, e.name);
       if (VENDOR.some((m) => (p + '/').includes(m))) continue;
       if (e.name === '.swarm') {
-        // Same resolution as probeMemory — the fleet walk had the identical hardcoded assumption (#127).
-        const resolved = ['memory.db', 'agentdb-memory.db'].map((n) => path.join(p, n)).filter((f) => fs.existsSync(f))
-          .sort((a, b) => { const sz = (f) => { try { return fs.statSync(f).size; } catch { return 0; } }; return sz(b) - sz(a); })[0];
-        if (resolved) out.push({ project: dir, db: resolved });
+        // Fleet activity is project memory, so resolve the canonical store rather than selecting a
+        // coordination database by size. The latter is diagnostic-only and can contain unrelated rows.
+        try {
+          const resolved = resolveProjectStore({ projectDir: dir }).canonicalAgentDbPath;
+          if (fs.existsSync(resolved)) out.push({ project: dir, db: resolved });
+        } catch { /* an unresolvable directory is not a project store */ }
         continue;
       }
       if (e.name.startsWith('.') || e.name === 'node_modules') continue;
@@ -1833,8 +1874,16 @@ function findMemoryStores(root) {
   return out;
 }
 function gatherActivity(cwd) {
-  const project = fs.existsSync(path.join(cwd, '.swarm/memory.db')) ? cwd : REPO;
-  const db = path.join(project, '.swarm/memory.db');
+  let project;
+  let db;
+  try {
+    const resolved = resolveProjectStore({ projectDir: projectDirectory({ cwd }) });
+    project = resolved.projectRoot;
+    db = resolved.canonicalAgentDbPath;
+  } catch {
+    const measuredAt = new Date().toISOString();
+    return { generatedAt: measuredAt, project: path.basename(cwd), hasStore: false, continuity: 'unavailable', ...freshnessOf(measuredAt) };
+  }
   if (!fs.existsSync(db)) {
     // No store to read — the existence check above IS the entire measurement, so it IS the
     // observation instant. Stamped here, not with a value taken before the check ran.
@@ -2254,7 +2303,7 @@ export function preferredSeat(subs) {
 function gatherState(cwd, { fleet = true } = {}) {
   const wiring = wiringSurvey();
   const memory = gatherMemory(cwd, { fleet });
-  try { memory.learnings = learnings(); } catch { memory.learnings = null; }
+  try { memory.learnings = learnings({ cwd }); } catch { memory.learnings = null; }
   const savings = gatherSavings();
   const cfgNow = readJSON(CONFIG_PATH) || {};
   // issue #20: the Savings card's "Turn on smart routing" CTA must reflect what was actually saved —
@@ -3078,8 +3127,8 @@ function startServer({ port = Number(process.env.CONSOLE_PORT) || 7411, open = f
           //     refresh that did not start must not report that it did, so `started` is the child's
           //     real answer, not a constant.
           expireCachesEmbedding([STATE_CACHE, STACK_CACHE, MEMORY_CACHE, CAPABILITY_CACHE]);
-          const started = kickRefresh({ force: true });
-          return sendJSON(res, 200, { ok: true, refreshing: true, started });
+          const refresh = kickRefreshDetailed({ force: true });
+          return sendJSON(res, 200, { ok: refresh.status !== 'failed', started: refresh.status === 'started', refreshing: refresh.status === 'started' || refresh.status === 'already-running', refresh });
         }
         if (url === '/api/undo') return sendJSON(res, 200, undo(body.undoToken));
         if (url === '/api/set-lesson') return sendJSON(res, 200, setLesson(body));

package/scripts/oracle/producer-hosts.mjs

@@ -18,9 +18,10 @@
  * with them.
  */
 import { spawn } from 'node:child_process';
+import { DUAL_HOST_MODEL_IDS } from '../review-model-defaults.mjs';
 
 // Pinned on 2026-09-13 against the native hosts (same ids scripts/dual-host-deliberation.mjs pins).
-export const PRODUCER_MODELS = Object.freeze({ claude: 'claude-fable-5-1', codex: 'gpt-6-astra' });
+export const PRODUCER_MODELS = DUAL_HOST_MODEL_IDS;
 export const PRODUCER_HOSTS = Object.freeze(['claude', 'codex']);
 export const DEFAULT_ROLES = Object.freeze({ generator: 'claude', judge: 'codex' });
 export const CLAUDE_TIMEOUT_MS = 900_000;

package/scripts/private-overlay.mjs

@@ -4,13 +4,23 @@
 //
 //   node scripts/private-overlay.mjs --root <kbDir> --from <sidecarDir> --store <name> [--store ...]
 //                                    [--dry-run] [--force] [--alias <name>=<nick,nick>] [--card <name>=<file>]
+//                                    [--origin <label>]
+//
+// `--origin` is stamped into SOURCE.json alongside updateManaged:false (omitted when not passed, so
+// every existing caller's output is byte-identical). scripts/ingest-repo.mjs passes `local-ingest`
+// (S3: explicit local ownership) so a repo pulled in on demand is distinguishable from a genuinely
+// private pre-built sidecar; `--from` may equal `--root` for that case (the bytes are already in
+// place — this writer degenerates to registry stamping only, since every file compares byte-equal
+// to itself).
 //
 // WHY THIS FILE EXISTS (measured 2026-09-11/12). kb/forge-update.mjs preserves exactly one thing
 // across a public bundle apply: SOURCE.json store entries flagged `updateManaged:false`
 // (capturePrivateOverlayState, kb/forge-update.mjs:356-358) — the capture then needs a matching
 // RVF-GENERATIONS.json row with a `file` (:369-372) and picks up `## <name>` cards and alias rows
-// (:402-408). restoreTreeExact (:570-591) deletes every name the bundle lacks. Nothing anywhere
-// WROTE that flag: forge-refresh's writeSourceManifest records public repos only, and
+// (:402-408). The apply path builds its candidate fresh from the extracted bundle
+// (`restorePrivateFilesIntoCandidate`, forge-update.mjs — the one apply path, S1), so every name the
+// bundle lacks is simply absent from that candidate. Nothing anywhere
+// WROTE that flag: forge-refresh's writeSourceManifestFromLedger records public repos only, and
 // ingest-repo.mjs builds from a git checkout with a canonical URL. So private stores that arrive as
 // pre-built sidecars had no writer, sat in the root unflagged, and 0 of 8 survived the 2026-09-10
 // tree replacement. This is that writer. It ADDS entries and never rebuilds top-level identity:
@@ -20,7 +30,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { sha256File } from './rvf-generation.mjs';
+import { sha256File, projectSourceStore } from './rvf-generation.mjs';
 
 export const REQUIRED_SIDECARS = ['.big.rvf', '.big.rvf.embed.json', '.big.rvf.idmap.json', '.meta.json', '.passages.jsonl'];
 export const OPTIONAL_SIDECARS = ['.symbols.json', '-primer.md'];
@@ -94,7 +104,7 @@ function cardFor({ from, name, meta, cardFile }) {
   throw new Error(`${name}: no card source — add ${name}-primer.md to ${from}, or pass --card ${name}=<file>`);
 }
 
-function planStore({ root, from, name, force, aliases, cardFile }) {
+function planStore({ root, from, name, force, aliases, cardFile, origin }) {
   if (!NAME_RE.test(name)) throw new Error(`invalid store name: ${name}`);
   const missing = REQUIRED_SIDECARS.filter((suffix) => !isRegular(path.join(from, name + suffix)));
   if (missing.length) throw new Error(`${name}: missing sidecar(s) in ${from}: ${missing.map((suffix) => name + suffix).join(', ')}`);
@@ -121,10 +131,21 @@ function planStore({ root, from, name, force, aliases, cardFile }) {
   }
   const rvf = path.join(from, `${name}.big.rvf`);
   const card = cardFor({ from, name, meta, cardFile });
+  const generation = { file: `${name}.big.rvf`, sha256: sha256File(rvf), bytes: fs.statSync(rvf).size, model: embed.model, dimensions: embed.dimensions, sourceCommit: null, builtUtc };
   return {
-    name, files, copies, card, aliases,
-    generation: { file: `${name}.big.rvf`, sha256: sha256File(rvf), bytes: fs.statSync(rvf).size, model: embed.model, dimensions: embed.dimensions, sourceCommit: null, builtUtc },
-    source: { kbName: name, updateManaged: false, builtUtc, sourceCommit: null, sourceRepo: 'private', canonicalManifestUrl: null },
+    name, files, copies, card, aliases, generation,
+    // S4 (ONE PROVENANCE RECORD): source.sourceCommit/builtUtc are projected from `generation`
+    // above (projectSourceStore, scripts/rvf-generation.mjs) rather than a second, independent
+    // copy of the same facts. A private store has no selfUpdate/canonicalBundleUrl/builder —
+    // those are public-bundle-only fields, so they are simply never passed in the updater here.
+    // `origin` is opt-in (omitted entirely when not supplied, never written as null/undefined) so a
+    // caller that does not pass it gets the exact byte-identical stamp this writer has always
+    // produced. S3 (explicit local ownership): scripts/ingest-repo.mjs passes origin:'local-ingest'
+    // so a store this brain pulled in on demand is distinguishable, in SOURCE.json itself, from one
+    // that arrived as a genuinely private pre-built sidecar (a bare "private" sourceRepo alone conflated
+    // the two before this).
+    source: projectSourceStore(name, generation, { updateManaged: false, sourceRepo: 'private',
+      canonicalManifestUrl: null, ...(origin ? { origin } : {}) }),
   };
 }
 
@@ -132,7 +153,7 @@ function planStore({ root, from, name, force, aliases, cardFile }) {
  * Add private stores to a live brain root. Idempotent; refuses before writing anything; snapshots
  * every registry it is about to change to `<file>.pre-overlay-<epoch>` first; temp+rename writes.
  */
-export function applyPrivateOverlay({ root, from, stores, dryRun = false, force = false, aliases = {}, cards = {}, now = Date.now }) {
+export function applyPrivateOverlay({ root, from, stores, dryRun = false, force = false, aliases = {}, cards = {}, now = Date.now, origin = null }) {
   root = path.resolve(String(root || ''));
   from = path.resolve(String(from || ''));
   if (!Array.isArray(stores) || !stores.length) throw new Error('at least one --store <name> is required');
@@ -158,7 +179,7 @@ export function applyPrivateOverlay({ root, from, stores, dryRun = false, force
     schemaVersion: 1, kind: 'ruvnet-brain-private-overlay-receipt', at: new Date(now()).toISOString(),
     root, from, dryRun, force, stores: [],
   };
-  const plans = stores.map((name) => planStore({ root, from, name, force, aliases: aliases[name], cardFile: cards[name] }));
+  const plans = stores.map((name) => planStore({ root, from, name, force, aliases: aliases[name], cardFile: cards[name], origin }));
   for (const plan of plans) {
     const { name } = plan;
     if (!fence.has(name.toLowerCase())) {
@@ -226,6 +247,7 @@ function parseArgs(argv) {
     else if (flag === '--force') options.force = true;
     else if (flag === '--alias') { const [name, list] = pair(next(), flag); options.aliases[name] = list.split(',').map((s) => s.trim()).filter(Boolean); }
     else if (flag === '--card') { const [name, file] = pair(next(), flag); options.cards[name] = path.resolve(file); }
+    else if (flag === '--origin') options.origin = next();
     else throw new Error(`unknown argument: ${flag}`);
   }
   if (!options.root || !options.from || !options.stores.length) {

package/scripts/public-verification-aggregate.mjs

@@ -7,10 +7,11 @@ import { canonicalJson, digest } from './coverage-integrity.mjs';
 import { retrievalOracleExpectationFromPlan, validateRetrievalOracleReview } from './independent-review-receipt.mjs';
 import { validateRetrievalCanaryPlan, validateRetrievalCanaryReceipt } from './retrieval-canary.mjs';
 import { validateNightlyProofReceipt, validateNativeSchedulerSmoke } from './nightly-two-run-proof.mjs';
+import { CLAUDE_FABLE_5_ID, GPT_5_6_SOL_ID, LEGACY_REVIEW_MODEL_IDS } from './review-model-defaults.mjs';
 
 export const PUBLIC_VERIFICATION_OS = Object.freeze(['linux', 'macos', 'windows']);
 export const PUBLIC_VERIFICATION_MODES = Object.freeze(['claude', 'codex', 'dual']);
-export const REQUIRED_REVIEW_MODELS = Object.freeze(['claude-fable-5', 'gpt-5.6-sol']);
+export const REQUIRED_REVIEW_MODELS = LEGACY_REVIEW_MODEL_IDS;
 
 const HEX40 = /^[a-f0-9]{40}$/;
 const HEX64 = /^[a-f0-9]{64}$/;
@@ -110,10 +111,10 @@ export function validateIndependentReviewReceipt(review) {
     || typeof review.execution?.invocationDigest !== 'string' || !HEX64.test(review.execution.invocationDigest)) {
     throw new Error('independent review receipt is malformed, below 95, or incomplete');
   }
-  if (review.model === 'claude-fable-5' && review.provider !== 'firstParty') {
+  if (review.model === CLAUDE_FABLE_5_ID && review.provider !== 'firstParty') {
     throw new Error('Fable 5 review did not use the verified first-party subscription path');
   }
-  if (review.model === 'gpt-5.6-sol' && (review.provider !== 'openai' || typeof review.execution.threadId !== 'string'
+  if (review.model === GPT_5_6_SOL_ID && (review.provider !== 'openai' || typeof review.execution.threadId !== 'string'
     || !review.execution.threadId || !HEX64.test(String(review.execution.catalogRowSha256 || '')))) {
     throw new Error('GPT-5.6-Sol review lacks live catalog and thread evidence');
   }

package/scripts/publication-receipt.mjs

@@ -654,6 +654,15 @@ export function livePublicationAdapter({ root = process.cwd(), candidateRoot = r
         }
       }
       const result = await session.search({ query, k, timeoutMs: DEADLINE_MS });
+      if (result.error || !result.mcpResult || (Object.hasOwn(result, 'status') && result.status !== 0)) {
+        // Same guard as warmupInstalled() above and host-install-matrix.mjs's equivalent canary
+        // search: without it, a real timeout on this full-corpus search reaches
+        // parseRetrievalResult() with no mcpResult, which throws the generic "UNKNOWN:
+        // incompatible MCP response lacks structured retrieval results" — masking a timeout as a
+        // data-shape error. This is the release blocker traced from v4.3.28's public verification
+        // failure ("retrieval canary acceptance failed for claude", run 35559726522).
+        throw new Error(`installed Brain search failed for ${mode} (query="${query}"): ${result.error?.message || `no MCP result within ${DEADLINE_MS}ms`}`);
+      }
       return parseRetrievalResult(result.mcpResult, { query, k });
     },
 

package/scripts/qe/agentic-qe-4.3.mjs

@@ -26,7 +26,6 @@ const LANES = Object.freeze({
   // Fail design/provenance issues before any long behavioral or platform lane starts.
   preflight: [
     { kind: 'command', command: process.execPath, args: ['--check', 'scripts/qe/agentic-qe-4.3.mjs'], timeoutMs: 10_000 },
-    { kind: 'command', command: process.execPath, args: ['--check', 'scripts/qe/aggregate-4.3.mjs'], timeoutMs: 10_000 },
     { kind: 'command', command: npm, args: ['run', 'version:check'], timeoutMs: 60_000 },
     vitest(['tests/qe/gpt56/critical-risk-map.test.mjs'], 60_000),
   ],

package/scripts/rebuild-gists-from-receipts.mjs

@@ -149,7 +149,7 @@ export async function reconstructGists(source, { fetchFn = globalThis.fetch, con
     const digest = sha256(bytes);
     if (digest !== file.sha256) fail(`${gistId}/${file.filename} sha256 ${digest} differs from receipt ${file.sha256}`);
     try {
-      return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+      return new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes);
     } catch {
       fail(`${gistId}/${file.filename} is not valid UTF-8 text`);
       return undefined; // unreachable; keeps linters happy about a missing return on every path