ruvnet-brain 4.3.34 → 4.3.36

package/scripts/rehearse-seed-selection.mjs

@@ -0,0 +1,234 @@
+// scripts/rehearse-seed-selection.mjs — the ADR-0091 D4 half of the corpus rehearsal.
+//
+// Before D4 the rehearsal handed candidate N straight to generation N+1 and never exercised seed
+// SELECTION at all (the audit's V4 gap). This module lets it do what the nightly does:
+//   1. "publish" candidate N into a LOCAL release registry, from the exact files release.mjs tried to
+//      upload (the recorded `gh release create`), so nothing is invented about the asset set;
+//   2. optionally cut a simulated CODE RELEASE in the disposable checkout between generations (a
+//      version bump through the repo's own scripts/sync-version.mjs, committed) -- the event that,
+//      before D4, reset the seed chain to the bootstrap (ADR-0091 section 3.4);
+//   3. register newer, INCOMPATIBLE decoy generations that must be skipped before any archive
+//      download: one whose receipt names a different embedding model, one whose recall report was
+//      measured against a different frozen fixture;
+//   4. answer the real corpus-next-seed.mjs resolver through a fake `gh` served from that registry,
+//      which REFUSES any archive download and records every call;
+//   5. check every candidate's runtime surface with the real verifyApprovedRuntime against a pin
+//      derived from the CHECKOUT's own files, never from the candidate -- so a seed's executable that
+//      leaked into the archive shows up as "no approved code release pinned".
+//
+// It publishes nothing and calls no network: the registry is a directory, the `gh` is a function.
+
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+
+const ARCHIVE_ASSET = 'ruvnet-brain.zip';
+const SIGNATURE_ASSET = 'ruvnet-brain.zip.sig';
+
+const sha256Text = (text) => crypto.createHash('sha256').update(text).digest('hex');
+function sha256File(file) {
+  const hash = crypto.createHash('sha256');
+  const fd = fs.openSync(file, 'r');
+  const buffer = Buffer.allocUnsafe(1024 * 1024);
+  try {
+    let bytes;
+    while ((bytes = fs.readSync(fd, buffer, 0, buffer.length, null)) > 0) hash.update(buffer.subarray(0, bytes));
+  } finally { fs.closeSync(fd); }
+  return hash.digest('hex');
+}
+const clone = (from, to) => fs.copyFileSync(from, to, fs.constants.COPYFILE_FICLONE);
+
+// ---------------------------------------------------------------------------------------------
+// The local registry
+// ---------------------------------------------------------------------------------------------
+
+/**
+ * Register one generation. `files` are local paths whose basenames become asset names. `declared`
+ * overrides an asset's listed size without writing its bytes (a decoy's archive is listed, never
+ * served). A `.sig` placeholder is added when the files carry none, and the release records that it
+ * is a placeholder: the rehearsal's publish path is the non-promoting one, which signs nothing, and
+ * the resolver checks the signature's PRESENCE only (verification happens in the updater).
+ */
+export function registerGeneration({ registryDir, tag, createdAt, files = [], declared = {}, note = null }) {
+  const dir = path.join(registryDir, tag);
+  fs.mkdirSync(path.join(dir, 'assets'), { recursive: true });
+  const assets = [];
+  for (const file of files) {
+    const name = path.basename(file);
+    clone(file, path.join(dir, 'assets', name));
+    assets.push({ name, size: fs.statSync(file).size, state: 'uploaded' });
+  }
+  for (const [name, size] of Object.entries(declared)) {
+    fs.writeFileSync(path.join(dir, 'assets', name), '');
+    assets.push({ name, size, state: 'uploaded', declaredOnly: true });
+  }
+  let signaturePlaceholder = false;
+  if (!assets.some(({ name }) => name === SIGNATURE_ASSET)) {
+    fs.writeFileSync(path.join(dir, 'assets', SIGNATURE_ASSET), 'rehearsal placeholder: not a signature\n');
+    assets.push({ name: SIGNATURE_ASSET, size: fs.statSync(path.join(dir, 'assets', SIGNATURE_ASSET)).size, state: 'uploaded' });
+    signaturePlaceholder = true;
+  }
+  const release = { tagName: tag, isDraft: false, createdAt, assets, signaturePlaceholder, note };
+  fs.writeFileSync(path.join(dir, 'release.json'), `${JSON.stringify(release, null, 2)}\n`);
+  return release;
+}
+
+/** The files a recorded `gh release create` would have uploaded: its existing-file arguments. */
+export function uploadedFilesOf(createArgs) {
+  return (createArgs || []).filter((value) => path.isAbsolute(String(value)) && fs.existsSync(value) && fs.statSync(value).isFile());
+}
+
+/**
+ * A `gh` answering the three calls corpus-next-seed.mjs makes, from the registry. An archive download
+ * is REFUSED and recorded, so the rehearsal can assert the resolver judged from small files only.
+ */
+export function registryGh(registryDir) {
+  const calls = [];
+  const releases = () => fs.readdirSync(registryDir)
+    .map((tag) => JSON.parse(fs.readFileSync(path.join(registryDir, tag, 'release.json'), 'utf8')));
+  const run = (command, args) => {
+    const line = `${command} ${args.join(' ')}`;
+    calls.push(line);
+    if (command !== 'gh') return { status: 127, stderr: `unexpected command ${command}` };
+    if (args[0] === 'release' && args[1] === 'list') {
+      return { status: 0, stdout: JSON.stringify(releases().map(({ tagName, isDraft, createdAt }) => ({ tagName, isDraft, createdAt }))) };
+    }
+    const release = releases().find((row) => row.tagName === args[2]);
+    if (args[0] === 'release' && args[1] === 'view') {
+      if (!release) return { status: 1, stderr: 'release not found' };
+      return { status: 0, stdout: JSON.stringify({ tagName: release.tagName, isDraft: release.isDraft,
+        assets: release.assets.map(({ name, size, state }) => ({ name, size, state })) }) };
+    }
+    if (args[0] === 'release' && args[1] === 'download') {
+      const pattern = args[args.indexOf('--pattern') + 1];
+      const dir = args[args.indexOf('--dir') + 1];
+      if (pattern === ARCHIVE_ASSET) return { status: 1, stderr: 'rehearsal registry refuses archive downloads to the resolver' };
+      const asset = release?.assets.find(({ name }) => name === pattern);
+      if (!asset || asset.declaredOnly) return { status: 1, stderr: 'asset not found' };
+      fs.copyFileSync(path.join(registryDir, release.tagName, 'assets', pattern), path.join(dir, pattern));
+      return { status: 0, stdout: '' };
+    }
+    return { status: 1, stderr: `unsupported gh call in the rehearsal registry: ${line}` };
+  };
+  return {
+    run,
+    calls,
+    downloads: () => calls.filter((line) => / release download /.test(line)),
+    archiveDownloadAttempts: () => calls.filter((line) => / release download /.test(line) && line.includes(`--pattern ${ARCHIVE_ASSET} `)),
+  };
+}
+
+/**
+ * Two newer generations the resolver must SKIP, each rebound to its own digest so every identity
+ * check that precedes the compatibility check still passes -- only the property under test differs:
+ *   model-mismatch   -- one store's receipt row names another model/dimensions (rejected from the
+ *                       receipt alone; its recall report must never be fetched);
+ *   fixture-mismatch -- the recall report was measured against another frozen fixture (rejected
+ *                       after the small recall download; its archive must never be fetched).
+ */
+export function registerIncompatibleDecoys({ registryDir, real, createdAtMs, scratchDir }) {
+  const realReceipt = JSON.parse(fs.readFileSync(real.receiptFile, 'utf8'));
+  const realRecall = JSON.parse(fs.readFileSync(real.recallFile, 'utf8'));
+  const decoys = [];
+  const make = (kind, offsetMs, mutate) => {
+    const digest = sha256Text(`rehearsal-decoy:${kind}:${real.sha256}`);
+    const tag = `corpus-sha256-${digest}`;
+    const dir = path.join(scratchDir, `decoy-${kind}`);
+    fs.mkdirSync(dir, { recursive: true });
+    const recall = { ...realRecall, archive: { ...realRecall.archive, sha256: digest, bytes: real.bytes } };
+    const receipt = { ...realReceipt, archive: { ...realReceipt.archive, sha256: digest, bytes: real.bytes } };
+    mutate({ recall, receipt });
+    const recallFile = path.join(dir, 'ruvnet-brain.zip.recall.json');
+    fs.writeFileSync(recallFile, JSON.stringify(recall));
+    receipt.recallReport = { file: path.basename(recallFile), sha256: sha256File(recallFile), bytes: fs.statSync(recallFile).size };
+    const receiptFile = path.join(dir, 'corpus-receipt.json');
+    fs.writeFileSync(receiptFile, JSON.stringify(receipt));
+    registerGeneration({
+      registryDir, tag, createdAt: new Date(createdAtMs + offsetMs).toISOString(),
+      files: [receiptFile, recallFile, real.accuracyFile], declared: { [ARCHIVE_ASSET]: real.bytes },
+      note: `rehearsal decoy (${kind}); its archive is listed, never served`,
+    });
+    decoys.push({ kind, tag });
+  };
+  make('fixture-mismatch', 1000, ({ recall }) => {
+    recall.fixture = { ...recall.fixture, sha256: sha256Text('rehearsal-decoy: a different frozen fixture') };
+  });
+  make('model-mismatch', 2000, ({ receipt }) => {
+    receipt.stores = receipt.stores.map((row, index) => (index === 0 ? { ...row, model: 'Xenova/all-MiniLM-L6-v2', dimensions: 384 } : row));
+  });
+  return decoys;
+}
+
+// ---------------------------------------------------------------------------------------------
+// A code release between generations
+// ---------------------------------------------------------------------------------------------
+
+export function nextPatchVersion(version) {
+  const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(String(version || ''));
+  if (!match) throw new Error(`cannot bump a non x.y.z version (${version})`);
+  return `${match[1]}.${match[2]}.${Number(match[3]) + 1}`;
+}
+
+/**
+ * Cut a code release in the disposable checkout the way CONTRIBUTING.md's "set version" commit does:
+ * edit the ONE hand-edited number (plugin/.claude-plugin/plugin.json) and let scripts/sync-version.mjs
+ * propagate it (kb/package.json -- a SHIPPED runtime file -- among others). Only the paths this bump
+ * changed are committed; the rehearsal's own scratch edits in the checkout stay uncommitted.
+ */
+export function simulateCodeRelease({ checkoutRoot }) {
+  const git = (args) => {
+    const result = spawnSync('git', args, { cwd: checkoutRoot, encoding: 'utf8' });
+    if (result.status !== 0) throw new Error(`git ${args.join(' ')} failed: ${String(result.stderr).trim().slice(0, 400)}`);
+    return String(result.stdout);
+  };
+  const dirty = () => new Set(git(['status', '--porcelain']).split('\n').filter(Boolean).map((line) => line.slice(3)));
+  const pluginFile = path.join(checkoutRoot, 'plugin', '.claude-plugin', 'plugin.json');
+  const plugin = JSON.parse(fs.readFileSync(pluginFile, 'utf8'));
+  const from = plugin.version;
+  const to = nextPatchVersion(from);
+  const before = dirty();
+  plugin.version = to;
+  fs.writeFileSync(pluginFile, `${JSON.stringify(plugin, null, 2)}\n`);
+  const sync = spawnSync(process.execPath, [path.join(checkoutRoot, 'scripts', 'sync-version.mjs')], { cwd: checkoutRoot, encoding: 'utf8' });
+  if (sync.status !== 0) throw new Error(`sync-version.mjs failed in the disposable checkout: ${String(sync.stderr || sync.stdout).trim().slice(0, 400)}`);
+  const committed = [...dirty()].filter((file) => !before.has(file)).sort();
+  if (!committed.includes('kb/package.json')) throw new Error('the simulated code release did not change kb/package.json, the shipped runtime manifest');
+  git(['add', '--', ...committed]);
+  git(['-c', 'user.email=rehearsal@localhost', '-c', 'user.name=corpus rehearsal', 'commit', '-q', '-m', `chore(release): set version ${to} (rehearsal)`]);
+  return { from, to, head: git(['rev-parse', 'HEAD']).trim(), committed };
+}
+
+// ---------------------------------------------------------------------------------------------
+// The runtime surface, judged against the CHECKOUT
+// ---------------------------------------------------------------------------------------------
+
+/**
+ * A pin built from the checkout's own bytes, for the runtime-shaped rows of a candidate manifest.
+ * build-bundle.mjs copies the kb module graph and kb/package*.json from <checkout>/kb, and
+ * verify-bundle.mjs, the signing key and primer/ from the checkout root or scripts/. A row is pinned
+ * only when a checkout file at one of those places has EXACTLY its bytes; anything else (a file that
+ * could only have come from the seed) stays unpinned, so verifyApprovedRuntime's backward check names
+ * it. Never emitted from the candidate itself, which would pin whatever leaked.
+ */
+export function checkoutRuntimePin({ checkoutRoot, manifest, approvedCodeSha, version, api }) {
+  const traced = [];
+  const untraced = [];
+  for (const row of manifest.files.filter((entry) => api.isRuntimeFile(entry.path))) {
+    const candidates = [path.join('kb', row.path), row.path, path.join('scripts', row.path)];
+    const source = candidates.find((relative) => {
+      const file = path.join(checkoutRoot, relative);
+      return fs.existsSync(file) && fs.statSync(file).isFile() && fs.statSync(file).size === row.bytes && sha256File(file) === row.sha256;
+    });
+    if (source) {
+      const file = path.join(checkoutRoot, source);
+      traced.push({ path: row.path, sha256: sha256File(file), bytes: fs.statSync(file).size, source });
+    } else untraced.push(row.path);
+  }
+  const pin = api.emitApprovedRuntime({
+    manifest: { schemaVersion: 1, kind: 'ruvnet-brain-archive-manifest', version, releaseTag: `v${version}`,
+      files: traced.map(({ path: p, sha256, bytes }) => ({ path: p, sha256, bytes })) },
+    approvedCodeSha,
+  });
+  return { pin, traced: traced.length, untraced };
+}

package/scripts/release.mjs

@@ -60,12 +60,15 @@ const recallNotes = (receipt) => {
       + ` about themselves from their own content; ${r.exactFileTop5}/${r.questions} return the exact`
       + ` labeled file in the top 5 (floor ${r.floor}).`,
     'NOT measured: generated-answer correctness, citation support, or unscoped whole-corpus discovery.',
-    `ADR-086 C3 was NOT met and is NOT claimed — its measurement ships as ${receipt.accuracyReport.file}`
-      + ' for inspection.',
+    `ADR-086 C3 was NOT met and is NOT claimed — its diagnostic measurement (a declared question sample`
+      + ` when its coverage.bounded says so) ships as ${receipt.accuracyReport.file} for inspection.`,
   ];
 };
 import { verifyBundle } from './verify-bundle.mjs';
 import { CORPUS_GENERATION_FIELD, evaluateCorpusPromotion } from './corpus-promotion.mjs';
+import { bindCoverageToReceipt, writeCoverageAssets } from './corpus-coverage-sidecar.mjs';
+import { degradedPublication } from './corpus-store-failure.mjs';
+import { assertNoNewerCorpusGeneration } from './code-release-corpus.mjs';
 
 const ROOT = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
 const PUBLISH = process.argv.includes('--publish');
@@ -114,6 +117,28 @@ function corpusFailure(message) {
   throw new Error(`[corpus-seed] ${message}`);
 }
 
+/**
+ * A newer code release was published after this corpus was built at its approved runtime. Promoting
+ * it now would put an OLDER runtime on releases/latest over a newer live code release (fresh installs
+ * then fail on a version mismatch). That is not a broken night -- the next night builds at the newer
+ * runtime -- so it is a distinct, typed outcome: exit CORPUS_SUPERSEDED_EXIT, recorded as `superseded`.
+ */
+export const CORPUS_SUPERSEDED_EXIT = 4;
+export class CorpusSuperseded extends Error {
+  constructor(message) {
+    super(`[corpus-seed] superseded: ${message}`);
+    this.name = 'CorpusSuperseded';
+    this.code = 'CORPUS_SUPERSEDED';
+  }
+}
+
+const CODE_TAG = /^v(\d+)\.(\d+)\.(\d+)$/;
+const compareCodeTags = (left, right) => {
+  const a = CODE_TAG.exec(left).slice(1).map(Number);
+  const b = CODE_TAG.exec(right).slice(1).map(Number);
+  return Math.sign(a[0] - b[0] || a[1] - b[1] || a[2] - b[2]);
+};
+
 export async function runProtectedCorpusSeed({
   argv = process.argv.slice(2),
   env = process.env,
@@ -135,13 +160,15 @@ export async function runProtectedCorpusSeed({
   const tag = cliArg(argv, '--corpus-tag');
   const bundleFile = cliArg(argv, '--corpus-bundle');
   const receiptFile = cliArg(argv, '--corpus-receipt');
+  // ADR-0091 D6.2: the generation's sealed coverage (the prepared artifact's source-coverage.json).
+  const coverageFile = cliArg(argv, '--corpus-coverage');
   const target = cliArg(argv, '--target');
   const repo = cliArg(argv, '--repo') || env.GITHUB_REPOSITORY;
   const digestMatch = String(tag || '').match(/^corpus-sha256-([a-f0-9]{64})$/);
   if (!digestMatch) corpusFailure('corpus tag must be corpus-sha256- followed by 64 lowercase hex characters');
   if (repo !== env.GITHUB_REPOSITORY || repo !== 'stuinfla/ruvnet-brain') corpusFailure('repository does not match the protected workflow');
 
-  for (const [label, file] of [['bundle', bundleFile], ['receipt', receiptFile]]) {
+  for (const [label, file] of [['bundle', bundleFile], ['receipt', receiptFile], ['coverage', coverageFile]]) {
     if (!file || !path.isAbsolute(file)) corpusFailure(`${label} must be an absolute regular file`);
     try {
       const stat = fs.lstatSync(file);
@@ -164,8 +191,28 @@ export async function runProtectedCorpusSeed({
   } catch (error) {
     corpusFailure(`corpus receipt is unreadable/corrupt (${error.message})`);
   }
-  if (!isHex(target, 40) || target !== head || target !== env.GITHUB_SHA || target !== receipt.builderSourceSha) {
-    corpusFailure('target must exactly equal HEAD, GITHUB_SHA, and the corpus receipt builderSourceSha');
+  // DECOUPLED FROM main HEAD (2026-09-29 nightly redesign). The corpus is built at the APPROVED
+  // runtime -- the newest code release with a verified install aggregate -- whose source is on main's
+  // history but is usually NOT main HEAD. The old rule (target === GITHUB_SHA) stood the nightly down
+  // whenever main was ahead of the newest verified release. The guard that rule was protecting
+  // (independent review of ADR-0091 D3: never promote an OLDER runtime over the live code release)
+  // is now enforced directly: target must be the checkout, the receipt's builder, an ancestor of this
+  // protected run's GITHUB_SHA, and -- for a customer promotion -- the commit of --approved-tag, which
+  // must still be the NEWEST code release at publish time (below; otherwise CorpusSuperseded).
+  // Format checks run first; no value reaches a subprocess unvalidated.
+  if (!isHex(target, 40) || target !== head || target !== receipt.builderSourceSha || !isHex(env.GITHUB_SHA, 40)) {
+    corpusFailure('target must exactly equal HEAD and the corpus receipt builderSourceSha (and GITHUB_SHA must be a commit)');
+  }
+  const ancestry = run('git', ['merge-base', '--is-ancestor', target, env.GITHUB_SHA], {
+    cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  if (ancestry.error || ancestry.status !== 0) corpusFailure(`target ${target} is not an ancestor of this run's GITHUB_SHA ${env.GITHUB_SHA}`);
+  const approvedTag = cliArg(argv, '--approved-tag');
+  if (promoteLatest) {
+    if (!CODE_TAG.test(String(approvedTag || ''))) corpusFailure('customer promotion requires --approved-tag vX.Y.Z (the approved runtime this corpus was built at)');
+    if (receipt.archiveManifestReleaseTag !== approvedTag) {
+      corpusFailure(`the archive ships runtime ${receipt.archiveManifestReleaseTag}, not the approved runtime ${approvedTag}`);
+    }
   }
 
   // Schema 3 (ADR-086 Step 15 / A6): the receipt binds the full provenance closure shipped INSIDE
@@ -210,10 +257,11 @@ export async function runProtectedCorpusSeed({
 
   // ADR-086 Step 15's second binding. The detached accuracy report travels beside the archive; this
   // proves (a) the file the receipt names is the file present here, byte for byte, (b) the report
-  // was measured against THESE archive bytes, (c) every partition in both query modes passed
-  // 20x>=19x with no timeouts and no bounded sampling, and (d) it was produced by the committed
-  // benchmark against the committed oracle — so a swapped oracle or a patched benchmark is caught
-  // here even though the receipt itself carries only {file, sha256, bytes}.
+  // was measured against THESE archive bytes, and (c) it was produced by the committed benchmark
+  // against the committed oracle — so a swapped oracle or a patched benchmark is caught here even
+  // though the receipt itself carries only {file, sha256, bytes}. It does NOT check the score or
+  // coverage completeness: C3 is a diagnostic (ADR-086 amendment 2026-09-15), and the corpus
+  // pipeline measures a declared question sample of it (ADR-0091 D2).
   const accuracyReportFile = `${bundleFile}.accuracy.json`;
   if (receipt.accuracyReport.file !== path.basename(accuracyReportFile)) {
     corpusFailure('corpus receipt names an accuracy report that is not the one beside this archive');
@@ -254,11 +302,16 @@ export async function runProtectedCorpusSeed({
     || fs.statSync(recallReportFile).size !== receipt.recallReport.bytes) {
     corpusFailure('detached repo-recall report bytes do not match the corpus receipt');
   }
+  // ADR-0091 D7.3: a claimed retirement is recomputed from THIS generation's sealed coverage (the bytes
+  // published beside the archive as CORPUS-COVERAGE.json), never taken from the report's own claim.
+  const recallFixture = loadFixture();
   try {
     readRecallReport({
       reportFile: recallReportFile,
       archive: archiveIdentity,
-      expectedFixtureSha256: loadFixture().fixtureSha256,
+      expectedFixtureSha256: recallFixture.fixtureSha256,
+      coverageBytes: fs.readFileSync(coverageFile),
+      fixtureStores: recallFixture.questions.map((question) => question.store),
     });
   } catch (error) {
     corpusFailure(`retrieval does not qualify this corpus for publication (${error.message})`);
@@ -273,12 +326,39 @@ export async function runProtectedCorpusSeed({
   // here. It runs before any `gh` call so an untrue candidate never reaches the network.
   try {
     await verifyCorpusReceipt({
-      receiptFile, bundleFile, accuracyReportFile, recallReportFile, expectedBuilderSha: target, expectedArchiveSha256: archiveSha256,
+      receiptFile, bundleFile, accuracyReportFile, recallReportFile, coverageFile, expectedBuilderSha: target, expectedArchiveSha256: archiveSha256,
     });
   } catch (error) {
     corpusFailure(`corpus receipt does not verify against the sealed archive (${error.message})`);
   }
 
+  // ADR-0091 D6.2 + D10. The archive carries no coverage and the schema-3 receipt binds none, so this
+  // is the one place the publisher can SEE whether the generation is degraded. The coverage must be
+  // the coverage of THIS archive (bound store by store to the receipt), it is published beside the
+  // archive as CORPUS-COVERAGE.json + coverage-receipt.json (no receipt schema bump), and a
+  // generation with any carried or missing store is refused while D10 has recorded no soaked
+  // tolerant-validator transition -- installed clients would reject it. Local, before any network.
+  let coverageAssets;
+  try {
+    coverageAssets = writeCoverageAssets({
+      dir: fs.mkdtempSync(path.join(os.tmpdir(), 'corpus-coverage-assets-')),
+      coverageFile, generationTag: tag, archiveSha256, archiveBytes: archiveIdentity.bytes,
+    });
+    const degraded = bindCoverageToReceipt({
+      coverage: JSON.parse(fs.readFileSync(coverageAssets.coverageFile, 'utf8')), receipt,
+    });
+    if (degraded.carried.length + degraded.missing.length > 0) {
+      const decision = degradedPublication();
+      if (!decision.allowed) {
+        corpusFailure(`degraded generation (${degraded.carried.length} carried, ${degraded.missing.length} missing) `
+          + `must not be published: ${decision.reason}`);
+      }
+    }
+  } catch (error) {
+    if (String(error.message).startsWith('[corpus-seed]')) throw error;
+    corpusFailure(`the generation's sealed coverage does not bind this archive (${error.message})`);
+  }
+
   // EVERY local proof happens before the first network call. `gh` must never be reached by a
   // candidate that is already known to be unpublishable — that is the same discipline the deep
   // verifyCorpusReceipt above follows, and a customer release with an unusable signature is exactly
@@ -300,16 +380,48 @@ export async function runProtectedCorpusSeed({
     if (!Number.isFinite(Date.parse(generation))) corpusFailure('corpus receipt createdAt is not a readable generation timestamp');
   }
 
-  const viewArgs = ['release', 'view', tag, '--json', 'tagName', '--repo', repo];
   const ghCommand = env.RUVNET_GH_COMMAND || 'gh';
   const ghPrefix = env.RUVNET_GH_SCRIPT ? [env.RUVNET_GH_SCRIPT] : [];
-  const view = run(ghCommand, [...ghPrefix, ...viewArgs], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+  const gh = (args) => run(ghCommand, [...ghPrefix, ...args], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+  const ghJson = (args, label) => {
+    const result = gh(args);
+    if (result.error || result.status !== 0) {
+      corpusFailure(`cannot read ${label} (${String(result.error?.message || result.stderr || result.stdout || '').trim() || `gh exited ${result.status}`})`);
+    }
+    try { return JSON.parse(String(result.stdout || 'null')); }
+    catch (error) { corpusFailure(`cannot parse ${label} (${error.message})`); }
+  };
+
+  if (promoteLatest) {
+    // PUBLISH-TIME RE-RESOLVE, before anything is written. Preparation takes hours; a code release
+    // may have been published meanwhile. The newest code release is selected exactly as
+    // scripts/approved-runtime.mjs selects it (non-draft, non-prerelease vX.Y.Z, highest version).
+    // Its signed install aggregate was re-verified for --approved-tag by the workflow step that built
+    // the runtime pin moments ago; what can change after that is only WHICH release is newest.
+    const listed = ghJson(['release', 'list', '--repo', repo, '--limit', '200', '--json', 'tagName,isDraft,isPrerelease'], 'the code release list');
+    const [newest] = (Array.isArray(listed) ? listed : [])
+      .filter((row) => !row?.isDraft && !row?.isPrerelease && CODE_TAG.test(String(row?.tagName || '')))
+      .map((row) => row.tagName).sort((a, b) => compareCodeTags(b, a));
+    if (!newest) corpusFailure(`no published code release is listed on ${repo}; the approved runtime ${approvedTag} cannot be confirmed`);
+    const order = compareCodeTags(newest, approvedTag);
+    if (order > 0) {
+      throw new CorpusSuperseded(`code release ${newest} was published after this corpus was built at ${approvedTag}; `
+        + 'promoting it would put an older runtime over the live code release. The next night builds at the newer runtime.');
+    }
+    if (order < 0) corpusFailure(`approved runtime ${approvedTag} is newer than every published code release (newest ${newest})`);
+    const commit = ghJson(['api', `repos/${repo}/commits/${approvedTag}`], `the commit of ${approvedTag}`);
+    if (String(commit?.sha || '').toLowerCase() !== target) {
+      corpusFailure(`target ${target} is not the source of the approved runtime ${approvedTag} (${commit?.sha || 'unknown'})`);
+    }
+  }
+
+  const viewArgs = ['release', 'view', tag, '--json', 'tagName', '--repo', repo];
+  const view = gh(viewArgs);
   if (!view.error && view.status === 0) corpusFailure(`release ${tag} already exists; refusing to overwrite immutable corpus seed`);
   const viewError = String(view.error?.message || view.stderr || view.stdout || '');
   if (!/(release not found|no release found)/i.test(viewError)) corpusFailure(`cannot prove ${tag} is absent (${viewError.trim() || `gh exited ${view.status}`})`);
 
   const receiptSha256 = sha256File(receiptFile);
-  const gh = (args) => run(ghCommand, [...ghPrefix, ...args], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
 
   if (!promoteLatest) {
     // BOOTSTRAP/RECOVERY seeds stay exactly as ADR-086's original contract left them: an immutable
@@ -337,6 +449,7 @@ export async function runProtectedCorpusSeed({
       '--title', `Immutable corpus seed ${archiveSha256.slice(0, 16)}`,
       '--notes', notes,
       bundleFile, receiptFile, accuracyReportFile, recallReportFile,
+      coverageAssets.coverageFile, coverageAssets.receiptFile,
     ];
     const create = gh(createArgs);
     if (create.error || create.status !== 0) {
@@ -388,7 +501,8 @@ export async function runProtectedCorpusSeed({
   // (or the next night's dispatcher) that downloads the archive must be able to reverify it against
   // the identity it was actually measured under — the blocking recall gate AND the C3 diagnostic it
   // scored 59.0% on, so nobody has to take either number on trust.
-  const assetFiles = [bundleFile, signatureFile, digestFile, receiptFile, accuracyReportFile, recallReportFile];
+  const assetFiles = [bundleFile, signatureFile, digestFile, receiptFile, accuracyReportFile, recallReportFile,
+    coverageAssets.coverageFile, coverageAssets.receiptFile];
   const create = gh([
     'release', 'create', tag,
     '--draft',
@@ -418,13 +532,22 @@ export async function runProtectedCorpusSeed({
     corpusFailure(`corpus promotion to latest failed (${String(promote.error?.message || promote.stderr || promote.stdout || '').trim()})`);
   }
 
-  const finalView = gh(['release', 'view', tag, '--json', 'tagName,isDraft,isLatest,isPrerelease,assets', '--repo', repo]);
+  // `isLatest` is NOT a `gh release view` field (gh 2.101.0: "Unknown JSON field"; it exists only on
+  // `gh release list`), so asking for it made this confirmation fail against the real CLI every time.
+  // Latest-ness is read from the one authoritative endpoint instead: releases/latest must BE this tag.
+  // tests/unit/gh-json-fields.test.mjs checks every --json field list against the captured real CLI.
+  const finalView = gh(['release', 'view', tag, '--json', 'tagName,isDraft,isPrerelease,assets', '--repo', repo]);
   if (finalView.error || finalView.status !== 0) corpusFailure('cannot confirm the promoted corpus release');
   let promoted;
   try { promoted = JSON.parse(String(finalView.stdout || 'null')); }
   catch (error) { corpusFailure(`cannot read the promoted corpus release (${error.message})`); }
+  const latestNow = gh(['api', `repos/${repo}/releases/latest`]);
+  let latestTag = null;
+  if (!latestNow.error && latestNow.status === 0) {
+    try { latestTag = JSON.parse(String(latestNow.stdout || 'null'))?.tag_name ?? null; } catch { latestTag = null; }
+  }
   const promotedAssets = (promoted?.assets || []).map((asset) => asset?.name).sort();
-  if (promoted?.tagName !== tag || promoted.isDraft !== false || promoted.isLatest !== true
+  if (promoted?.tagName !== tag || promoted.isDraft !== false || latestTag !== tag
     || promoted.isPrerelease !== false || JSON.stringify(promotedAssets) !== JSON.stringify(expectedAssets)) {
     corpusFailure('corpus release did not reach a complete, non-draft, non-prerelease latest state');
   }
@@ -441,7 +564,13 @@ if (CORPUS_SEED) {
     console.log(JSON.stringify({ ok: true, mode: 'corpus-seed', ...result }, null, 2));
   } catch (error) {
     console.error(error.message);
-    process.exitCode = 1;
+    if (error instanceof CorpusSuperseded) {
+      // Typed, not red: stdout carries the outcome the workflow records.
+      console.log(JSON.stringify({ ok: false, mode: 'corpus-seed', outcome: 'superseded', reason: error.message }));
+      process.exitCode = CORPUS_SUPERSEDED_EXIT;
+    } else {
+      process.exitCode = 1;
+    }
   }
 } else {
 
@@ -549,6 +678,22 @@ if (PUBLISH) {
       process.exit(1);
     }
   }
+  // ADR-0091 D6.6 — THE BACKWARD-MOVE RACE. Release QE sealed the corpus generation this bundle was
+  // built from; publication happens later, after owner approval. Clients always accept a code release
+  // and drop their corpusGeneration marker when they install one (kb/forge-update.mjs), so publishing
+  // a bundle built from generation G after G+1 already shipped rolls every user back one night.
+  // Re-resolve with the SAME resolver, before any asset upload, and refuse on any difference -- or on
+  // any answer that could not prove there is no newer generation.
+  try {
+    const guard = await assertNoNewerCorpusGeneration({
+      sealedFile: assets.corpusSeedPath, repo: 'stuinfla/ruvnet-brain', runtimeRoot: ROOT,
+    });
+    console.log(`  corpus seed still current at publish time: ${guard.origin} ${guard.tag}`);
+  } catch (error) {
+    console.error(`\n${c.r('✗ GATE FAILED: corpus generation moved after release QE')} ${c.dim(error.message)}`);
+    console.error(`${c.r('  NOT shipped. Re-run release QE so this release is built from the newest generation.')}\n`);
+    process.exit(1);
+  }
   const bundleSha256 = fs.readFileSync(assets.bundleDigestPath, 'utf8').trim().split(/\s+/)[0];
   if (!/^[a-f0-9]{64}$/i.test(bundleSha256)) {
     console.error(`\n${c.r('✗ GATE FAILED: release digest is not a SHA-256 value')}`);