ruvnet-brain 4.3.35 → 4.3.36

package/README.md

@@ -7,7 +7,7 @@ Created: 2026-06-29 22:36:38 EDT
 
 # 🧠 RuvNet Brain
 
-### 🧠 RuvNet Brain — [![RuvNet Brain version 4.3.35 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.3.35-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
+### 🧠 RuvNet Brain — [![RuvNet Brain version 4.3.36 — updated 2026-07-30 03:24 EDT](https://img.shields.io/badge/version_4.3.36-updated_2026--07--30_03:24_EDT-1E90FF?style=for-the-badge&labelColor=0757BA)](https://github.com/stuinfla/ruvnet-brain/blob/main/plugin/.claude-plugin/plugin.json)
 
 **A portable, source-grounded brain over Reuven Cohen's (rUv's) RuvNet stack — delivered as a Claude Code plugin that makes Claude _use_ the stack instead of fighting it.**
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.3.35",
+  "version": "4.3.36",
   "description": "One-command installer for RuvNet Brain \u2014 a portable, source-grounded brain over rUv's RuvNet building blocks, delivered as a Claude Code plugin so Claude uses the stack instead of fighting it.",
   "type": "module",
   "bin": {

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ruvnet-brain",
   "description": "RuvNet brain transplant for Claude Code — grounds every RuvNet decision in real source across 77 rUv repositories, prefers Ruflo / RuVector-RVF / AgentDB over training-prior defaults (pgvector, Pinecone, hand-rolled cosine), and can pull in any RuvNet repo on demand. Ships a UserPromptSubmit retrieve-and-inject grounding hook and a PreToolUse write gate that refuses ungrounded rUv-product code until search_ruvnet has been consulted (ADR-0012 / ADR-067).",
-  "version": "4.3.35",
+  "version": "4.3.36",
   "author": {
     "name": "Stuart Kerr"
   },

package/plugin/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "ruvnet-brain",
-  "version": "4.3.35",
+  "version": "4.3.36",
   "description": "Source-grounded RuvNet knowledge, lifecycle enforcement, and learning for Codex.",
   "author": {
     "name": "Stuart Kerr"

package/plugin/scripts/coverage-integrity.mjs

@@ -225,6 +225,41 @@ export function generationLedgerBytes(ledger) {
   return Buffer.from(`${JSON.stringify(ledger, null, 2)}\n`);
 }
 
+const isIsoOrNull = (value) => value === null || (typeof value === 'string' && Number.isFinite(Date.parse(value)));
+const isAttemptCount = (value) => Number.isSafeInteger(value) && value >= 1;
+
+/**
+ * ADR-0091 D5: how an ELIGIBLE repository row stands in a bundle. It returns
+ *   'shipped' — the store's bytes ship: CURRENT, or STALE with a verified `carry` record (the refresh
+ *               failed and the previous generation's bytes, re-hashed against the ledger, were kept);
+ *   'absent'  — MISSING with a `failure` record: a store that failed with no prior bytes, excluded
+ *               from the repository store set;
+ *   null      — anything else. A STALE/MISSING row WITHOUT its record, FAILED and UNVERIFIED stay
+ *               rejected, exactly as before.
+ * The status token is never new: the distinction lives in the object (0.1.0's STALE_CARRIED and
+ * PENDING_FAILED were withdrawn).
+ */
+export function eligibleRepositoryStanding(row) {
+  const status = row?.status;
+  const { carry, failure } = row || {};
+  if (status === 'CURRENT') return carry === undefined && failure === undefined ? 'shipped' : null;
+  if (status === 'STALE' && carry && typeof carry === 'object' && failure === undefined) {
+    const carried = String(carry.carriedSourceCommit || '').toLowerCase();
+    const shipped = typeof carry.reason === 'string' && carry.reason.length > 0
+      && HEX40.test(carried) && carried === String(row.artifact?.sourceCommit || '').toLowerCase()
+      && HEX40.test(String(carry.missedUpstream || '').toLowerCase())
+      && String(carry.missedUpstream).toLowerCase() === String(row.upstream?.sha || '').toLowerCase()
+      && carried !== String(carry.missedUpstream).toLowerCase()
+      && isAttemptCount(carry.attempts) && isIsoOrNull(carry.carriedCommittedAt)
+      && row.artifact?.bytesVerified === true && row.artifact?.passagesPresent === true;
+    return shipped ? 'shipped' : null;
+  }
+  if (status === 'MISSING' && failure && typeof failure === 'object' && carry === undefined) {
+    return typeof failure.reason === 'string' && failure.reason.length > 0 && isAttemptCount(failure.attempts) ? 'absent' : null;
+  }
+  return null;
+}
+
 export function validatePublicInventory({ assetsDir, coverage, ledger, installedPublicStores = null, gistReceipt = null }) {
   const root = path.resolve(assetsDir);
   const selected = installedPublicStores === null ? null : [...installedPublicStores].map((store) => String(store).toLowerCase());
@@ -248,11 +283,23 @@ export function validatePublicInventory({ assetsDir, coverage, ledger, installed
     if (stores.some((store) => !store) || new Set(stores).size !== stores.length) throw new Error(`${family} stores are missing or duplicated`);
     return stores.sort();
   };
-  const repos = coverage.rows.filter((row) => row.kind === 'repository' && row.disposition === 'eligible');
-  if (repos.some((row) => row.status !== 'CURRENT')) throw new Error('an eligible repository is not CURRENT');
+  const eligibleRepos = coverage.rows.filter((row) => row.kind === 'repository' && row.disposition === 'eligible');
+  const rejected = eligibleRepos.find((row) => eligibleRepositoryStanding(row) === null);
+  if (rejected) {
+    throw new Error(`an eligible repository is not CURRENT (${rejected.artifact?.store || rejected.name}: ${rejected.status} `
+      + 'without a verified carry/failure record)');
+  }
+  const repos = eligibleRepos.filter((row) => eligibleRepositoryStanding(row) === 'shipped');
   const repositories = uniqueStores(repos, 'repository');
+  // A MISSING-with-failure store ships no bytes: it is in neither the repository set nor the excluded
+  // set, so a stray file under its name still fails below as an unclassified public store.
+  const absentRepositories = uniqueStores(eligibleRepos.filter((row) => eligibleRepositoryStanding(row) === 'absent'),
+    'absent repository');
   const excludedRepositories = uniqueStores(coverage.rows.filter((row) => row.kind === 'repository'
     && row.disposition !== 'eligible'), 'excluded repository');
+  if (absentRepositories.some((store) => repositories.includes(store) || excludedRepositories.includes(store))) {
+    throw new Error('an absent repository store is also shipped or excluded');
+  }
   const excludedSet = new Set(excludedRepositories);
   if (repositories.some((store) => excludedSet.has(store))) throw new Error('eligible and excluded repository stores overlap');
   const gists = coverage.rows.filter((row) => row.kind === 'gist' && row.disposition === 'eligible');
@@ -339,6 +386,15 @@ export function validatePublicInventory({ assetsDir, coverage, ledger, installed
       throw new Error(`${store} generation record provenance is incomplete`);
     }
   }
+  // A carried store ships the PREVIOUS generation's bytes: the ledger must name exactly the commit
+  // the carry record says was kept, or the row describes bytes this bundle does not carry.
+  for (const row of repos) {
+    if (!row.carry) continue;
+    const store = String(row.artifact.store).toLowerCase();
+    if (String(ledger.stores[store]?.sourceCommit || '').toLowerCase() !== String(row.carry.carriedSourceCommit).toLowerCase()) {
+      throw new Error(`${store} carry record names a source commit the generation ledger does not carry`);
+    }
+  }
   const publicStores = expected;
   evidenceFiles.sort((a, b) => a.path.localeCompare(b.path) || a.kind.localeCompare(b.kind));
   return { repositories, excludedRepositories, gistAggregate, derived, publicStores,

package/scripts/build-bundle.mjs

@@ -62,11 +62,13 @@ import { validatePublicInventory } from './public-inventory.mjs';
 import { bindAssembledReleaseProjection, createReleaseProjection } from './release-projection.mjs';
 import { materializePublicInputs, SELECTION_FILE, validateSelectionReceipt } from './public-inputs.mjs';
 import { isPrivate, loadPrivateSlugs, shouldFenceL2 } from './private-fence.mjs';
-import { validateCoverageLedger } from './coverage-integrity.mjs';
+import { eligibleRepositoryStanding, validateCoverageLedger } from './coverage-integrity.mjs';
 // The org total is DERIVED, never a literal: it was hardcoded 248 in this file and in its
 // sibling while the account actually had 200 — one stale fact, restated twice (2026-08-12).
 import { orgRepoCount } from './org-repo-count.mjs';
 import { assertCapabilityOnlyStore } from '../kb/capability-only.mjs';
+import { CURRENCY_BASIS, corpusCurrencyBlock } from './corpus-currency.mjs';
+import { loadFixture } from './oracle/repo-recall.mjs';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -566,6 +568,8 @@ async function assembleBundleImpl({ corpusDir, runtimeRoot, outDir, identity = {
   // and is never rewritten here, so they are declared to validateSelectedRvfGenerations as explicitly
   // EXCLUDED rather than left looking like unexplained extra generation records.
   const legacyExcluded = [];
+  // The bootstrap tag the legacy pass-2 projection was produced from (manifest.corpus.generationTag).
+  let legacySeedTag = null;
   // LEGACY SEED pass 2 (retires at plan step 11): the externally-produced release projection is the
   // selection authority for this mode, exactly as it was before the step-5 consolidation. Scope the
   // discovered set to the stores that projection actually bound, so the assembled tree and
@@ -597,6 +601,7 @@ async function assembleBundleImpl({ corpusDir, runtimeRoot, outDir, identity = {
     if (legacyCoverage?.kind !== 'ruvnet-brain-release-coverage' || !Array.isArray(legacyCoverage.rows)) {
       fail('legacy release projection coverage is not a ruvnet-brain-release-coverage ledger');
     }
+    legacySeedTag = typeof legacyCoverage.corpusSeed?.tag === 'string' ? legacyCoverage.corpusSeed.tag : null;
     const projectedClasses = path.join(path.resolve(legacySeedProjection.projectionDir), 'public-store-classes.json');
     const projectedDerived = fs.existsSync(projectedClasses)
       ? (JSON.parse(fs.readFileSync(projectedClasses, 'utf8')).derived || []).map((e) => String(e?.store || '').toLowerCase())
@@ -672,6 +677,11 @@ async function assembleBundleImpl({ corpusDir, runtimeRoot, outDir, identity = {
     // validatePublicInventory has already bound that ledger to the bytes on disk.
     for (const row of corpusCoverage.rows) {
       if (row.disposition !== 'eligible') continue;
+      // ADR-0091 D5: a MISSING row with a `failure` record ships no store at all (validatePublicInventory
+      // already proved no bytes exist under its name), so there is no ledger generation to bind. A
+      // STALE row with a `carry` record binds below exactly like a CURRENT one: its artifact digest and
+      // source generation ARE the carried bytes this ledger carries.
+      if (row.kind === 'repository' && eligibleRepositoryStanding(row) === 'absent') continue;
       const store = String(row.artifact?.store || '');
       const generation = ledgerIn.stores?.[store]
         || Object.entries(ledgerIn.stores || {}).find(([key]) => key.toLowerCase() === store.toLowerCase())?.[1];
@@ -886,10 +896,26 @@ async function assembleBundleImpl({ corpusDir, runtimeRoot, outDir, identity = {
   // sealed bytes never depends on, or varies with, network availability.
   const ORG = orgRepoCount({ fetch: () => null });
   const hasConcepts = selectedResults.some((r) => r.kind === 'derived' && r.name.toLowerCase() === 'concepts');
+  // ADR-0091 D7.1: `generated` is the ASSEMBLY time and must never be read as freshness. `corpus` says
+  // what is actually known about content currency, from the sealed coverage this archive was bound to
+  // above (null fields where nothing was observed -- never estimated). See scripts/corpus-currency.mjs.
+  const fixtureFile = path.join(dataDir, 'retrieval-query-evidence.json');
+  let fixtureStores = null;
+  if (corpusCoverage && fs.existsSync(fixtureFile)) {
+    try { fixtureStores = loadFixture(fixtureFile).questions.map((question) => question.store); }
+    catch (error) { fail(`frozen retrieval fixture is unreadable (${error.message})`); }
+  }
+  const corpusCurrency = corpusCurrencyBlock({
+    coverage: corpusCoverage,
+    basis: corpusCoverage ? CURRENCY_BASIS.SEALED : legacySeed ? CURRENCY_BASIS.LEGACY : CURRENCY_BASIS.NONE,
+    generationTag: seedIdentity?.tag ?? legacySeedTag,
+    fixtureStores,
+  });
   const manifest = {
     brainVersion: version, // FIELD = bare literal; versionTag stays the v-prefixed Release tag
     generated: now.toISOString(),
     generatedHuman: now.toUTCString(),
+    corpus: corpusCurrency,
     coverage: { built: manifestEntries.length, catalogued: regFlat.length, orgTotalApprox: ORG.count, orgTotalSource: ORG.source, orgTotalAt: ORG.at, pending: pendingRepos.length },
     crossRepoTool: { mcp: 'forge-mcp-all.mjs', cli: 'forge-ask-all.mjs', tool: 'search_ruvnet' },
     conceptsStore: hasConcepts ? { store: 'concepts.big.rvf', note: 'L2 synthesis + per-repo primers embedded as prose; unioned by search_ruvnet so code-implemented capabilities are retrievable as high-confidence prose.' } : null,

package/scripts/code-release-corpus.mjs

@@ -0,0 +1,276 @@
+#!/usr/bin/env node
+// scripts/code-release-corpus.mjs — ADR-0091 D6: a code release is built from the newest compatible
+// corpus generation, through one of TWO assembly paths chosen by where the seed came from.
+//
+//   seed origin                      path               what runs
+//   -------------------------------  -----------------  ---------------------------------------------
+//   published-generation             single-pass        observe-baseline, ONE build-bundle with the
+//   (corpus-sha256-<digest>, with                       generation's sealed coverage. The generation's
+//   its D6.2 coverage sidecar)                          bytes are NEVER mutated: no capability-only
+//                                                       refresh, no index repair. Proven afterwards.
+//   committed-bootstrap (v4.3.26,    legacy-two-pass    exactly the pre-D6 ci.yml sequence: capability-
+//   pre-ADR-0091 Step 4)                                only refresh + index repair, observe-baseline,
+//                                                       build / release-projection / build.
+//
+// This is a genuine dual path, not one path with a flag to retire: the bootstrap remains the recovery
+// seed (ADR-0091 D6.1), and it predates every sealed-input contract the single-pass assembly checks.
+// Running refreshCapabilityOnlyStore on a sealed generation would rewrite one store and prune another
+// AFTER the generation's coverage measured them, so the coverage would describe bytes the release
+// does not ship. The path choice lives in ONE function (assemblyPathFor) so a test can prove neither
+// collapses into the other.
+//
+// It also owns the D6.6 publish-time guard (assertNoNewerCorpusGeneration), because it is the same
+// resolver question asked a second time.
+//
+// Usage (ci.yml release-qe, after downloading and extracting the resolved seed):
+//   node scripts/code-release-corpus.mjs assemble --descriptor <release-evidence/corpus-seed.json>
+//        --seed-bundle <seed zip> --assets <extracted seed dir> --evidence-dir <release-evidence>
+//        [--coverage <CORPUS-COVERAGE.json> --coverage-receipt <coverage-receipt.json>]   (single-pass only)
+
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { verifyCoverageSidecar } from './corpus-coverage-sidecar.mjs';
+import { resolveNextCorpusSeed } from './corpus-next-seed.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const CORPUS_TAG = /^corpus-sha256-([0-9a-f]{64})$/;
+const HEX64 = /^[0-9a-f]{64}$/;
+export const SINGLE_PASS = 'single-pass';
+export const LEGACY_TWO_PASS = 'legacy-two-pass';
+// The seed reader modules the legacy capability-only refresh embeds with -- the exact pins the pre-D6
+// ci.yml step installed (npm package @ruvector/rvf 0.3.4: ruvector/npm/packages/rvf/package.json).
+const LEGACY_READER_PACKAGES = ['@xenova/transformers@2.17.2', '@ruvector/rvf@0.3.4'];
+// Every file of a store family build-bundle copies from the corpus (build-bundle.mjs step 3).
+const STORE_SUFFIXES = ['.big.rvf', '.big.rvf.idmap.json', '.big.rvf.embed.json', '.passages.jsonl', '.meta.json',
+  '.symbols.json', '.sources.json'];
+
+function fail(message) {
+  throw new Error(`[code-release-corpus] ${message}`);
+}
+
+function sha256File(file) {
+  const hash = crypto.createHash('sha256');
+  const fd = fs.openSync(file, 'r');
+  const buffer = Buffer.allocUnsafe(1024 * 1024);
+  try {
+    let bytes;
+    while ((bytes = fs.readSync(fd, buffer, 0, buffer.length, null)) > 0) hash.update(buffer.subarray(0, bytes));
+  } finally { fs.closeSync(fd); }
+  return hash.digest('hex');
+}
+
+/** The ONE place the path is chosen. Anything that is neither shape is refused, never defaulted. */
+export function assemblyPathFor(descriptor) {
+  if (descriptor?.origin === 'published-generation') {
+    const match = CORPUS_TAG.exec(String(descriptor.tag || ''));
+    if (!match || match[1] !== descriptor.sha256) fail(`generation seed tag ${descriptor.tag} does not name its own digest`);
+    if (!descriptor.coverage || !HEX64.test(String(descriptor.coverage.sha256 || ''))) {
+      fail(`generation seed ${descriptor.tag} was resolved without its coverage sidecar; resolve with --require-coverage`);
+    }
+    return SINGLE_PASS;
+  }
+  if (descriptor?.origin === 'committed-bootstrap') {
+    if (CORPUS_TAG.test(String(descriptor.tag || ''))) fail('a committed bootstrap seed must be the pinned pre-ADR-0091 tag, not a generation tag');
+    return LEGACY_TWO_PASS;
+  }
+  fail(`resolved seed has no recognised origin (${JSON.stringify(descriptor?.origin ?? null)}); `
+    + 'it must come from scripts/corpus-next-seed.mjs');
+}
+
+/** Digest of every regular file under `dir` -- the "was the sealed generation touched?" proof. */
+export function treeDigest(dir) {
+  const rows = [];
+  const walk = (current, prefix) => {
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+      const file = path.join(current, entry.name);
+      if (entry.isDirectory()) walk(file, relative);
+      else if (entry.isFile()) rows.push(`${relative}\0${sha256File(file)}`);
+    }
+  };
+  walk(path.resolve(dir), '');
+  rows.sort();
+  return { files: rows.length, sha256: crypto.createHash('sha256').update(rows.join('\n')).digest('hex') };
+}
+
+/**
+ * ADR-0091 V6a: the assembled archive ships the generation's store bytes, unchanged. The store set
+ * must equal the generation's ledger, and every store-family file in the assembly must be
+ * byte-identical to the generation's copy.
+ */
+export function assertStoresUnmutated({ seedDir, bundleDir }) {
+  const readLedger = (dir) => JSON.parse(fs.readFileSync(path.join(dir, 'RVF-GENERATIONS.json'), 'utf8'));
+  const seedStores = Object.keys(readLedger(seedDir).stores || {}).map((name) => name.toLowerCase()).sort();
+  const bundleStores = Object.keys(readLedger(bundleDir).stores || {}).sort();
+  if (JSON.stringify(bundleStores.map((name) => name.toLowerCase())) !== JSON.stringify(seedStores)) {
+    fail(`assembled store set differs from the generation's (${bundleStores.length} vs ${seedStores.length})`);
+  }
+  let compared = 0;
+  const changed = [];
+  for (const store of bundleStores) {
+    for (const suffix of STORE_SUFFIXES) {
+      const shipped = path.join(bundleDir, `${store}${suffix}`);
+      if (!fs.existsSync(shipped)) continue;
+      const sealed = path.join(seedDir, `${store}${suffix}`);
+      if (!fs.existsSync(sealed) || sha256File(sealed) !== sha256File(shipped)) changed.push(`${store}${suffix}`);
+      compared += 1;
+    }
+  }
+  if (changed.length) fail(`assembly changed ${changed.length} store file(s) the generation sealed: ${changed.slice(0, 5).join(', ')}`);
+  return { stores: bundleStores.length, files: compared };
+}
+
+const defaultRun = (command, args, options = {}) => spawnSync(command, args, { stdio: 'inherit', ...options });
+
+function checkedRun(run, label, command, args, options) {
+  const result = run(command, args, options) || {};
+  if (result.error || result.status !== 0) {
+    fail(`${label} failed (${result.error?.message || `exit ${result.status}`})`);
+  }
+  return result;
+}
+
+/**
+ * Assemble the release bundle into <root>/dist from the resolved seed. `run` is the process seam: the
+ * tests record it to prove which commands each path runs, and in which order.
+ */
+export function assembleCodeReleaseCorpus({
+  root = ROOT, descriptor, seedBundle, assetsDir, evidenceDir, coverageFile = null, coverageReceiptFile = null,
+  run = defaultRun, env = process.env,
+} = {}) {
+  const mode = assemblyPathFor(descriptor);
+  const node = process.execPath;
+  const script = (name) => path.join(root, 'scripts', name);
+  const version = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version;
+  const assets = path.resolve(assetsDir || '');
+  const evidence = path.resolve(evidenceDir || '');
+  const baselineReceipt = path.join(evidence, 'baseline-observation-receipt.json');
+  const observeBaseline = () => {
+    checkedRun(run, 'observe-baseline', node, [script('public-verification-inputs.mjs'), 'observe-baseline',
+      '--baseline-bundle', seedBundle, '--expected-tag', descriptor.tag, '--expected-sha256', descriptor.sha256,
+      '--expected-bytes', String(descriptor.bytes), '--out', baselineReceipt], { cwd: root, env });
+    return sha256File(baselineReceipt);
+  };
+
+  if (mode === LEGACY_TWO_PASS) {
+    // The pre-D6 ci.yml sequence, unchanged. The public ruOS input is capabilities-only and the
+    // bootstrap predates that policy, so its RVF is rebuilt from the curated summary; --repair also
+    // re-seals stale ledger hashes after index persistence (the v4.2.1 seed exposed three roots whose
+    // HNSW bytes advanced after their ledger rows were written).
+    checkedRun(run, 'install seed reader dependencies', 'npm', ['install', '--prefix', assets, '--no-save',
+      '--package-lock=false', '--ignore-scripts', ...LEGACY_READER_PACKAGES], { cwd: root, env });
+    const embedEnv = { ...env, XENOVA_PATH: path.join(assets, 'node_modules', '@xenova', 'transformers'),
+      RVF_MODULE_PATH: path.join(assets, 'node_modules') };
+    checkedRun(run, 'capability-only refresh', node, [script('refresh-capability-only-store.mjs'), '--assets', assets],
+      { cwd: root, env: embedEnv });
+    checkedRun(run, 'index repair', node, [script('rvf-index-audit.mjs'), '--dir', assets, '--repair'], { cwd: root, env: embedEnv });
+    const baselineSha256 = observeBaseline();
+    const build = ['--version', `v${version}`, '--assets', assets, '--legacy-seed-projection'];
+    checkedRun(run, 'legacy build pass 1', node, [script('build-bundle.mjs'), ...build], { cwd: root, env });
+    const projection = path.join(path.dirname(evidence), 'release-projection');
+    checkedRun(run, 'release projection', node, [script('release-projection.mjs'), '--corpus', 'data/source-coverage.json',
+      '--assets', 'dist/ruvnet-brain', '--out', projection, '--version', version,
+      '--source-snapshot', env.GITHUB_SHA || '', '--baseline-receipt-sha256', baselineSha256,
+      '--seed-tag', descriptor.tag, '--seed-sha256', descriptor.sha256, '--seed-bytes', String(descriptor.bytes)], { cwd: root, env });
+    checkedRun(run, 'legacy build pass 2', node, [script('build-bundle.mjs'), ...build,
+      '--coverage', path.join(projection, 'COVERAGE.json'), '--projection', projection], { cwd: root, env });
+    return { mode };
+  }
+
+  // SINGLE-PASS. The coverage file must be the one the resolver bound to this generation.
+  const coverageBytes = fs.readFileSync(path.resolve(coverageFile || ''));
+  const verified = verifyCoverageSidecar({ sidecar: JSON.parse(fs.readFileSync(path.resolve(coverageReceiptFile || ''), 'utf8')),
+    coverageBytes, generationTag: descriptor.tag, archiveSha256: descriptor.sha256, archiveBytes: descriptor.bytes });
+  if (crypto.createHash('sha256').update(coverageBytes).digest('hex') !== descriptor.coverage.sha256) {
+    fail('the downloaded coverage is not the coverage the resolver sealed into the descriptor');
+  }
+  if (verified.degraded.carried.length || verified.degraded.missing.length) {
+    fail(`generation ${descriptor.tag} is degraded (${verified.degraded.carried.length} carried, `
+      + `${verified.degraded.missing.length} missing); a code release does not ship one (ADR-0091 D10)`);
+  }
+  const before = treeDigest(assets);
+  // build-bundle reads the sealed coverage from the ONE canonical path (<root>/data/source-coverage.json),
+  // exactly as prepareCorpusCandidate does. The committed file is restored afterwards so no later
+  // release-QE step reads the generation's coverage believing it is the checkout's.
+  const canonical = path.join(root, 'data', 'source-coverage.json');
+  const committed = fs.existsSync(canonical) ? fs.readFileSync(canonical) : null;
+  try {
+    fs.writeFileSync(canonical, coverageBytes);
+    const baselineSha256 = observeBaseline();
+    checkedRun(run, 'single-pass build', node, [script('build-bundle.mjs'), '--version', `v${version}`, '--assets', assets,
+      '--coverage', canonical, '--seed-tag', descriptor.tag, '--seed-sha256', descriptor.sha256,
+      '--seed-bytes', String(descriptor.bytes), '--baseline-receipt-sha256', baselineSha256], { cwd: root, env });
+  } finally {
+    if (committed === null) fs.rmSync(canonical, { force: true });
+    else fs.writeFileSync(canonical, committed);
+  }
+  const after = treeDigest(assets);
+  if (after.sha256 !== before.sha256) fail(`the sealed generation directory was modified during assembly (${before.files} -> ${after.files} files)`);
+  const unmutated = assertStoresUnmutated({ seedDir: assets, bundleDir: path.join(root, 'dist', 'ruvnet-brain') });
+  return { mode, seedTree: before, unmutated };
+}
+
+/**
+ * ADR-0091 D6.6. `sealed` is the descriptor release QE sealed into the payload; `resolution` is a fresh
+ * resolveNextCorpusSeed({ requireCoverage: true }) answer. Refuses on any difference, and on any
+ * resolution that could not prove there is nothing newer (a failed list, view or small download).
+ */
+export function checkNoNewerCorpusGeneration({ sealed, resolution }) {
+  if (!sealed?.origin || !sealed?.tag || !HEX64.test(String(sealed.sha256 || ''))) {
+    fail('the sealed corpus seed descriptor carries no resolver origin/tag/sha256; it did not come from corpus-next-seed.mjs');
+  }
+  const indeterminate = (resolution?.rejected || []).filter((row) => row.indeterminate);
+  if (indeterminate.length) {
+    fail(`cannot prove no newer corpus generation was published (${indeterminate.map((row) => `${row.tag || '(list)'}: ${row.reason}`).join('; ')})`);
+  }
+  const now = resolution?.seed;
+  if (now?.tag !== sealed.tag || now?.sha256 !== sealed.sha256) {
+    fail(`corpus generation ${now?.tag} published after this release was QE'd from ${sealed.tag}; re-run release QE`);
+  }
+  return { origin: sealed.origin, tag: sealed.tag };
+}
+
+export async function assertNoNewerCorpusGeneration({ sealedFile, repo, runtimeRoot = ROOT, run = undefined,
+  resolve = resolveNextCorpusSeed } = {}) {
+  const sealed = JSON.parse(fs.readFileSync(sealedFile, 'utf8'));
+  const resolution = await resolve({ repo, root: runtimeRoot, runtimeRoot, requireCoverage: true, ...(run ? { run } : {}) });
+  return checkNoNewerCorpusGeneration({ sealed, resolution });
+}
+
+const arg = (argv, name) => {
+  const index = argv.indexOf(name);
+  return index >= 0 ? argv[index + 1] : null;
+};
+
+export function main(argv = process.argv.slice(2)) {
+  if (argv[0] !== 'assemble') {
+    process.stderr.write('usage: code-release-corpus.mjs assemble --descriptor <f> --seed-bundle <f> --assets <d> --evidence-dir <d> [--coverage <f> --coverage-receipt <f>]\n');
+    return 2;
+  }
+  const descriptor = JSON.parse(fs.readFileSync(arg(argv, '--descriptor'), 'utf8'));
+  const result = assembleCodeReleaseCorpus({
+    descriptor,
+    seedBundle: arg(argv, '--seed-bundle'),
+    assetsDir: arg(argv, '--assets'),
+    evidenceDir: arg(argv, '--evidence-dir'),
+    coverageFile: arg(argv, '--coverage'),
+    coverageReceiptFile: arg(argv, '--coverage-receipt'),
+  });
+  process.stdout.write(`${JSON.stringify({ ok: true, seed: descriptor.tag, ...result })}\n`);
+  return 0;
+}
+
+function isMain() {
+  try {
+    return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+}
+
+if (isMain()) {
+  try { process.exitCode = main(); } catch (error) { console.error(error.message); process.exitCode = 1; }
+}

package/scripts/corpus-candidate.mjs

@@ -124,7 +124,7 @@ function normalizeBootstrapIdentity(bootstrapIdentity) {
 // from bundleFile, or is one of the three inputs that are not archive-derived (builderSourceSha,
 // bootstrapIdentity, createdAt) — verification supplies those from the receipt being checked, so a
 // receipt can never claim archive contents that were not really shipped.
-async function deriveCorpusCandidate({ bundleFile, builderSourceSha, bootstrapIdentity, createdAt, accuracyReportFile, recallReportFile }) {
+async function deriveCorpusCandidate({ bundleFile, builderSourceSha, bootstrapIdentity, createdAt, accuracyReportFile, recallReportFile, coverageFile = null }) {
   const bundle = path.resolve(bundleFile || '');
   if (!fs.existsSync(bundle) || !fs.statSync(bundle).isFile()) fail(`bundle missing (${bundle || 'no path supplied'})`);
   if (!HEX_SOURCE.test(builderSourceSha || '')) fail('builderSourceSha must be a 40-64 hex source identity');
@@ -145,10 +145,16 @@ async function deriveCorpusCandidate({ bundleFile, builderSourceSha, bootstrapId
   // a DECLARED REDUCTION in release requirements, not a demonstration that C3 passed — so the C3
   // report is still required to exist and still bound to these exact archive bytes, and is published
   // alongside rather than quietly dropped.
+  // ADR-0091 D7.3: a report that claims retired questions is only accepted against this candidate's
+  // sealed coverage (the archive carries none, and the schema-3 receipt binds none), recomputed here
+  // from those bytes. With no coverage supplied, any claimed retirement is rejected.
+  const fixture = loadFixture();
   const recall = readRecallReport({
     reportFile: recallReportFile || `${bundle}.recall.json`,
     archive,
-    expectedFixtureSha256: loadFixture().fixtureSha256,
+    expectedFixtureSha256: fixture.fixtureSha256,
+    coverageBytes: coverageFile ? fs.readFileSync(path.resolve(coverageFile)) : null,
+    fixtureStores: fixture.questions.map((question) => question.store),
   });
   const accuracyDiagnostic = readDiagnosticAccuracyReport({
     reportFile: accuracyReportFile || `${bundle}.accuracy.json`,
@@ -418,6 +424,7 @@ function currentGitSha() {
 
 export async function createCorpusReceipt({
   bundleFile, builderSourceSha, bootstrapIdentity = null, receiptFile, createdAt, accuracyReportFile = null, recallReportFile = null,
+  coverageFile = null,
 } = {}) {
   const resolvedReceiptFile = path.resolve(receiptFile || 'dist/corpus-receipt.json');
   const receipt = await deriveCorpusCandidate({
@@ -427,6 +434,7 @@ export async function createCorpusReceipt({
     createdAt: createdAt || new Date().toISOString(),
     accuracyReportFile,
     recallReportFile,
+    coverageFile,
   });
   fs.mkdirSync(path.dirname(resolvedReceiptFile), { recursive: true });
   fs.writeFileSync(resolvedReceiptFile, `${JSON.stringify(receipt, null, 2)}\n`);
@@ -435,6 +443,7 @@ export async function createCorpusReceipt({
 
 export async function verifyCorpusReceipt({
   bundleFile, receiptFile, expectedBuilderSha, expectedArchiveSha256, expectedReceiptSha256, accuracyReportFile = null, recallReportFile = null,
+  coverageFile = null,
 } = {}) {
   const resolvedReceiptFile = path.resolve(receiptFile || '');
   const resolvedBundleFile = path.resolve(bundleFile || '');
@@ -465,6 +474,7 @@ export async function verifyCorpusReceipt({
     createdAt: receipt.createdAt,
     accuracyReportFile,
     recallReportFile,
+    coverageFile,
   });
   if (canonicalJson(derived) !== canonicalJson(receipt)) fail('receipt does not match the exact corpus archive contents');
   return receipt;
@@ -474,7 +484,9 @@ export async function verifyCorpusReceipt({
 // (corpus-sha256-<digest>) and its accompanying schema-2 candidate receipt. This never compares
 // the external tag against the archive's own internal ARCHIVE-MANIFEST releaseTag/version — those
 // are two independent identity domains and conflating them was the historical bug this fixes.
-export async function verifySeedBaseline({ seedDescriptor, bundleFile, receiptFile, accuracyReportFile = null, recallReportFile = null } = {}) {
+export async function verifySeedBaseline({
+  seedDescriptor, bundleFile, receiptFile, accuracyReportFile = null, recallReportFile = null, coverageFile = null,
+} = {}) {
   if (!seedDescriptor || typeof seedDescriptor !== 'object') fail('seed descriptor is required');
   const { tag, sha256, bytes, sourceCommit = null, allowPinnedTag = false } = seedDescriptor;
   const expectedSha256 = String(sha256 || '').toLowerCase();
@@ -498,6 +510,7 @@ export async function verifySeedBaseline({ seedDescriptor, bundleFile, receiptFi
     receiptFile,
     accuracyReportFile,
     recallReportFile,
+    coverageFile,
     expectedArchiveSha256: expectedSha256,
     ...(sourceCommit ? { expectedBuilderSha: sourceCommit } : {}),
   });
@@ -515,6 +528,7 @@ async function main() {
   const receiptFile = arg('--receipt', arg('--out', 'dist/corpus-receipt.json'));
   const accuracyReportFile = arg('--accuracy-report');
   const recallReportFile = arg('--recall-report');
+  const coverageFile = arg('--coverage');
   if (mode === 'create') {
     const bootstrapTag = arg('--bootstrap-tag');
     const bootstrapSha256 = arg('--bootstrap-sha256');
@@ -526,6 +540,7 @@ async function main() {
       receiptFile,
       accuracyReportFile,
       recallReportFile,
+      coverageFile,
     });
     console.log(JSON.stringify({
       ok: true, mode, archive: receipt.archive, stores: receipt.storeCount, accuracyReport: receipt.accuracyReport, recall: receipt.recallSummary,
@@ -536,6 +551,7 @@ async function main() {
       receiptFile,
       accuracyReportFile,
       recallReportFile,
+      coverageFile,
       expectedBuilderSha: arg('--expected-builder-sha'),
       expectedArchiveSha256: arg('--expected-archive-sha256'),
       expectedReceiptSha256: arg('--expected-receipt-sha256'),